Skating on Stilts

Sex Secrets of the Security Line

“I … watch him working at the stove.  His easy concentration, economical movements, setting up in me a procession of sparks and chills.”

-- Alice Munro, Dear Life

Three pages after this passage, Alice Munro’s virginal young narrator goes to bed with the man at the stove. That will come as no surprise to most readers, but it's an aspect of human nature that seems to have eluded the Transportation Security Agency.

***

It’s Thanksgiving weekend, when most of us get to spend at least some time thinking about TSA. I’ve spent mine puzzling over the roots of TSA-hatred.

There’s no doubt that it’s virulent. As a privacy skeptic and national security conservative, I’m used to hostile comments.  But it’s only when I defend TSA that the comments go beyond hostile to visceral and occasionally even spittle-flecked.

Why is that? Notwithstanding the venom of the TSA-haters, polls show that most Americans support TSA, including the decision to use whole body scanners. But for a very vocal minority opposing the agency isn’t political. It’s personal.

I can’t explain the women who hate TSA with a passion.  But I’m not sure how many there are.  Anti-TSA sites and comments have a distinct whiff of testosterone. If you’re one of those men, I ask whether this sounds familiar:

It starts before you get to the airport. Get your liquids in a clear, quart-size bag. I keep a cache of travel-size toothpaste and shaving cream in a sandwich-size baggie; I’ll reuse it on about a half-dozen trips before it wears out. Put the baggie on top of everything in your carry-on. The people who have the hardest time are the ones opening up their bags in line to find their liquids. That wastes precious time. I put my laptop and Kindle in an accessible pocket outside my carry-on. Next, take your ID out of your wallet and put it in a breast pocket with the boarding pass. I almost always wear a sports jacket when traveling. Why do I do that? Pockets. Take all of your small electronics and put them in jacket pockets, along with change, keys, and your wallet. When you get to the line, you just take your jacket off and put it in the tray. That’s the main trick: Instead of unloading my pants pockets in the line, I prepack my jacket. In the airport, after you show your documents, put your license back in your pocket—you don’t want to lose it. At the bag screening, the shoes go off first—I always wear loafers. Then I put my jacket in a tray behind the shoes, and my liquids on top of the jacket. The laptop goes in the next tray, then my carry-on follows. I sequence it that way so I can reverse the unpacking process at the other end. You put your shoes and your jacket on, then your hands are free to grab the liquids and the laptop, and the bag’s right there.

That’s Michael Chertoff talking, former Secretary of Homeland Security, my former boss, and a legal and financial force in Washington.  He’s got a lot to think about. Is this really a good use of his time?  After all, how efficiently he performs in the security line is going to make – what? –- maybe a one-minute difference in how fast he gets through the line?

It may not make sense. But I’m willing to bet that a lot of the men reading this have similarly choreographed plans for the security line.

I know I do. And if I’m honest with myself, the rituals of the screening line aren’t really about speed.  They’re about performance.  I feel a kind of competitive pressure to keep the line moving. I’m not happy to see more than about six inches of distance between my luggage and the bags in front of me on the belt. Every delay in pulling out my laptop or my liquids, every last minute bit of change I have to throw haphazard into the bin, every stutterstep as I realize it’s a whole-body scanner, not a metal detector, so belt and watch have to come off too –- all detracts from the performance.

Every once in a while, though, everything goes right, and I feel great. I’m Michael Chertoff, baby, all smooth competence, no wasted motions, no hesitation, no gaps on the conveyor belt.

OK, that’s a little embarrassing to admit.  But it gets worse when I ask myself why I care.  If you’re the kind of guy who can’t throw away a piece of paper without wadding it up and arcing it across the room, you already know.

In part we do it to keep our place in the hierarchy of guys.  But in the end, what we’re really hoping for is an Alice Munro moment -- that our easy concentration and economical movements will set up in someone “a procession of sparks and chills,” followed a few pages later by, well, what we deserve for all that demonstrated competence.

And that means that TSA has an Alice Munro problem.  Because it’s the TSA agent who points to the phone that’s still on your waist and sends you on the walk of shame back to the conveyor belt, every prospect of chills and sparks annihilated.

Worse,  TSA keeps changing its routine.  Shoes in the bin or shoes on the belt? Wallet in the bin or in your pocket? Boarding pass in your hand or on the belt?  Just when we learn the ritual, there’s something new. How well would LeBron perform if the NBA kept moving the basket?

