Wikileaks rocks

The news was on in the background. I was paying little attention. But I caught the following. It was Wikileaks, and some be-suited mandarin commented: “It was a private conversation between the United States ambassador and the King of Saudi Arabia. A private conversation!”

That’s what’s wrong today. This dislocation between public servants and what they are. They are public servants paid by the public to serve the public. By what right does an ambassador believe he can keep from his employers, us, what he says on our behalf to foreign dignitaries? He cannot and must not.

This absurd arrogance is rampant in all democracies, and all levels of bureaucracy. From members of parliament fiddling their expenses and being annoyed when found out; to park keepers officiously and offensively saying where we can and cannot walk on the land we own and upkeep with our taxes; to the policemen who strike legal demonstrators with vicious sticks that we pay for, even when fallen. The list goes on and on and on.

Public servants need to be held to account. They have to do what we want, whether they are presidents, prime ministers or park keepers, or be sacked. But they seek to protect themselves with secrecy. Secrecy that leads to illegal wars that kill thousands upon thousands of people. Secrecy that leads to our money propping up banks and bankers who prefer to pocket it rather than lend it back to us. Secrecy that leads to health scares that lead to our money stockpiling drugs that aren’t necessary, aren’t wanted and aren’t used.

Only by breaking this cult of secrecy, this bureaucratic arrogance, and by making our servants accept that they are our servants and not our masters will we maintain democracy. And only Wikileaks seems capable of doing this. So rock on, Wikileaks: you are a greater defender of democracy than those we pay to defend it.

The ICO imposes its first fines for personal data loss

The UK’s Information Commissioner has finally used his new powers and imposed financial sanctions on wrongdoers.

The first penalty, of £100,000, was issued to Hertfordshire County Council for two serious incidents where council employees faxed highly sensitive personal information to the wrong recipients. The first case, involving child sexual abuse, was before the courts, and the second involved details of care proceedings.

The second monetary penalty, of £60,000, was issued to employment services company A4e for the loss of an unencrypted laptop which contained personal information relating to 24,000 people who had used community legal advice centres in Hull and Leicester.
ICO

This has provoked a range of different reactions. “It’s good to see the ICO showing its mettle for the first time, sending a clear message that it is completely unacceptable to be cavalier with private and confidential sensitive information,” said Graeme Stewart, public sector business development director at Sophos.

Ed Macnair, CEO, Overtis

Ed Macnair, CEO of Overtis, is slightly more critical, “At first glance this looks like the ICO has real teeth. However, in the case of the stolen laptop, the penalty is less than £3 for each lost record. When you consider the fact that A4e is a £145 million company, the breach has had a higher impact on the 24,000 individuals whose confidential information has been lost.

“Similarly, this council had clearly not learned from the first devastating security breach and continued to use the same insecure channel for sharing highly sensitive information. The technology is there to prevent information from being stored in unencrypted format and to tightly control the faxing, sending and printing of confidential information. Let’s hope that the ICO’s action encourages other organizations to urgently review their policies and procedures.”

This is closer to my own views. £60,000 to a large company is nothing – it will be less than the cost of some decent security software and staff awareness training. So in fact the ICO is saying it’s cheaper to lose the data than to protect it.

And in the case of the council, as I’ve said before, it’s the public what pays. It’s silly to fine a public body because public bodies don’t have any money: only the body public has money, and it’s the body public, you and me, that has to foot the bill. My view is that people who lose personal data should also lose their job: and that should apply as much to the CEO as the clerk. I asked Ed Macnair, whose company develops user activity management and monitoring software that can prevent such leaks, if the ICO is worth its cost.

“Absolutely,” he replied. “While you make a good point that a government office imposing fines on public sector bodies is ultimately penalising the tax payer, there are many hundreds of private sector organisations that are also storing personally identifiable information on UK citizens. Many of them are doing so in a sloppy manner, using systems that are highly vulnerable to accidental data loss or deliberate theft.

“Loss of personal information that has been entrusted to an organisation is a breach of trust and causes a great deal of distress to the people affected. I think the imposition of fines is a step in the right direction. While a £100k fine may seem disproportionate to the damage caused by organizations breaching the Data Protection Act, it sends a strong signal that the Information Commissioner is ready to wield his power.

