Posts by Hargrove

Anyone for a Book Discussion? Marc Goodman, Future Crimes

And a case in point

http://www.theregister.co.uk/2016/03/30/router_infecting_malware_gets_remastered/

provides a good example of a specific vulnerabilities Goodman sees in the IOT.

I'm not very -- actually not at all -- au courant with IT. The days (Today-45 years and counting) when I could code in machine language by punching the binary indicators/switches on the panel of a Naval Tactical Data System 642B are long gone. However, while I may have difficulty figuring out where I am at any given moment, I fancy I still, in the words of the salesmen's song from "The Music Man" have a feel for the territory.

My take is that we are in deep kimchi.

For marketing and competitive advantages, technology providers require that users allow them to load hundreds of programs and God alone knows how many lines of executable code. This is code that in most cases cannot be readily removed by the average user; code that if can be disabled can be reenabled by other system functions, and that regardless of user preferences runs unobserved and unattended in the background.

Every one of these is a mechanism for system failure, and a vector for potential malware attack and infection Marketing and support practices appear deliberately designed to obscure and deny users access to information to enable them to clean up their systems.

Those who govern, in their lust for unfettered hoovering every iota of data on everyone have been fully complicit by establishing policies that restrict user access to and impede development and use of technology that might allow end users to protect themselves.

I see no practical defense against the cyber threat under these conditions.

Anyone for a Book Discussion? Marc Goodman, Future Crimes

I just started this and am finding it an interesting read. It deals with and integrates a number of themes that are common in The Reg. I think it provides fodder for a number of interesting threads of discussion.

My intent is to throw out questions and points that catch my attention as I read. I hope that others will do the same.

For information:

The full title is "Future Crimes: Everything is connected, everyone is vulnerable and what we can do about it" (C) 2015; Published by Doubleday.

US boffins demo 'twisted radio' mux

Re: I fail to see...

I'm an old microwave component engineer who spent the last 45 years as a systems engineer. In other words, I have lost most of what I ever knew about the subject. But, from what little I do remember, I found the quality of the discussion is impressive.

@JeffyPoooh is right on the mark.

I'm reminded of a conference I attended where a professor from a major US university truncated his presentation to introduce a revolutionary new invention for eliminating household electrical wiring that his graduate students had discovered. This new discovery had the astonishing ability of being able to transmit electrical power through the standard construction gypsum wallboard interior walls.

He then showed a picture of the prototype, which consisted of two large coils on either side of the wall, one driven by the power source, the other hooked to a light bulb. No one in an audience of about 400 people had the temerity to point out the obvious. . . that his geniuses had re-invented the resonant air core transformer. I would have, but I was too busy wiping up the coffee that I had just spurted out my nose.

Comcast now touts unlimited gigabit service (that you can't get)

Re: @ Deltics:

Noted, and well said.

Meanwhile, the Myth is alive and well.

Of course unlimited 1 GB service is only unlimited if you have all eternity to use it. Otherwise:

Shannon's Law says that the highest obtainable error-free data speed, expressed in bits per second (bps), is a function of the bandwidth and the signal-to-noise ratio. ... No practical communications system has yet been devised that can operate at close to the theoretical speed limit (Source:Whatis.com)

It is amazing how many ways the telecom industry has been able to come up with to imply that it can deliver unlimited bandwidth. In a way it's unfair of me to pick on Comcast. . . this is far from the most egregious example. For laughs, google "Infinite bandwidth" -Christ -band to get a sampling of the proposals to violate the laws of physics and mathematics. (The exclusions are necessary to eliminate multiple hits on a book title asserting that Christ has infinite bandwidth, and to a musical band named "Infinite bandwidth." Being a Christian, I try to stay in touch with the former. I don't recall that I've ever gotten any inspirations related to telecom, so I figure he won't be offended. I never heard of the band; they may be.)

I will cheerfully concede that, as any good lawyer will point out, Comcast does not actually offer infinite bandwidth. However I believe that touting this service to a select group of customers will almost certainly generate unrealistic customer expectations of what the technology can really deliver universally.

Who watches over your data – and how do you know it won't go AWOL?

Answers: For most businesses, everybody and you don't, respectively.

First, kudo's for a thoughtful article and a splendid topic.

The reality of the global internetwork is that data shared MAY BE data published. At least in the US the courts have issued ruling to the effect that the internet is a public place, and nothing posted, or stored there has any expectation of privacy.

This is all well an good for large companies that can muster the resources and knowledge to use dedicated end to end encryption for transmission and exchange of sensitive information. (At least they have the option. . . whether or not they do is another issue.) For most businesses and individuals, privacy is a fiction. The bizarre rulings of US courts effectively gut copyright protection.

A good read on the overall subject is Marc Goodman's, Future Crimes. He refutes the argument that I don't need privacy unless I'm doing something wrong. Information has economic value. If those who work and

A purely hypothetical example. My friend, a small local florist, does amazing work. She has a number of original designs that make up a large part of her business base. She has them marked a copyrighted on all her literature. I send one to my wife on her birthday. My wife is thrilled. So thrilled that she posts several high res images showing it from all angles on social media. A local competitor, part of a national chain, copies it an undercuts her prices. The direct result is a financial loss.

Now, the Reg is the closest to social media I come, precisely for the reasons cited in Goodman's book.

And, also because I read all the fine print in the Terms and Conditions and Privacy Policy. (More on this, perhaps, in another post in the Forum's Café) As I recall those, the end effect of my wife's posting the pictures of the copyrighted work is that under the T&C the social network now claims ownership of the picture, and the rights to do anything with it they want.

