Church of the Computer

Mare Nostrum computer at the Technical University of Catalonia, Barcelona, Spain, housed in a 1920s cathedral.

(Via BLDGBLOG.)

Bennett on Free Press net neutrality "facts"

Richard Bennett at the Original Blog has criticized Free Press's list of network neutrality facts, arguing that most of them are fictions, e.g.:

PSEUDO-FACT #1: Network Neutrality protections have existed for the entire history of the Internet.

REAL FACT: Actually, there is no legal precedent at all for the anti-QoS provision of the Neutrality regulations, and many commercial Internet customers use QoS today. Even the Internet2 Abilene network tried to use it.

This pseudo-fact is one I've repeatedly criticized network neutrality advocates for falsely asserting. The Free Press folks are the people managing the "Save the Internet" campaign.

The whole list is well worth reading, as are a couple of other recent posts at Bennett's blog. One is a note he wrote to Senator Barbara Boxer, which includes this bit:

The Snowe-Dorgan and Markey Amendments contain a poison pill that will stifle the evolution of the Internet, in the form of a prohibition against a Quality of Service surcharge:

If a broadband network provider prioritizes or offers enhanced quality of service to data of a particular type, it must prioritize or offer enhanced quality of service to all data of that type (regardless of the origin or ownership of such data) without imposing a surcharge or other consideration for such prioritization or enhanced quality of service.

The argument in favor of this provision says that it’s needed in order to prevent the formation of a two-tier Internet, where one tier has Quality of Service and the other doesn’t, and this is somehow bad for Daily Kos and Google.

This is a false claim, because the engineering math behind Quality of Service says it can’t be applied to every stream from every user. In Lake Woebegon all the children are above average, but on the Internet all the packets can’t be above average.

Another is his comment on tomorrow's Senate hearing where Ben Scott of the Free Press will be representing the "pro-regulation side of the neutrality debate" which he suggests is "a good choice" because he's "easily confused." In the same post, he reports on Matt Stoller's (of MyDD) presentation at the Yearly Kos event, in which Stoller "had to admit that he knows nothing about the issue of Telecom policy, which was interesting because the regulations he proposes don’t actually relate to telecom policy. They’re a new and unprecedented intervention into Internet routing and service plan regulation, a totally virgin territory for government regulators. Stoller admitted that it’s just a good guys vs. bad guys issue for him, one that’s lots of “fun”."

Bennett asks, "So my question is this: “should the US Congress take advice on virgin regulatory territory from someone who admits to knowing nothing about the subject matter?”"

Verizon's Thomas Tauke on net neutrality

Declan McCullagh interviews Verizon's Thomas Tauke on net neutrality. A key Q&A:

What do you think of the tone of the debate, and the appearance of pro-Net neutrality spokespeople like Moby and Alyssa Milano?
Tauke: I think it's one of the stranger debates I've ever been involved in. It's almost like we're debating what is beauty and how do we define it and regulate it? The problem is that everyone has a different definition of Net neutrality. If you look at the four major companies that are supporting the Net neutrality arguments, there are three distinct definitions of what Net neutrality should mean.

The question becomes which way do you think the market will better develop? If government sets policy today that dictates how the market develops? We think it should develop in the free market space, and government regulation should come in when a problem becomes apparent.

He's right on the money here. Most net neutrality advocates don't even seem to know what they are advocating, let alone understand the current legal or technological structure of the Internet in the U.S. (or elsewhere). They just think the telcos are somehow trying to take control of the Internet, block their access to websites, redirect them to different sites than they request, and intentionally degrade their service to make things slow, and they need to be stopped.

Hat tip: Matt S., the Only Republican in San Francisco.

Martin Geddes on net neutrality, federalism, and U.S. vs. EU

Martin Geddes has written a very interesting post at his Telepocalypse blog titled "You won't like this, not one bit," but I do like it, very much. He links to his past statements on network neutrality, and then asserts that "over time, the architecture of the telecom system will resemble the political system around it." He compares the U.S. government to the EU, and the irony that the planned federalism of the U.S. (where the states would run things their own way, competing with each other and evolving better rules in the process) has been supplanted by much stronger federal government setting most of the rules at a national level, while the EU, composed of nations of a much more collectivist/statist variety, has evolved into a collection of "competing regulatory regimes and voluntary cross-border cooperation compared to the centrally planned US communications economy."

