20111227
20111224
Smoke Screening
As you stand in endless lines this holiday season, here’s a comforting thought: all those security measures accomplish nothing, at enormous cost. That’s the conclusion of Charles C. Mann, who put the T.S.A. to the test with the help of one of America’s top security experts.
By Charles C. Mann
Not until I walked with Bruce Schneier toward the mass of people unloading their laptops did it occur to me that it might not be possible for us to hang around unnoticed near Reagan National Airport’s security line. Much as upscale restaurants hang mug shots of local food writers in their kitchens, I realized, the Transportation Security Administration might post photographs of Schneier, a 48-year-old cryptographer and security technologist who is probably its most relentless critic. In addition to writing books and articles, Schneier has a popular blog; a recent search for “TSA” in its archives elicited about 2,000 results, the vast majority of which refer to some aspect of the agency that he finds to be ineffective, invasive, incompetent, inexcusably costly, or all four.
As we came by the checkpoint line, Schneier described one of these aspects: the ease with which people can pass through airport security with fake boarding passes. First, scan an old boarding pass, he said—more loudly than necessary, it seemed to me. Alter it with Photoshop, then print the result with a laser printer. In his hand was an example, complete with the little squiggle the T.S.A. agent had drawn on it to indicate that it had been checked. “Feeling safer?” he asked.
Ten years ago, 19 men armed with utility knives hijacked four airplanes and within a few hours killed nearly 3,000 people. At a stroke, Americans were thrust into a menacing new world. “They are coming after us,” C.I.A. director George Tenet said of al-Qaeda. “They intend to strike this homeland again, and we better get about the business of putting the right structure in place as fast as we can.”
The United States tried to do just that. Federal and state governments embarked on a nationwide safety upgrade. Checkpoints proliferated in airports, train stations, and office buildings. A digital panopticon of radiation scanners, chemical sensors, and closed-circuit television cameras audited the movements of shipping containers, airborne chemicals, and ordinary Americans. None of this was or will be cheap. Since 9/11, the U.S. has spent more than $1.1 trillion on homeland security.
To a large number of security analysts, this expenditure makes no sense. The vast cost is not worth the infinitesimal benefit. Not only has the actual threat from terror been exaggerated, they say, but the great bulk of the post-9/11 measures to contain it are little more than what Schneier mocks as “security theater”: actions that accomplish nothing but are designed to make the government look like it is on the job. In fact, the continuing expenditure on security may actually have made the United States less safe.
The first time I met Schneier, a few months after 9/11, he wanted to bet me a very expensive dinner that the United States would not be hit by a major terrorist attack in the next 10 years. We were in Washington, D.C., visiting one of the offices of Counterpane Internet Security, the company he had co-founded in 1999. (BT, the former British Telecom, bought Counterpane seven years later; officially, Schneier is now BT’s chief security technology officer.) The bet seemed foolhardy to me. Defense Secretary Donald Rumsfeld had just told The Washington Times that al-Qaeda was dispersing its killers all over the world.
From an airplane-hijacking point of view, Schneier said, al-Qaeda had used up its luck. Passengers on the first three 9/11 flights didn’t resist their captors, because in the past the typical consequence of a plane seizure had been “a week in Havana.” When the people on the fourth hijacked plane learned by cell phone that the previous flights had been turned into airborne bombs, they attacked their attackers. The hijackers were forced to crash Flight 93 into a field. “No big plane will ever be taken that way again, because the passengers will fight back,” Schneier said. Events have borne him out. The instigators of the two most serious post-9/11 incidents involving airplanes— the “shoe bomber” in 2001 and the “underwear bomber” in 2009, both of whom managed to get onto an airplane with explosives—were subdued by angry passengers.
Schneier’s sanguine views had little resonance at a time when the fall of the twin towers was being replayed nightly on the news. Two months after 9/11, the Bush administration created the Transportation Security Agency, ordering it to hire and train enough security officers to staff the nation’s 450 airports within a year. Six months after that, the government vastly expanded the federal sky-marshal program, sending thousands of armed lawmen to ride planes undercover. Meanwhile, the T.S.A. steadily ratcheted up the existing baggage-screening program, banning cigarette lighters from carry-on bags, then all liquids (even, briefly, breast milk from some nursing mothers). Signs were put up in airports warning passengers about specifically prohibited items: snow globes, printer cartridges. A color-coded alert system was devised; the nation was placed on “orange alert” for five consecutive years. Washington assembled a list of potential terror targets that soon swelled to 80,000 places, including local libraries and miniature-golf courses. Accompanying the target list was a watch list of potential suspects that had grown to 1.1 million names by 2008, the most recent date for which figures are available. Last year, the Department of Homeland Security, which absorbed the T.S.A. in 2003, began deploying full-body scanners, which peer through clothing to produce nearly nude images of air passengers.
Bruce Schneier’s exasperation is informed by his job-related need to spend a lot of time in Airportland. He has 10 million frequent-flier miles and takes about 170 flights a year; his average speed, he has calculated, is 32 miles and hour. “The only useful airport security measures since 9/11,” he says, “were locking and reinforcing the cockpit doors, so terrorists can’t break in, positive baggage matching”—ensuring that people can’t put luggage on planes, and then not board them —“and teaching the passengers to fight back. The rest is security theater.”
Remember the fake boarding pass that was in Schneier’s hand? Actually, it was mine. I had flown to meet Schneier at Reagan National Airport because I wanted to view the security there through his eyes. He landed on a Delta flight in the next terminal over. To reach him, I would have to pass through security. The day before, I had downloaded an image of a boarding pass from the Delta Web site, copied and pasted the letters with Photoshop, and printed the results with a laser printer. I am not a photo-doctoring expert, so the work took me nearly an hour. The T.S.A. agent waved me through without a word. A few minutes later, Schneier deplaned, compact and lithe, in a purple shirt and with a floppy cap drooping over a graying ponytail.
The boarding-pass problem is hardly the only problem with the checkpoints. Taking off your shoes is next to useless. “It’s like saying, Last time the terrorists wore red shirts, so now we’re going to ban red shirts,” Schneier says. If the T.S.A. focuses on shoes, terrorists will put their explosives elsewhere. “Focusing on specific threats like shoe bombs or snow-globe bombs simply induces the bad guys to do something else. You end up spending a lot on the screening and you haven’t reduced the total threat.”
As I waited at security with my fake boarding pass, a T.S.A. agent had darted out and swabbed my hands with a damp, chemically impregnated cloth: a test for explosives. Schneier said, “Apparently the idea is that al-Qaeda has never heard of latex gloves and wiping down with alcohol.” The uselessness of the swab, in his view, exemplifies why Americans should dismiss the T.S.A.’s frequent claim that it relies on “multiple levels” of security. For the extra levels of protection to be useful, each would have to test some factor that is independent of the others. But anyone with the intelligence and savvy to use a laser printer to forge a boarding pass can also pick up a stash of latex gloves to wear while making a bomb. From the standpoint of security, Schneier said, examining boarding passes and swabbing hands are tantamount to performing the same test twice because the person you miss with one test is the same person you'll miss with the other.
After a public outcry, T.S.A. officers began waving through medical supplies that happen to be liquid, including bottles of saline solution. “You fill one of them up with liquid explosive,” Schneier said, “then get a shrink-wrap gun and seal it. The T.S.A. doesn’t open shrink-wrapped packages.” I asked Schneier if he thought terrorists would in fact try this approach. Not really, he said. Quite likely, they wouldn’t go through the checkpoint at all. The security bottlenecks are regularly bypassed by large numbers of people—airport workers, concession-stand employees, airline personnel, and T.S.A. agents themselves (though in 2008 the T.S.A. launched an employee-screening pilot study at seven airports). “Almost all of those jobs are crappy, low-paid jobs,” Schneier says. “They have high turnover. If you’re a serious plotter, don’t you think you could get one of those jobs?”
The full-body-scanner program—some 1,800 scanners operating in every airport in the country—was launched in response to the “underwear bomber” incident on Christmas Day in 2009, when a Nigerian Muslim hid the plastic explosive petn in his briefs and tried to detonate it on a flight from Amsterdam to Detroit. It has an annual price tag of $1.2 billion. The scanners cannot detect petn directly; instead they look for suspicious bulges under clothing. Because petn is a Silly Putty–like material, it can be fashioned into a thin pancake. Taped flat to the stomach, the pancake is invisible to scanning machines. Alternatively, attackers could stick gum-size wads of the explosive in their mouths, then go through security enough times to accumulate the desired amount.
Staffing the airport checkpoints, at least in theory, are “behavioral detection officers,” supposedly trained in reading the “facial microexpressions” that give away terrorists. It is possible that they are effective, Schneier says—nobody knows exactly what they do. But U.S. airlines carried approximately 700 million passengers in 2010. In the last 10 years, there have been 20 known full-fledged al-Qaeda operatives who flew on U.S. planes (the 9/11 hijackers and the underwear bomber, who was given explosives by a Yemeni al-Qaeda affiliate). Picking the right 20 out of 700 million is simply not possible, Schneier says.