Now companies can assert any kind of asinine claims and require users to accept them. I recently heard of an instance where a well-known internet company's T&C's claimed ownership of the registering company's name.

The problem, in the US at least, is the courts often support them. A company with a several billion dollar turnover and two dozen lawyers on staff can deal with this. My local florist, and literally hundreds of millions other individuals and small business entities like her, can not. In fact, my personal experience has been that it will be virtually impossible for them to find a lawyer that has the expertise to begin to handle such a case.

It is one hell of mess.

I'll to try to post a Topic to discuss the Goodman book in the Forum. Strongly recommend everyone read the book, and if you're interested, join the discussion.

Pentagon to Dept of Defense: Give us $580bn for cyberwar and spacewar

Re: Wouldn't it be cheaper ...

@ Marketing Hack

"the role of the DoD as a jobs program extending into every congressional district in the U.S!"

This WAS DoD's role. It has a higher calling now. That is to ensure the continued transfer of the wealth of the People of the United States to special interests as expeditiously as possible, under conditions that ensure that neither those who govern nor the special interests they serve can be held accountable for as much as a dime of it.

Cybersecurity operations--conducted behind a veil of the highest classification levels--provide the perfect vehicle. The reality is that DoD has, for decades now, been critically dependent on Commercial Off-the Shelf Technology (COTS) information systems. The expertise and knowledge needed to address cybersecurity must come from the civil sector.

The USG is funneling billions of dollars into what amount to administrative processes to collect massive amounts of data the end result of which is to be able to certify that systems are certified by virtue of having been certified by certification authorities certified to certify that the data was certified.

At the same time the government appear to be going balls to the wall to make it illegal for the private sector to develop and deploy effective cybersecurity technology.

Is Facebook about to get a Virtual Reality check?

Re: They're probably being realistic.

"If Intel and Nvidia have any sense, they'll be marketing the Broadwell-E chips release, and Nvidia's new architecture in Q2/Q3 as ideal for VR. You'll need all the power you can get."

Virtual reality in high end simulation has, to some extent, been a target market of the chip manufacturers for a couple of decades. And as Binky. etc. rightly notes, the need for all the computational performance you can get has been a driving function.

The idea of virtual reality tele-presence, is a completely different application. No amount of computational performance at the node is going to compensate for network latency and bandwidth.

I've not tracked the field for several years, but my suspicion is that even for telerobotics, where you can have dedicated data links, there are tradeoffs that militate against the use of immersive VR in real R.

BoldMan's predictions:

Spot on, BoldMan.

Other predictions:

1. Despite all hopes and promises to the contrary, Shannon's law will not be repealed. Real networks will have real latency and real bandwidth limits.

2. With 1. will come that marvelous real experience, a form of particularly acute motion sickness known as "simulator sickness."

3. American humorist Dave Barry is right. People are idiots. In reality people (they know who they are) will Sext and drive.

4. Crime will skyrocket as law enforcement officials called to the scenes of accidents caused by the inevitable combination on 2. and 3. quit en masse saying "I'm willing to die to defend and protect, but I didn't sign up for this."

Feds look left and right for support – and see everyone backing Apple

Re: Let's help you out then :)

Modern information technology has inherently changed the nature of global society, including the diversity and capabilities of the diffuse threats to the members of that society. I've yammered on at some length in El Reg Fora about what I characterize as the breach of the social contract between those who govern and the governed. The essence of this contract is that the governed cede to those who govern certain rights and freedoms in return for a greater good.

Now, I'll concede that given the radical technological and social changes of the past 50 years, changes to some of the terms and conditions of the social contract are doubtless in order. But it is critical that the result be a valid contract. That is, the parties must reach a meeting of the minds on the adequacy of the quid pro quo and there should be equity and balance regarding the consequences of violations of the terms and conditions. In the case of physical search and seizure those conducting the search had names and faces, and left physical evidence of their passing. There was, at least in theory, some possibility of holding them legal accountable for trampling a citizens rights.

That is not the situation we face here. Over the last couple of decades, the federal government has systematically built a firewall around its activities. The terrorist threat has been used as an excuse to create a web of laws and draconian penalties pursuant to executive orders authorized by law. At the same time the government has drawn an impenetrable veil of classification around its information operations. Finally, in the US at least, the federal government, through the offices of the Justice Department have succeeded in marginalizing state and local law enforcement officers, constraining their actions, and making every act subject to intense monitoring and scrutiny.

Before citizens cede any more authority to the federal government, the terms and conditions of the revised social contract must include some serious restraints and limits on the power of federal officials. Actions of federal officials must be closely monitored and those who overreach and abuse their authority must be held accountable and severely punished. The rights of a People are sacred. Abuses of authority should be criminal offenses, and the consequences should be dire. As an example, in addition to civil and criminal penalties, consequences should include a life-time ban on employment in any position funded in whole or in part, directly or indirectly by taxpayer money, and forfeiture of income exceeding some reasonable multiple of the established national minimum wage,

It may be that the People will, at some point, decide to cede authority to those who govern. But first last and always that should be the People's call and not, as appear to be the current case, an extra-legal dictate of some unaccountable federal official.

Never forget Miriam Carey. To the best of my knowledge her killers have never been identified by name. All we know is that they were federal officers and they were fully exonerated. This being an IT forum the following side note may be of interest. I just Googled Who shot Michael Brown. The query returned 259 million hits led by a photo of Officer Darren Wilson. The query Who shot Miriam Carey returned 401,000 hits, and no names. As the kiddies are wont to say: "Do the f---ing math!"