For good measure, he throws in a comparison to networks: "That means the EU constitution is “edge-based”, and the US one doesn’t scale. Oops. Hey, just skip a generation and move straight to anarchism: peer-to-peer contracts, and a state whose only function is to enforce them."

Network security panel in Boston area

I'll be on a breakfast panel for MassNetComms on June 28 in Newton, MA, on this subject:

Secure Carrier Infrastructure in the IP Network
When customers talk to the suppliers of network services, whether VoIP, or broadband, or wireless, their most important requirements are associated with network security. Breaches in network security impact reliability and availability, with devastating revenue and competitive consequences. Service providers who demonstrate cost-effective security at all layers of the network and applications will be able to differentiate their services in an increasingly competitive market. The need for security is creating more demand for outsourced managed services, and thus a business opportunity for the carrier. Are carriers recognizing that security is integral to the value proposition? As the major carriers continue to invest in infrastructure, how does the architecture support network security?

More information about this event at the MassNetComms site.

When private property becomes the commons

While thinking about Jonathan Adler's presentation at the Skeptics Society conference, it occurred to me that the problem of botnets is, in effect, a tragedy of the commons. The private personal computers of consumers which are connected full-time to the Internet and are not kept up-to-date on patches have, in effect, become a commons to be exploited by the botherders. The owners of the computers are generally not aware of what's going on, as the bots generally try to minimize obtrusiveness in order to continue to operate. The actual damages to each individual are typically quite small (with some notable exceptions--botherders can steal and make use of any data on the machine, including personal identity information and confidential documents), and the individual consumer doesn't have sufficient incentive to prevent the problem (say, by spending additional money on security software or taking the time to maintain the system).

Similarly, the typical entry-level casual blogger may not have incentives to keep their blogs free of spam comments. Neither, for that matter, does commons-advocate Larry Lessig, whose blog's comments are full of spam, making them less useful than they otherwise would be--I think this is an amusing irony about Lessig's position in his book Code. He argues that we need to have some subsidized public space on the Internet, but it seems to me private companies have already created it largely without public subsidy, and I think Declan McCullagh has the better case in his exchange with Lessig. (By contrast, Blogger does have incentive to prevent spam blogs, which consume large amounts of its resources and make its service less useful--and so it takes sometimes heavy-handed automated actions to try to shut it down.)

Bruce Schneier has argued that the right way to resolve this particular problem is by setting liability rules to shift incentives to players who can address the issue--e.g., software companies, ISPs, and banks (for phishing, but see this rebuttal). I agree with Schneier on this general point and with the broader point that economics has a lot to teach information security.

"Banner farms" and spyware

Ben Edelman continues his valuable research with an exposure of Hula Direct's "banner farms" which are being used to display banner ads through popups, driven by spyware installations:

Hula cannot write off its spyware-sourced traffic as a mere anomaly or glitch. I have received Hula popups from multiple spyware programs over many months. Throughout that period, I have never arrived at any Hula site in any way other than from spyware -- never as a popup or popunder served on any bona fide web site, in my personal casual web surfing or in my professional examination of web sites and advertising practices. From these facts, I can only conclude that spyware popups are a substantial source of traffic to Hula's sites.

Edelman also notes that most of Hula's ads include JavaScript code or HTML refresh meta tags to automatically reload the ads fairly quickly. The effect is to display more ads, and to show the ads for a shorter time than the advertisers are expecting.

Hula doesn't have a direct relationship with its advertisers (Edelman notes the relationships of cash and traffic flow), but they are being complacent and allowing it to happen. Some of the advertisers: Vonage, Verizon, Circuit City.

Finally, Edelman notes that some of the ad networks being used by Hula have taken notice and started to take action. One ad network, Red McCombs Media, refused to pay a $200,000+ bill from Hula and has been sued by them for breach of contract.