After the airport checkpoint, an additional layer of security is provided, in theory, by air marshals. At an annual cost of about $1.2 billion, as many as 4,000 plainclothes police ride the nation’s airways—usually in first class, so that they can monitor the cockpit. John Mueller, co-author of Terror, Security, and Money, a great book from which I drew much information for this article, says it's a horrible job. “You sit there and fly and you can’t even drink or listen to music, because you can’t have headphones on. You have to stay awake. You are basically just sitting there, day after day.” Unsurprisingly, there’s a lot of turnover—“you’re constantly training people, which is expensive.” Worse, the program has had no measurable benefit. Air marshals have not saved a single life, although one of them did shoot a deranged passenger a few years ago.
Has the nation simply wasted a trillion dollars protecting itself against terror? Mostly, but perhaps not entirely. “Most of the time we assess risk through gut feelings,” says Paul Slovic, a psychology professor at the University of Oregon who is also the president of Decision Research, a nonprofit R&D organization. “We’re not robots just looking at the numbers.” Confronted with a risk, people ask questions: Is this a risk that I benefit from taking, as when I get in a car? Is it forced on me by someone else, as when I am exposed to radiation? Are the potential consequences catastrophic? Is the impact immediate and observable, or will I not know the consequences until much later, as with cancer? Such questions, Slovic says, “reflect values that are sometimes left out of the experts’ calculations.”
Security theater, from this perspective, is an attempt to convey a message: “We are doing everything possible to protect you.” When 9/11 shattered the public’s confidence in flying, Slovic says, the handful of anti-terror measures that actually work—hardening the cockpit door, positive baggage matching, more-effective intelligence—would not have addressed the public’s dread, because the measures can’t really be seen. Relying on them would have been the equivalent of saying, “Have confidence in Uncle Sam,” when the problem was the very loss of confidence. So a certain amount of theater made sense. Over time, though, the value of the message changes. At first the policeman in the train station reassures you. Later, the uniform sends a message: train travel is dangerous. “The show gets less effective, and sometimes it becomes counterproductive.”
Terrorists will try to hit the United States again, Schneier says. One has to assume this. Terrorists can so easily switch from target to target and weapon to weapon that focusing on preventing any one type of attack is foolish. Even if the T.S.A. were somehow to make airports impregnable, this would simply divert terrorists to other, less heavily defended targets—shopping malls, movie theaters, churches, stadiums, museums. The terrorist’s goal isn’t to attack an airplane specifically; it’s to sow terror generally. “You spend billions of dollars on the airports and force the terrorists to spend an extra $30 on gas to drive to a hotel or casino and attack it,” Schneier says. “Congratulations!”
What the government should be doing is focusing on the terrorists when they are planning their plots. “That’s how the British caught the liquid bombers,” Schneier says. “They never got anywhere near the plane. That’s what you want—not catching them at the last minute as they try to board the flight.”
To walk through an airport with Bruce Schneier is to see how much change a trillion dollars can wreak. So much inconvenience for so little benefit at such a staggering cost. And directed against a threat that, by any objective standard, is quite modest. Since 9/11, Islamic terrorists have killed just 17 people on American soil, all but four of them victims of an army major turned fanatic who shot fellow soldiers in a rampage at Fort Hood. (The other four were killed by lone-wolf assassins.) During that same period, 200 times as many Americans drowned in their bathtubs. Still more were killed by driving their cars into deer. The best memorial to the victims of 9/11, in Schneier’s view, would be to forget most of the “lessons” of 9/11. “It’s infuriating,” he said, waving my fraudulent boarding pass to indicate the mass of waiting passengers, the humming X-ray machines, the piles of unloaded computers and cell phones on the conveyor belts, the uniformed T.S.A. officers instructing people to remove their shoes and take loose change from their pockets. “We’re spending billions upon billions of dollars doing this—and it is almost entirely pointless. Not only is it not done right, but even if it was done right it would be the wrong thing to do.”
2011 in Review: The Year Secrecy Jumped the Shark
As the year draws to a close, EFF is looking back at the major trends influencing digital rights in 2011 and discussing where we are in the fight for a free expression, innovation, fair use, and privacy. The government has been using its secrecy system in absurd ways for decades, but 2011 was particularly egregious. Here are a few examples:
- Government report concludes the government classified 77 million documents in 2010, a 40% increase on the year before. The number of people with security clearances exceeded 4.2. million, more people than the city of Los Angeles.
- Government tells Air Force families, including their kids, it’s illegal to read WikiLeaks. The month before, the Air Force barred its service members fighting abroad from reading the New York Times—the country’s Paper of Record.
- Lawyers for Guantanamo detainees were barred from reading the WikiLeaks Guantanamo files, despite their contents being plastered on the front page of the New York Times.
- President Obama refuses to say the words “drone” or “C.I.A” despite the C.I.A. drone program being on the front pages of the nation’s newspapers every day.
- CIA refuses to release even a single passage from its center studying global warming, claiming it would damage national security. As Secrecy News' Steven Aftergood said, “That’s a familiar song, and it became tiresome long ago.”
- The CIA demands former FBI agent Ali Soufan censor his book criticizing the CIA’s post 9/11 interrogation tactics of terrorism suspects. Much of the material, according to the New York Times, “has previously been disclosed in open Congressional hearings, the report of the national commission on 9/11 and even the 2007 memoir of George J. Tenet, the former C.I.A. director.”
- Department of Homeland Security has become so bloated with secrecy that even the “office's budget, including how many employees and contractors it has, is classified,” according to the Center for Investigative reporting. Yet their intelligence reports “produce almost nothing you can’t find on Google,” said a former undersecretary.
- Headline from the Wall Street Journal in September: “Anonymous US officials push open government.”
- NSA declassified a 200 year old report which they said demonstrated its “commitment to meeting the requirements” of President Obama’s transparency agenda. Unfortunately, the document “had not met the government's own standards for classification in the first place,” according to J. William Leonard, former classification czar.
- Government finally declassifies the Pentagon Papers 40 years after they appeared on the front page of the New York Times and were published by the House’s Armed Services Committee.
- Secrecy expert Steve Aftergood concludes after two years “An Obama Administration initiative to curb overclassification of national security information… has produced no known results to date.”
- President Obama accepts a transparency award…behind closed doors.
- Government attorneys insist in court they can censor a book which was already published and freely available online.
- Department of Justice refuses to release its interpretation of section 215 of the Patriot Act, a public law.
- U.S. refuses to release its legal justification for killing an American citizen abroad without a trial, despite announcing the killing in a press conference.
- U.S. won’t declassify legal opinion on 2001’s illegal warrantless wiretapping program.
- National Archive announced it was working on declassifying “a backlog of nearly 400 million pages of material that should have been declassified a long time ago.”
- The CIA refused to declassify Open Source Works, “which is the CIA’s in-house open source analysis component, is devoted to intelligence analysis of unclassified, open source information” according to Steve Aftergood.
- Twenty-three year State Department veteran gets his security clearance revoked for linking to a WikiLeaks document on his blog.
- The ACLU sued asking the State Department to declassify 23 cables out of the more than 250,000 released by WikiLeaks. After more than a year, the government withheld 12 in their entirety. You can see the other 11, heavily redacted, next to the unredacted copies on the ACLU website.
The Homeland Security Snow-Cone Machine
Every time you think "homeland security" can't get more ridiculous, it gets more ridiculous.
There have been plenty of examples already showing that large amounts of your tax money supposedly earmarked for the "War on Terror" end up getting used for purposes that are, shall we say, less than mission-critical. Back in 2006, we learned that $25 million in homeland-security money had been handed out in just one grant program with no controls at all, which resulted in $77,000 going to local fire departments to fund "puppet and clown shows," and another $22,000 for an "educational robot." An Indiana county got in trouble for using its $300,000 Electronic Emergency Message Boards, intended to notify the public about things like evacuation routes, to advertise the volunteer fire department's charity fish fry. This is just the local stuff, not counting the umpteen billions spent on naked scanners that don't do any good.
Also, the war in Iraq.
Still, it is something special when a homeland-security grant is used to buy a snow-cone machine.
Actually, thirteen snow-cone machines, one for every county in Michigan Homeland Security Region 6. Region 6, as you almost certainly don't know, covers 13 counties in western Michigan including Clare, Isabella, Montcalm, Muskegon, Newaygo, and other areas also near the very top of al-Qaeda's hit list. According to the Greenville Daily News, the Board of Commissioners in Montcalm noted that they had been presented with a snow-cone machine, and while they probably appreciated this unexpected gift, they did inquire as to whether the $900 treat-maker was an appropriate use of homeland-security dollars. (Apparently, another county - anonymous for now - requested the machine, and somebody thought that was such a good idea that all 13 counties got one.)
The Daily News was able to confirm that the the snow-cone machines were funded by a grant from the Michigan Homeland Security Program, but nobody seems to have had a good answer for the "appropriate use" question, surprisingly enough. Two ways to go in that situation: (1) admit it was a mistake or a bad decision, and fix it; or (2) insist that yes, there is an entirely valid purpose for incorporating an Arctic Blast Sno-Cone machine into your anti-terrorism plan.
“It is used to attract people so they can be educated and prepared for homeland security,” [Sandeep] Dey said from his office in Muskegon. “More importantly, they (homeland security officials) felt in a medical emergency the machine was capable of making ice packs which could be used for medical purposes.”You didn't really think anybody would pick Option One, did you?
Dey is the executive director of the West Michigan Shoreline Regional Development Commission, which oddly is in charge of Homeland Security Region 6. He did not dream up these explanations just now, though, because they are the same ones contained in the state grant program's "Allowable Cost Justification" form that was filed back in May. According to the Daily News, that document (which sadly was not available online) says the machines would be used to "make ice to prevent heat-related illnesses during emergencies, treat injuries and provide snow cones as an outreach at promotional events."