Super-computers aren't super-secure

Good money after bad.

Some observations:

There is no monolithic "scientific high-performance computing (HPC) infrastructure" in the sense used in this report. Nor, by and large, are they "supercomputers" in the ancient meaning of the term. What you have is an internetwork of commodity clusters sharing information and computational capability.

To the extent that the student population is bright, young and mischievous (and largely foreign), and the academic environment traditionally more open, universities may have some human engineering challenges. However, the distinctions are marginal at best, and not unique in any technical sense.

Cybersecurity in the US has become what mathematics was in the old Soviet Union. A discipline at which large amounts of money can be thrown with no pretext of MEASURABLE results. It brings to mind an old line from some military official--"We know of no case where the enemy has successfully used camouflage against us."

Forget anonymity, we can remember you wholesale with machine intel, hackers warned

Re: Awesome

Related to this comment, nobody uses hacking tools that do the coding for you either?

If this article represents the state of the art 'mongst the white hats. the black hats have it made.

Re: Hungry for results?

That's slightly better than I can do if I flip a coin

Splendid comment. It is obvious and only common sense, but common sense is in vanishingly short supply these days.

Re: These detection methods don't scale.

The best and most accessible discussion of the problem of data classification is in a couple of papers by Tom Fawcett. These deal with something called ROC curves. ROC originally stood for "receiver operating characteristic", referring to the ability of a receiver to classify targets in noise. An analogous phenomenon occurs in pattern matching in digital data, where the term "relative operating characteristic" is used. The following link is good starting point.

http://www.hpl.hp.com/techreports/2003/HPL-2003-4.pdf

The problem boils down to one of true detection and false alarm rates. You can have an arbitrarily high true detection rate if you can live with an arbitrarily high rate of false alarms. You can reduce the number of false alarms to an arbitrarily low level. But, only at the cost of missing an arbitrarily large percentage of true targets.

The phrase "No such thing as a free lunch" is occasionally used in the literature to describe this and ZenCoder's comment is right to the mark.

Newspaper kills 'what was fake' column as pointless in internet age

Re: The problem is that Critical Thinking is not taught in School

Theology? Critical thinking? Those things don't go together.

No. but they can and should. The question of whether Shakespeare was right when he penned "There is a divinity that shapes our ends . . ." and the reality (or lack thereof) of Einstein's Central Mystery are fundamental theological questions. These are worthy topics for critical thought.

The natural philosophy of folks like Penrose and Hawkings is, in a real sense, critical theology, even if the logical conclusion (logical in the sense of formal logic) is that God does not exist.

Religion has given has given "God or the gods if there be such", and by extension, theology, a bad name. My personal conclusion, after some 70 years of pursuing such questions, is that the only intellectually honest stance is radical agnosticism (Motto: I don't know; you don't either; it doesn't matter.) The answer to the great question "Why?" is the one my Grandfather gave me when I was 3, and every time I asked thereafter. . .To make little boys like you ask questions.

Why study if the end is not certain knowledge? I can only answer for myself. The exercise has enriched every aspect of my life, and I have enjoyed a rich full life.

Re: If its on the internet...

"@chen "it seems to be getting worse, , ,""

The Internet and popular media are trivial in comparison to what is occurring in government, particularly in the US and UK, where we have all lost our abilities to think critically about anything.

Whether something is right or true--in the sense that those terms are used in math and formal logic--has become completely irrelevant. Perception is reality.

Unfortunately, those who govern in our respective countries have spent the last half century (at a markedly accelerated pace since 2011) crafting laws and regulations to create the perception of doing something, to no practical benefit for anyone except a select set of fiancial interests that perpetuate their power.

The standard response of those who govern, one I encounter almost daily in my profession is, "We know what we have is wrong, but we have to do something." Perhaps, But does it always have to be somethng abysmally stupid to the detriment of the ordinary citizen who are the productive lifeblood of our countries and for the financial gain of those who produce nothing.

Consider this. . . In the years after WWII several generations of Americans spent their lives producing goods and services of value and saved to accumulate wealth. Those who govern and the money-changers have rigged the system so that, for the last full decade, they have essentially paid those who earned the wealth essentially nothing (less that a percent) for use of their savings. At the same time through bewildering array of arcane practices, deliberately enabled by legislation, they demand exorbitant rates for the consumers, use of money. And this depite the fact that information technology has drastically cut the operating costs in the insurance and financial industry.

Let's call it what it is--government sponsored greed, fraud, and abuse on an incomprehensible scale. For the common good, we, the people, need to wrap our minds around the problem and give it some critical thought.

How cyber insurance actually works

Re: I saw one of these proposals recently

Mr. Greenwood's post makes a critical point. The reason this "was/is not unexpected" reflects the inherent nature of the insurance business. The insurer needs a sufficient base of data to be able to predict the probable outcome with a high degree of precision and confidence.

And, in this regard, cyber insurance is not simply new. . .the nature of the risks and losses it deals with are radically different in kind from any other activity. Using auto liability as a analog (admittedly a poor and trivial one, but the best I can come up with at the moment) writing a cyber insurance policy is like trying to ensure a fleet of cars where the number, location, and design of the road system, and the size, numbers, as speed limits of the vehicles for any given span of time can vary by orders of magnitude, in ways that cannot be predicted, and where 90% of the drivers are unlicensed.

