Skating on Stilts

Don't gloat. Your phone could be next.

Due to security holes in the SMS protocol, it is possible to send text messages that allow a hacker to take over an Apple iPhone, according to Fortune:

Using a flaw they've found in the iPhone's handling of text messages, the researchers say they'll demonstrate how to send a series of mostly invisible SMS bursts that can give a hacker complete power over any of the smart phone's functions. That includes dialing the phone, visiting Web sites, turning on the device's camera and microphone and, most importantly, sending more text messages to further propagate a mass-gadget hijacking.

 Want to be safe from this attack?  Too bad.  You can't turn off SMS texting on most phones, and Apple hasn't released a patch.  Apparently the only hope is that no exploits have yet been seen in the wild.  That, and turning off your phone immediately if someone sends you a single square as a text message.

Europe agrees not to be a terrorist data haven

The original US-EU deal over SWIFT banking data created a European data haven for terrorist transactions, ensuring that European transactions would not be subject to US examination.  It appears that the EU has agreed to give the US access to the data that it pulled out of US jurisdiction in the last deal.

This arrangement is being heavily criticized by members of the European Parliament, which is apparently feeling disrespected.  Which, for some reason, made me think of this story.

UPDATE:  In my original post, I unfairly conflated the European Commission, which did the SWIFT deal, with other European officials.  Here's the broader story.

In 2006-2007, SWIFT was subjected to a bitter European campaign for cooperating with US measures to identify terrorist financing.  The campaign included an irresponsible Belgian criminal investigation that was ultimately shut down once the Belgian government had the facts.  As a result, an EU-US deal was negotiated that imposed limits on the US antiterrorism program.  That deal was reached in June 2007. 

While the deal resolved the US-EU diplomatic dispute, that didn't solve the legal problems faced by SWIFT, which was still under Belgian criminal investigation and being criticized heavily by the assembled data protection authorities of Europe, a group known as the Article 29 Working Party. 

Pressed on these fronts, in October of the same year, SWIFT announced that it had decided to create a separate Swiss operations center that would handle European transactions.  It would not be sending data from this center through the US, so terrorists were free to conduct intraEuropean financing transactions free from US scrutiny.  This triumph of privacy doctrine over good sense was hailed by the Article 29 Working Party:   "The new structure foresees by the end of 2009 the creation of a new operation centre in Switzerland" the group said with evident satisfaction. "This means personal data in intra-European transactions will no longer be processed in the US operating centre."  The Belgian data protection authority also cited the new Swiss center favorably when it announced in early 2008 that SWIFT actually hadn't broken Belgian law.  Coincidence?  Nope.  SWIFT admitted that pressure from the data protection authorities was one of them: "Distributed architecture will improve resilience, add capacity, control long-term average message costs, and alleviate European data protection concerns."

In short, it's pretty clear that SWIFT was forced to create a safe haven for European terrorist financing, and the pressure came from European government officials.

But, to be fair, it wasn't the European Commission that insisted on a Swiss safe haven, and indeed the whole point of the 2009 agreement was to mitigate the consequences of the privacy campaigners' insistence on a safe haven.  That is, it restores some US scrutiny of intraEuropean transactions for indicia of terrorist financing. 

On the one hand, I suppose this could be seen as a good new precedent, since the European Commission is actually proposing to give the US access to data located in Europe for antiterror purposes.  More realistically, it is the adults on the Commission coming in to clean up a mess left by Europe's privacy bureaucrats, since at best the deal will restore the status quo ante -- "giving" the US access to data that it had access to before the privacy agencies decided to declare SWIFT guilty before trial. 

What's remarkable, though not surprising, is that the Commission's action is provoking criticism in the European Parliament.

Little-known Lobbying Facts: Tornadoes all occur north of the Panhandle

DHS's decision to award the contract for a new pathogen research facility to Kansas has brought critics out of the woodwork.

But some sort of special lobbying prize should go to the Texas Coalition of Pots Against Soot-Blackened Kettles: 

A Texas consortium that hoped to lure the DHS facility to San Antonio argues that the agency has wasted millions of dollars trying to justify its choice, and said the GAO's findings show that the selection method was "preposterous."

"They call it 'Tornado Alley' for a reason," said Michael Guiffre, an attorney for the consortium. "This really boils down to politics at its very worst and public officials who are more concerned about erecting some gleaming new research building than thinking about what's best for the general public."

Gee, Michael, what do you call this?

Newspaper wants DHS employees punished for what they said

The Wayne County Star didn't like the comments posted at the end of a story about the Border Patrol.  So it investigated the IP addresses of the commenters, and when it discovered that some comments came from Border Patrol addresses, it removed the comments and called in the prosecutors and the inspector general, who are now investigating the commenters.

For some reason, this reminds me a bit of the Gates-Crowley controversy: I can't help suspecting that the Wayne County Star is so enamored of its first amendment status as presumed victim of government oppression that it sees government oppression everywhere and doesn't see anything odd or ironic about bringing down the full weight of government on one or two blue-collar (well, green collar) workers in the Border Patrol because of, well, what they said.  And neither does the New York Times.