“I think that since the ICO gained its increased powers in April, the UK has held its breath to see whether Christopher Graham would act. He has acted. This should serve as a strong warning to any other organisation, in the public or private sector, that still hasn’t put the policies, processes and technology in place to safeguard UK citizens’ data.”

I repeated my view that fines don’t really hurt anyone (unless they are personal fines), and that really, heads should roll.

“When it comes to culpability,” he replied, “I do believe that fining the organisation is the right approach.  I don’t believe it is fair to fine individual employees because often they are simply trying to get on with their jobs and the data breach is caused by them doing something in a rush, without following policy. The organisation has a responsibility to set policies; educate staff on safe data handling; and to set up systems, processes and technology to prevent these policies from being breached. Pinning the blame on individuals would negate the responsibility of company directors who should be putting the policies, procedures and technology in place to prevent breaches occurring. That said, where an employee has maliciously flouted policy and succeeded in damaging their organisation’s reputation by leaking personal identifiable information, then this should be dealt with in the same way as any act of serious professional misconduct.”

Overtis

Why do I want a smartphone? Let me count the ways

This is why I want a smartphone:

• I want my computer with me at all times
• I want instant access to the internet; anywhere, anytime
• I want all those wonderful apps you can get for a smartphone, either free or at a tiny fraction of the cost of the equivalent on a laptop or desktop

What I don’t want a smartphone is for – a phone. Why should I want another phone? I’ve got a mobile phone. It’s more than adequate. I speak into it, and I hear from it. It’s a perfectly adequate phone. So all I need or want from the smartphone is the computer – not the phone.

But can I have a smartphone without the phone? Can I he…

Well, wait a minute, maybe I can.

All I need is a SIM free smartphone. Provided I have access to wi-fi broadband, such as at home, where I have already paid for access to the internet, then I can use wi-fi to hop onto my prepaid broadband.

But it gets better, because I can then use Skype to get free VoIP telephony while I’m at home. And, come to think of it, according to their latest television adverts, if I subscribe to BT Internet, then I qualify for free use of thousands and thousands of BT wi-fi hotspots all over the country – so I can get free VoIP telephone conversations on a SIM free smartphone in an increasing number of situations and places. I’ll be able to keep my existing dumb smartphone pay-as-you go for emergencies when I can’t access a BT hotspot.

Now I totally accept that this is just theory, and that BT’s hotspots will be a long way from giving me adequate VoIP telephony just yet. But maybe the hotspots is BT’s way of fighting back at the microwave mob… Maybe, with more and more people using mobile phones instead of BT’s landlines, BT is beginning to be a bit concerned. And maybe, just maybe, the free wi-fi hotspots is a plan to stop the rot. I do hope so.

(Sadly, I have to admit that this is all theory. I don’t have a smartphone, SIMful or SIMfree, so I don’t know if this would actually work. The theory sounds good though… Anyone?)

The European Parliament’s Draft Report on the impact of advertising on consumer behaviour

First off, this is not a report on something; it’s a proposal to do something. I do wish these overpaid bureaucrats would get things right.

However, and finally, the European Parliament, in the name of Philippe Juvin and the Committee on the Internal Market and Consumer Protection, has seen sense. Since Europe has proven incapable of defeating spammers, it is switching to aiding and abetting them.

A new Draft Report on the impact of advertising on consumer behaviour

Calls on the Commission to (among other things)

• require advertisements sent by e-mail to contain an automatic link enabling the recipient to refuse all further advertising;

So here’s my plan. I’m going to keep sending you legitimate adverts for silly things. But in accordance with EU requirements, I shall place the following at the bottom of each mail:

We do our best to offer you useful and attractive goods at the very best possible value. We hope you agree. However, if you decide that you no longer wish to receive our offers, in accordance with EU law, you can visit our website (clickhereandwevegotyou.com) and click the Unsubscribe (Gotcha) button. This will prevent any further correspondence from us.

