Shared posts

17 Aug 02:55

Sharing HBO Go Accounts Could Result In Prison

by Unknown Lamer
coolnumbr12 writes "In a recent New York Times article called 'No TV? No Subscription? No Problem?' Jenna Wortham noted how she used, 'the information of a guy in New Jersey that I had once met in a Mexican restaurant.' Dave Their of Forbes admitted that he used his sister's boyfriend's father's account in exchange for his Netflix information. But this is stealing under the Computer Fraud and Abuse Act, which makes it a misdemeanor with a maximum one-year prison sentence to 'obtain without authorization information from a protected computer.' It is also a violation of the Digital Millennium Copy Act because it is knowingly circumventing a protection measure set up to prevent someone from watching content like 'Game of Thrones' without paying. Forbes points out that a crafty prosecutor could also claim that using an HBO Go password without paying is a form of identity theft."

Share on Google+

Read more of this story at Slashdot.



17 Aug 02:40

Scientists Explain Why Chairman of House Committee On Science Is Wrong

by samzenpus
Lasrick writes "Michael Oppenheimer and Kevin Trenberth take apart Rep. Lamar Smith's (R-Tex.) Washington Post op/ed on climate science saying: 'Contrary to Smith's assertions, there is conclusive evidence that climate change worsened the damage caused by Superstorm Sandy. Sea levels in New York City harbors have risen by more than a foot since the beginning of the 20th century. Had the storm surge not been riding on higher seas, there would have been less flooding and less damage. Warmer air also allows storms such as Sandy to hold more moisture and dump more rainfall, exacerbating flooding.'"

Share on Google+

Read more of this story at Slashdot.



17 Aug 02:36

Steubenville Hacker Faces Longer Prison Sentence Than the Rapists

by timothy
joeflies writes "In a previous Slashdot article, hackers worked to preserve content for the Steubenville rape case. The two football players charged received juvenile detention sentences of one and two years. One of the hackers, on the other hand, faces 10 years in prison."

Share on Google+

Read more of this story at Slashdot.



17 Aug 02:35

Northern Hemisphere Pollution a Cause of '80s Africa Drought

by timothy
vinces99 writes "Decades of drought in central Africa reached their worst point in the 1980s, causing Lake Chad, a shallow lake used to water crops in neighboring countries, to almost dry out completely. The shrinking lake and prolonged drought were initially blamed on overgrazing and bad agricultural practices. More recently, Lake Chad became an example of global warming. But new University of Washington research shows the drought was caused at least in part by Northern Hemisphere air pollution. Particles from coal-burning factories in the United States and Europe during the 1960s, '70s and '80s cooled the entire Northern Hemisphere, shifting tropical rain bands south. That meant that rains no longer reached the Sahel region, a band that spans the African continent just below the Sahara desert."

Share on Google+

Read more of this story at Slashdot.



23 Jul 02:02

Microsoft Confirms Xbox One's Phone Home Requirement, Game Resale Rules

by Soulskill
Following the confusion surrounding Microsoft's announcement of the Xbox One, the company has now clarified many of the hot-button issues in a set of posts on their official site. First, they confirmed that the console will need to phone home in order to continue playing games. On your primary console, you'd need to connect to the internet and check in once every 24 hours. They also announced that you'll be able to access and play any of your games by logging in on somebody else's console, but the internet connection will be required every hour to keep playing that way. Other media don't require the connection. Microsoft also explained how game licensing will work. On the upside, anyone using your console will be able to play your games, and you can share your games with up to 10 members of your family for free. The downside is the news about used games; Microsoft says they've "designed Xbox One so game publishers can enable you to trade in your games at participating retailers." The key word there is can, which implies that you can't without the publisher's express permission. Finally, the company made a set of statements about how Kinect's audio and video sensors will collect and share your data. "When Xbox One is on and you're simply having a conversation in your living room, your conversation is not being recorded or uploaded." They also say data gathered during normal use won't leave the console without your explicit permission.

Share on Google+

Read more of this story at Slashdot.



22 Jul 20:17

US Mining Data Directly From 9 Silicon Valley Companies

by samzenpus
Rick Zeman writes "Hot on the heels of Verizon's massive data dump to NSA comes news of 'PRISM' where The National Security Agency and the FBI are tapping directly into the central servers of nine leading U.S. Internet companies, extracting audio, video, photographs, e-mails, documents and connection logs that enable analysts to track a person's movements and contacts over time. This program, established in 2007, includes major companies such as Apple, Microsoft, Yahoo, Google, Facebook...and more."

Share on Google+

Read more of this story at Slashdot.



22 Jul 20:17

NSA Building $860 Million Data Center In Maryland

by timothy
1sockchuck writes "As its current data collection makes headlines, the National Security Agency is continuing to expand its data storage and processing capabilities. The agency recently broke ground on an $860 million data center at Fort Meade, Maryland that will span more than 600,000 square feet. The project will provide additional IT capacity beyond the NSA's controversial Utah data center. The new facility will be supported by 60 megawatts of power and use both air-cooled and liquid-cooled equipment."

Share on Google+

Read more of this story at Slashdot.



22 Jul 20:14

The NSA: Never Not Watching

by timothy
Trailrunner7 writes "For many observers of the privacy and surveillance landscape, the revelation by The Guardian that the FBI received a warrant from the secretive Foreign Intelligence Surveillance Court to require Verizon to turn over to the National Security Agency piles of call metadata on all calls on its network probably felt like someone telling them that water is wet. There have been any number of signals in the last few years that this kind of surveillance and data collection was going on, little indications that the United States government was not just spying on its own citizens, but doing so on a scale that would dwarf anything that all but the most paranoid would imagine." And now the Obama administration has defended the practice as a "critical tool."

Share on Google+

Read more of this story at Slashdot.



22 Jul 20:08

Chinese Firm Approved To Raise World's Tallest Building In 90 Days

by samzenpus
kkleiner writes "The long anticipated Chinese construction project called Sky City, a 220-story building that can house 30,000 people, has finally received approval from the central government to break ground. The firm Broad Sustainable Building previously constructed a prefab 30-story building in 15 days, but for Sky City, they have an even more aggressive schedule: 90 days to build 2,750 feet into the air. Once completed, the building will be a place for people to both live and work, with recreational facilities, theaters, a school, and a hospital all within the structure."