The original Star story was implicitly critical of the Border Patrol for stopping a boatload of apple workers whose employer was taking them on an outing; the Border Patrol asked for the workers' papers, and at least one worker turned out to be in the country illegally, but the farmer and others were highly critical of the stop.  In turn, some of the comment posts were hostile to the story and to those who criticized the stop. 

Of the three comments traced to government IP addresses, one offers a pretty straightforward attack on NY apple farmers for causing the illegal worker problem and then complaining about enforcement: “These farmers have a problem because the gravy train that they were riding for soooooo long is being brought to light.”  

The other two are less attractive.  One claimed to be from  [email protected], and said “watcha doing to mi wifey, no checky her papeles. she no legal, but she havey benifit card. oh wait, take her and I get me a applehog till I go to Mexico.  Viva la Raza!!!” (You don't need a real email address to post to the Star's page.  Go here
and you'll find my test post, claiming to be from the email address "[email protected]".)

The next post from a government computer was evidently a response to the earlier post:  “That sounds like my boyfriend.  Leave him alones and get your own.  My boyfriend works sometimes but he is really good at getting FREE benefits from the Federal and State government.”

Investigating these comments raises some tough questions. 

• How much of the outrage is about allegations of racism and how much is about apple farmers hoping to put an end to enforcement?  The NYT quotes one Congressman who seems pretty clearly to think this is about enforcement:  “'I’m investigating these reports to make sure that people’s rights aren’t being harmed and that the economy of Wayne County is not being harmed,' said Mr. Maffei, a Democrat." 

• Is it really a violation of DHS rules to do anything on line that isn't directly work-related, even if it's a thirty-second detour from work duties? 

• Or is the problem that DHS is somehow being associated with offensive views?  That seems hard to maintain when the commenters actually went out of their way not to associate DHS with what they said.  The connection was made only because the Star was so unhappy at the reaction to its story that it decided to investigate those obnoxious upstarts in the comments section.

• You could say that no one in the Border Patrol should be a racist and that it's racist to think that the crude impersonation in the last two posts is amusing.  But that doesn't really justify an investigation of the first post, which is simply criticism of a locally powerful industry.  Nor is it plainly unrelated to the commenter's work; it's the kind of thing one can imagine a combative press rep for Border Patrol saying if called by the Star.  Nor is it obviously offensive, unless apple growers became a protected class when I was out getting bread and milk this morning.

Bad news on the border

Robert Rosas was doing what Border Patrol agents do every day.  Chasing people who were trying to sneak across the Mexican border.  Alone.  In the dark.  This time, though, his everyday courage ended in tragedy.  Rosas was shot in the head after a struggle with one of the intruders. 

Let's mourn and honor Robert Rosas for doing every day something that most people, even most cops, would not be willing to do -- police the border without a regular partner and with backup that won't arrive in time if things go bad. 

Then let's capture and execute the man who committed this crime.

Testifying on PASS ID

Testified today on REAL ID and PASS ID at a typically thoughtful hearing by the Senate Homeland Security Committee.  I predict that PASS ID will get an injection of security improvements (change is usually is usually in the air when the Secretary says "We look forward to working with you on that, Senator").  And for anyone looking to make security improvements, the bill is a target-rich environment.  My testimony can be downloaded here.

Are you a privacy victim? Part 6

Have you ever sat in the slow lane at a border crossing because you were afraid that the government put a chip in the border crossing card that would allow anyone to track you?  Did you ever wait at the border behind someone like that -- maybe someone who'd read this scary story about the technology.  Well, you're a privacy victim too.

Privacy groups are making a big fuss about RFID chips in passports and passport cards, trying to stop adoption of the technology (and working with some companies who've invested heavily in other technology).  But in the end the worst that can be said about RFID in passports and passport cards is that they can be induced to release a unique number -- not a passport or credit card number, just a placeholder that allows the border computer system to recognize what passport is coming up.  So at most, they allow some remote sensing of people -- though rarely at distances where eyesight wouldn't work better and only if the people in question are carrying the passport card without putting it in a protective sleeve.

Is it the end of the world that this number can be extracted from the gear carried by insouciant individuals?  Well, quick, what's on your belt or in your purse?  If you have a cell phone in there, you already live in the frightening dystopia the privacy campaigners have conjured up for 2025, when RFID passports might be carried at any given time by at most 25% of the population.  Your cell phone not only has a unique ID, but it broadcasts that ID for miles.  Why would anyone build a machine to extract, maybe, a meaningless number when instead they could capture a cell phone number (and instead of hacking the border computer system to find out who they've identified, they could just, well, call up and ask "Who is this?")

Kudos to Gigi Zenk, the one person in this story who has a clue:

But Gigi Zenk, a spokeswoman for the Washington state Department of Licensing, says Americans "aren't that concerned about the RFID" in a time when "tracking an individual is much easier through a cell phone."