The director did try to do a little damage control, apparently feeling a little heat-related stress himself at that point. "He said the ... request would not have been granted by itself, but was approved because it came with other homeland security equipment." I'm not sure what that means. Maybe with every dozen radiation detectors you buy, they throw in a free snow-cone machine? Dey also contended, evidently, that they are budget-conscious and making the hard choices, saying that "one county requested a popcorn machine, but that request was denied." Because that would just be ridiculous.
"I don't like the term 'snow-cone machine,' because it sounds horrible," said Montcalm County Emergency Services Director David Feldpausch about the term that appears right on the side of the machine. "When you look at it as an ice-shaving machine and its purpose, it makes a little more sense." With Option Two thus in full effect, Feldpausch had one more argument. According to the report, "Feldpausch [also] said the machine could be useful at the scene of a large fire."
To be fair, I don't think he meant to be taken literally there. Obviously you'd have to combine the full power of all 13 Arctic Blast Ice-Shaving Anti-Terror Machines to deal with a really large fire. The good news is that Region 6 is now equipped to handle that. And terrorism.
20111222
For Christmas, Your Government Will Explain Why It's Legal to Kill You
Ha! Just kidding! It won't tell you that. That's classified!
Plaintiffs The New York Times Company, Charlie Savage, and Scott Shane (jointly, "NYT"), by their undersigned attorney, allege for their Complaint:Summary:
1. This is an action under the Freedom of Information Act ("FOIA") ... seeking the production of agency records improperly withheld by Defendant United States Department of Justice ("DOJ") in response to requests properly made by Plaintiffs.
***4. Given the questions surrounding the legality of the practice [of "targeted killing"] under both U.S. and international law, notable legal scholars, human rights activists, and current and former government officials [i.e., Democrats and Republicans] have called for the government to disclose its legal analysis justifying the use of targeted lethal force, especially as it applies to American citizens.
***11. Both before and after the death of [Anwar] al-Awlaki [who was blown up in Yemen], NYT duly filed FOIA requests seeking memoranda that detail the legal analysis behind [blowing people up]. To date, DOJ has refused to release any such memoranda or any segregable portions, claiming them to be properly classified and privileged and in respect to certain memoranda has declined to say whether they in fact exist.
***35. On September 30, 2011, the Washington Post described a [DOJ] "secret memorandum authorizing the legal targeting" of al-Awlaki, an American citizen accused of coordinating the Al-Qaeda operations in the Arabian peninsula. The article said that officials refused to disclose the exact legal analysis" such as "how they considered any Fifth Amendment right to due process." It also quoted a "former senior intelligence official" as saying the C.I.A. "would not have killed an American without such a written opinion."
***44. On October 7, 2011, Mr. Savage submitted a FOIA request [to] DOJ OLC seeking a copy of "all Office of Legal Counsel memorandums analyzing the circumstances under which it would be lawful for United States armed forces or intelligence community assets to target for killing a United States citizen who is deemed to be a terrorist."
45. By letter dated October 27, 2011, [DOJ] denied Mr. Savage's request.
- The government dropped a bomb on a U.S. citizen,
- who, though a total dick and probably a criminal, may have been engaged only in propaganda,
- which, though despicable, is generally protected by the First Amendment;
- it did so without a trial or even an indictment (that we know of),
- based at least in part on evidence it says it has but won't show anyone,
- and on a legal argument it has apparently made but won't show anyone,
- and the very existence of which it will not confirm or deny;
- although don't worry, because the C.I.A. would never kill an American without having somebody do a memo first;
- and this is the "most transparent administration ever";
- currently run by a Nobel Peace Prize winner.
Keeping you safe from cupcakes because they contain a "gel"
Rebecca writes,
At Las Vegas International Airport, TSA supervisor [REDACTED] is keeping travelers safe from the terror of delicious cupcakes-in-a-jar. I learned this firsthand earlier today, when I put myself and my fellow travelers at risk by attempting to travel with one.
The agent who first found my dangerously delectable snack consulted [REDACTED] about it just barely within my earshot. He responded hesitantly at first, saying that he was "not sure"--and "with the holidays coming, it's getting harder and harder." When he finally decided my treat was a no-go, I asked to speak with him directly, and he asserted that the frosting on this red velvet cupcake is "gel-like" enough to constitute a liquid, in part because it "conforms to its container." Also: it "should have been in a zip-lock." At this, I offered to scoop my dangerously conformist cupcake out of its jar and place it in a zip-lock bag, where it could mush about to its heart's content; but Agent [REDACTED] wisely refused. After all, the jar in all its tasty glory "clearly contains more than 3 ounces of total contents," he said.
I then explained to [REDACTED] that I'd been allowed to bring cupcakes-in-jars through Boston's Logan airport on my outbound flight with no problem (the TSA agent there had exclaimed, "These look delicious!"). To this logic, [REDACTED] responded, "If Boston had done their job right in the first place, we wouldn't be having this conversation right now." (Take that, Boston!)
CLEARLY [REDACTED] is in the right, because unbeknownst to him, when I had previously opened one of these marvelous cupcakes on the flight from Boston, everyone's safety was jeopardized. There was pandemonium among my hunger-crazed fellow travelers: Everybody wanted one. (Just like [REDACTED], who probably ate my cupcake on his next break.)
Don't Break the Internet!
by Mark Lemley, David S. Levine, & David G. Post
Two bills now pending in Congress—the PROTECT IP Act of 2011 (Protect IP) in the Senate and the Stop Online Piracy Act (SOPA) in the House—represent the latest legislative attempts to address a serious global problem: large-scale online copyright and trademark infringement. Although the bills differ in certain respects, they share an underlying approach and an enforcement philosophy that pose grave constitutional problems and that could have potentially disastrous consequences for the stability and security of the Internet’s addressing system, for the principle of interconnectivity that has helped drive the Internet’s extraordinary growth, and for free expression.
To begin with, the bills represent an unprecedented, legally sanctioned assault on the Internet’s critical technical infrastructure. Based upon nothing more than an application by a federal prosecutor alleging that a foreign website is “dedicated to infringing activities,” Protect IP authorizes courts to order all U.S. Internet service providers, domain name registries, domain name registrars, and operators of domain name servers—a category that includes hundreds of thousands of small and medium-sized businesses, colleges, universities, nonprofit organizations, and the like—to take steps to prevent the offending site’s domain name from translating to the correct Internet protocol address. These orders can be issued even when the domains in question are located outside of the United States and registered in top-level domains (e.g., .fr, .de, or .jp) whose operators are themselves located outside the United States; indeed, some of the bills’ remedial provisions are directed solely at such domains.
Directing the remedial power of the courts towards the Internet’s core technical infrastructure in this sledgehammer fashion has impact far beyond intellectual property rights enforcement—it threatens the fundamental principle of interconnectivity that is at the very heart of the Internet. The Internet’s Domain Name System (DNS) is a foundational block upon which the Internet has been built and upon which its continued functioning critically depends; it is among a handful of protocols upon which almost every other protocol, and countless Internet applications, rely to operate smoothly. Court-ordered removal or replacement of entries from the series of interlocking databases that reside in domain name servers and domain name registries around the globe undermines the principle of domain name universality—the principle that all domain name servers, wherever they may be located across the network, will return the same answer when queried with respect to the Internet address of any specific domain name. Much Internet communication, and many of the thousands of protocols and applications that together provide the platform for that communication, are premised on this principle.
Mandated court-ordered DNS filtering will also have potentially catastrophic consequences for DNS stability and security. It will subvert efforts currently underway—and strongly supported by the U.S. government—to build more robust security protections into the DNS protocols. In the words of a number of leading technology experts, several of whom have been intimately involved in the creation and continued evolution of the DNS for decades:
Mandated DNS filtering would be minimally effective and would present technical challenges that could frustrate important security initiatives. Additionally, it would promote development of techniques and software that circumvent use of the DNS. These actions would threaten the DNS’s ability to provide universal naming, a primary source of the Internet’s value as a single, unified, global communications network. . . . DNS filtering will be evaded through trivial and often automated changes through easily accessible and installed software plugins. Given this strong potential for evasion, the long-term benefits of using mandated DNS filtering to combat infringement seem modest at best.[1]Indeed, this approach could actually have an effect directly contrary to what its proponents intend: if large swaths of websites are cut out of the Internet addressing system, those sites—and the users who want to reach them—may well gravitate towards alternative, unregulated domain name addressing systems, making it even harder for governments to exercise their legitimate regulatory role in Internet activities.
The bills take aim not only at the Internet’s core technical infrastructure, but at its economic and commercial infrastructure as well. Credit card companies, banks, and other financial institutions could be ordered to “prevent, prohibit, or suspend” all dealings with the site associated with the domain name. Online advertisers could be ordered to cease providing advertising services to the site associated with the domain name. Search engine providers could be ordered to “remove or disable access to the Internet site associated with the domain name,” and to disable all hypertext links to the site.