Share on Google+

Read more of this story at Slashdot.



22 Jul 20:05

Temporal Cloak Erases Data From History

by Soulskill
ananyo writes "Electrical engineers have used lasers to create a cloak that can hide communications in a 'time hole', so that it seems as if they were never sent. The method is the first that can cloak data streams sent at the rapid rates typically seen in telecommunications systems. It opens the door to ultra-secure transmission schemes, and may also provide a way to better shield information from noise corruption (abstract). The researchers manipulated laser light in time to create regular periods with zero light intensity (a Talbot carpet) in which to hide data. Unfortunately, the current set up erases the data-adding event entirely from history. Though they are confident that future modifications will allow them, or others, to send secret messages successfully, the more immediate use of the technology will be to cut down crosstalk when multiple data streams share the same fibre."

Share on Google+

Read more of this story at Slashdot.



22 Jul 20:03

Keyless Remote Entry For Cars May Have Been Cracked

by Soulskill
WheezyJoe writes "The Today Show had a piece this morning showing video of thieves apparently using a small device to open and enter cars equipped with keyless entry. Electronic key fobs, which are supposed to be secure, are replacing keys in more and more new cars, but the evidence suggests that a device has been developed which effortlessly bypasses this security (at least on certain makes and models). 'Adding to the mystery, police say the device works on some cars but not others. Other surveillance videos show thieves trying to open a Ford SUV and a Cadillac, with no luck. But an Acura SUV and sedan pop right open. And they always seem to strike on the passenger side. Investigators don't know why.' Police and security experts say they are 'stumped.'"

Share on Google+

Read more of this story at Slashdot.



22 Jul 19:59

American Targeted By Digital Spy Tool Sold To Foreign Governments

by Soulskill
An anonymous reader points out a report in Wired of an American woman at a "renowned academic institution" who received targeted malware from what was most likely a foreign government. "... analysis of [the downloader] showed that it was the same downloader that has been used in the past to install Remote Control System (RCS), a spy tool made by the Italian company Hacking Team and sold to governments." What's significant about this malware is that it is made by an Italian firm who claims they sell it only to government and law enforcement bodies, and it isn't of much use to your standard botnet operator. "The RCS tool, also known as DaVinci, records text and audio conversations from Skype, Yahoo Messenger, Google Talk and MSN Messenger, among other communication applications. It also steals Web browsing history and can turn on a computer’s microphone and webcam to record conversations in a room and take photos. The tool relies on an extensive infrastructure to operate and therefore is not easily copied and passed to non-government actors outside that infrastructure to use for their own personal spy purposes, according to a Hacking Team spokesman." There's no solid proof indicating who is responsible, but the malware email contained a link to a website in Turkey. "Turkey is a member of the North Atlantic Treaty Organization alliance. If authorities there were behind the hack attack, it would mean that a NATO ally had attempted to spy on a U.S. citizen on U.S. soil, presumably without the knowledge or approval of U.S. authorities, and for reasons that don't appear to be related to a criminal or counter-terrorism investigation."

Share on Google+

Read more of this story at Slashdot.



07 Jul 18:50

New Drugs Trail Many Old Ones In Effectiveness Against Disease

by Soulskill
Lasrick tips this report from Reuters: "Despite the more than $50 billion that U.S. pharmaceutical companies have spent every year since the mid-2000s to discover new medications, drugmakers have barely improved on old standbys developed decades ago. Research published on Monday showed that the effectiveness of new drugs, as measured by comparing the response of patients on those treatments to those taking a placebo, has plummeted since the 1970s. 'While experts agree that tougher trials and similar factors explain some of the decline in drugs' reported effectiveness, something real is going on here,' said Olfson. 'Physicians keep saying that many of the new things just aren't working as well,' and therefore prescribe antidepressant drugs called tricyclics (developed in the 1950s) instead of SSRIs (from the 1980s), or diuretics (invented in the 1920s) for high blood pressure instead of newer anti-hypertensives.'"

Share on Google+

Read more of this story at Slashdot.



07 Jul 18:49

U.S. District Judge: Forced Decryption of Hard Drives Violates Fifth Amendment

by Soulskill
hansamurai writes with an update to a story we've been following for a while. Jeffrey Feldman is at the center of an ongoing case about whether or not crime suspects can be forced to decrypt their own hard drives. (Feldman is accused of having child pornography on his hard drives.) After initially having a federal judge say Feldman was protected by the Fifth Amendment, law enforcement officials were able to break the encyption on one of his many seized storage devices. The decrypted contents contained child pornography, so a different judge said the direct evidence of criminal activity meant Feldman was not protected anymore by the Fifth Amendment. Now, a third judge has granted the defense attorney's emergency motion to rescind that decision, saying Feldman is once again (still?) protected by the Fifth Amendment. Feldman's lawyer said, "I will move heaven and earth to make sure that the war on the infinitesimal amount of child pornography that recirculates on the Internet does not eradicate the Fifth Amendment the way the war on drugs has eviscerated the Fourth Amendment. This case is going to go many rounds. Regardless of who wins the next round, the other side will appeal, invariably landing in the lap of the Seventh Circuit Court of Appeals and quite possibly the U.S. Supreme Court. The grim reality facing our country today is one where we currently have a percentage of our population behind bars that surpasses even the heights of the gulags in Stalinist Russia. On too many days criminal lawyers lose all rounds. But for today: The Shellow Group: 1, Government: 0."

Share on Google+

Read more of this story at Slashdot.



07 Jul 18:48

EU Wants To Enshrine Network Neutrality In Law

by Soulskill
Bismillah writes "Following the example of the Dutch, who enacted laws supporting network neutrality, the European Union is now looking at doing the same. They are pushing for an end to the throttling and blocking of services such as Skype and Whatsapp by providers hoping to drive users to their own competing services. The EU also wants a service transparency requirement for ISPs, so people know what they're buying — like minimum speed. It'll be interesting to see how this pans out."

Share on Google+

Read more of this story at Slashdot.



