Bon Voyage and Happy Hunting

eclipseThere are those who think, “Oh cool, Eclipse.  Let’s all party and watch the {sun|moon} disappear for a few minutes.”  And then there are those who are serious about it.  While we all were celebrating the 4th of July (wherever we were), several friends of mine were busy getting themselves and a lot of provisions onto a plane to China in order to observe the upcoming solar eclipse in the eastern part of that country.  This is not the first eclipse for which they’ve traveled far and wide.  Two years ago March there was another solar eclipse in Southern Libya.  Do you what is in Southern Libya?  Sand.  Not much else.  That wasn’t the craziest place to travel.  In 2003, there was an eclipse over Antarctica.  Now the thing about Antarctica is that it’s not an easy place to stay.  And so what they did was charter a Boeing 747-400 from Quantas and flew it through the path of totality as fast as they could without the equipment being disturbed.

Why all the fuss?  What is so special about a lack of sun for a few minutes?  In the case of one of my friends, the answer lies in what’s near the sun.  He has devoted considerable effort to attempting to prove that volcanoid asteroids exist.  These little things come so close to the sun that on any normal day state of the art optics are unable to see them because of the sun’s rays.  And so, with the light turned off for a few minutes, one can scan the surrounds.

But if you thought this would be a purely scientific or humorous article, tough.  My friend brought with him a considerable amount of equipment with which to visualize the astroids, and some of it isn’t cheap, and some of it is custom made metal.  Knowing this, he went to the Department of Homeland Security to find out how to go about getting the equipment from here to China.  It took a Congresswoman to get DHS to meet with him in the first place, and then they provided him absolutely no guidance, saying that if the screener on duty (someone who is probably paid only a bit above minimum wage) decides an object doesn’t get on a plane, it doesn’t get on a plane.  There is no way to pre-clear anything.  And so he was told to ship the object through a known shipper.

The U.S. does recognize a distinction between known shippers and just the average Joe.  This is one of many circumstances where a positive reputation is required to get something done.  Now unless you’re going to buy your own airplane or cargo ship, you are going to use a shipper fo some sort, so why not use a known one?  Well, the story doesn’t end there.  In the passing the buck, each shipper is looking to limit their liability and hence want to know exactly who and what they are dealing with.  If you are an published astronomer as my friend is, you must put an extraordinary amount of effort into seeing that your goods arrive intact.

Personally, as someone who has had belongings stolen due to DHS policies I find all of this a bit rich.  If a baggage handler can rip off my stuff out of my bag and get it out of the airport, what’s to stop them from putting stuff in?

Think about it.

Anyway, I wish my friends on their trip happy hunting for objects that are extremely elusive, to the point where they might not actually exist.

The CIA’s torture teachers: Communist China

Continuing our theme from Independence Day, let’s talk about freedoms and rights.  For those such as Alan Dershowitz who advocate such things as torture warrants, or for simple apologists for the Bush administration’s shameful behavior, now comes this little ditty from the New York Times about how the CIA took a crash course in rough interregation techniques for Guantanamo Bay just after the Towers came down.  What they probably didn’t know was that the material was derived from a 1957 Chinese training manual that an airforce psychologist discredited as generating false confessions.  Of course, even if the method did work, we now know who this administration turns to for guidance: a discredited regime used by a form of government we despised.  This brings me to a point that I’ve always believed: fasism, communism, whatever: each can be used to subjugate citizens in just the same manner.  It’s just a slightly different rationale.  Yes, that says that it can and has happened in the United States, and it goes back to what Benjamin Franklin said: Those who would give up Essential Liberty to purchase a little Temporary Safety, deserve neither Liberty nor Safety. We’ve already seen that U.S. Senator Kit Bond was a perfect example.  Of course, Franklin was defending against a different King George.

With our King George and in this case, we have to worry about what moral authority we have lost.  Those Americans who happen to be abroad and in the wrong place and the wrong time will be the sorry beneficiaries of this president’s legacy.

Happy Independence Day!

fireworksHappy Fourth of July!  232 years ago, descendants of peopel seeking religious freedom declared that they would not be subjugated from afar by a tyrant and his parliament.

We hold these truths to be self-evident, that all men are created equal, that they are endowed by their Creator with certain unalienable Rights, that among these are Life, Liberty and the pursuit of Happiness.

Thomas Jefferson, The Declaration of Independence, July 4, 1776

Since then nearly every government in the world has recognized the basic right to have a say in how one is governed, excepting of course Iran, Libya, Saudi Arabia, Zimbabwe, North Korea, China, Russia, and the United States.  Even as he wrote those words, Jefferson held slaves on his property.  It would take another eighty-nine years for black people to be free, and another 92 years for their children to go to the same schools as white people, and another 51 years for them to have the first black national candidate for president on one of the major party tickets.

Put another way, Jefferson lied.  He did not hold those truths to be self-evident.  People had to fight for them every step of the way, starting with patriots in the American revolution, continuing for the rights of black people during the Civil War.  When we do not stand up for their rights of others, we lose our ability to defend our own rights.  The examples are shameful.  In Germany, nobody stood for others’ rights and the result was a world war and a holocaust that afflicted all of Europe, while back in America we once again jailed our fellow Americans because of the color of their skin.

Now in America we see another group once again fighting for their rights.  That a person is gay does not offend my rights as an individual.  Even were I to find homosexuality offensive in some way (which I do not), we as Americans have the right to offend.  And we do it as early and as often as we can.  Only heaven help the person who does it to us.  The tyranny of the majority part of human nature, and requires each of us to check ourselves about our beliefs.  And so, when Californians go to the polls in November, they will have a choice: indulge their bigotries and impose their will on a minority of people who merely want to the same treatment as others, or stand up for a group who has always held fast that they too are Americans and can and should do their part as patriots.