It’s even more of a problem if the TSA officer shows even the slightest attitude. The only thing worse than failing publicly is having your nose rubbed in the failure.  Every time I walk the walk of shame, I find myself on full alert for even a hint of criticism or superiority from the TSA officers around me; I'm just one word or lifted eyebrow away from going into full junior-high-school rebellion mode.

***

If I’m right about the roots of TSA-hatred, there's a lot the agency could do to ease the problem. Start with the officers. They’ve already become far more professional and hard to provoke.  That’s good, but there's room for more.  When protocols change, in particular.  After a week, the officers know the new routine cold, but for months after a change they’ll be dealing with people who don’t. It’s natural -- but unwise -- for officers to treat deviations from the new protocol as mistakes. Instead, to avoid triggering performance anxiety, the agency should adopt a self-deprecating and even apologetic tone. For months or years, the officers will need to say,  “I’m sorry.  We changed the rules again. Now we’re asking people to put their shoes on the belt, not in the bin.”

In fact, the agency should avoid any hint that it is judging our performance from on high. How about a sign on the way to the belt that says, “Forty of the forty-two TSA officers now on duty have forgotten their cell phones at least once while walking through the scanner.  We’re hoping this sign will help you avoid our mistake”? Or one that says, “We change our protocols from time to time to make life harder for terrorists.  We know it makes life harder for you too, and we’re sorry.  If you’ve got questions about the new procedures, just ask”? Maybe that video of John Pistole could include an interview where he talks about all the stuff he’s mistakenly tried to take through security -- water or pen-knives (maybe even guns – he was after all an FBI guy for most of his career).

In short, maybe TSA needs a simple new message for travelers:  We’re not judging you, we’re just trying to keep dangerous stuff off planes. Oh, and you’re not in a competition; you’re in a security line.

The new approach may not stop some travelers from hoping that our displays of easy concentration and economical movements in the security line could still inspire a procession of sparks and chills. But at least we won’t blame TSA when they don’t.

It’s worth a try.  We could call it the Munro Doctrine.

NOTE: Comments explaining that TSA is an intolerable intrusion on our freedoms that the rest of the country simply fails to grasp are inevitable, but those using the word "sheeple" or linking to stories from PrisonPlanet may be removed, or mocked.

FURTHER NOTE: No, that's not a real Craigslist ad.

The Right to Be ... Oh, Forget It

The harshest blow yet has been struck against the European Commission‘s wacky “right to be forgotten.” What’s worse, the blow came from another European Union agency, the European Network and Information Security Agency, or ENISA.  And, worst of all, ENISA trashed the right to be forgotten in the most innocent and most devastating way possible:  By trying to take the idea seriously.

ENISA’s report simply asks how government will implement an individual "right to be forgotten" when data are so often plural –- concerned with more than one person and freely exchanged with many more.  How, ENISA asks, would government force the forgetting of a couple's photograph when one person wants the photo forgotten and the other doesn't?  And how can data be tracked down and “forgotten” when we don’t even know who has seen or stored it?

Consider Alice viewing Bob’s personal information on a computer screen, while she is allowed to do so (i.e., before Bob has invoked his right to be forgotten). Alice can take a picture of the screen using a camera, take notes or memorize the information. It is technically impossible to prevent Alice from doing so, or even to recognize that she has obtained a copy of Bob’s personal data.

Faced with such obstacles, you might think the European Commission would acknowledge reality and give up on the unenforceable right to be forgotten.  But remember the recording industry. When told that enforcing its rights over easily copied digital files would require suing masses of music fans, the industry said, “You think we won’t?  Watch us.” 

In the same spirit, perhaps European data protectors could hire aging Stalinist photo retouchers to edit photos person by person, and take tips from 1984 on how to monitor everything that appears on our computer screens, just in case it turns out that the war with Eastasia has to be forgotten, fast. 

Attribution and Retribution: The Anvisoft Case

Attribution of cyberattacks is getting easier, but we’re still bad at the next step:  retribution.  A case in point is Brian Krebs’s clever investigation of a new antivirus company, Anvisoft. He offers compelling reasons to believe that Anvisoft is run by a notorious Chinese hacker who helped attack a DoD contractor and others several years ago, according to an iDefense report.  The hacker, Tan Dailin, is pictured on the right.

If Brian’s suspicions are correct, this is a great case for retribution. After all, Anvisoft is offering its software for download in the United States. The company has subjected itself to US jurisdiction, and it probably needs the US market if it’s going to succeed globally.  This is an opportunity for the US government to demonstrate that hacking US companies isn’t something we’re likely to forget or forgive. Indeed, if the government were taking foreign government hacking seriously, it would already be investigating Anvisoft.