To be economically viable insurance coverage must be limited to those risks and losses that can be reliably predicted based on hard statistical data. Given the reality of the global cybersphere, that means limiting the coverage to virtually nothing.

It's crystal clear that this is headed down the same path as Affordable Health Care. Companies and individuals are going to be required to have cyber insurance, the terms and condition of which will allow the insurance industry to extract high profits for insuring very little in practical terms.

It would be amusing

It would be amusing to see how the insurance industry would price out the premiums for the following requirements:

Cyber insurance in the amount of $1,000,000 US per incident $3,000,000 in aggregate.

This is a requirement in a real US government subcontract that a private company has been asked to sign. No information or regulatory reference as to what types of loss or damages must be covered. Requests for that information have generated no response from the prime.

Russian cybercriminals steal $790 million in three years

For further reading:

I did not see any references in this article, but the following sites provide additional information.

http://www.kaspersky.com/about/news/virus/2015/Russian-language-cybercrime-95-of-incidents-are-about-stealing-money

https://securelist.com/analysis/publications/72782/russian-financial-cybercrime-how-it-works/

Love your IoT gadget but could you keep the noise down?

Re: before 1927 it was not even possible

Reality rears its ugly head. A most enjoyable thread of discussion!

What is Not Information . . .

The author makes a splendid point regarding the intrinsic limitations of the technology.

What is not signal is noise. More specifically and ego-centricly what is not MY signal is noise.

And noise is noise.

Hillary Clinton: Stop helping terrorists, Silicon Valley – weaken your encryption

@ a_yank_lurker.

Did you mean to say Traffic analysis does NOT require decryption? From the context that's what I infer.

(An aside. . . If so, just last week I made the identical ommision in something I sent to a colleague. I sent him a correction. He responded that he had read what I meant, with the missing NOT, without noticing that it wsas missing. Such is the nature of the medium.)

Re: Cryptography + steganography = plausible deniability

Absolutely spot on, Pizza. Governments are going balls to the wall to weaken the very measures that societies needs for legitimate security purposes. They are completely blind to the obvious--that in the process they increase the vulnerability of critical financial and infrastructure operations. Worse, their initiatives will do little or nothing to counter the measures that terrorists are far more likely to employ.

Nothing is more detrimental to security than the illusion of security.

If the terrorists' objective is to do what was recently done in Paris they do not need high tech cryptography. The planning can be done by word of mouth over cups of coffee. Once the plan is set, all that are needed for execution are street maps,a calendar, watches, and a willingness to die for the cause.

Engagement and human intel are the best, perhaps the only effectve, countermeasures for this kind of threat.

Freedom exacts a price and carries risks that demand hard decisions. Decisions like, do we wish to remain a society that welcomes and helps those in need, knowing that some intend us harm? Or do we want to lock our borders and live in a police state? Or, hopefully, something in between where the benefis and risks are in reasonable balance.

These are not idle questions. These are questions we must each answer for ourselves, individually and as a society. They are NOT questions that those who govern can or should be allowed to make without our informed consent..

You cannot have a secure society

by denying its members the technology and rights to secure it.

The only alternative (and what Ms. Clinton and others appear to be pushing for) is a gobal totalitarian state in which the government controls every aspect of security.

It must be global, because the technologies and the systems they siupport are global. It must be totalitarian, because it willl be necessary to criminalize the use of those technologies that cannot be controlled by any other means--for examples, 'one time pads' and steganography.

As to the motivation, one need only follow the money, and see who are benefiting from present government cybersecurity initiatives, particularly in the US, the UK and China.

Intel left a fascinating security flaw in its chips for 16 years – here's how to exploit it

Re: Genuine question!

Oh Joy! Some people do still speak my language!!

It's 2015, and someone can pwn Windows PCs by inserting a USB stick

Re: Thank you for this useful service

Well bloody f#@King hell!

First, I second RRs sentiment in spades. We cannot fight what we cannot see, Situational awareness is a first essential step.

The broader issue is that the background update process goes on continuously, from multiple vendors. At least some of these, according to the information the third party vendors provide, may include bug fixes and updates unrelated to the security vulnerability fix. The code is considered proprietary.

The bottom line is that the users, including large entities who operate ISP/Hosting services, government data bases and now the everlovin' f--ing cloud, have no visibility into what the actual system configuration looks like and what the code actually does.

Security demands situational awareness. And we have none.

Problems often present in that worst of forms. . . intermittent.

I live in a third world county in Virginia, USA, and am limited to satellite internet. The closest nodes in the internet are in the Richmond--DC--Baltimore corridor. And, I'm using W8.1 What could possibly go wrong.

I spent the better part of day earlier this week trying to track down why nine out of ten of my e-mails were timing out on the outgoing server. The answer from my ISP was, we know there's a problem, we just haven't been able to track it down. I know of a similar situation with a DoD site. It refuses to deliver pages to certain users. The service desk has been able to confirm have these users have authorized access that the system is recognizing and accepting. The answer--we know this happens for some number of users, we don't know why. In this case, reality rises to bite us in the butt. The guv needs for a contractor to fix the problem. There is no contract.

In the meantime, users get to piss away countless hours and money trying to troubleshoot problems that may, or may not, be on their system.

As a user, with a lot of history but waning chops in this technology, I find this insane.