These drastic consequences would be imposed against persons and organizations outside of the jurisdiction of the U.S. courts by virtue of the fiction that these prosecutorial actions are proceedings in rem, in which the “defendant” is not the operator of the site but the domain name itself. Both bills suggest that these remedies can be meted out by courts after nothing more than ex parte proceedings—proceedings at which only one side (the prosecutor or even a private plaintiff) need present evidence and the operator of the allegedly infringing site need not be present nor even made aware that the action was pending against his or her “property.”
This not only violates basic principles of due process by depriving persons of property without a fair hearing and a reasonable opportunity to be heard, it also constitutes an unconstitutional abridgement of the freedom of speech protected by the First Amendment. The Supreme Court has made it abundantly clear that governmental action suppressing speech, if taken prior to an adversary proceeding and subsequent judicial determination that the speech in question is unlawful,[2] is a presumptively unconstitutional “prior restraint.” In other words, it is the “most serious and the least tolerable infringement on First Amendment rights,”[3] permissible only in the narrowest range of circumstances. The Constitution requires a court “to make a final determination” that the material in question is unlawful “after an adversary hearing before the material is completely removed from circulation.”[4]
The procedures outlined in both bills fail this fundamental constitutional test. Websites can be “completely removed from circulation”—rendered unreachable by, and invisible to, Internet users in the United States and abroad—immediately upon application by the government, without any reasonable opportunity for the owner or operator of the website in question to be heard or to present evidence on his or her own behalf. This falls far short of what the Constitution requires before speech can be eliminated from public circulation.
As serious as these infirmities are, SOPA, the House’s bill, builds upon them, enlarges them, and makes them worse. Under SOPA, IP rights holders can proceed vigilante-style against allegedly offending sites, without any court hearing or any judicial intervention or oversight whatsoever. For example, SOPA establishes a scheme under which an IP rights holder need only notify credit card companies of the facts supporting its “good faith belief” that an identified Internet site is “primarily designed or operated for the purpose of” infringement. The recipients of that notice will then have five days to cease doing business with the specified site by taking “technically feasible and reasonable” steps to prevent it “from completing payment transactions” with customers. And all of this occurs based upon a notice delivered by the rights holder, which no neutral third party has even looked at, let alone adjudicated on the merits. If they get the assistance of a court, IP owners can also prevent other companies from “making available advertisements” to the site, and the government can prevent search engines from pointing to that site.
These bills, and the enforcement philosophy that underlies them, represent a dramatic retreat from this country’s tradition of leadership in supporting the free exchange of information and ideas on the Internet. At a time when many foreign governments have dramatically stepped up their efforts to censor Internet communications, these bills would incorporate into U.S. law a principle more closely associated with those repressive regimes: a right to insist on the removal of content from the global Internet, regardless of where it may have originated or be located, in service of the exigencies of domestic law.
United States law has long allowed Internet intermediaries to focus on empowering communications by and among users, free from the need to monitor, supervise, or play any other gatekeeping or policing role with respect to those communications. Requiring Internet service providers, website operators, search engine providers, credit card companies, banks, Internet advertisers, and others to block access to websites because of their content would constitute a dramatic retreat from that important policy. Laws protecting Internet intermediaries from liability for content on the Internet are responsible for transforming the Internet into the revolutionary communications medium that it is today. They reflect a policy that has not only helped make the United States the world leader in a wide range of Internet-related industries, but that has also enabled the Internet’s uniquely decentralized structure to serve as a global platform for innovation, speech, collaboration, civic engagement, and economic growth. These bills would undermine that leadership and dramatically diminish the Internet’s capability as a communications medium. As Secretary of State Hillary Clinton noted last year:
[T]he new iconic infrastructure of our age is the internet. Instead of division, it stands for connection. But even as networks spread to nations around the globe, virtual walls are cropping up in place of visible walls. . . . Some countries have erected electronic barriers that prevent their people from accessing portions of the world’s networks. They’ve expunged words, names, and phrases from search engine results. They have violated the privacy of citizens who engage in non-violent political speech. . . . With the spread of these restrictive practices, a new information curtain is descending across much of the world.[5]It would be not just ironic, but tragic, were the United States to join the ranks of these repressive and restrictive regimes, erecting our own “virtual walls” to prevent people from accessing portions of the world’s networks. Passage of these bills will compromise our ability to defend the principle of the single global Internet—the Internet that looks the same to, and allows free and unfettered communication between, users located in Boston, Bucharest, and Buenos Aires, free of locally imposed censorship regimes. As such, it may represent the biggest threat to the Internet in its history.
Copyright and trademark infringement on the Internet is a very real problem, and reasonable proposals to augment the ample array of enforcement powers already at the disposal of IP rights holders and law enforcement officials may serve the public interest. But the power to break the Internet shouldn’t be among them.
SOPA: What You Should Know & Why We Oppose It
Are you familiar with the Great Firewall Of China? Sometimes referred to as the Golden Shield project, it’s a Chinese government censorship and Internet surveillance project kicked off in 1998 and put into action in 2003. Simply put, it enables the government to restrict what content its citizens can read and view via IP blocking and DNS filtering. If they don’t like a site request a user makes, it won’t get viewed.
Many dismiss what’s happening in China and chalk to up to their communist political system. That could never happen in a free speech-driven, rights for all society like we have in the United States, right?
If the Stop Online Piracy Act (SOPA) introduced this week gets enacted into law, things could change negatively for Americans which is why Dyn opposes the bill.
While online piracy is obviously bad, this is the wrong way to go about fighting it. We understand why the groups like the Motion Picture Association of America and the U.S. Chamber of Commerce are supporting the bill as piracy of content costs the original producers/distributors tens of billions of dollars. They’re desperate for a solution to recoup that lost revenue. This isn’t it.
The Great Firewall of America? Yep, kinda feels like that. SOPA is a shot across the bow of free speech and as one of the largest Internet IaaS companies in the world, we cannot endorse it in any way, shape or form.
For our international friends, there is a petition here that has got a tremendous following.
You can also contact your local government officials and tell them you oppose SOPA. The more people that are heard, the more the government will understand that this level of control over today’s Internet is unneeded and unwanted. We don’t often rally the troops for causes such as this, so hopefully this post gets across the impact of how strongly we oppose SOPA.
Many dismiss what’s happening in China and chalk to up to their communist political system. That could never happen in a free speech-driven, rights for all society like we have in the United States, right?
If the Stop Online Piracy Act (SOPA) introduced this week gets enacted into law, things could change negatively for Americans which is why Dyn opposes the bill.
What Is SOPA?
The goal of the bill is to “expand the ability of federal law enforcement to shut down foreign Web sites and services that use counterfeited or pirated content created by U.S. firms.” It was introduced by Texas Republican Lamar Smith earlier this week as a companion to the Protect IP bill introduced that would punish those web entities that host unauthorized, copyrighted content like movies, software, songs and anything else that can be illegally downloaded.While online piracy is obviously bad, this is the wrong way to go about fighting it. We understand why the groups like the Motion Picture Association of America and the U.S. Chamber of Commerce are supporting the bill as piracy of content costs the original producers/distributors tens of billions of dollars. They’re desperate for a solution to recoup that lost revenue. This isn’t it.
Why We’re Opposed To It
Web companies like Google, Yahoo and some of our fellow DNS providers like OpenDNS have strongly come out in opposition to SOPA and for good reason. Essentially, this bill would give the government more control into shutting down websites they don’t agree with in general. Anti-American sentiment promoted on Twitter, Tumblr or another one of our clients that promotes free discourse? Both the sites themselves and Dyn as their DNS provider could be penalized for simply providing a conduit in which someone can access or promote views the government doesn’t agree with — regardless of whether the source is based in the U.S. or not.The Great Firewall of America? Yep, kinda feels like that. SOPA is a shot across the bow of free speech and as one of the largest Internet IaaS companies in the world, we cannot endorse it in any way, shape or form.
What Can You Do?
If you’re based in the U.S. and against this act, we urge that you e-sign this petition to ‘Stop The E-Parasite Act’. The initial goal was to get 25,000 signatures by the end of November and as I write this, there are more than 40,000. Clearly, this is a movement that is gaining momentum.For our international friends, there is a petition here that has got a tremendous following.
You can also contact your local government officials and tell them you oppose SOPA. The more people that are heard, the more the government will understand that this level of control over today’s Internet is unneeded and unwanted. We don’t often rally the troops for causes such as this, so hopefully this post gets across the impact of how strongly we oppose SOPA.
SOPA: Why Do We Have To Break The DNS?
Last month, we posted our position piece on the Stop Online Piracy Act, also known as SOPA or the E-Parasite Act. In this post, I’m going to examine the technical details of the act and how it relates to the operation of the global Domain Name System (DNS).
SOPA proposes the idea of using DNS-based filtering by Internet Service Providers (ISPs) as a means to remove U.S. support of a foreign infringing website.
While the bill doesn’t specifically define how the ISP should technically go about this, it does seem to indicate that an ISP should capture, redirect and modify DNS query / response pairs to ensure that a downstream user does not access the site. There’s a number of ways to “remove support” from a foreign infringing website at the DNS level, so we’ll take a look at the techniques that could be used at all the layers of the DNS and why some are more destructive than others.
There is the domain registration itself, which signals existence of a domain into the appropriate top-level domain’s DNS zone.
For example, if the domain “example.com” was a foreign infringing site, a law enforcement agency could petition Verisign (the registry operator of the .com TLD) to remove the relevant DNS records that provide the delegation for example.com. In fact, this type of behavior isn’t SOPA specific and our current judicial framework permits this to happen today.