Adler on federal environmental regulation

At the Skeptics Society conference on "The Environmental Wars," Jonathan Adler gave a talk on "Fables of Federal Environmental Regulation." Adler's talk made several points, the main ones among them being:

* Federal regulations tend to come late to the game, after state and local regulations or private actions have already begun addressing the problems. The recurring pattern is that there is an initial recognition of a problem, there's state and local regulation and private action to address it, and then there's federalization. I can add to Adler's examples the development of the cellular telephone industry, where private actors stepped in to allocate licenses through the "Big Monopoly Game" (a story told in the book Wireless Nation) when the FCC proved incompetent to do so itself; federal anti-spam legislation, which came only after many states passed anti-spam laws; and federal law to require notification of customers whose personal information has been exposed by system compromise (which still doesn't exist, though almost half the states now have some kind of hacking notification law). (In a related point, industries regularly develop products that completely sidestep federal regulations, such as the SUV, interstate banking, credit cards, money market accounts, and discount brokerages. The development of the latter financial products is a story told in Joseph Nocera's A Piece of the Action: How the Middle Class Joined the Money Class.)

* The causes of federal regulations are not necessarily the problems themselves, but are often rent-seeking by involved entities, which can create a barrier to other alternative solutions. Adler listed four causes of federal environmental regulations: increased environmental awareness (by the voters and the feds), increasingly nationalized politics (political action at a national level), distrust of states and federalism, and rent-seeking. He gave examples to illustrate.

* We don't see (I'd say "we tend not to see") environmental problems where we have well-defined property rights; the environmental problems occur in the commons (cf. Garrett Hardin's "The Tragedy of the Commons"). I disagree with making this an absolute statement since there are bad actors who disregard even well-established property rights (or liability rules).

Adler's intent was to raise skepticism about federal regulation on environmental matters on the basis of several points:

* History shows the problem already being addressed effectively in a more decentralized manner.
* Federal regulation tends to preempt state regulation, creating a uniform approach that doesn't allow us the benefits of seeing how different approaches might work--we can miss out on better ways of dealing with the issue.
* The rent-seeking behavior can produce unintended consequences that can make things worse or impose other costs.

While I'm not sure I agree with the implied conclusion that federal regulation is never helpful, I agree that these are good reasons to be skeptical.

The preemption issue in particular is a big one. The federal anti-spam law, CAN-SPAM, was pushed through after years of failure to pass federal regulations against spam after California passed a tough mandatory opt-in law. The federal law was passed largely through efforts by Microsoft and AOL (whose lawyers helped write it) and preempted state laws which mandated opt-in or any requirements contrary to the federal law. I don't think it's cynical to believe that preventing the California law from taking effect--which would potentially have affected online marketing efforts by Microsoft and AOL--was a major cause of the federal legislation passing.

The benefit of preemption is that it creates a level playing field across the entire nation, which reduces the costs of compliance for those who operate across multiple states. But it also reduces the likelihood of innovation in law through experimentation with different approaches, and reduces the advantages of local entities in competition with multi-state entities. It also prevents a state with more stringent requirements from affecting the behavior of a multi-state provider operating in that state, when the requirements get dropped to a federal lowest common denominator. As regulation almost always has unintended consequences, a diversity of approaches provides a way to discover those consequences and make more informed choices.

Another issue is that many federal regulations provide little in the way of enforcement, and the more federal regulations are created, the less likely that any particular one will have enforcement resources devoted to it. If you look at the FCC's enforcement of laws against illegal telemarketing activity (such as the prohibition on prerecorded solicitations to residential telephones, and the prohibition on telemarketing to cell phones), it's virtually nonexistent. They occasionally issue a citation, and very rarely issue fines to telemarketers who are blatantly violating the law on a daily basis. In this particular case, the law creates a private right of action so that the recipient of such an illegal call can file a civil case, and this model is one I'd like to endorse. I've personally had far more effect on most of the specific telemarketers who have made illegal calls to my residence than the FCC has. Federal laws and regulations can be effective when they are applicable to a small number of large players who can be adequately policed by a federal agency (but in such cases those large players tend to also be large players in Washington, D.C., and have huge influence over what rules get set) or when the enforcement is pushed down to state, local, or even private levels (e.g., using property or liability rules rather than agency-based regulation). Otherwise, they tend to be largely symbolic, with enforcement actions only occurring against major offenders while most violations are left unpunished.

The most effective solutions are those which place the incentives on involved parties to voluntarily come to agreements that address the issues, and I think these are possible in most circumstances with the appropriate set of property and liability rules. A good discussion of this subject may be found in David Friedman's book, Law's Order: What Economics Has to Do With Law and Why It Matters.