For the Register, we of British heritage, are a proud lot. Please speak (or write) the language. Just because some fumble fingered jackass makes a typing error, doesn't mean that it needs to be adapted as the queen's English. All the jargon and geek (or in this case leetspeak) does is force us crotchety old men to look the damned term up. The technical jargon that is over my head, I don't mind. Smarter folks than I are communicating important things to one another. But pwn? Olease!

NB. pwn may, in fact, not be due to fumble fingers. The writer may be stuck with the version of the MS ergonomic keyboard I'm using--which for my convenience has changed the size and repostioned keys relative to the MS ergonomic keyboard it replaced.

It is to weep.

UK.gov: Are we talking about Big Data enough? Should we plug it more?

Re: Never mind Betteridge's Law, you cynical mob

"Also isn't Big Data, just the marketing speak for Data warehouse. Like "The Cloud" is for visualization."

My take is that the Cloud has more to do with storage than visualization. But I may be wrong. I find The "Cloud" to be a very nebulous concept. I'm pretty foggy on it.

Big Data, specifically big data analytics, however, are perfectly clear. Once all the data is in the cloud, one simply applies Harry Seldon's principle of pychohysteria to craft a preternaturally intelligent semantic query to extract "THE ANSWER" to any question from "The Cloud."

So far the answer to every question has been "43,"

There are still a few bugs in the system

Re: Forget Big Data

Spot on, Uberseehandel.

I'm not sure the private sector is doing much better. IT provides a wonderful suite of tools for building effective systems. Unfortunately, from the users' perspectives the vast majority of what is built is supremely indifferent to what users need, want, or are actually doing with the technology at any given point in time.

Big data is the greatest, most wonderful, promising technology every devised . . .

if your end goal is a big, intrusive, and repressive totalitarian government.

Otherwise, not so much

Cyber-Senate's cyber-security cyber-law cyber-scares cyber-rights cyber-fighters

A discernible pattern

Hoover data comprehensively;

Under "legal" fictions (either terms and conditions or legislative mandates) that effectively gut citizens' fundamental rights;

Promote/require the storage of all the data in private cloud paid for and controlled by those who govern, but whose operations are not subject to the same constraints and public oversights as government officials;

Implement legislation and/or procedures defined by executive order that allow those who govern to mine the data to look for criminal offenses and take actions that effectively circumvent due process with complete impunity

and, Voila! the classic Police State.

Power President Obama will deny himself this power when pigs fly. In his defense, he didn't start this, he's just been along for the ride.

Vive le Act Patriotique: Liberté, égalité, fraternité, pick any two. No, not those

Re: You gotta love the EU!

Concur vehemently with the sentiment. However, regarding "The elite's plan . . ."

Not sure that they have one. The special interests that comprise the oligarchy before whom every government knee must bend are more akin to a swarm of termites, acting instinctively to consume and destroy.

And in a complete non sequitur. . . The title of this piece is pure genius.

Run Windows 10 on your existing PC you say, Microsoft? Hmmm.

Re: @codejunky Ha

The idea of Linux for the elderly (I myself resemble and resent that remark) is a good one.

The assumptions of the IT industry. . . that everyone has a systems administrator to call on AND is able to spend upwards of 500 to 1000 US dollars every other year to buy a new system is nonsense. Computing is evolving to provide more instant gratification. However, for serious information management, the technology is beginning to melt down.

Only users who are computer expert (computer literate and computer savvy isn't good enough any more) have a fighting chance.

As others have commented, being forced to use the cloud for APPs, which seems to be a universal objective of the industry, has serious issues. Particularly, so if some of the more draconian and predatory licensing practice migrate to the cloud.

For the reader who commented that they had bought their applications. . . Only in a world where common sense and morality applied would that be the case. But alas, we do not own the APP; we just have license to use it under conditions specified by the vendor. I have the distinction of being the only person I know who actually reads the damned things. They can easily run to tens of pages, and are written in such arcane an convoluted legalese as to defy understanding.

My guess is that in the not too distant future the terms and conditions of licensing will require users to cede ownership of their own information to service providers, retaining only limited use right to what they have produced.

The good news is that anyone who wants to download a selfie of their junk to social media, will be able to do it with two clicks (three if they count undoing their belt.)

Private companies fall behind in cloud spending race

A jaundiced view of a nebulous concept

My simplistic explanation for public v. private cloud computing is that cloud computing is an ideal mechanisms consolidating private information in the hands of those who govern, whilst transferring private funds (read peoples' taxes) to special interests with little or no visibility or accountability. Governments can operate at a loss, performance is not an consideration, and no one is accountable.

Private enterprises and individuals, who are accountable. are understandably more conservative. They hesitate yielding direct control of storage and control of their information (effectively, their lives) to something as nebulous as "the Cloud."

(THE Cloud is myth. What we have are scattered clouds. It seems that almost every other APP I get these days, comes with a feature encouraging me to upload data to cloud storage.)

No one thinks--much less talks--about the risks. The fact is that massively parallel data centers face serious technical challenges to reliability--challenges for which technical solutions are in short supply.

These are generally dismissed by hand waving references to redundancy, with no reference to the elephant in the parlor--communications bandwidth.

We live in interesting times.

The weapons pact threatening IT security research

@Charles Manning:

Well said. Part of my day job is assessing new technology. In the past several years our bright young scientists have invented radar (exactly as the Brits did it in 1938); Kichoff's law for Voltage (and with it the multi-battery flashlight); the air core transformer. The first two were granted new US Patents. The USTPO also within the last couple of years granted a patent for a scalable device to extract unlimited power from any point in the universe.