07 Jul 18:47

Vint Cerf: Data That's Here Today May Be Gone Tomorrow

by Soulskill
dcblogs writes "Vinton Cerf is warning that digital things created today — spreadsheets, documents, presentations as well as mountains of scientific data — may not be readable in the years and centuries ahead. Cerf illustrates the problem in a simple way. He runs Microsoft Office 2011 on Macintosh, but it cannot read a 1997 PowerPoint file. 'It doesn't know what it is,' he said. 'I'm not blaming Microsoft,' said Cerf, who is Google's vice president and chief Internet evangelist. 'What I'm saying is that backward compatibility is very hard to preserve over very long periods of time.' He calls it a 'hard problem.'" We're at an interesting spot right now, where we're worried that the internet won't remember everything, and also that it won't forget anything.

Share on Google+

Read more of this story at Slashdot.



07 Jul 18:45

U.N. Realizes Internet Surveillance Chills Free Speech

by Soulskill
An anonymous reader writes "The Electronic Frontier Foundation reports that the United Nations has finally come to the realization that there is a direct relationship between government surveillance online and citizens' freedom of expression. The report (PDF) says, 'The right to privacy is often understood as an essential requirement for the realization of the right to freedom of expression. Undue interference with individuals' privacy can both directly and indirectly limit the free development and exchange of ideas. An infringement upon one right can be both the cause and consequence of an infringement upon the other.' The EFF adds, 'La Rue's landmark report could not come at a better time. The explosion of online expression we've seen in the past decade is now being followed by an explosion of communications surveillance. For many, the Internet and mobile telephony are no longer platforms where private communication is shielded from governments knowing when, where, and with whom a communication has occurred.'"

Share on Google+

Read more of this story at Slashdot.



05 Jul 18:16

How to Build the Ultimate Shooting Range Bag

by James Tarr

This year I’m celebrating my 20th year of competitive shooting. I learned quickly that going to a shooting match was different than just heading to the local range to practice—many matches were out of town—if not out of state—and if you didn’t have it with you, you shouldn’t count on one of the other competitors to loan you something. Heck, they want to beat you, so even if they do have a full set of Allen wrenches in their bag, they might not admit it.  Heading to a nearby range, you can throw whatever you might need into the back of your truck. Competitive shooters, however, live and die, win and lose, based on the contents of their bags.

The first range bag I ever bought was the biggest on the market at the time, because I figured if I got anything smaller, I’d end up regretting it. It was sold by Wilson Combat, and veteran competitive shooter Bill Wilson knew a few things about range bags. Wilson doesn’t sell that bag anymore, but it was large enough to hold four handguns, 1,000 rounds of ammo, a cleaning kit, spare gun parts, whatever other assorted gun tools you could think of, 20 magazines and it still had room left over for your empty cases. You know what else it was when I loaded it up? HEAVY.

I lugged that bag around for years, even to local matches, before I stopped and asked myself, “Why am I lugging all this stuff around?” At that point, I started paring down the contents of my range bag to the items I really needed, and the stuff I couldn’t do without. Now my range bag is a much more minimalist affair, but I still have everything I need.  Here’s a short list of stuff you absolutely need to have in your bag to make sure your range time puts a smile on your face.

×

Allen Wrenches and Screwdrivers

You know you’re going to need to loosen a scope or tighten a magazine pouch, if not this trip then the next. If you don’t, somebody else will. You can be a hero by having the tools to get the job done. Neither of these tools take up a lot of room, but they are indispensible. Just make sure whoever you loan them to at the firing line gives them back. At $159.99, The Leatherman MUT is a great all-purpose tool for any range bag.

Otis B.O.N.E. Tool

The B.O.N.E Tool comes included with Otis’ MS/AR Cleaning System, but it is such a nifty tool Otis sells it separately. Anyone who owns a modern sporting rifle ought to have one of these handy little tools. This one piece of metal has been specifically designed to scrape carbon and fouling from the firing pin, bolt, and bolt carrier of an AR-15; not bad for a $25 part.

Spare Set of Earplugs

Whether you forget your favorite electronic earmuffs or bring a friend/family member to the range, always having a few cheap foam earplugs at the bottom of your range bag is a darn good idea. For the last two years or more I have exclusively been using the Surefire Sonic Defenders. I find them superior to standard foam plugs; rubber doesn’t really wear out, and after one too many shooting matches in 100 plus degree weather, I don’t wear earmuffs anymore. I just got a set of the new EP7 plugs, which are tipped with foam instead of rubber. They actually work even better at reducing noise, but the foam will wear out quicker than the rubber. The small price of $19.99 will have your friends thanking you when they don’t have to scream in your ear to carry on a conversation.

Cleaning Kit

Some cleaning kits are larger than the range bag I currently use. If you want to bring along a full-size, clean-any-size-gun-ever-made cleaning kit, that’s fine, but you don’t need it. Having a small, compact cleaning kit such as an Otis —with a toothbrush, bore brush, small bottle of lube and patches—will be very handy when your rifle or pistol doesn’t want to run and you need to clean it on the spot.

Towel or Gun Rag

Small patches work great for swabbing out your bore, but you may need to do some serious cleaning. Bring a terrycloth towel or an old T-shirt to hog out that grimy receiver, or wipe down the pistol you accidentally dropped in the mud. Been there, done that. If you don’t want to sacrifice a T-shirt to carbon and fouling, Webril Handi Pads are strong, absorbent and reusable.

Squib Rod for Pistols

Rifle cleaning kits with fixed or segmented rods tend to take up a lot of space. If you’re only shooting a pistol and don’t have a sturdy cleaning rod with you, then you ought to have a sturdy squib rod in your kit. I’ve lost count of the number of bullets I’ve seen stuck in pistol barrels, and the only way to get them out is with a squib rod. A hammer to bang on the end of the rod is nice, but again, this takes up some room in your bag, and banging the end of the rod on the shooting bench works almost as well.

Mesh Bottom Brass Bag

A lot of people these days either reload or save their brass for a buddy who does. Whether you plan to shoot 10 rounds or 200, dumping those spent, possibly dirty cases into the bottom of your range bag will make the inside of your bag a complete mess. Many companies make mesh bottom brass bags designed to be tied onto the outside of your range bags. For years I thought they were an affectation, and then the bottom of my bag started to look like a dry riverbed. Mesh bags designed to go into washing machines work well, but if you’re looking for something a little nicer, check out Ceddaa.com and IShot, Inc..