There seems to be a widespread illusion on the part of many people that many problems can be solved merely by passing the federal legislation, without regard for the actual empirical consequences of such legislation (or the actual process of how it's determined what gets put into such legislation!). From intellectual property law, to environmental law, to telecommunications law (e.g., net neutrality), good intentions can easily lead to bad consequences by those who don't concern themselves with such details. Friedman's book is a good start as an antidote to such thinking.

George Ou explains QoS to Russell Shaw

In an exchange on ZDNet, George Ou gives a simple explanation of the benefits of QoS for VoIP traffic and why any form of "net neutrality" that prohibits it or requires it to be offered without premium charges is a bad idea:

I’ll say this loud and clear; QoS is a reordering of packets that is an essential part of network traffic engineering. Take the following example where A represents VoIP packets and b represents webpage packets.

No enhanced QoS policy
AbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbAbAbbbbbbAbA

With enhanced QoS policy
AbbbbbbbbbAbbbbbbbbbbAbbbbbbbbbbAbbbbbbbbbbA

Now note that there are only 5 A packets in the entire stream for either scenario and you still get the exact same throughput for the b packets with or without prioritization for the VoIP A packets. The difference is that the A packets are now a lot more uniform which makes sound quality go up and the webpage b packets don’t really care about uniformity since all they care is that they get there at all intact. With this QoS example, you can improve VoIP without affecting the average throughput of web surfing. More precisely, QoS has ZERO throughput effect on non-prioritized when there is zero congestion on the pipe. If it had been a congested network, then QoS will have minimal effect on non-prioritized traffic.

Hat tip to Richard Bennett at the Original Blog.

Also see Dave Siegel on QoS and net neutrality.

Information Security Index

This post is an index to posts at The Lippard Blog on the subject of information security. This is probably not a complete list; I've tended to exclude posts labeled "security" that don't specifically touch on information security and may have over-excluded.

"Richard Bejtlich reviews Extreme Exploits" (August 16, 2005) Link to Richard Bejtlich review of Extreme Exploits, a book I was the technical editor on.

"Sony's DRM--not much different from criminal hacking" (November 2, 2005) Summary and link to Mark Russinovich's exposure of the Sony rootkit DRM.

"Defending Against Botnets" (November 3, 2005) Link to my presentation on this subject at Arizona State University.

"Sony DRM class action lawsuits" (November 10, 2005) Comment on the Sony rootkit class action lawsuits.

"Another Botnet Talk" (December 11, 2005) Comment on my December botnet talk for Phoenix InfraGard, with links to past botnet presentations.

"Major flaw in Diebold voting machines" (December 23, 2005) A flaw that allows preloading votes on a memory card for Diebold voting machines in an undetectible way.

"The Windows Meta File (WMF) exploit" (January 3, 2006) Description of an at-the-time unresolved Windows vulnerability.

"New Internet consumer protection tool--SiteAdvisor.com" (January 25, 2006) Report on SiteAdvisor.com tool (now a McAfee product).

"Pushing Spyware through Search" (January 28, 2006) Ben Edelman's work on how Google is connected to spyware by accepting paid advertising from companies that distribute it.

"Database error causes unbalanced budget" (February 17, 2006) How a house in Indiana was incorrectly valued at $400 million due to a single-keystroke error, leading to wrongly increased budgets and distribution of funds on the expectation of property tax revenue.

"The Security Catalyst podcast" (February 18, 2006) Announcement of Michael Santarcangelo's security podcast.

"Controversial hacker publishes cover story in Skeptical Inquirer" (February 19, 2006) Critique of Carolyn Meinel's article about information warfare.

"Even more serious Diebold voting machine flaws" (May 14, 2006) Hurst report on new major flaws found in Diebold voting machines.

"Botnet interview on the Security Catalyst podcast" (May 23, 2006) Link to part I of my interview on botnets with Michael Santarcangelo.

"Part II of Botnets Interview" (June 4, 2006) Link to part II of my botnets interview.

"'Banner farms' and spyware" (June 12, 2006) Ben Edelman's exposure of Hula Direct's "banner farms" used to deliver ads via spyware.

"When private property becomes the commons" (June 12, 2006) Consumer PCs as Internet "commons," economics and information security.

"Network security panel in Boston area" (June 12, 2006) Announcement of a public speaking gig.

"Identity Crisis: How Identification is Overused and Misunderstood" (July 6, 2006) Quotation from Tim Lee review of book by Jim Harper with this title.