Nevertheless, despite this silly suggestion, the draft report is designed to counter the threat of ‘unfair advertising practices’; and that in itself cannot be bad. But here’s another proposal:

The European Parliament,

Having regard to this and that, and whereas this and bearing in mind that,

• Deplores the development of ‘hidden’ internet advertising that is not covered by the UCPD (C2C relationships), in the form of comments posted on social networks, forums and blogs, the content of which is difficult to distinguish from mere opinion;

• Suggests that the Member States encourage the emergence of forum observers/moderators who are alert to the dangers of hidden advertising;

Is this proposal really suggesting that Member States encourage the emergence of some form of thought police to patrol social networks and decide whether someone’s opinion is not just an opinion but a devious form of hidden advertising? Jesus wept!

And despite interfering and poking its nose where it doesn’t belong, the report simply fudges the really important issue where it should be clear. Behavioural advertising. It should simply say that there must be no behavioural advertising without the full,  informed and active approval of the target. Instead, it fudges the issue:

• Voices its concern about the routine use of behavioural advertising and the development of intrusive advertising practices (such as reading the content of emails, using social networks and geolocation, and retargeted advertising);

Is this document a serious proposal (in which case Phillipe Juvin should be deselected from the European Parliament for wasting taxpayers’ money), or is it largely a PR exercise designed to show off Phillipe Juvin’s Leftist credentials (in which case Phillipe Juvin should be deselected from the European Parliament for wasting taxpayers’ money)? Either way, I hope someone with a bit of a clue gets to redraft it before it goes too far.

DRAFT REPORT on the impact of advertising on consumer behaviour (2010/2052(INI))

Potential exposure of ALL Birmingham NHS patients’ private data

Hardly a week seems to pass without me saying that the ICO is a waste of time – and therefore money. Our money. It needn’t be, but it is.

Last month I discussed The ICO: a guard dog that won’t bite and hardly barks; and I concluded on a story about the NHS losing personal and private patient information:

Obviously there’s no point in fining the NHS; so, hard as it may seem, doctors who lose their patients’ medical records need to be sacked. And that applies to anybody who loses the personal data of others. It’s the only way.

It is the only way; because the ICO’s slapped wrist and don’t do it again approach clearly is not working. Today, the Birmingham Post is reporting an absolutely horrific data breach story:

All patient data along with staff pay and personal details up to chief executive level are believed to have been left accessible to more than 6,000 NHS workers who normally would not be allowed access to such private material…

A NHS source, who feared being named, claimed members of the public using computers at some health sites, like Moseley Hall Hospital, would also have been able to access the insecure confidential records.
Security alert over NHS data breach

Words fail me. We need to wait for more information to emerge, but what if it’s true? Fining the NHS the maximum fine of £500,000 is just a way of levying a £500,000 additional tax on us; because we are the ones who will have to pay it. Somebody has got to go. My bet is that the managers are already looking for a sacrificial lamb amongst their staff. Wrong. It is the top levels of management that need to take responsibility for their failure: resign or be sacked.

Are Bug Bounty Programmes a good thing or a bad thing?

Here’s another of those debates that confound the security industry, like ‘should security firms employ proven security experts if they’re ex-hackers?’ and ‘which is right: full disclosure or responsible disclosure?’. This one is ‘should the security industry pay a reward for vulnerabilities?’

The argument against is given by Anthony Haywood, CTO at Idappcom; a company strong in application security and management, and vulnerability assessment; the trigger is news that Barracuda Networks has launched a bug bounty programme, with ‘a cash prize ranging from $500 to $3133.7, depending on the severity of the vulnerability’.

Barracuda Networks Inc. today announced the Barracuda Security Bug Bounty Program, an initiative that rewards researchers who identify and report security vulnerabilities in the company’s security product line…

“Security product vendors should be at the forefront of promoting security research,” said Dr. Paul Judge, chief research officer at Barracuda Networks. “This initiative reflects our commitment to our customers and the security community at large. The goal of this program is to reward researchers for their hard work as well as to promote and encourage responsible disclosure.”
Barracuda’s Bug Bounty Scheme

Anthony Haywood is agin it. He believes that there is a significant danger that it will attract developers into researching the vendor’s products and then offering them to the highest bidder. Personally, I think this is already happening. But if the legitimate industry offers nothing, then the illegitimate industry is all that is left. A good zero-day exploit could be worth anything from tens of thousands of dollars to hundreds of thousands of dollars to the criminal fraternity. Those researchers who will sell to the highest bidder are already doing so.