One should note that the impact of such a suspension would have a worldwide impact. All users of the domain name would no longer be able to access services offered by that domain.
There’s the authoritative DNS service for example.com which could be terminated.
A delegation for example.com is made from Verisign to the domain’s authoritative DNS provider to a company such as Dyn. If a foreign infringing site were to be supported by a U.S. authoritative DNS provider, law enforcement could petition the authoritative DNS provider to remove support for the domain by terminating authoritative DNS service. Again, this would cause a worldwide suspension of services for the domain, but unlike a registry level termination, the alleged infringer could move services to another authoritative DNS provider and continue doing whatever he/she was doing utilizing the newly acquired authoritative DNS service.
There’s recursive DNS interception, redirection and alteration (which is the primary technique contemplated by SOPA) that would be implemented at the ISP level.
Unlike TLD and domain authoritative nameservers (of which any set are under the same common administrative control, i.e. Dyn), recursive DNS servers are deployed Internet wide in clusters throughout ISPs. Under SOPA, U.S. ISPs would be required to accept an additional “feed” of data which would include a list of known or alleged domains participating in foreign infringement.
The feed would be used to block DNS queries made for foreign infringing domains and would remove U.S. access of these domains for users of U.S. ISPs. The feed could be incorporated into DNS using a variety of techniques including deep packet inspection (DPZ), a software interface such as BIND’s Response Policy Zones (RPZ) or even by creating false zones in the recursive DNS servers view.
From Dyn’s perspective, the third option — ISP-based DNS query manipulation — is the most hazardous to the health of the global DNS.
Implementing such a solution breaks the distributed tree of authority concept used by the DNS by “injecting” U.S. nationalized pieces of DNS policy into the system. ISPs around the United States would become responsible for implementing, maintaining and monitoring these SOPA feeds into their DNS infrastructures, creating an additional layer of operational complexity for their DNS operations. Additionally, since not all DNS systems permit the inclusion of external data feeds to support local policy, many operators would be required to upgrade the recursive DNS infrastructures in significant ways.
There’s a number of conditions that could occur where a SOPA-fed recursive DNS server could hand back incorrect DNS data or be circumvented all together. If an ISP were to have issues pulling the SOPA feed or clearing domains from the SOPA list, a single domain could be blacklisted in the United States when it is perfectly legal to be used. If the source of a SOPA feed were to ever be compromised, an attacker could take critical Internet infrastructure domains offline by adding them to the feed (i.e. root-servers.net).
Savvy users could simply bypass a SOPA-enabled recursive DNS server by pointing their DNS settings to an off-shore recursive DNS server. Technically savvy networks might respond by blocking port 53 externally or by hijacking port 53 traffic on their network to their SOPA-enabled recursive DNS resolvers. Anyone want to bring Net Neutrality into this discussion? What would happen to users if an infringer decided to setup a “free, non-SOPA” recursive DNS server for users to use – one that additionally hijacked legitimate banking, ecommerce and business websites, too?
It is Dyn’s opinion that the technical implementation techniques contemplated by SOPA do more damage to the global DNS than help solve the problem it aims to tackle. There are existing law enforcement techniques available to deal with copyright infringement today at the registry level, so we ask why are they not being effectively utilized? Must we resort to breaking the DNS?
SOPA proposes the idea of using DNS-based filtering by Internet Service Providers (ISPs) as a means to remove U.S. support of a foreign infringing website.
While the bill doesn’t specifically define how the ISP should technically go about this, it does seem to indicate that an ISP should capture, redirect and modify DNS query / response pairs to ensure that a downstream user does not access the site. There’s a number of ways to “remove support” from a foreign infringing website at the DNS level, so we’ll take a look at the techniques that could be used at all the layers of the DNS and why some are more destructive than others.
There is the domain registration itself, which signals existence of a domain into the appropriate top-level domain’s DNS zone.
For example, if the domain “example.com” was a foreign infringing site, a law enforcement agency could petition Verisign (the registry operator of the .com TLD) to remove the relevant DNS records that provide the delegation for example.com. In fact, this type of behavior isn’t SOPA specific and our current judicial framework permits this to happen today.
One should note that the impact of such a suspension would have a worldwide impact. All users of the domain name would no longer be able to access services offered by that domain.
There’s the authoritative DNS service for example.com which could be terminated.
A delegation for example.com is made from Verisign to the domain’s authoritative DNS provider to a company such as Dyn. If a foreign infringing site were to be supported by a U.S. authoritative DNS provider, law enforcement could petition the authoritative DNS provider to remove support for the domain by terminating authoritative DNS service. Again, this would cause a worldwide suspension of services for the domain, but unlike a registry level termination, the alleged infringer could move services to another authoritative DNS provider and continue doing whatever he/she was doing utilizing the newly acquired authoritative DNS service.
There’s recursive DNS interception, redirection and alteration (which is the primary technique contemplated by SOPA) that would be implemented at the ISP level.
Unlike TLD and domain authoritative nameservers (of which any set are under the same common administrative control, i.e. Dyn), recursive DNS servers are deployed Internet wide in clusters throughout ISPs. Under SOPA, U.S. ISPs would be required to accept an additional “feed” of data which would include a list of known or alleged domains participating in foreign infringement.
The feed would be used to block DNS queries made for foreign infringing domains and would remove U.S. access of these domains for users of U.S. ISPs. The feed could be incorporated into DNS using a variety of techniques including deep packet inspection (DPZ), a software interface such as BIND’s Response Policy Zones (RPZ) or even by creating false zones in the recursive DNS servers view.
From Dyn’s perspective, the third option — ISP-based DNS query manipulation — is the most hazardous to the health of the global DNS.
Implementing such a solution breaks the distributed tree of authority concept used by the DNS by “injecting” U.S. nationalized pieces of DNS policy into the system. ISPs around the United States would become responsible for implementing, maintaining and monitoring these SOPA feeds into their DNS infrastructures, creating an additional layer of operational complexity for their DNS operations. Additionally, since not all DNS systems permit the inclusion of external data feeds to support local policy, many operators would be required to upgrade the recursive DNS infrastructures in significant ways.
There’s a number of conditions that could occur where a SOPA-fed recursive DNS server could hand back incorrect DNS data or be circumvented all together. If an ISP were to have issues pulling the SOPA feed or clearing domains from the SOPA list, a single domain could be blacklisted in the United States when it is perfectly legal to be used. If the source of a SOPA feed were to ever be compromised, an attacker could take critical Internet infrastructure domains offline by adding them to the feed (i.e. root-servers.net).
Savvy users could simply bypass a SOPA-enabled recursive DNS server by pointing their DNS settings to an off-shore recursive DNS server. Technically savvy networks might respond by blocking port 53 externally or by hijacking port 53 traffic on their network to their SOPA-enabled recursive DNS resolvers. Anyone want to bring Net Neutrality into this discussion? What would happen to users if an infringer decided to setup a “free, non-SOPA” recursive DNS server for users to use – one that additionally hijacked legitimate banking, ecommerce and business websites, too?
It is Dyn’s opinion that the technical implementation techniques contemplated by SOPA do more damage to the global DNS than help solve the problem it aims to tackle. There are existing law enforcement techniques available to deal with copyright infringement today at the registry level, so we ask why are they not being effectively utilized? Must we resort to breaking the DNS?
It’s for charity - but is it for a good cause?
By Holden
People can get away with some incredible things as soon as they say that what they’re doing is “for charity.” First among these, of course, are the tax advantages that subsidize everything from helping the needy to fighting gun control, convincing people to eat beef, and stockpiling giant piles of cash for eternity. But it isn’t just the IRS that loses all ability to tell right from wrong as soon as the word “charity” comes up. It’s all of us. Except me.
You may not attend a rock concert to benefit beef, but what about cancer research? How about humane societies? Of course, these two causes are in direct conflict over the question of animal testing - many humane societies put significant amounts of their resources directly into trying to illegalize the testing that other “charities” are busy funding.
Charities oppose each other in more subtle ways as well. Going through all these 990s, I’ve really become aware of the huge presence among charities of political advocacy. It’s natural that charities find themselves wanting to address the “root causes” of the problems they address; but as soon as they do this, it’s no longer safe to say that their funds are “going to a good cause” without at least thinking twice. After all, if the legal changes they want to make were completely noncontroversial, you’d think they’d already be made. If you go to a concert to “fight global warming” or “save the environment,” your dollars aren’t going to feed cuddly bunnies; chances are, they’re going to lobbyists, advocates, even demonstrators, with the aim of putting laws in place that might be pro-environment or anti-business, depending on your point of view. And even if you’re on the pro-environment side, it’s worth considering that one of the biggest struggles in politics is not just for position, but for attention and prioritization. When it comes down to it, Greenpeace (saving the environment) and Oxfam (fighting poverty) are largely working against each other - trying to get legislators to pay attention to their issue rather than others.
And at least as big as political advocacy, at least judging by charities’ mission statements, is “raising awareness.” Well, awareness is a zero-sum game too. People only have so much attention span available for things that aren’t sports and diets. You want to raise awareness for Darfur, for global warming, or for Lou Gehrig’s disease? “All of the above” isn’t necessarily an option.