"9th Circuit approves random warrantless searches and seizures of laptops" (July 28, 2006) Bad decision granting border police the right to perform full forensic examination of the hard drives of laptops carried by people wanting to cross the U.S. border.

"Is it worth shutting down botnet controllers?" (August 18, 2006) A response to remarks by Gadi Evron and Paul Vixie that it is no longer worth shutting down botnet controllers.

"The ineffectiveness of TRUSTe" (September 29, 2006) A larger proportion of sites with TRUSTe certification are marked as untrustworthy in SiteAdvisor's database than of those that don't have TRUSTe certification.

"The U.S. no-fly list is a joke" (October 5, 2006) The no-fly list has major flaws, listing people who aren't a threat and not listing people who are--and presuming that terrorists will be identifiable by their names.

"How planespotting uncovered CIA torture flights" (October 20, 2006) How an unusual hobby allowed for traffic analysis to uncover CIA torture flights.

"Point out the obvious, get raided by the FBI" (October 29, 2006) Chris Soghoian gets raided by the FBI after putting up a web page that allows generation of Northwest Airlines boarding passes.

"Electronic voting machines in Florida having problems in early voting" (October 31, 2006) A report on voting machines registering votes for the wrong candidate due to touch screen calibration issues.

"The Two Faces of Diebold" (November 5, 2006) The difference between the public and private versions of SAIC's report on Diebold voting machine vulnerabilities.

"FBI eavesdropping via cell phones and OnStar" (December 4, 2006) Reports of vulnerabilities in newer cell phones that allow them to be used as listening devices even when powered off.

"Time to Stop Using Microsoft Word" (December 7, 2006) New unpatched malicious code execution vulnerability in most versions of Word.

"Staffer for Congressman tries to hire hacker to change grades" (December 22, 2006) Todd Shriber's failed attempt to retroactively improve his college career.

"My bank is on the ball" (January 6, 2007) My bank prevents theft of my money.

"Skeptical information and security information links" (January 23, 2007) Promotion of my security links and skeptical links sites.

"Schoolteacher convicted on bogus charges due to malware" (February 4, 2007) Connecticut teacher Julie Amero successfully prosecuted for showing porn to kids, when in fact it was the result of malware on a machine the school district refused to pay for antivirus software on.

"McCain proposes an unfunded mandate for ISPs" (February 7, 2007) McCain sponsors a bill to force ISPs to scan all traffic for and report child porn images they find.

"Warner Music: We'd rather go out of business than give customers what they want" (February 9, 2007) Warner Music says no way to DRM-free music.

"The economics of information security" (February 13, 2007) Ross Anderson and Tyler Moore paper on the economics of infosec.

"How IPv6 is already creating security problems" (February 19, 2007) Apple AirPort allows bypass of firewall rules via IPv6.

"Windows, Mac, and BSD Security" (March 8, 2007) Amusing video parody comparing the OSes.

"Bob Hagen on botnet evolution" (March 9, 2007) My former colleague on trends in botnets.

"The rsync.net warrant canary" (March 25, 2007) How rsync.net will communicate whether it receives a National Security Letter without breaking the law.

"FBI focus on counterterrorism leads to increase in unprosecuted fraud and identity theft" (April 11, 2007) The law of unintended consequences strikes again.

"Banning the distribution of AACS keys is futile" (May 3, 2007) You can't stop the communication of a 128-bit number as though it's proprietary.

"CALEA compliance day" (May 14, 2007) Commemoration of the day that VoIP providers have to be CALEA-compliant.

"Spying on the homefront" (May 14, 2007) PBS Frontline on FBI misuse of National Security Letters and NSA eavesdropping.

"The bots of summer" (June 6, 2007) Report on some media coverage of my botnet interview with the Security Catalyst from 2006.

"Microsoft's new Turing Test" (June 12, 2007) It's not often I get to combine animal rescue and information security topics, but this is one--using animal pictures to authenticate.

"Operation Bot Roast" (June 14, 2007) FBI prosecution of some botnet people.

"Google thinks I'm malware" (July 13, 2007) Google stops returning results to me in some cases because my behavior looks like malware activity.

"Asking printer manufacturers to stop spying results in Secret Service visit?" (July 14, 2007) MIT Media Lab project to get people to complain to printer manufacturers about their secret coding of serial numbers, which got one person a visit from the USSS.