And, of course, if the bug is a really serious one that cybercriminals can exploit to generate fraudulent revenue, there is a significant danger of the exploit information falling into the dark ecosystem that black hat hackers – as well as cybercriminals – now inhabit.

I would suggest that this is less likely to happen with Barracuda’s bounty programme than if there were no legitimate reward.

Whilst even organisations like Google and Mozilla offer juicy sums of money for bugs in their software, you are going to get other vendors following suit. But just because it is becoming the norm for the IT industry, does not make it in the long-term interests of our market sector…

…The irony of the situation is that, as well as paying indirectly for the bug bounty schemes, end users of IT security systems, software and services also end up `paying’ as the tide of malware and other electronic mayhem rises as a result.

This is a cause and effect situation. No one really wins in the longer term from bug bounty programs. And that’s why we say that they are not in the real interests of our industry.

Personally, I disagree with this interpretation just about, well, totally. Firstly, software vendors demanding what they describe as ‘responsible disclosure’ without a reward is the same as demanding that security researchers act as unpaid employees, effectively undertaking and reporting unpaid security code audits. And secondly, security researchers, whether white hat or black hat, do not create the vulnerabilities. They merely discover them. So if a white hat researcher doesn’t find it first, sooner or later (and possibly already) a black hat researcher will do so. I would much rather a good guy find the vulnerability and pocket $3000 by disclosing to the vendor a vulnerability that can now be fixed; than a black hat researcher sell it to a criminal gang for a lot more money.

The current system isn’t working. Criminals are getting more and more organised, and there seems to be an inexhaustible supply of vulnerabilities. Researchers don’t make these vulnerabilities; it is the software developer that creates the software vulnerabilities. Therefore the software vendor is responsible. And where responsibility lies, there too should lie redress. So this is my proposal. All software vendors should have a choice. Either they should be responsible for loss caused by vulnerabilities in their software; or they should offer a reward program. This will force the vendor to behave more responsibly. He will increase efforts to release secure software, because failure to do so will prove very expensive. Either he will be liable for his users’ losses, or he will choose to pay a reward to freelance researchers for responsible disclosure. My bet is that 100%, give or take nothing, will opt for the reward scheme. So, rather than be castigated, bug bounty schemes should be applauded, and possibly compulsory.

Idappcom
Barracuda Networks

Government consultations – Doublespeak in action

The UK Government is conducting what it calls a consultation into its proposed amendments to RIPA – specifically, amendments to ‘lawful interception’. This is not done by choice, but because it has to, by order of the EU.

It goes back to Phorm’s behavioural advertising system, and BT’s covert use of the system on its own customers without their knowledge, nevermind their approval. At the time, the Home Office had issued guidance suggesting that the Phorm system was legal. Privacy campaigners disagreed, complained and took the matter to the EU.

The EU decided that the UK had not ‘transposed’, that is, implemented, the EU privacy requirements adequately into UK law (the EU privacy requirements are contained in the European Data Protection Directive (95/46) and the E-Privacy Directive (2002/58).

Apparently, the UK did not transpose the E-Privacy Directive in toto because it believed that some of the conditions were already met within the Regulation of Investigatory Powers ACT (RIPA). Under RIPA, the Home Office believed that Phorm/BT’s opt-out (of interception) process is legal. But the EU’s position is that interception is only lawful under informed consent; that is, ‘opt-in’ rather than ‘opt-out’. The EU has consequently required the UK to bring its national laws into line with the EU Directives.

The UK’s proposed course of action is to amend RIPA.

RIPA makes provision for lawful interception without a warrant under certain limited circumstances. These include the provision in section 3(1) where both the sender and intended recipient of the communication give their consent to the interception, or where the person carrying out the interception “has reasonable grounds for believing” that consent has been given. The interception of communications will involve the processing of personal data, and it is important to ensure that there is clarity about the circumstances in which lawful interception can take place.