To be a bit more pointed about it, where the hell is the Federal Trade Commission when we need it?  It sure sounds like consumer fraud for an anti-US hacker to try to sell security software to Americans while hiding his past.

Of course, the FTC is resource constrained.  But it’s spending boatloads of money litigating with Wyndham Hotels, claiming that the hotel chain didn’t do enough to keep hackers from breaking into the hotel network and stealing credit card numbers. 

Jon Leibowitz, call your office.  Given a choice, I think we’d all be happier, and safer, if you devoted your scarce enforcement resources to investigating the perpetrators of crime before suing the victims.

Cyberwar and Industrial Controls: A conversation with Ralph Langner

I got a call the other day from Ralph Langner, the man who reverse-engineered Stuxnet. He wanted to compare views on cyberweapons and industrial control systems.

These systems have now been installed in most of the infrastructure that supports civilian life. But Stuxnet showed how vulnerable such systems can be to cyberattack. I fear that civilians will be targeted by cyberweapons in future conflicts – and that we have no good response to that threat.

Langner, a German national whose consulting firm remediates infrastructure risks, knows a lot about these issues. Here is an edited version of a conversation that left me both disturbed and, oddly, optimistic.

BAKER: After Stuxnet, am I right to worry that we could see a cyberattack on industrial control systems with the kind of massive civilian damage that will look and feel like war?

LANGNER: There’s no doubt that cyberattacks on industrial control systems are possible. And that they could cause large-scale disasters. It’s just not that hard, and definitely does not require the resources of a nation state, to cause major physical damage by changing the code being executed on an industrial control system.

BAKER: Like what?

LANGNER: The big difference between IT and control systems is that manipulating the latter doesn’t simply change data, but physical reality – such as destroying equipment, maliciously changing products (think about food and beverages for example), or causing explosions. And those changes cannot be fixed by simply restoring from backup tapes.

It's not just the loss of infrastructure we need to worry about.  Chemical plants run on industrial control systems; they could be remotely instructed to release gases that will kill the people in surrounding neighborhoods in a Cyber Bhopal scenario. That’s a huge problem because there are several thousand potential chemical targets in the US alone.

BAKER: Even if the industrial control system is fully separated from the Internet?

LANGNER: Sure. You can cause the damage using rogue code which is infiltrated via contractors’ BYOD ["bring your own device” –- a recent IT trend allowing employees to use their own equipment on corporate networks – SB] to jump the air gap, as in the Stuxnet scenario. Such rogue code operates autonomously once it’s released into the system.

BAKER: A kind of “fire and forget” weapon, like a cruise missile?

LANGNER: Right. And once it reaches the target, it can cause disaster within minutes. Stuxnet again showed the way. Its authors were never in direct communication with the malware’s payload after it infected the Natanz enrichment facility. They didn't need to be. The rogue code did all the damage on its own.

BAKER: So, are widespread civilian infrastructure disasters inevitable in future conflicts? Are we just screwed?

LANGNER: Only if we are stupid. There’s a lot we can do to prevent those disasters. The technical problem is solvable. The real problem is political will.

The Hackback Debates -- Together at Last

In recent years, Orin Kerr of the Volokh Conspiracy has debated hacking law with two of his cobloggers, Stewart Baker and Eugene Volokh.  The issue:  whether federal law prevents network owners from hacking those who are hacking them.

Spread over several years and multiple posts and comments, the debates have been hard to find and harder to read. 

No more.  I’ve pulled the dialogue into a single document, with introduction, and posted it here, on the Steptoe Cyberblog. 

Republicans Briefly Repudiate 40 Years of Tougher Copyright Enforcement

As the fight over SOPA wound down, I predicted that SOPA might be turn out to be a watershed, permanently turning Tea Party Republicans into copyright skeptics: 

For Republicans, opposition to new intellectual property enforcement is starting to look like a political winner. It pleases conservative bloggers, appeals to young swing voters, stokes the culture wars and drives a wedge between two Democratic constituencies, Hollywood and Silicon Valley.

That prediction is starting to look pretty good.  The conservative-led Republican Study Committee just put out a Policy Brief that questions forty years of bipartisan support for tougher copyright enforcement.

Indeed, the Republican Study Committee expresses support for expanding fair use, treating the reduction of statutory copyright damages as a kind of tort reform, punishing false copyright enforcement claims, and limiting copyright terms to twelve years, with increasingly expensive extensions available for no more than 34 years. It is the most radical proposal for overhauling copyright that we have seen in recent years, and the most head-turning change of direction in decades for either party on intellectual property issues.