Tooling around through my recent Google alerts (”Charity”), I see a mind-boggling silence on these questions. Indeed, I see Barry Bonds being praised for “giv[ing] some of his own things to charity,” with no mention of what causes he’s supported. I see a whole article on celebrities’ support of charities for Mother’s Day, without the mention of a single charity beyond Eva Longoria’s personal foundation (not a word on that foundation’s priorities). I see plenty of debate on the recent “Idol Gives Back” campaign in terms of whether its “devotion to charity” makes up for its cheesiness … but my question is, what does the ONE campaign (one of its beneficiaries) mean when it talks about “call[ing] for debt cancellation, trade reform and anti–corruption measures”? That sounds like legal change - what does the campaign want and is it a good idea? Nobody else wants to know?
It’s the same old problem: as soon as people hear the word “charity,” their critical faculties turn off. Of course, celebrities and athletes would love it to stay this way - the last thing they need is more questions, just when they’re trying to clean up their image by throwing a few bucks at 501c3’s. But the rest of us would do well to wake up. I’ve said it before and I’ll say it again: if you want to know if someone is doing good things, the best way is to look at what they’re doing.
20111218
Holiday displays dividing Va. town
By Caitlin Gibson
LEESBURG, Va. — Baby Jesus is keeping strange company.
For the better part of 50 years, a creche and a Christmas tree were the only holiday displays on the Loudoun County Courthouse grounds.
Then came the atheists. And the Jedis. And the Church of the Flying Spaghetti Monster -- each with its own decorations. A skeleton Santa Claus was mounted on a cross, intended by its creator to portray society's obsession with consumerism. Nearby, a pine tree stood adorned with atheist testimonials.
Flying Spaghetti Monster devotees are scheduled to put up their contribution this weekend. It's a banner portraying a Nativity-style scene, but Jesus is nowhere to be found. Instead, the Virgin Mary cradles a stalk-eyed noodle-and-meatball creature, its manger surrounded by an army of pirates, a solemn gnome and barnyard animals. The message proclaims: "Touched by an Angelhair."
With the new displays, a new tradition was born: a charged seasonal debate.
This year the dispute struck a particularly raw nerve. Skeleton Santa was ripped down -- twice. Kenneth Reid, Loudoun County supervisor-elect for the Leesburg district, sent a news release opposing "outrageous anti-religious displays."
For Loudoun locals, the heart of the issue isn't about a Santa Claus corpse or a deity made of noodles. And despite a flurry of tongue-in-cheek news reports about the ongoing debate, most people don't find it a laughing matter. Some say the issue is about freedom of speech, or separating church and state; others say it is about the importance of preserving a cherished tradition.
It's also about fast-growing Loudoun County grappling with the inevitability of change.
Stanley Caulkins, who moved to Leesburg in 1937, remembers the first time the Nativity was put up at the corner of the courthouse lawn.
Caulkins, who has owned Caulkins Jewelers in downtown Leesburg for over half a century, sees it as a valued symbol, something that should not be messed with. He went before the county board two years ago to argue that it should stay. Last week, he said that he still does not understand why the issue engenders such controversy.
"The creche is not religious," Caulkins insisted, his voice trembling.
A depiction of the adoration of baby Jesus, attended by the three kings, is not religious?
"It is a belief symbol. You have to believe in something," Caulkins said.
But he expressed little patience for those who believe in flying pasta monsters or the artistic value of a skeleton Santa Claus.
"It is embarrassing to me, and it should be to everyone," Caulkins said of those displays. His perspective, shared by others, shows that the issue cannot be debated entirely on logical grounds; matters of faith -- and even the value of tradition -- are less about facts than feelings.
For decades, the creche took its place without fanfare. Then, in 2009, a courthouse-grounds committee, concerned about a growing number of requests to use the public space, decided that Loudoun should ban all unattended displays on the property.
Public outcry was fierce and emotional. Residents poured into the county boardroom wearing Santa hats and religious pins, pleading with county leaders to respect their freedoms of speech and religion. The board ultimately decided to allow up to 10 holiday displays on a first-come, first-served basis. Applicants got in line.
Baby Jesus has appeared in several displays. But others had far different interpretations of a holiday greeting. One year a mannequin arrangement featured Luke Skywalker of "Star Wars."
Matthew Courtney, a member -- or "Pastafarian" -- of the Church of the Flying Spaghetti Monster, thinks allowing diversity in the decorations is welcoming. "I understand that it's out of the blue for some of these residents -- that there are atheists in the community, or Pastafarians in the community," Courtney said. "A lot of them are uncomfortable with that. At some level I can understand that. But it doesn't bother me. … It does show the diversity of the community, and I think that's a good thing, not a bad thing."
The question remains: Will the "War on Christmas" end this year?
Loudoun County Board of Supervisors Chairman Scott K. York has indicated that the policy probably will be reconsidered when the new, all-Republican board takes office in January. Reid said he believes that the supervisors will be able to find a compromise and salvage the town's tradition.
YouTube Says Universal Had No ‘Right’ to Take Down Megaupload Video
By David Kravets
YouTube said Friday that Universal Music abused the video-sharing site’s piracy filters when it employed them to take down a controversial video of celebrities and pop superstars singing and praising the notorious file-sharing service Megaupload.
YouTube’s copyright filters removed the all-star video, which features Kanye West, Mary J. Blige, will.i.am and others, on Dec. 9. Google reinstated the four-minute spot Wednesday.
“Our partners do not have the right to take down videos from YT unless they own the rights to them or they are live performances controlled through exclusive agreements with their artists, which is why we reinstated it,” Google-owned YouTube said.
Megaupload produced the video for $3 million, and says it has waivers from all the celebrities. The Hong Kong-based service claims in a federal lawsuit filed Monday that the takedown was a “sham” designed to chill free speech. The suit seeks unspecified damages, alleging the label had violated a provision in copyright law that forbids bogus copyright claims.
Megaupload has some 50 million daily users, and the recording industry says it is a haven for music pirates.
YouTube’s statement came a day after Universal Music told a federal judge hearing the case that it had used YouTube’s content filters, known as the Content Management System, to have the video removed shortly after Megaupload had uploaded it. Universal never disclosed to U.S. District Judge Claudia Wilken why it had the video removed.
But Universal told Wilken, an Oakland federal judge, that Megaupload is not entitled to monetary damages, (.pdf) even if Universal Music gamed YouTube’s filters.
Universal said Google’s private system doesn’t count as an official takedown notice under the Digital Millennium Copyright Act, and thus it was immune from legal liability. It’s a position that Ira Rothken, Megaupload’s attorney, said was preposterous.
YouTube has engineered a filtering system enabling rights holders to upload music and videos they own to a “fingerprinting” database. When YouTube users upload videos, the system scans the upload against the copyright database for matches. If a full or partial match is found, the alleged rights holder can have the video automatically removed, or it can place advertising on the video and make money every time somebody clicks on the video.
Under the DMCA, online service providers like YouTube lose legal immunity for their users’ actions if they don’t remove allegedly infringing content if asked to by rights holders. If the content is not removed, internet service providers could be held liable for damages under the Copyright Act, which carries penalties of up to $150,000 per violation.
Megaupload’s lawsuit is pending.
Byron Sonne: the thin line between terrorist and gardener
Denise Balkissoon
Fertilizer, corned beef or bomb? Potassium nitrate contains multitudes. And it’s just one of the many chemicals found inside Byron Sonne’s house during a police search after the security consultant’s pre-G20 arrest in June 2010.
After spending almost a year in pre-trial custody and sitting through a three-week hearing as to whether his Charter rights were violated during his arrest and detention, the 39-year-old’s criminal trial finally began this week. Sonne and his lawyers lost that one—on December 12, Superior Court Justice Nancy Spies ruled that although the search of Sonne’s home did violate his Charter rights, by excising the bad parts of the search warrants and amplifying the good, she could admit the evidence seized during the search into the trial proper. Sonne’s lawyers had also fought to have his interrogation by Detective Tam Bui kept out of the proceedings, but Spies decided that most of Sonne’s statements had been voluntary. She cut out some parts (mostly referring to how he used his credit cards) but largely let the interview stand.
The star witness this week was Dr. Crawford John Anderson, the head of Military Engineering for Defence Research and Development Canada. Anderson spends much of his time looking into what types of improvised explosive devices are trending on the internet, and building them himself to see if they actually work. He was here to opine as to whether the chemicals found in Sonne’s house could have been combined into a bomb.
No one disputes that Sonne had a lab in his basement, stocked with glassware and neatly labelled containers (see photos here). There was potassium permanganate, potassium nitrate, ammonium nitrate, iron oxide and zinc oxide. There was stearine, copper sulfate, urea, hydrogen peroxide and aluminum powder, as well as dextrin, sulfamic acid, hexachloroethane, charcoal, potassium silicate and sodium bicarbonate. Sonne had plastic bags full of wax shavings and PVC shavings, and a container of hexamine tablets next to his camp stove. There was acetone, methyl hydrate and hydrochloric acid in his garage. In his furnace room, he had an electrochemical setup where he seemed to be turning potassium chloride into potassium chlorate, a shiny white crystal that is, Anderson said, a well-known ingredient in improvised explosives like TATP (triacetone triperoxide) and HMTD (hexamethylene triperoxide diamlene).
Most of these chemicals have multiple uses. Urea and ammonium nitrate are fertilizers, and police photographed stacks of seeds from Martha Stewart Living. “That’s the difficulty with a lot of this,” Anderson said. “It can be done with ordinary kitchen stuff.” Some have no explosive properties at all. Copper sulfate can be used to grow “beautiful blue crystals,” beakers of which were found during the search.