Real Avid Gun Tool

These weapon-dedicated multi-tools have become hugely popular, and for good reason. They collect all the tools you’ll need to work on a firearm and pack them into one convenient package. Real Avid is also offering specialized versions—such as the Ruger Gun Tool, packed with the tools you’ll need to disassemble/clean any Ruger firearm. You can find them just about everywhere online, with various versions selling for between $17 to $30.

Brownells Weapon-Specific Field Packs

For those of you wanting to upgrade the type or number of repair tools you’re bringing to the range, Brownells is now offering field maintenance packs which contain everything you could possibly need to service a specific type of firearm. They are just the right size to fit into larger range bags. Brownells offers versions designed for Glocks, S&W M&Ps, tactical shotguns, AR-15s, 1911s, Ruger Mini-14s, Remington 700s and the Beretta 92/M9. They are not cheap, but you get what you pay for.

Range Bag

Back in the day, serious range bags designed by people who knew their business were hard to come by. These days, finding a quality range bag is easy and you have your choice of size and style. If you want a bag big enough to hold anything you might need—yet small enough to actually lift when full—check out either the Blackhawk Enhanced Pro Shooters Bag or the Brownells Signature Series Shooting Bag. The Blackhawk bag is a no-nonsense range tool with a tactical look to it, while the larger Brownells bag is one of the best.

Picture 1 of 10

Building the Ultimate Range Bag

11 Jun 19:23

Paranoid Android’s HALO multi-tasking feature open sourced

by Nick Gray

Multi-tasking on custom Android ROMs is about to get a lot more interesting. The Paranoid Android team has announced that they will open source their new Halo multitasking feature. HALO was originally inspired by Facebook’s Chat Heads, but rather than simply overlaying messages on top of running applications, the HALO multitasking system is fully integrated into the operating system, giving you direct access to all of your notifications without having to close out of the app that you are currently running.

Like Chat heads, HALO is a circle which can be re-positioned and pinned to the edge of your phone’s screen. Accessing notifications through HALO will open its corresponding application in a smaller frame on top of your running app. You can read or compose an email, send a text message or even do a Google search without worrying about losing your place in the game that you are playing. The included HALO application even allows users to pin specific apps so that they can easily be accessed even if the app does not have any pending notifications for you to check.

HALO is still in Beta and lacks proper support for Android’s tablet UI , but the Paranoid Android team believes that the code is solid enough to be released. We’re excited to see how other ROM developers will use HALO.

    


11 Jun 19:18

Reverse Peephole Security: Protecting Your Privacy with Peephole Covers

by Bryan Black

Peephole security is a real thing, especially when it comes to situations out of your control, like hotel rooms. It’s often neglected within the overall security picture, but nevertheless it’s something that you should consider.

Why should you worry about peephole security? Because products like Reverse Peephole Viewers exist and are easily obtainable by anyone. These viewers, when placed over the outward facing side of a peephole, allow the user to view what’s on the other side by realigning the otherwise unviewable lenses.

To counter the threat of reverse peephole viewers, today we’ll be taking a look at a few commercially available products to help you to determine which might be the best for your situation.

Defeating The Reverse Peephole Threat

Not to be confused with the Seinfield episode where Kramer reverses the peephole on his door on purpose so that “if somebody want’s to help themselves to an eyeful, we say enjoy the show.” A reverse peephole viewer is a bit on the pricey side, but as mentioned, easily obtainable by anyone.

I purchased a couple of solutions for this threat online a few months back and will share my pros and cons of each below. Basically, there’s two categories that these devices fall into, permanent and portable. Let’s first look at portable.

Portable Solutions

Privacy Logic is a company I stumbled onto while searching online and I really like their product offering. They offer a set of two SPEYEGUARD Portable Peephole Covers that simply slip into your existing peephole. The set of two will cover the most common peephole diameters of 3/8″ and 5/8″. Everything I’ve come across so far, has been able to fit these size covers. The top and bottom of the covers have cutouts that enable you to grasp the device to quickly remove it for a peek and easily reinsert it.

Peephole Covers 02
Peephole Covers 03

They’re made of ABS plastic and built well in the USA. The tabs that insert into the peephole are flexible enough to withstand multiple uses and still retain their functionality. Check out Privacy Logic for more information and to purchase these Portable Peephole Covers.

Permanent Solutions

To start off the two products we’ll be looking at in the permanent category, Privacy Logic also offers the SPEYEGUARD Stationary Peephole Cover. The backplate of this cover mounts to the door via a top and bottom mounting screw. The top cover locks into place on a ramp, which allows it to easily slide up and down as needed.

Peephole Covers 08
Peephole Covers 10
Peephole Covers 09

I did find that pilot holes are needed before attempting to simply screw the backplate in place on a door, that or a nail punch is what Privacy Logic suggests in the installation instructions. I really liked the functionality of this device and it’s a good solution. Plus, all Privacy Logic products are made in the USA.

The second product we’ll take a look at in the permanent category is the SecureAview Peephole Cover, which is a pendulum style cover that mounts with one screw above the peephole.

Peephole Covers 05

This was a bit simpler to mount than the Privacy Logic permanent solution, but I don’t care for the fact that the spacers it comes with don’t allow you to adjust the tension that the cover has. This causes it to swing unnecessarily when you let it go. It also makes quite a bit of noise when opening and closing the door due to the swinging. I’m sure this could all be fixed by simply having a thin rubber washer added between the cover and the metal washer.

Peephole Covers 06
Peephole Covers 07

What I also didn’t care for, was that because the device doesn’t sit flush against the peephole, there’s visible light that could be seen by someone with a reverse peephole viewer. The only reason I mention this is movement on the other side of the door could be detected by the viewable light.

I do think the all-metal construction is great on the SecureAview product and I really like the attention to detail of including a matching adhesive cover to apply over the screw during installation. To learn more or pick up a peephole cover from SecureAview, click here.

Notes

A great tip that the SecureAview website shared was to ensure your existing peephole is assembled with a little blue loctite (non-permanent) so that it can’t be unscrewed from the outside. They also mention that some people squirt toothpaste in peepholes at a hotel, so as a last resort, you could always do that. Also ensure you check the peephole of any hotel room if it has one and make sure it hasn’t been reversed by the last comedic guest.

Peephole Covers 04

While protecting your privacy by covering your peephole might not be on the forefront of your security plan, hopefully you’ve learned a bit from this article about why you should take it seriously.