UPDATE: That was fast. The policy brief has been withdrawn. The study committee's executive director's statement explained the withdrawal this way: "Yesterday you received a Policy Brief on copyright law that was published without adequate review within the RSC and failed to meet that standard. Copyright reform would have far-reaching impacts, so it is incredibly important that it be approached with all facts and viewpoints in hand." 

When Should Government Suppress the Truth About Powerful Men?

That’s a trick question. Government is always tempted to punish those who reveal unwelcome truths, just as it’s always tempted to protect the rich and powerful by selective enforcement of vague laws.

But even good liberals and libertarians seem to have trouble seeing the problem when suppression of truth and protection of the powerful is done in the name of privacy.

Here as elsewhere, though, events in Greece are doing much to strip the gauze off our illusions:

Prosecutors on Monday set a fast-track trial date for the investigative journalist arrested last weekend after publishing a politically sensitive list of Greeks said to have Swiss bank accounts.

The snowballing case has raised questions about press freedom and Greece’s willingness to crack down on tax evasion.

Prosecutors said that Kostas Vaxevanis, the editor of Hot Doc magazine, would be tried Thursday in Athens on charges of interfering with sensitive personal data in a one-hearing procedure that is routine in Greece for misdemeanors. If found guilty, he could face a minimum prison term of one year and a fine of around €30,000, or about $39,000, one of his lawyers said.

For more, here’s NPR on the same case.

UPDATE I: The trial did occur on Thursday, and Vaxevanis was acquitted. The prosecutor's strategy will leave litigators scratching their heads:

The prosecutor, Iraklis Pasalidis, called no witnesses and sat stone-faced during most of the trial. He submitted a blank witness list to the judge, a move that one lawyer deemed “an analogy of the blank nature of the allegations.” ... Pasalidis nevertheless argued strongly that Vaxevanis should be found guilty for defaming people without determining their guilt. “These are the culprits, take them and crucify them,” Pasalidis told the court. “Is this a solution to the country’s problems? Cannibalism?”  

UPDATE II: Privacy campaigners sure can be persistent where the rich and powerful fundamental rights to privacy are concerned.  Prosecutors have announced that they will retry Vaxevanis:

The Athens public prosecutor’s office found the judge’s verdict in Mr. Vaxevanis’s case to be “legally mistaken” and wants it re-examined, a court official said, adding that a date for a retrial had yet to be set. “Such appeals by the prosecutor are not unusual, particularly in cases where personal privacy are concerned,” said Aristides Hatzis, a professor of law at the University of Athens."

The Latest Victim of Europe's Privacy Regulation is ... Privacy Itself

Transcending parody, the European Union has proposed a privacy regulation that will inevitably deprive many people of their privacy. The regulation, now working its way through the tortuous Brussels process, includes a "right to data portability." This is typically oversexed Commission-speak for a regulatory requirement that information services must hand over all of a subscriber's historical data upon request, and "without hindrance."  

Peter Swire and Yianni Lagos recently released a nice paper demonstrating the high risk that Europe's privacy regulation will turn all of us into privacy victims. The new right, they say with admirable restraint, "raises serious risks for another principle of data protection law, which is protecting the security of an individual’s personal data – in our world of weak authentication and rampant identity theft, moving all of a person’s data to another system “without hindrance” creates security risks that can outweigh the portability benefits."

I don't always agree with Peter, but in this case I do. Swire and Lagos rely heavily on the work of an FTC advisory committee on data access and security.  I served on that committee, which explored exactly this problem.  Here's a excerpt from my now-twelve-year-old concurring statement:

[A]s the Report says, "Giving access to the wrong person could turn a privacy policy into an anti-privacy policy." If access to personal data is turned into a legislative right, Americans’ personal data will be at risk of exposure to con men, private investigators, suspicious spouses – anyone who has the chutzpah and the scraps of information needed to plausibly impersonate their target.

That’s bad for all of us, but it is especially bad for the companies forced to set up some sort of access system. If they demand clear and convincing proof of identity before releasing personal data, they will be accused of offering access in theory while denying it in practice. But if they relax the rules, they will surely be sued every time a con man exploits the relaxed rules to steal a consumer’s identity. 

The European Commission has now had more than a decade to study the US work on the topic, a decade in which hacking and bad Internet authentication have only grown into more serious security threats.  

How does the data portability provision ease the threat to the security of our data? "Unfortunately," Swire and Lagos note, the provision "makes no mention of the right to data security."  

That's privacy law in a nutshell: Rights first. Regrets later.