Anderson said that none of the chemicals had been combined—what he saw were “precursors,” not a bomb. Still, the expert was sober, pointing out that there were enough precursors in the Forest Hill home to make eight to 10 kilos of explosives, enough to “blow apart the back of a bus.”
“I haven’t seen any evidence that something explosive was made,” Anderson said. “But it’s my opinion that the materials there, the kit, not just the chemicals but the materials to put them together, I can’t see any reason other than to at some point make some sort of localized explosive.” The next day, defence lawyer Peter Copeland took Anderson through the chemical list again. Acetone is crucial to both TATP and HMTD, and Anderson agreed that he didn’t know whether the containers found in Sonne’s garage were full. But even one kilogram would be a significant explosion. The lawyer and bomb expert went through the step-by-step process of making each of the explosives up for discussion: TATP and HMTD, plus the less-powerful ANFO (which is a crude mixture of ammonium nitrate and fuel oil) and HDN (hexamine dinitrate). It would take about four hours to make 200 grams of TATP, which would then need to be dried. It would take about the same time to make 50 grams of HMTD, which would also need to be dried. Anderson agreed that Sonne had a limited amount of small glassware. Making the full London-bombing haul of explosives would take a very long time, if done by an amateur, by hand. Copeland had Anderson reiterate that none of these explosives were in the process of being made when police entered Sonne’s home three days before the G20 summit began.
In lawyerly Latin, “mens rea” means “guilty mind.” In other words, intent—the goal of the accused is a factor, which is how murder becomes manslaughter, or vice versa. Sonne says his intent was to build model rockets, and to do so within the bounds of the law. He was a member of the Canadian Association of Rocketry, and says he suspended all his experiments when the president of the association told him he needed a license to mess with stuff like potassium chlorate. Copeland and Anderson went back and forth about whether bomb-precursor chemicals are also rocket propellants. The bag of wax shavings could be used to form chemicals into a solid rocket fuel, Anderson agreed, and the drill press in the garage could be used for the same purpose. He also said, over and over, that rockets aren’t his speciality. Near the end of December 15th's testimony, Copeland posed Anderson another question. “If someone were interested in testing the system, to see whether they could raise flags with the people in authority who regulates chemicals,” the lawyer said, “could that be one reason for acquiring some chemicals in that collection?”
“It’s possible,” said Anderson. “I think it’s a bad idea.”
The trial resumes March 19.
20111216
In group decision-making, ignorance promotes democracy
By Kate Shaw
How do groups of animals make collective decisions? Last week, we learned that bees reach consensus by headbutting those with opposing views. But in many other species, the decision-making process is a bit more democratic. In cases where social animals are unrelated and have different self-interests (such as our own), contrasting opinions are common. But it can be just as common for individuals to either be uninformed about the options, or simply not care much about the decision.
Researchers have long wondered how the dynamics of decision-making work in these cases. Some evidence suggests that those who are ignorant or naïve are subject to manipulation by a loud, opinionated minority. If this is true, uninformed individuals are detrimental to democratic decision-making, since they can turn over power to a minority. However, a new study in this week's Science shows that, under certain conditions, uninformed individuals actually shift the balance toward the majority, enabling a democratic process where the majority rules.
First, the researchers created a simple computational model in which a group of virtual animals had the option of moving to one of two locations. There were few rules: virtual animals were attracted to each other and tended to travel in the same general direction. Based on these rules, the individuals acted like members of a rudimentary social group. Then, the researchers varied the number of animals that wanted to go to each location and the strength of their convictions.
In the first set of models, all the individuals had a preference for either one location or the other, with varying degrees of conviction. Not surprisingly, when the majority of animals had a strong preference to move to one location, the group moved there. Even when the majority’s preference was equal in strength to the minority’s preference, the majority won out. However, when the strength of the minority's preference was increased past a certain threshold, the minority could dictate the group’s behavior. These results suggest that an opinionated minority can win out over a majority with weaker convictions.
Things got more interesting when the researchers added animals without a preference to the model. Under these conditions, even when the minority's preference was extremely strong, the presence of the "uninformed" individuals actually returned control to the majority. The more uninformed individuals there were, the stronger this effect became (up to a point; eventually noise took over).
The researchers then used an experimental approach to ask the same questions using golden shiners, a very social species of fish known for their schooling behavior. Some fish were trained to swim to a yellow target in the tank, and some were trained to move toward a blue target. Intrinsically, the fish preferred the yellow target—even after training, their preference for the yellow target was stronger than their preference for the blue target. This created an natural way to test the researchers’ theories.
The results from these lab tests mirrored the findings of the computational model. When the minority of fish in the tank were those trained to go to the yellow target (meaning they had a strong preference for the option), they won out and the group went there. When untrained fish were introduced into the tank, however, the majority regained control, even though their preference for the blue target was weaker. When the majority of the fish in the tank were trained to go to the yellow target, the presence of untrained fish had no effect.
Under these conditions, the presence of ignorant or naïve individuals actually tends to lessen the influence of a strongly-opinionated majority. Clearly, these experiments are simplistic compared to the conditions under which many collective decisions are actually made in nature (or in our electoral system). Additionally, in this study, only two options were being considered. In real life, there are often multiple possibilities. In other words, it’s probably not realistic to predict or explain our upcoming elections with these results. But they're a good start to understanding the dynamics of collective decision-making.
Science, 2011. DOI: 10.1126/science.1210280 (About DOIs).
UMG claims "right to block or remove" YouTube videos it doesn't own
By Timothy B. Lee
Universal Music Group has responded to Megaupload's request for a temporary restraining order barring the music giant from further interference with the distribution of its "Mega Song." UMG insists that it had a right to take down the video—not under the Digital Millennium Copyright Act, as Megaupload had assumed, but under a private contractual arrangement between UMG and YouTube.
UMG's filing raises more questions than it answers. Most obviously, the firm has not explained why it took down the video in the first place. But the filing also raises deeper questions about UMG's effort to essentially opt out of the DMCA takedown rules. UMG seems to believe it can take down videos even if it doesn't hold the copyright to them, and that when UMG takes a video down from YouTube, the owner of that video can't avail herself of even the weak protections against takedown abuse provided by the DMCA.
A different kind of takedown
As we discussed on Thursday, UMG casts Megaupload as a major villain in the war over illegal file-sharing. Last week, Megaupload sought to bolster its image by releasing a pop-star-studded promotional video. UMG's takedown request was an unexpected publicity coup. Megaupload took full advantage, suing UMG on Monday and asking the judge for an immediate restraining order to prevent UMG from further interfering with the video's distribution.
UMG's response, filed late on Thursday, focuses on the narrow question of whether Judge Claudia Wilken should grant such a restraining order. The recording giant makes two principle arguments in opposition.
First, UMG says such a restraining order is not authorized by the Digital Millennium Copyright Act. The DMCA's notice-and-takedown safe harbor includes a provision for monetary damages against copyright holders who abuse the takedown process, but it does not give the courts the power to block copyright holders from sending takedown requests.
But more importantly, Universal argues that its takedown is not governed by the DMCA in the first place. In a statement supporting Megaupload's complaint, CIO Kim Dotcom had stated "it is my understanding" that Universal had invoked the DMCA's notice-and-takedown provisions. But UMG says Dotcom got it wrong: the takedown was sent "pursuant to the UMG-YouTube agreement," which gives UMG "the right to block or remove user-posted videos through YouTube's CMS based on a number of contractually specified criteria."
In other words, when UMG removes a video using YouTube's CMS, that might be a takedown, but it's not a DMCA takedown. And that, UMG argues, means that the DMCA's rule against sending takedown requests for files you don't own doesn't apply.
"Not limited to copyright infringement"
UMG underscored the point by including a letter UMG lawyer Kelly Klaus sent to YouTube on Wednesday. In that letter, Klaus wrote:
Your letter could be read to suggest that UMG's rights to use the YouTube "Content Management System" with respect to certain user-posted videos are limited to instances in which UMG asserts a claim that a user-posted video contains material that infringes a UMG copyright. As you know, UMG's rights in this regard are not limited to copyright infringement, as set forth more completely in the March 31, 2009 Video License Agreement for UGC Video Service Providers, including without limitation Paragraphs 1(b) and 1(g) thereof.
This appears to be a reference to the agreement underlying the VEVO partnership between Google and UMG announced in April 2009. As far as we know, the agreement isn't public, so we can only speculate on what's in Paragraphs 1(b) and 1(g). But we plan to ask Google for a copy.
UMG's response also sheds some light on another mystery: why Monday's issue of Tech News Today was yanked from YouTube. When UMG removes a video via YouTube's CMS, a "reference file" is created that "in theory is supposed to identify other instances of postings of the same content." UMG speculates that this "reference file" system was responsible for the accidental removal from YouTube of a Tech News Today episode featuring the Megaupload video.
The recording industry is currently lobbying for passage of the Stop Online Piracy Act, which would create a DMCA-style takedown regime for advertising and credit card networks. Critics may question whether it's wise to give new takedown powers to copyright holders that demonstrate such a cavalier attitude toward the rights of others.
20111215
As Banks Start Nosing Around Facebook and Twitter, the Wrong Friends Might Just Sink Your Credit
By Adrianne Jeffries
Can't pay? Well, what about your friends?