There are many new things under the sun that weren't in the texts back in the day when I was in college. On the other hand the accumulated wisdom of many centuries of human scientific development was. The phenomenon Charles's comments points to--the overwhelming propensity of today's scientists to presume that their ignorance of a concept means it must be novel represents that deadliest combination of human attributes--arrogance and stupidity.

A Comment/Correction

Strictly speaking, the Wassenaar Arrangement is an international agreement, not a treaty. Within the framework it creates, there is latitude in how it is implemented in national regulations.

Europe and the rest of the members of the Waasenaar have the national discretion not to shoot themselves in the foot. And except for the UK, are most likely to exercise it.

The countries who are not members, particularly China, must be ecstatic.

Now Smartflash wants $1.6bn for its iTunes patents. Apple: You'll get nothing and like it!

root of the problem

I don't know the specifics of this case, but a general observation on the American scene.

In recent decades changes in legislation, and making the patent office's funding fee-based, have resulted in a sharp deterioration in the technical integrity of the process. Hypothetical concepts---even those violating all known principles of science and engineering--can be patented. Any claim that can be hung on the theoretical concept may be granted. And, by law, the granting of the patent (in the US) is de facto proof of the practicability of the concept. (I got this in writing from the patent office in response to a question regarding a patent for a scalable system to extract unlimited power from any point in the universe,)

This creates a situation where those who do the hard work of actually building and developing something are at the mercy of trolls who have done nothing more that patent an idea.

New EU security strategy: Sod cyber terrorism, BAN ENCRYPTION

Root of the problem

Those who govern are hopelessly behind the technological power curve. The global cybersphere is not something that can be effectively controlled at a national level. Lessons learned in regulating the flow of goods and people simply do not apply.

It is true that IT is also woefully behind the same power curve when it comes to being able to provide effective cybersecurity. But other than to create a regulatory climate that facilitates and encourages the development and deployment of robust cybersecurity technology there is nothing those who govern can do that is not likely to prove counterproductive--if not outright hostile to the interests of the people. Restricting effective use of digital encryption technology in the interest of preserving the government's ability to hoover on the cheap is a prime example

Lack of secure protocol puts US whistleblowers at risk, says ACLU

And furthermore . . .

There is no question that the communications of whistleblowers should be secure. The question is, what is the nature of the threat to them, and who poses that threat.

Given recent events (the targeting of Tea Party members by the IRS, and the sad case of Miriam Carey) those who govern have to be counted amongst the threat. However, the government is also, rightfully the proper recipient for reports of waste, fraud and abuse.

I believe that the solution lies in establishing a proper balance between the powers of those who govern and the criminal penalties and sanctions for abuse of those powers. Those who abuse powers, whether for gain or ideology, have betrayed the public trust. They should be appropriately punished and barred for life from holding any position funded by any level of government.

Re: This should work well.

Ref @Tom13

And I wish I were joking.

But no joke, he's not joking. At least in the US the government is throwing billions at centralizing all data management in the name of "cybersecurity" to create an infrastructure that remains vulnerable to hackers, while randomly failing to accept credentials or to deliver content to authorized users.

The root cause is hubris--the insane presumption that election to public office automatically makes those who govern experts in information systems technology and gives them the power to suspend the laws of mathematics and physics.

It's a simple matter of having the right certification process, don't-ya know?

From what I observe, this is going to get much worse before it gets better.

Barry Obama declares national emergency over foreign hackers

In fairness to President Obama.

President Obama is an easy target for criticism. I believe that history will render a scathing assessment of his performance in office. I am among the many who feel his policies have pushed the US beyond a critical tipping point. If we are right, the US will be several generations recovering from the effects.

But the man has had lots of help. Some of the most problematic provisions of this EO simply replicate verbatim language taken from earlier EO's of President George Bush. Further the legislative basis of the dictatorial power now executed by the president has been aided, abetted, enabled and built with the full cooperation and collusion of the US Congress over decades.

This arguably explains the otherwise inexplicable lack of outrage from Congress about the draconian provisions eliminating due process. Presidents and Congresspersons are equally dependent on and uncompromisingly beholden to the special interests that purchase their offices for them.

Read the fine print

The Executive Order is short enough to read. It is also inordinately convoluted and difficult to understand:

As I read and interpret it (I are an ingineer not a lawyer)

1. While the implication is that the EO is directed to protecting US Citizens against foreign hackers, the actual language of Section 1(a)(ii), with the inclusive "or" at the end of para (C) has the effect of allowing the freezing of assets of any person determined by the Secretary of the Treasury, in consultation with the Attorney General and the Secretary of State . . . to have acted or purported to act for or on behalf of, directly or indirectly, any person whose property and interests in property are blocked pursuant to this order" without regard to whether the actions were taken knowingly. As written, this provision also appears to extend to otherwise legal actions unrelated to any cyber activity

2. Further, the language "include but not limited to" in section 3. extends the prohibitions in section one are extended to any and all normal commerce. That is:

Sec. 3. The prohibitions in section 1 of this order include but are not limited to:

(a) the making of any contribution or provision of funds, goods, or services by, to, or for the benefit of any person whose property and interests in property are blocked pursuant to this order; and

(b) the receipt of any contribution or provision of funds, goods, or services from any such person.

Again, as I read it, what determines whether assets can be blocked does not appear to depend on whether the contributions were related to any specific prohibited activity. . .sending a payment unknowingly to some one whose assets were blocked would be enough/.