11 Jun 19:10

Asking the U.S. government to allow Google to publish more national security request data

by Emily Wood
This morning we sent the following letter to the offices of the Attorney General and the Federal Bureau of Investigation. Read the full text below. -Ed.

Dear Attorney General Holder and Director Mueller

Google has worked tremendously hard over the past fifteen years to earn our users’ trust. For example, we offer encryption across our services; we have hired some of the best security engineers in the world; and we have consistently pushed back on overly broad government requests for our users’ data.

We have always made clear that we comply with valid legal requests. And last week, the Director of National Intelligence acknowledged that service providers have received Foreign Intelligence Surveillance Act (FISA) requests.

Assertions in the press that our compliance with these requests gives the U.S. government unfettered access to our users’ data are simply untrue. However, government nondisclosure obligations regarding the number of FISA national security requests that Google receives, as well as the number of accounts covered by those requests, fuel that speculation.

We therefore ask you to help make it possible for Google to publish in our Transparency Report aggregate numbers of national security requests, including FISA disclosures—in terms of both the number we receive and their scope. Google’s numbers would clearly show that our compliance with these requests falls far short of the claims being made. Google has nothing to hide.

Google appreciates that you authorized the recent disclosure of general numbers for national security letters. There have been no adverse consequences arising from their publication, and in fact more companies are receiving your approval to do so as a result of Google’s initiative. Transparency here will likewise serve the public interest without harming national security.

We will be making this letter public and await your response.

David Drummond
Chief Legal Officer
11 Jun 19:09

Google Maps and Waze, outsmarting traffic together

by Emily Wood
We’ve all been there: stuck in traffic, frustrated that you chose the wrong route on the drive to work. But imagine if you could see real-time traffic updates from friends and fellow travelers ahead of you, calling out “fender bender...totally stuck in left lane!” and showing faster routes that others are taking.

To help you outsmart traffic, today we’re excited to announce we’ve closed the acquisition of Waze. This fast-growing community of traffic-obsessed drivers is working together to find the best routes from home to work, every day.

The Waze product development team will remain in Israel and operate separately for now. We’re excited about the prospect of enhancing Google Maps with some of the traffic update features provided by Waze and enhancing Waze with Google’s search capabilities.

We’ll also work closely with the vibrant Waze community, who are the DNA of this app, to ensure they have what’s needed to grow and prosper.

The Waze community and its dedicated team have created a great source of timely road corrections and updates. We welcome them to Google and look forward to working with them in our ongoing effort to make a comprehensive, accurate and useful map of the world.

Posted by Brian McClendon, Vice President, Geo
09 Jun 15:21

What the ...?

by Emily Wood
Dear Google users—

You may be aware of press reports alleging that Internet companies have joined a secret U.S. government program called PRISM to give the National Security Agency direct access to our servers. As Google’s CEO and Chief Legal Officer, we wanted you to have the facts.

First, we have not joined any program that would give the U.S. government—or any other government—direct access to our servers. Indeed, the U.S. government does not have direct access or a “back door” to the information stored in our data centers. We had not heard of a program called PRISM until yesterday.

Second, we provide user data to governments only in accordance with the law. Our legal team reviews each and every request, and frequently pushes back when requests are overly broad or don’t follow the correct process. Press reports that suggest that Google is providing open-ended access to our users’ data are false, period. Until this week’s reports, we had never heard of the broad type of order that Verizon received—an order that appears to have required them to hand over millions of users’ call records. We were very surprised to learn that such broad orders exist. Any suggestion that Google is disclosing information about our users’ Internet activity on such a scale is completely false.

Finally, this episode confirms what we have long believed—there needs to be a more transparent approach. Google has worked hard, within the confines of the current laws, to be open about the data requests we receive. We post this information on our Transparency Report whenever possible. We were the first company to do this. And, of course, we understand that the U.S. and other governments need to take action to protect their citizens’ safety—including sometimes by using surveillance. But the level of secrecy around the current legal procedures undermines the freedoms we all cherish.

Posted by Larry Page, CEO and David Drummond, Chief Legal Officer
06 Jun 02:49

How to Install Android in VirtualBox

by Chris Hoffman
If you're itching give Android a try but don't necessarily want use your whole computer for the task, the best option is to run it in a virtual machine using VirtualBox.
05 Jun 04:01

The Politics of Security in a Democracy

by schneier

Terrorism causes fear, and we overreact to that fear. Our brains aren't very good at probability and risk analysis. We tend to exaggerate spectacular, strange and rare events, and downplay ordinary, familiar and common ones. We think rare risks are more common than they are, and we fear them more than probability indicates we should.

Our leaders are just as prone to this overreaction as we are. But aside from basic psychology, there are other reasons that it's smart politics to exaggerate terrorist threats, and security threats in general.

The first is that we respond to a strong leader. Bill Clinton famously said: "When people feel uncertain, they'd rather have somebody that's strong and wrong than somebody who's weak and right." He's right.

The second is that doing something -- anything -- is good politics. A politician wants to be seen as taking charge, demanding answers, fixing things. It just doesn't look as good to sit back and claim that there's nothing to do. The logic is along the lines of: "Something must be done. This is something. Therefore, we must do it."

The third is that the "fear preacher" wins, regardless of the outcome. Imagine two politicians today. One of them preaches fear and draconian security measures. The other is someone like me, who tells people that terrorism is a negligible risk, that risk is part of life, and that while some security is necessary, we should mostly just refuse to be terrorized and get on with our lives.

Fast-forward 10 years. If I'm right and there have been no more terrorist attacks, the fear preacher takes credit for keeping us safe. But if a terrorist attack has occurred, my government career is over. Even if the incidence of terrorism is as ridiculously low as it is today, there's no benefit for a politician to take my side of that gamble.

The fourth and final reason is money. Every new security technology, from surveillance cameras to high-tech fusion centers to airport full-body scanners, has a for-profit corporation lobbying for its purchase and use. Given the three other reasons above, it's easy -- and probably profitable -- for a politician to make them happy and say yes.

For any given politician, the implications of these four reasons are straightforward. Overestimating the threat is better than underestimating it. Doing something about the threat is better than doing nothing. Doing something that is explicitly reactive is better than being proactive. (If you're proactive and you're wrong, you've wasted money. If you're proactive and you're right but no longer in power, whoever is in power is going to get the credit for what you did.) Visible is better than invisible. Creating something new is better than fixing something old.