The current provisions do not provide the required clarity. This is because “reasonable grounds for believing” is open to different interpretations.

The UK proposes to amend RIPA so that it is clear that “interception will be lawful only where both parties to the communication give specific consent to the interception?” In other words, behavioural advertising must become opt-in by the user – that’s you and me. Our ISPs and behavioural advertising companies (take note, TalkTalk) will not be able to covertly monitor where we go and what we do on the internet without our specific approval.

It doesn’t mean that behavioural advertising is dead, because the ISPs could always push up their prices for anyone who doesn’t opt-in – but at least covert behavioural profiling is dead in the UK. Which might explain why Phorm is reducing its presence in the UK. Phorm’s Interim results for the six month period ended 30 June 2010 has the Chairman and CEO’s statement starting:

Operating losses for the six month period ended 30 June 2010 were $15.7m (six month period ended 30 June 2009: $15.0m). During this period, the Company underwent further restructuring, building up its operations in Brazil while reducing the size of the UK office to reflect the focus of our current operations…

So far the Government’s proposals seem to be a Good Thing. But the EU also requires that all unlawful interception should be subject to sanction. RIPA only has sanctions for ‘intentional interception’; spying on us by accident has been, well, not worth worrying about. But rather than make all unlawful interception subject to “imprisonment of up to two years and a substantial fine up to the statutory maximum”, the Government is now introducing a new civil sanction rather than extending the existing criminal sanction to include ‘unintended interception’.

The argument appears to be that since ISPs can be legally served warrants under RIPA to compel them to spy on us (legally) they should not be punished harshly if they accidentally spy on others of us who are not directly covered by the warrant. I don’t have too many concerns about this – after all, we all make mistakes. But it is not the courts who will decide, in public, whether an unlawful interception was intended or unintended – it is another of those unaccountable quangos: the Interception of Communications Commissioner (IoCC).

And this is where I do have a problem. Such quangos are not required to justify their actions in public – this one would merely

be required to take account of any representations made by the CSP before deciding whether to impose a penalty. Before imposing any penalty, the IoCC would also have to ensure that the penalty imposed and its amount was determined in accordance with all issued guidance.

In other words, a government-appointed quango will have the ability to take decisions secretly, and only be required to act ‘in accordance with all issued guidance.’ Guidance of the quality, I guess, of the earlier Home Office guidance saying that Phorm’s opt-out was perfectly legal.

This consultation provides a lesson in how to comply with European regulations without changing a thing: doublespeak in action.

Information Security and Paranoia are synonyms

This blog, as you know, is hosted on WordPress.com. I like WordPress. One of the things I particularly like is the Site Stats page the blog owner can view. It tells me how many visits different pages receive, where they come from, what search terms are used to find me, and where visitors go if they click a link on the site.

I monitor this information out of vanity (how many visitors I get, and how high my pages appear on search engines), and simple curiosity (which of my topics get the most referrals from me).

But yesterday I noticed that someone had clicked a link I didn’t recognise. What’s more, I didn’t like the look of the link – it appeared to relate to a site in the Far East that raised a few concerns. Now I was worried. Had some innocent visitor clicked a link to a malicious site while on my site?

First thing was to check the linked site itself. Armed with NoScript blocking all scripts, I went there – and it certainly isn’t a security site. I used NoScript to invoke some page analysis tools. First I used WOT.

 

The worrying link's WOT rating

 

The site comes out OK. But, with no disrespect to WOT, I don’t have total faith in community-based reputation systems. Reputations can be manipulated. So next I used Google’s Safe Browsing diagnostics.

 

Google's Safe Browsing diagnostics for the suspect link

 

This is far more worrying. It was safe the last time Google checked – but it has certainly been used to host malware recently; and there was nothing to say that it wasn’t doing so again. So now I was getting really worried. Where is this link on my site? How did it get there? Who clicked it? And has that innocent visitor to a security site been infected through visiting my site?

And then it dawned on me. I checked the spam folder. And there was the link.