3. All authority for regulatory implementation appears to be delegated to the Secretary of the Treasury under the International Emergency Economic Powers Act. The Attorney General and Department of State are advisory. There are no mechanisms for review or due process.

I have not systematically reviewed the record of past exercise of this specific Act. My impression is that the scope of action possible against US persons and property under this EO is unprecedented, and far exceeds what is either necessary or envisioned by the congress when the enabling IEEPA was enacted. That question is rendered moot by the pervasive lack of capability, will, and interest on the part of the US congress, in doing its job.

Al Franken to FBI: We need MORE revenge smut arrests

Re: I hope you include all religions there

First, a sincere apology to Mr. Pott for my speculation on his personal experience. It had no place in the post, and I sincerely regret including it.

I went back and looked at the original post and found that Mr, Pott did, indeed, include a statement, that

It may not be the exclusive preserve of religious nutters to want to peek into every aspect of the lives of others

in response to which I will offer a less-than-sincere apology for my stupidity in not recognizing this as a thoughtful and well-articulated discussion of authoritarian mindset outside of religion, and retire from the discussion.

Re: I hope you include all religions there

@Trevor Potts:

Three points:

First: Like the originator of this thread (I hope you include . . .) I sense that there is a specific personal experience underlying your response. That's not said to invalidate any of your points, many of which I agree with.

What I question, specifically, is your general assertion that all religions are obsessed with getting their hands on everyone's personally identifiable information. (I recognize that there are, within specific religions and sects, the proclivities you cite to admonish, correct, condemn and shun any who do adhere strictly to a specific set of doctrinal beliefs or ritual expressions of faith. I am also aware that of at least one religion obsessed with gathering the particulars of prior generations and relatives, gathering them like the burial treasures of the Egyptian Pharos to achieve personal "godhood." But in my experience these are the exception, not the norm.)

Second, while the personality traits implicit in your discussion are most visible (and annoying) amongst religious groups, they are by no means exclusive to them. You are describing an authoritarian "follower" mindset. Simplistically, authoritarians accept belief in an external authority as the basis for unquestionable truth, to the exclusion of logic or proofs to the contrary. For this personality type, as your post describes extremely well, belief is tantamount to proof.

Religious beliefs are arguably the easiest targets to hit. But the same personality type can seize on any authority. . . a book, a person, a group. This personality type is equally represented in Anabaptists and atheists alike. (My atheist colleagues quote Dawkins's "No Skyhooks" with all the passion of a Christian fundamentalist quoting Revelations--and with no more thought.)

This is anything but a one dimensional problem. As outlined by the Toffler's what one believes is essentially irrelevant to the "True Believer." They will believe anything, as long as they have an external authority to absolve them of personal responsibility. Again, not to take issue with Mr. Pott's points, per se. Just to observe that, as @Denarius points out, this is only part of a larger picture.

And, while the example is a cliche', the Nazi regime illustrated what can happen when an authoritarian leader succeeds in blending elements of religion, science, state authority and personality.

Third, for transparency, I am a confessed Christian. Granted I am a Christian of the flavor that have traditionally been burnt at the stake by other Christians. I'm essentially Wesleyan by nature. My faith is informed by scripture, tradition, experience and reason. I am fundamentally (pun intended) profoundly agnostic. Belief and knowledge are very different things. I am fairly typical of other Christians I encounter on a daily basis. I firmly believe that this same mindset is widely reflected in believers from other traditions.

Re: "walking sack of crap" @Trevor_Pott

"Then you're perfectly normal. Your morality and judgement are irrelevant. People have a right to privacy."

At the outset let me state emphatically that I'm in complete agreement with the spirit of Mr. Pott's post. Privacy is a major, if not the major issue, society faces. Lack of respect for privacy denotes a lack of respect for persons. It signals a breakdown in civility without which society itself begins to erode.

Here, in stream of consciousness order, are some thoughts that bear on the discussion.

Normal is a mathematical term defining a probability distribution. With respect to human behavior all kinds diverse, often unsightly and publicly objectionable things fall under the curve. All of us have a right to be who we are.

Those rights are not unbounded. Sr. Irma Mildred's response to one of her student's assertion that "I got rights!" remains to this day the best I've heard on the subject. "Your right to swing ends at the tip of my nose."

In basic terms, the purpose of government. . . some would argue the primary purpose. . . is to protect the individual's right to swing short of my nose, and to protect my rights to an unbroken nose and mete out swift, just, and appropriate punishment.

My nose, metaphorically, extends to what are broadly considered human rights.

On one hand, Trevor is right, my morality and judgment are irrelevant. Particularly what I think of your morality and judgment. On the other hand, the safety of my nose depends entirely on your morality and judgment. Morality and judgment cannot be legislated. All the law and government can do is punish you after my nose has been smashed.

Societies that believe otherwise, that seek to legislate every aspect of human existence are ripe for the sound of jackboots in the street. (This last shamelessly plagiarized from another post.)

Citizens in the US believe that the Constitution guarantees a right to privacy. It does not. The right to Privacy--if it exists--is among those rights not enumerated that the People reserve. If memory serves, I believe this is in Article 9 of the Bill of Rights.

Privacy is recognized in other international statements of human rights. And within the US it is strongly defended. Justice Brandeis's assertion of "the right to be left alone," is often quoted. What most readers don't realize is that this is from a written opinion in a case where he was, again if memory serves, on the losing side.

Those of us who value the right to privacy need to appreciate that our views are not universally accepted. Fostering deep understanding of the essential importance of a right to privacy, and all that right entails, may prove to be as great a challenge as defending it

IBM in China: Big Blue sees red, hopes to grow Middle Kingdom's tech

A sign of things to come . . .