Those last two maxims are why it's better for a politician to fund a terrorist fusion center than to pay for more Arabic translators for the National Security Agency. No one's going to see the additional appropriation in the NSA's secret budget. On the other hand, a high-tech computerized fusion center is going to make front page news, even if it doesn't actually do anything useful.

This leads to another phenomenon about security and government. Once a security system is in place, it can be very hard to dislodge it. Imagine a politician who objects to some aspect of airport security: the liquid ban, the shoe removal, something. If he pushes to relax security, he gets the blame if something bad happens as a result. No one wants to roll back a police power and have the lack of that power cause a well-publicized death, even if it's a one-in-a-billion fluke.

We're seeing this force at work in the bloated terrorist no-fly and watch lists; agents have lots of incentive to put someone on the list, but absolutely no incentive to take anyone off. We're also seeing this in the Transportation Security Administration's attempt to reverse the ban on small blades on airplanes. Twice it tried to make the change, and twice fearful politicians prevented it from going through with it.

Lots of unneeded and ineffective security measures are perpetrated by a government bureaucracy that is primarily concerned about the security of its members' careers. They know the voters are more likely to punish them more if they fail to secure against a repetition of the last attack, and less if they fail to anticipate the next one.

What can we do? Well, the first step toward solving a problem is recognizing that you have one. These are not iron-clad rules; they're tendencies. If we can keep these tendencies and their causes in mind, we're more likely to end up with sensible security measures that are commensurate with the threat, instead of a lot of security theater and draconian police powers that are not.

Our leaders' job is to resist these tendencies. Our job is to support politicians who do resist.

This essay originally appeared on CNN.com.

05 Jun 04:00

Are We Finally Thinking Sensibly About Terrorism?

by schneier

This article wonders if we are:

Yet for pretty much the first time there has been a considerable amount of media commentary seeking to put terrorism in context -- commentary that concludes, as a Doyle McManus article in the Los Angeles Times put it a day after the attack, "We’re safer than we think."

Similar tunes were sung by Tom Friedman of the New York Times, Jeff Jacoby of the Boston Globe, David Rothkopf writing for CNN.com, Josh Barro at Bloomberg, John Cassidy at the New Yorker, and Steve Chapman in the Chicago Tribune, even as the Washington Post told us “why terrorism is not scary” and published statistics on its rarity. Bruce Schneier, who has been making these arguments for over a decade, got 360,000 hits doing so for The Atlantic. Even neoconservative Max Boot, a strong advocate of the war in Iraq as a response to 9/11, argues in the Wall Street Journal, "we must do our best to make sure that the terrorists don't achieve their objective­ -- to terrorize us."

James Carafano of the conservative Heritage Foundation noted in a radio interview that "the odds of you being killed by a terrorist are less than you being hit by a meteorite." Carafano’s odds may be a bit off, but his basic point isn’t. At present rates, an American’s chance of being killed by a terrorist is about one in 3.5 million per year­ -- compared, for example, to a yearly chance of dying in an automobile crash of one in 8,200. That could change, of course, if terrorists suddenly become vastly more capable of inflicting damage­ -- as much commentary on terrorism has predicted over the past decade. But we’re not hearing much of that anymore.

In a 60 Minutes interview a decade ago filmmaker Michael Moore noted, "The chances of any of us dying in a terrorist incident is very, very, very small." Bob Simon, his interlocutor, responded, "No one sees the world like that."

Both statements were pretty much true then. However, the unprecedented set of articles projecting a more restrained, and broader, perspective suggests that Simon’s wisdom may need some updating, and that Moore is beginning to have some company.

There's also this; and this, by Andrew Sullivan; and this, by John Cole. And these two polls.

And, of course, President Obama himself declared that "Americans refuse to be terrorized."

05 Jun 03:56

The Security Risks of Unregulated Google Search

by schneier

Someday I need to write an essay on the security risks of secret algorithms that become part of our infrastructure. This paper gives one example of that. Could Google tip an election by manipulating what comes up from search results on the candidates?

The study’s participants, selected to resemble the US voting population, viewed the results for two candidates on a mock search engine called Kadoodle. By front-loading Kadoodle’s results with articles favoring one of the candidates, Epstein shifted enough of his participants' voter preferences toward the favored candidate to simulate the swing of a close election. But here’s the kicker: in one round of the study, Epstein configured Kadoodle so that it hid the manipulation from 100 percent of the participants.

Turns out that it could. And, it wouldn't even be illegal for Google to do it.

The author thinks that government regulation is the only reasonable solution.

Epstein believes that the mere existence of the power to fix election outcomes, wielded or not, is a threat to democracy, and he asserts that search engines should be regulated accordingly. But regulatory analogies for a many-armed, ever-shifting company like Google are tough to pin down. For those who see search results as a mere passive relaying of information, like a library index or a phone book, there is precedent for regulation. In the past, phone books -- with a monopoly on the flow of certain information to the public -- were prevented from not listing businesses even when paid to do so. In the 1990s, similar reasoning led to the "must carry" rule, which required cable companies to carry certain channels to communities where they were the only providers of those channels.

As I said, I need to write an essay on the broader issue.

05 Jun 03:55

The Problems with CALEA-II

by schneier

The FBI wants a new law that will make it easier to wiretap the Internet. Although its claim is that the new law will only maintain the status quo, it's really much worse than that. This law will result in less-secure Internet products and create a foreign industry in more-secure alternatives. It will impose costly burdens on affected companies. It will assist totalitarian governments in spying on their own citizens. And it won't do much to hinder actual criminals and terrorists.

As the FBI sees it, the problem is that people are moving away from traditional communication systems like telephones onto computer systems like Skype. Eavesdropping on telephones used to be easy. The FBI would call the phone company, which would bring agents into a switching room and allow them to literally tap the wires with a pair of alligator clips and a tape recorder. In the 1990s, the government forced phone companies to provide an analogous capability on digital switches; but today, more and more communications happens over the Internet.

What the FBI wants is the ability to eavesdrop on everything. Depending on the system, this ranges from easy to impossible. E-mail systems like Gmail are easy. The mail resides in Google's servers, and the company has an office full of people who respond to requests for lawful access to individual accounts from governments all over the world. Encrypted voice systems like Silent Circle are impossible to eavesdrop on—the calls are encrypted from one computer to the other, and there's no central node to eavesdrop from. In those cases, the only way to make the system eavesdroppable is to add a backdoor to the user software. This is precisely the FBI's proposal. Companies that refuse to comply would be fined $25,000 a day.