Let’s take a trip with the Ghost of Christmas Future. The year is 2016, and George Bailey, a former banker, now a part-time consultant, is looking for a 30-year fixed-rate mortgage for a co-op in the super-hot neighborhood of Bedford Falls (BeFa). He has never missed a loan payment and has zero credit card debt. He submits his information to the online-only PotterBank.com, but halfway through the application process, the website asks for his Facebook login. Then his Twitter. Then LinkedIn. The cartoon loan officer avatar begins to frown as the algorithm discovers Mr. Bailey’s taxi-driving buddy Ernie was once turned down by PotterBank for a loan; then it starts browsing his daughter Zuzu’s photo album, “Saturday Nite!” And what was this tweet from a few years back: “FML, about to jump off a goddamn bridge”?
A new wave of startups is working on algorithms gathering data for banks from the web of associations on the internet known as “the social graph,” in which people are “nodes” connected to each other by “edges.” Banks are already using social media to befriend their customers, and increasingly, their customers’ friends. The specifics are still shaking out, but the gist is that eventually, social media will account for at least the tippy-top of the mountain of data banks keep on their customers.
“There is this concept of ‘birds of a feather flock together,’” said Ken Lin, CEO of the San Francisco-based credit scoring startup Credit Karma. “If you are a profitable customer for a bank, it suggests that a lot of your friends are going to be the same credit profile. So they’ll look through the social network and see if they can identify your friends online and then maybe they send more marketing to them. That definitely exists today.”
And in the last year or so, financial institutions have started exploring ways to use data from Facebook, Twitter and other networks to round out an individual borrower’s risk profile—although most entrepreneurs working on the problem say the technology is three to five years away from mainstream adoption.
“Credit score is a lagging indicator,” said Brett King, a tall, puffy Australian with white blond hair who is the founder of the online-only bank Movenbank and author of BANK 2.0: How Customer Behavior and Technology Will Change the Future of Financial Services. “At best, your credit score is about 60 days behind. What we’re trying to do is look for things that reflect the likelihood of a future default, rather than what’s happened in the past.”
Movenbank is an online bank in private alpha release that replaces plastic credit and debit cards with a mobile device such as an iPad or smartphone. Mr. King is a major proponent of the questionable young science of using social media to evaluate creditworthiness.
When it comes to online privacy, Mr. King subscribes to the Mark Zuckerberg school of thought: standards are evolving, and the world will be better for it. (As long as you’re connecting and sharing, only good things can happen to you!) “Our view of what ‘private’ is, is changing,” Mr. King said. “We make friends with people we barely know!”
He predicts that banks will soon start asking customers to verify their social media profiles. Not everyone has a social media presence, of course, so submitting your Twitter handle will first be pitched as a way to provide customer support or account alerts, which will later open the door for “more complex products,” Mr. King said.
Employers have already started using social media to evaluate potential candidates, and in 2009 a woman in Quebec stopped receiving disability payments for major depression after Manulife decided, based on beach vacation photos on Facebook, that she seemed happy enough to work after all. “I’m sure that insurers now are looking at Facebook profiles and saying, ‘You’ve said you’re not a smoker? Well how come in three of these ten photos where you’re out with friends, you’re smoking?’” Mr. King said.
That means that tweet, “Just got fired, man. Spending my severance at the bar!” may have been ill-considered.
Mr. King is especially interested in identifying customers who can evangelize the service to a sizable crowd of cloud-friends. Movenbank requires users to connect their Facebook accounts upon registering, data from which will be baked into a proprietary “CRED” score, a number that determines which rates and products are available. The exact recipe is still being written, but eventually Movenbank will boost your CRED as you hook it up to your accounts on Twitter, LinkedIn and even eBay, which calculates a reputation score based on buyer feedback. It’s not the only metric, Mr. King said, but a strong Twitter presence could tip the scale in favor of a marginally risky borrower.
Much of this is driven by enterprising techies looking for the next big sector of the economy to disrupt with a social twist. Back in July, the 34-year-old internet pundit, angel investor and startup entrepreneur Kevin Rose, best known as the founder of Digg, sat down in front of his webcam in a t-shirt and baseball cap to talk to the internet about credit cards. “This might be potentially the dumbest, least-vetted idea I’ve ever put out there,” he said. “What if we could make credit cards a little more social?”
Mr. Rose was just spitballing, and his idea seemed innocuous enough. But there’s a nightmare scenario: if banks learn how to use social media, they could gather information they aren’t allowed to ask for on a credit application—including race, marital status and receipt of public assistance—or worse, to redline segments of the social graph.
In other words: choose your online friends wisely, for they may one day determine your APR.
Lenddo, a Hong Kong-based microlending startup incubated in New York’s FinTech Innovation Lab, calls itself “the first credit scoring service that uses your online social network to assess credit.” The first thing Lenddo asks for is a Facebook account; then it wants access to Gmail, Twitter, Yahoo, and Windows Live. The Observer was given a respectable score of 470. But when we tried to apply for a loan, we were told “you need at least 3 connections with scores above 400 in your Lenddo trusted network.” (We wouldn’t have been able to get a loan anyway: Lenddo is only available in the Philippines, although it recently hired an ex-Googler to head up the Americas.)
The company’s algorithm is proprietary and secret, said CEO Jeff Stewart, but the primary metric is what Lenddo knows about the people you’re friends with. “We think that in the age of the internet you should be able to establish your reputation and your identity through your social graph, through your on- and offline community, and use that to get access to financial products and information,” he said.
If Lenddo sees one of your best Facebook buddies took out a loan and paid it back, there’s a good chance you will too. “Our backgrounds are in machine learning and pattern recognition,” Mr. Stewart said. “It’s some serious math.
“There’s no reason there shouldn’t be thousands of engineers working to assess creditworthiness.”
In another nifty but nefarious innovation, Lenddo reserves the right to broadcast your loan status if you fall into default. As the site warns: “Failure to repay will negatively impact your Lenddo score, as well as the score of your Lenddo friends. Lenddo MAINTAINS THE RIGHT TO NOTIFY YOUR FRIENDS, FAMILY AND COMMUNITY if the borrower fails to repay, however, this is only done after several notifications to the borrower and an attempt to work out a payment plan.”
“I think Mark Zuckerberg said it best,” Mr. Stewart said. “Every industry will be in fact impacted by social.”
Banks have been curious about using social media to gauge risk for at least a year, said Matt Thomson, VP of platform at Klout, which calculates “influence” based on a user’s social media activity. Determining creditworthiness is not a core product of Klout’s, he said, but banks have approached the startup to ask about it. He wouldn’t name names. “It’s really like the who’s who of banking,” he said.
(Mr. Stewart of Lenddo also said his startup is approached “regularly” by major banks curious about the algorithm.)
Klout, arguably the leader in developing a metric for social media power users, has taken a beating from bloggers for being spammy and potentially insecure. The New York Times wrote about shocked parents who discovered Klout had autogenerated skeleton profiles for their children, based on what it had gathered from their connections to others; the science fiction writer Charles Stross called the service “the internet equivalent of herpes.” R. Ethan Smith, who blogs as The Startupist, recently wrote a critique of Movenbank’s projected partnership with Klout. “Klout claims that I am influential about New Jersey, coffee, and iPads,” he wrote, noting that he has no real expertise in any of the three and doesn’t even own an iPad. “Now, let’s assume that King is completely serious about using online social profile data to determine a Movenbank user’s influences, which will essentially determine their ability access a line of credit… To stake tangible dollars on what seems to be a relatively easily manipulable algorithm is not something I would characterize as ‘good business sense.’”
Media theorist Douglas Rushkoff dismissed the idea that social media credit scoring is a serious erosion of privacy, mostly because there’s nothing left to hide. “We’re already in the nightmare scenario,” he wrote in an email. “They already know everything about you—more than most of us realize. If anything, the addition of social networking information to this data mining will help us come to some understanding of how much more these companies know about us than we know about ourselves.”
The precise formula for FICO, the most widely used credit score, is secret and proprietary to the Fair Isaac Corporation, a publicly traded company. Experian and TransUnion, two of the three national credit bureaus, did not respond to requests for comment on this story; Equifax, the third, did respond. “Our corporate development professionals are very aware of the opportunities to enhance our proprietary data and partner with companies who add value to the accuracy of our reporting, which helps our customers make better decisions prior to lending,” a company rep said in an email, adding that Equifax can’t comment on future strategies because it’s a public company.
This new use for social media data could turn out to be empowering, Mr. Rushkoff pointed out, if it leads to people lending to one another. A reputation score based on the social graph could lower the barrier to entry for peer-to-peer lending startups. “Instead of everyone outsourcing their savings, investments, and borrowing to truly evil institutions who use what information they about us simply as an excuse to drain more money from us,” Mr. Rushkoff said, “we would invest in one another.”
Snow is falling lightly outside as Mr. Bailey logs off of PotterBank.com. Suddenly, a bell rings. It’s his iPhone: a text message from Lending Club, a peer-to-peer lending startup based in San Francisco. His friends saw his Tumblr post with photos of the coveted apartment, and forwarded it to friends of friends. Collectively, they’ve pledged to invest over and above the needed deposit. He looks up, smiles; looks back at his phone, and taps out a tweet: “No man is a failure who has friends!”
Subscribe to:
Posts (Atom)
Posts