Are you a privacy victim -- part 5

Has anyone used your identity to cash a check?  Get Medicare?  Get a job?  Chances are that the crooks used a driver's license to do that -- either a fake made with Photoshop or a real license obtained with fake "breeder" documents.  Breeder documents like birth certificates are even easier to forge than a license.

How come it's so easy to get a license to carry out these frauds?  Because privacy groups have been fighting to slow down or repeal REAL ID.

Here's an excerpt from my upcoming testimony on Wednesday, opposing efforts to gut REAL ID:

Critics claim that REAL ID is a threat to privacy.  This is false. 

The claim that REAL ID threatens privacy has helped to stall driver’s license security.  But the result of the delay is not more privacy, it is less.  People whose identity has been stolen with the help of a fake or fraudulent driver’s license are victims of the delay – indeed, they are victims of the “privacy” advocates who have campaigned against REAL ID.  They’ve suffered real losses, and a real invasion of their privacy, because people who claim to speak for privacy have been fighting to prevent good driver’s license security.  

Repealing or gutting the requirements of REAL ID will create hundreds of thousands more privacy victims over the next few years. A substantial number of identity thieves have used fake driver’s licenses to commit their crimes, and making licenses harder to forge will make this crime harder to perpetrate.  By requiring verification of documents such as birth certificates, REAL ID will make it harder for criminals to forge documents that allow them to obtain identifications.  Additionally, three levels of security feature that REAL ID requires on every card will make it harder for criminals to forge the identifications themselves. 

I have yet to hear a coherent explanation of the claim that REAL ID is bad for privacy.  Surely privacy is not improved by a bad identification system.  The closest thing to a coherent argument is based on the false claim that REAL ID would create a national database of individuals’ personal information.  Under REAL ID, state DMVs, not the federal government, will continue to control driver’s license data.  REAL ID simply allows  

 

Moreover, thanks to REAL ID, that data will get additional protection from disclosure.  State DMVs will have to meet tough new security standards for that data.  Among other measures, states will have to ensure the physical security of facilities used to create identification documents and store personal information, perform background checks on employees involved in the manufacture of REAL ID identifications, and formulate emergency response plans.

 

REAL ID does not create a national identification card.  States will continue to issue identifications, and no one is required to have one of these cards.  If anything, REAL ID eliminates the need for a national identity card because individuals will have secure state-issued identification.

Fingerprint plastic surgery?

Chinese surgeons are reported to be modifying fingerprints in the hopes of beating Japan's biometric ID system.

"Immigration authorities have successfully detected four people since January trying to enter Japan illegally by trying to fool the biometric identity system. ...The four people detected at Narita were arrested and told Chiba police investigators that their fingerprints were altered with surgery performed in China, where they had paid doctors 5,000 yuan (roughly ¥70,000) for the procedure, according to the police."

That's only $600, but it looks like you pretty much get what you pay for, since the system did detect fingerprint anomalies.  Let's hope US-VISIT is engaged in a technical exchange with the Japanese on this.

Admiring the 9/11 hijackers

Valerie Jarrett gives keynote address at ISNA Conference.

That's a significant shift since ISNA is an unindicted co-conspirator in a Hamas-support conspiracy and maintains significant leadership ties to its foundation 28 years ago by members of the Muslim Brotherhood in America. ....

During a "meet the authors" session, Imam Warith Deen Umar, former head of the New York state prison chaplain program managed to:

* Argue that key Obama aides are "Israeli," proving Jews "have control of the world."
* Malign the motives of Jews active in the Civil Rights movement.
* Portray the Holocaust as punishment of Jews for being "serially disobedient to Allah."
* Insinuate that Hurricane Katrina was a result of tolerance for homosexuality.

Umar's radicalism is no secret. He previously hailed the 9/11 hijackers as martyrs who were secretly admired by Muslims. He has called for violent jihad.

Easy Cybersecurity -- Publish SSNs

Two Carnegie Mellon researchers published a study the other day "Predicting Social Security Numbers from Public Data" in which they demonstrated that it was almost trivially easy to guess the first 5 digits of a person's social security number based on where and when they were born.  Since many (most?) security functions rely on the secrecy of those 5 digits and the public confirmation of the last 4 digits by a user, it is now almost trivially easy to extrapolate a person's full 9-digit SSN.

Any company that continues to use SSNs for security features is well beyond foolish.  And any user who voluntarily chooses a partner who uses SSNs as a security feature is simply courting identity theft.  Why anyone would do so is beyond me ... but companies and users continue down this benighted path.

Is there any way to make them stop this unwise practice?  I suppose we could outlaw it and make it a crime or some such heavy handed regulatory solution.  But, in keeping with my view that more transparency generally equals greater security, here's an easier solution -- the US government should simply publish a book (call it the Green Pages, since Yellow and White are already taken) listing everyone who has a social security number and making the SSNs public.

That would instantly drain the SSN of all security value and return it to its original function as an accounting identifier.  At that point, anyone who continued to use SSNs for security would be so negligent that the tort lawyers would have a field day.