The FBI believes it can have it both ways: that it can open systems to its eavesdropping, but keep them secure from anyone else's eavesdropping. That's just not possible. It's impossible to build a communications system that allows the FBI surreptitious access but doesn't allow similar access by others. When it comes to security, we have two options: We can build our systems to be as secure as possible from eavesdropping, or we can deliberately weaken their security. We have to choose one or the other.

This is an old debate, and one we've been through many times. The NSA even has a name for it: the equities issue. In the 1980s, the equities debate was about export control of cryptography. The government deliberately weakened U.S. cryptography products because it didn't want foreign groups to have access to secure systems. Two things resulted: fewer Internet products with cryptography, to the insecurity of everybody, and a vibrant foreign security industry based on the unofficial slogan "Don't buy the U.S. stuff -- it's lousy."

In 1993, the debate was about the Clipper Chip. This was another deliberately weakened security product, an encrypted telephone. The FBI convinced AT&T to add a backdoor that allowed for surreptitious wiretapping. The product was a complete failure. Again, why would anyone buy a deliberately weakened security system?

In 1994, the Communications Assistance for Law Enforcement Act mandated that U.S. companies build eavesdropping capabilities into phone switches. These were sold internationally; some countries liked having the ability to spy on their citizens. Of course, so did criminals, and there were public scandals in Greece (2005) and Italy (2006) as a result.

In 2012, we learned that every phone switch sold to the Department of Defense had security vulnerabilities in its surveillance system. And just this May, we learned that Chinese hackers breached Google's system for providing surveillance data for the FBI.

The new FBI proposal will fail in all these ways and more. The bad guys will be able to get around the eavesdropping capability, either by building their own security systems -- not very difficult -- or buying the more-secure foreign products that will inevitably be made available. Most of the good guys, who don't understand the risks or the technology, will not know enough to bother and will be less secure. The eavesdropping functions will 1) result in more obscure -- and less secure -- product designs, and 2) be vulnerable to exploitation by criminals, spies, and everyone else. U.S. companies will be forced to compete at a disadvantage; smart customers won't buy the substandard stuff when there are more-secure foreign alternatives. Even worse, there are lots of foreign governments who want to use these sorts of systems to spy on their own citizens. Do we really want to be exporting surveillance technology to the likes of China, Syria, and Saudi Arabia?

The FBI's short-sighted agenda also works against the parts of the government that are still working to secure the Internet for everyone. Initiatives within the NSA, the DOD, and DHS to do everything from securing computer operating systems to enabling anonymous web browsing will all be harmed by this.

What to do, then? The FBI claims that the Internet is "going dark," and that it's simply trying to maintain the status quo of being able to eavesdrop. This characterization is disingenuous at best. We are entering a golden age of surveillance; there's more electronic communications available for eavesdropping than ever before, including whole new classes of information: location tracking, financial tracking, and vast databases of historical communications such as e-mails and text messages. The FBI's surveillance department has it better than ever. With regard to voice communications, yes, software phone calls will be harder to eavesdrop upon. (Although there are questions about Skype's security.) That's just part of the evolution of technology, and one that on balance is a positive thing.

Think of it this way: We don't hand the government copies of our house keys and safe combinations. If agents want access, they get a warrant and then pick the locks or bust open the doors, just as a criminal would do. A similar system would work on computers. The FBI, with its increasingly non-transparent procedures and systems, has failed to make the case that this isn't good enough.

Finally there's a general principle at work that's worth explicitly stating. All tools can be used by the good guys and the bad guys. Cars have enormous societal value, even though bank robbers can use them as getaway cars. Cash is no different. Both good guys and bad guys send e-mails, use Skype, and eat at all-night restaurants. But because society consists overwhelmingly of good guys, the good uses of these dual-use technologies greatly outweigh the bad uses. Strong Internet security makes us all safer, even though it helps the bad guys as well. And it makes no sense to harm all of us in an attempt to harm a small subset of us.

This essay originally appeared in Foreign Policy.

05 Jun 03:17

Confession #9: I’ve Been a Current TSA Employee, Not a Former TSA Employee, All Along.

by takingsenseaway
Jay McDaniel

Amen!!!

When I started this blog, my greatest worry was that no one would find it. Then, after the blog caught media attention, my greatest worry became that the TSA would find me: I was blogging as a current TSA employee, not a “former TSA employee,” up until a few days ago.

It was the TSA’s use of the full-body scanners that prompted me to first speak out and voice my opinion that the technology represented a wasteful, reckless, and unnecessary infringement upon people’s privacy; an opinion informed by several years’ experience operating the full body scanners, and it is for similar reasons that I am making this confession today— in light of the fact that now, the public finally has the chance to voice its opinion on the matter.

Though my primary goal with this blog is to bring some levity to my experiences as a TSA employee, the TSA’s mission to make the scanners the primary mode of screening is the one thing in which I have been unable to find much humor.

While a small contingency of civil liberties advocates opposed the scanners from the moment the TSA announced its plans to roll them out en masse, I was privileged with a behind-the-scenes view.  From day one of training  I had the sense that the TSA’s implementation of the scanners was  an ill-conceived and clumsy venture. As time went by, my inkling was to be borne out by evidence: we TSA screeners on the floor-level soon learned that the scanners essentially did not work. It did not take long for members of the public to deduce that fact and reveal it to a wider audience.

It was around this time, in 2011, that I began planning to separate from federal employment.  I had to find another career path, but in the meantime could not remain silent on the many absurdities that I was witnessing from an insider’s vantage point; could not continue to watch quietly from the sidelines as citizens waged legal battles against the TSA, while my TSA co-workers and superiors hid from the public what we knew to be the truth: that the scanners were only superficially effective, at best, and completely ineffective, at worst.

It was harrowing for a while, donning a TSA uniform by day, and expressing my uncensored opinions on the TSA to a global audience by night. At times I was going into work and quietly enduring TSA supervisors and managers obsessed with trifling matters  such as gum-chewing, and then coming home to discover encouraging e-mail from former Undersecretaries of the Department of Homeland Security and other D.C. higher-ups in my inbox.