The tyranny of the majority doesn’t stop at race or sexual orientation, but is rooted in America in religion.  George W. Bush is President of the United States in large part because he galvanized a group of people who wished to impose their religious values on all of us, and he and they have been remarkably successful.  The Office of Faith-Based and Community Initiatives, an organization that gives money to churches, has been held to be constitutional, while school vouchers have stripped away disparately needed money from improving public education.  It is not Muslims who need to fear for their rights, but those of us who want nothing at all to do with religion.  Can you imagine a presidential candidate, never mind a president, who did not end every speech with “God Bless America”?  Our founders saw this fear and clearly placed freedom of religion in the First Amendment of the Bill of Rights.

Today is not also the anniversary of our founding, but also the 182nd anniversary of the deaths of Thomas Jefferson and John Adams.  Those who believe that partisanship is an invention of the late 20th century should take the time to read John Adams, by David McCullough, in which he describes the bitter battle between then opponents in 1800.  That particular bit of rivalry led to the historic decision of Marbury v. Madison in 1803.  Our rivalries are as the framers intended, meant to spur good government.  Whether that goal is met today is an open and fair question.

Good Fences Make Good Neighbors

A FenceWhen I was about 13 years old, my neighbors put a pool in their back yard.  However, they failed to put a fence around it.  My sister at the time was only four years old, and there were many people her age in the neighborhood.  In our community there was an ordinance that required such fences, but the neighbors ignored it, as they did my parents’ pleas.

While you can question the wisdom of letting a four year old walk around on his or her own, at the time it was the norm for our community, and one day little Donald was on his own, dangling his feet in the neighbor’s unsupervised pool.  After running out of our house as fast as she could and pulling Donald away from the pool, my mother filed a complaint, causing the neighbors to have to pay a fine.  Donald’s parents could have sued.

Our neighbors created an attractive nuisance and needed to be held accountable. While not exactly the same, regularly updating your software with the latest versions does reduce a computer’s exposure to vulnerabilities.  What’s more, there is a well known network effect of doing so.  When you patch your software, not only do you protect your computer against attack by others, but you also prevent your computer from being used as a vehicle to attack others.  Put another way, not patching your software makes your system a nuisance to others.  The bad guys know this.  One study by Jianwei Zhuge, et al, shows that exploits often appear in the wild before or very shortly after a patch is released.  A position paper written by Ross Anderson, et al., for ENISA will tell you which vendors are better and which are worse at patching.

A new study released this week by people at the ETH, Google, and IBM shows that in the best case with Firefox, no more than 83% of users patch their browsers.  The worst case is Internet Explorer, where you are more than likely not to have the latest patch.

What does all this say?  First of all it says that Firefox is probably doing a pretty good job.  One wonders what is going on with the 17% of individuals who do not patch their browsers.  Perhaps we have another case of rational ignorance, as I discussed previously.  The study also says that Microsoft could do a better job.  Part of Microsoft’s problem is that they have previously released “security” patches that do more than fix security problems. Distribution of Windows Genuine Advantage, which has been called a form of spyware, degraded peoples’ trust in Microsoft.

Apple isn’t all that much better than Microsoft.  For one, their patch rates are actually slower than that of Microsoft.  For another, Safari 3 broke stuff, which is precisely why many people do not upgrade.  Sun and HP are even worse.

Much as we like to blame vendors, in some cases we have nobody to blame but ourselves.  Here is something to do.  Check that you are running the latest version of the software you use.  If you use anything more than the standard application suite for your computer, there is a very good chance you are out of date.

No Evidence That Data Breach Privacy Laws Work

Have you ever received a notice that your data privacy has been breached?  What the heck does that mean anyway?  Most of the time what it means is that some piece of information that you wouldn’t normally disclose to others, like a credit card or your social security number, has been released unintentionally, and perhaps maliciously (e.g., stolen).  About five years ago states began passing data breach privacy laws that required authorized possessors of such information to report to victims when a breach occurred.  There were basically two goals for such laws:

  • Provide individuals warning that they may have suffered identity theft, so that they can take some steps to prevent it, like blocking a credit card or monitoring their credit reports; and
  • Provide a more general deterrent by embarrassing companies into behaving better. “Sunlight as a disinfectant,” as Justice Brandeis wrote.[1]

A study conducted by Sasha Romanosky, Rahul Telang, and Alessandro Acquisti at CMU found that as of yet there can be no correlation found between these laws and identity theft rates.  This could be for many reasons why the correlation isn’t there.  First, actual usage of the stolen information seems to be only a small percentage.  Second, it may be that just because a light has been shined doesn’t mean that there is anything the consumer will be capable or willing to do.  For instance, suppose you buy something at your-local-favorite-website.com.  They use a credit card or billing aggregation service that has its data stolen, and so that service reports to you that your data has been stolen.  You might not even understand what that service has to do with you.  Even if you do, what are the chances that you would be willing to not use your-local-favorite-website.com again?  And if you hear about such a break-in from someone else, would it matter to you?  Economists call that last one rational ignorance.  In other words, hear no evil, see no evil.

Add to all of this that some people have said that there are huge loopholes in some of the laws.  At WEIS and elsewhere several not-so-innovative approaches were discussed about how some firms are getting around the need to disclose.

This paper is not the final word on the subject, but clearly work needs to be done to improve these laws so that they have more impact.  As longitudinal studies go, this one isn’t very long.  It’s possible we’ll see benefits further down the road.

[1]  The Brandeis quote could be found in the paper I cited (which is why I used it).