 

The offending link - found in the spam folder

 

 

I asked around, and, yes, it appears that when a comment is made and held in moderation, both the site operator and the commenter can click any links contained. But, I discovered with a huge sense of relief, no-one else can.

So, since it wasn’t me who clicked the link, it must have been the spammer checking to see if his spamlink worked. All I can say is that I hope he got infected when he did.

Paranoia is bad for the heart – but good for your safety.

The ethics of employing ex-hackers

Kurt Wismer, who writes the anti-virus rants blog, has made an interesting point as a comment to my post Panda’s Urban Myths: should the security industry employ ex-hackers? He says

the anti-malware community has historically been far, far less ethically ‘flexible’ than the broader security community…

…because those companies weren’t started by a bunch of people with questionable pasts, they’ve had the option of crucifying any competitor in the court of public opinion for ethical breaches such as hiring the fox to guard the hen house.

I do not disagree with Kurt one iota – I think it a very perceptive view of the AV industry. But I want to ask a question that arises: can ethics be flexible?

Well, for our purpose, let’s define ‘ethics’ as moral values and rules. Clearly, there are no absolute ‘moral values and rules’. If there were, we would need no law nor courts, just the Book of Ethics. But if moral values are not absolute, they must be subjective and relative. This means that each person may have his or her own ethical values. So while I may disagree with your ethics, I could never prove that mine are superior – just different.

However, moral values are so important to the smooth running of society, that I think it is incumbent upon all of us to fight for and uphold those values in which we believe. So I find myself coming down firmly on the side of the less ethically flexible anti-malware community. And basically for just one reason: we must never reward bad behaviour. It simply encourages more bad behaviour; and for other children to copy and escalate that bad behaviour. Ask any parent.

Copyright Laws and the art of Dissembling

If there is one thing at which all politicians excel, it is the art of dissembling. That is how elections are won: promise the people what they want while remaining free to deliver what the powers demand. But despite my absolute understanding of this process, I still get tempted by their dissemblage.

Townsend's Dictionary of Political Process

Take Friday’s speech by Neelie Kroes (Les rencontres internationales de la culture, de l’économie et des médias), European Commission Vice-President for the Digital Agenda: it is so full of purple prose that I fear the lady doth protest too much. But it is also seductive. Consider

It is no different in the case of the internet revolution, which is unveiling the unsustainable position of certain content gatekeepers and intermediaries. No historically entrenched position guarantees the survival of any cultural intermediary. Like it or not, content gatekeepers risk being sidelined if they do not adapt to the needs of both creators and consumers of cultural goods…

Just like cinema did not kill theatre, nor did television kill radio. The internet won’t kill any other media either.

By jingo, the lady has a clue! I take this as saying that existing publishers (the current ‘content gatekeepers and intermediaries’ between the artists and their audience) have no God-given right to maintain their position. That suggests to me that Steely Neelie (not my epithet I hasten to add, but I hope she lives up to it) will not simply fold to the rights-holders’ demands to control the internet and criminalise downloaders willy-nilly.

Then experience and reality sets in.

Instead of a dysfunctional system based on a series of cultural Berlin walls, I want a return to sense. A system where there is scope to create new opportunities for artists and creators, and new business models that better fit the digital age. We want to help you seize the opportunities of this age.

In conclusion, let the debate continue. It will be fierce, there are indeed hurdles. But our job is to look past them in order to clear them.

Fine words, signifying nothing. The reality is that Neelie Kroes says nothing at all in this speech, except that she believes in culture. You get the feeling that she could be a breath of fresh air; but there is nothing to say that she will be. So here’s my prediction:

• No politician is going to take on the strength of News Corp
• No Government can take on the combined might of the rights holders: News Corp, Microsoft, Disney, Sony etc etc etc
• The EU, and all of our craven governments, will endorse and ratify the ACTA treaty, thereby confirming and strengthening the ‘position of certain content gatekeepers and intermediaries’

Do not believe a politician. Any politician. Ever. Their purpose is not to serve the people, but to stay in power. And that requires disassembling the truth, so that we believe one thing while they do the other.