There were other surreal moments, like the realization that two of my co-workers were following my blog’s Twitter account, unaware that they were actually working side-by-side with the anonymous “former employee.”  There was the time I noticed two co-workers reading this blog on their smartphones in our break room, laughing and speculating about which airport the blogger had been based out of. There was the joy of giving voice to an underrepresented group of people—former TSA screeners who wrote me expressing various concerns, some of whom, after being published on this blog, went on to receive media coverage in their own right. And, most significantly, there was the time— December 31, 2012, 9:22 A.M.— when I logged into the TSA’s intranet system (the TSA’s “Idea Factory”) to find that a TSO had posted a comment regarding this blog, proposing that the TSA’s PR department do more to deny the truth of everything that I was writing; I watched the comment section with a certain amount of dread, worried that I would find a chorus of TSA employees echoing his sentiment, but was relieved when he received no comment from his peers (save for criticism of his grammar).

A few passengers emailed me asking me what I would do if the government tracked me down; if I were proverbially “thrown in Guantanamo” for speaking out about the TSA and DHS. On January 23rd, I received a question from a passenger named Shane, regarding Sensitive Security Information:

My question to you is: If you’re not an employee of TSA anymore, does that make you no longer a “covered person”? If not, what’s your rationale behind continuing to uphold a directive that TSA has been been seen to use as a shield to avoid accountability despite it offering no actual security benefit? Do you fear retaliation by TSA? I would understand if you did, as the agency is nothing but authoritarian. Do they claim that ex-employees are still bound by SSI guidelines even though SSI isn’t a real security classification?

I apologize that it’s taken me so long to respond to your letter, Shane, but yes, the possibility— perhaps inevitability— of retaliation by the TSA has always hung in the back of my mind. After all, I began receiving hate mail from TSA employees early on, some of which I’ve published, some of which I have not. But I felt that the benefit to the public of voicing my opinion outweighed the risk of civil penalties or “other corrective actions.”

Now that I am truly a former employee, I can say that working for the TSA rarely ever felt like anything more than being on-tour with a clown troupe doing a 21st-century parody of the Keystone Cops. Only instead of making people laugh, for the most part, all we did was impinge upon their privacy and compromise their rights, under dubious pretenses. To be sure, there were some golden moments of laughter: there was the TSA supervisor who told us, in the wake of the 2006 liquids plot, that sandwiches were not to be allowed on-board planes until he got official word on whether or not the sandwiches’ mustard and mayonnaise constituted a banned liquid; there was the manager who declared that passengers were to be forced to surrender tinfoil due to the boxes’ potentially dangerous serrated edges; there was the sheer absurdity of coming to find out that we were operating full body scanners that couldn’t detect guns.

OK: there were actually a lot of humorous moments at the TSA, and as you have seen, I have tried to tease humor out of the organization wherever possible. But I would rather write jokes than work for one, and so recently, after much searching, I received a job opportunity more in-line with my goals, and officially resigned my post as a TSA officer.

The purpose of this post is to encourage as many people as possible to take their turn in expressing their opinions on the full-body scanners, now that the TSA has been forced into a measure of accountability. There are still 3 weeks remaining for citizens to officially speak out.  The TSA is attempting to make the case that its initial roll-out and continued use of the full body scanners represented a public good; that making full-body scanners a new fact of life for the public was necessary in the interest of ensuring our safety. They tout their new “privacy-friendly” millimeter wave scanners as the solution to their badly bungled initial decision to expose the public to radiation-emitting Rapiscan machines, but the truth is, the millimeter wave scanners are ineffective, too. The truth is that an alarming number of TSA employees with whom I was personally acquainted were privately of the opinion that the full body scanners, in all their iterations, should be abandoned as a primary screening method.

The truth is that I knew several TSA employees who, through independent internal tests of the millimeter wave scanners, discovered a weakness in the technology’s detection capability: the MMW scanners are consistently unreliable when it comes to detecting threats in a certain area of the body,  the exact location of which I have decided not to divulge. Suffice it to say that it is a laughable weakness. Various TSA employees have attempted to bring the aforementioned vulnerability to the attention of TSA higher-ups, and to recommend that the scanners be done away with in favor of a slightly enhanced version of pre-2010 security protocols—the level of security deemed satisfactory by several nations. But the concerns and opinions of those vocal employees have fallen on deaf ears at TSA headquarters; or at least upon the ears of those whose interests do not intersect with acknowledgment of the inefficacy of the full body scanners.

It is not just one weakness, either: the millimeter wave scanners are fraught  with defects— there is their high false alarm rates, which alone caused some governments to decline to implement the scanners. There is their costliness, which, when factoring in the price of manning the machines, quickly runs into the hundreds of millions when spread out over several years. There is the comical degree to which the scanners are rendered inane due to the TSA’s need to make them PWD and kid-friendly: there are several loopholes one can exploit to make oneself ineligible for the scanners (e.g., claiming the inability to raise one’s arm, going through security holding a small pet, or simply traveling with someone who appears to be aged 12 or under.)  There is the false sense of security that the scanners give TSA screeners and passengers alike, thereby compounding the security weaknesses of the scanners-as-primary-screening-method configuration.  And last but not least, there is the possibility that the full-body scanners will have the effect of conditioning the public to be willing to submit to unnecessary, invasive security measures as a result of highly infrequent and statistically negligible terrorist threats.

In short, the full body scanners are inherently plagued by so many weaknesses that it would be in the public’s best interest for them to be removed from airports as a primary screening method. This is my opinion, and the opinion of many TSA employees whom I knew. EPIC’s lawsuit is correct in its statement:

“When the TSA deployed the body scanners, it initiated one of the most sweeping, most invasive and most unaccountable suspicion-less searches of American travelers in history.”

With this post I am merely voicing the opinion of many TSA employees who are too timid or complacent in their jobs to speak out about the gross mismanagement and abuse of public trust endemic to the TSA.

Whatever may happen to me as a result of this blog in the coming years, I will not regret its publication. I believe there to have been an intrinsic Good in having spoken out; a small triumph in the very presence of these words on your screen, for I believe the function of free speech,  in the words of Thomas Sowell, to be a social one:

“Intended to benefit vast numbers of people who do not themselves exercise their rights.”


05 Jun 02:26

Comic for June 4, 2013