The noted futurist Paul Saffo makes some interesting points about the decreasing relevance of national governments. For several decades now, US companies have been implementing their own strategic policies with respect to China. We can expect this to continue, regardless of national policies and preferences.

The spy who leaked me: Ex-CIA boss Petraeus 'fesses up to blabbing intel to his mistress

Re: How quickly the hornet-squad attacks

Well said @elDog

The court document referenced in the article is required reading if anyone wants a better sense of how this tragedy (and it does have all the attributes of a Greek tragedy) occurred.

Unarguably the general showed abysmally poor judgment, professionally and, one strongly suspects, personally. In agreeing to this settlement, however, the General took the only honorable option. And, while it is out of character for me so say so, it appears that the government not have behaved so badly.

The court documents lay out the criteria for what generically constitutes classified information. Information that is potentially seriously damaging to the nation's security frequently appears in unclassified articles. It may well be that only a handful of cleared individuals within the government have the knowledge to understand the significance of the information. But it occurs.

The inverse also applies: Information copied verbatim from unclassified literature very frequently winds up being marked as highly classified in government documents.

Good security practice demands, then, that speculation regarding the potential classification of information be neither confirmed nor denied.

The court documents imply that the General's personal notes did not carry any formal classification markings, and thus, were not subject to formal document control. What the plea agreement concedes is that the government could, beyond any reasonable doubt, prove that information in the General's notebooks revealed information that has been deemed classified and properly marked in the formal sense.

Several things stand out about this case. The government is not claiming that an actual compromise of the information to persons or entities hostile to the US occurred. The general is conceding that his actions did, in fact, constitute violations of security procedures. And there is absolutely nothing to be gained, and much to be lost by pursuing confirmation or denial of the actual classification of the General's personal notes.

Abuse of health data deserves JAIL, thunders ethics body

When it comes to individual rights and freedoms, privacy is the canary in the coal mine.

The power to gather data for ostensible benefit to the people of a country must be balanced by appropriately severe criminal penalties for misuse of those powers. This should apply to both government and private enterprise. And the term misuse instead of abuse is deliberate.

I want the government to have access to the data they legitimately need to defend me against terrorism. And I want anyone who uses the data so collected for any other purpose to be fined, jailed and barred from government service in perpetuity. ANY use of data for ANY purposes other than those that have been explicitly stated by the data gatherer should be prohibited by law, and punished. Draconian to be sure. But the pendulum has already swung too far in the wrong direction and is not slowing down. Drastic measures are needed to restore balance.

Hey, America. Canada's watchdog just slapped net neutrality rules on wireless internet

Mais, bien sur!

We just announced that we track all Canadians downloads, which although illegal is necessary to protect us from terrorists.

C'est bien necessaire. Il s'agit de terrorisme domestique!

Vive Quebec libre! A bas legalite! Aussi l'egalite! meme net neutralite'!

C'est drole, n'est-il pas!

Un Anglais.

'Revenge porn' bully told not to post people's nude pics online. That's it. That's his punishment

Vigilantism

@cornz 1

When the courts fail, in some cases, there is a moral case to be made for vigilantism..

Have a care, sir! This is a slippery slope you put us on.

And a valid point of discussion that demands much more serious attention and discussion than it receives.

The poles of the discussion are well represented by two statements attributed to John Adams, both of which I accept as adding value to the discussion: The first, from the 1780 Declaration of Rights in the Constitution of the State of Massachusetts. That statement, since removed, read: "The right of a nation to kill a tyrant in case of necessity can no more be doubted than to hang a robber or kill a flea."

This sentiment echoes the milder language in the US Declaration of Independence's statements that governments exist for the purpose of securing the rights of the people, and declaring the People's inalienable right to act when governments fail in that purpose.

It is hard to envision a more avid defender of the People as the sole legitimate basis for government authority than Adams. Yet he is also quoted as saying, "The proposition that the people are the best keepers of their own liberties is not true. They are the worst conceivable, they are no keepers at all; they can neither judge, act, think, or will, as a political body." This echoes Plato's equation of true Democracy and mob rule as the worst possible form of government.

These statements capture the inherent conflict between the need for institutionalized government to protect the rights of the individual from mob rule and the rights of the People to protect those same rights when governments fail.

I firmly believe that the principles articulated by the founders of the US Republic are eternal and as valid as ever. There is a strong argument to be made that those who now govern in the US do so for the benefit of special interests, and that government has ceased to be effective--some believe has already failed, or is on the verge of imminent failure--in its primary role as protector of the individual rights of the People. (Never forget Miriam Carey.)

At the same time, those of us with a natural bent toward vigilantism need to temper our inclinations. People arguably have the moral right to act to preserve freedom. But the means must also be morally appropriate.

The same IT that has proven to be such a threat to privacy has given the citizens unprecedented abilities to organize and change the government through the electoral process. At this juncture the people still have both the means and the opportunity to change the government, if they have the will.

The process of changing the government and unwinding the damage done on behalf of special interests will take, I believe, at least two generations. I also have a mild concern that those who govern, having established the legal framework and acquired the requisite number of armored combat vehicles for domestic use, will resort to forceful repression.

I also believe that although that possibility exists, the probability of its occurring is small. That is a bridge can be safely left for burning if and when necessity demands.

In the meantime, compliments to @cornz 1 for having had the courage to broach this subject.