"A marketplace for software vulnerabilities" (July 29, 2007) WabiSabiLabi's abortive attempt to create a market for the sale and purchase of vulnerability information.

"Another Sony rootkit" (September 5, 2007) F-Secure finds another Sony product that installs a rootkit--the Sony MicroVault USM-F memory stick (now off the market).

"Anti-P2P company suffers major security breach" (September 16, 2007) Media Defender gets hacked.

"Microsoft updates Windows XP and Vista without user permission or notification" (September 17, 2007) Nine executables get pushed to everybody even if Windows update is turned off--except for corporate SMS users.

"Lessons for information security from Multics" (September 19, 2007) Paul Karger and Roger Schell's paper on Multics gets attention from Bruce Schneier.

"Hacker finds vulnerability in Adobe Reader" (September 24, 2007) The era of attacks on applications rather than OS's gets a boost.

"Break-in at CI Host colo facility" (November 4, 2007) The role of physical security for websites.

"Spammers and criminals for Ron Paul" (November 6, 2007) Botnets used to send spam promoting Ron Paul.

"Macintosh security lags behind Windows and BSD" (November 8, 2007) Rundown on new Mac security features, some of which are negative in effect.

"Multics source code released" (November 13, 2007) Multics becomes open source.

"Untraceable looks unwatchable" (December 18, 2007) A post that generated a huge amount of response, about the Diane Lane movie that flopped at the box office, before it came out.

"Notorious major spammer indicted" (January 3, 2008) Alan Ralsky may actually get what he deserves.

"Boeing 787 potentially vulnerable to passenger software-based hijacking" (January 8, 2008) Passenger Internet access for the Boeing 787 is physically connected to the network for communication and navigation.

"'Anonymous' launches 'war' against Scientology" (January 22, 2008) Denial of service attacks and other pranks against Scientology.

"Tinfoil hat brigade generates fear about Infragard" (February 8, 2008) Response to Matt Rothschild's article in The Progressive claiming that InfraGard members have the right to "shoot to kill" when martial law is declared.

"FBI responds to 'shoot to kill' claims about InfraGard" (February 15, 2008) Commentary and link to the FBI's response to Rothschild.

"Malware in digital photo frames" (February 17, 2008) Viruses in unusual digital storage locations.

"Canada busts 17 in botnet ring" (February 21, 2008) News about law enforcement action against criminals in Canada.

"More InfraGard FUD and misinformation" (February 23, 2008) Response to Gary Barnett's InfraGard article at the Future of Freedom Foundation website.

"New Mexico InfraGard conference" (February 24, 2008) Summary of the New Mexico InfraGard's "Dollar-Gard 2008" conference.

"Pakistan takes out YouTube, gets taken out in return" (February 25, 2008) Yesterday's events of political and/or religious censorship gone awry in Pakistan.

"Jeremy Jaynes loses appeal on spamming case" (March 1, 2008) The Virginia Supreme Court upholds Virginia's anti-spam law.

"Software awards scam" (March 25, 2008) Many software download sites give out bogus awards.

"Scammers scamming scammers" (April 7, 2008) Marco Cova looks at what some phishing kits really do.

"Bad military botnet proposal" (May 13, 2008) A response to Col. Charles Williamson's proposal to build a military botnet.

"MediaDefender launches denial of service attack against Revision3" (May 29, 2008) Anti-P2P piracy firm crosses the line and attacks a legitimate company.

"San Francisco's city network held hostage" (July 19, 2008) Some actual facts behind the hyped charges against the city's network administrator.

"Did Diebold tamper with Georgia's 2002 elections?" (July 20, 2008) Some troubling information about Diebold's last-minute patching on Georgia election machines.

"Expert tells China visitors to encrypt data as U.S. announces policy of laptop seizure" (August 1, 2008) Concerns about privacy in both China and the U.S.

"Military botnets article" (August 28, 2008) Peter Buxbaum's article on "Battling Botnets" in Military Information Technology magazine.

"Virginia Supreme Court strikes down anti-spam law" (September 12, 2008) Julian Jaynes goes free as Virginia's anti-spam law goes away.

"Sarah Palin's Yahoo account hacked" (September 17, 2008) Palin's Yahoo account is hacked, and the contents published.

"TSA airport security is a waste of time and money" (October 18, 2008) Link to Jeffrey Goldberg's article in The Atlantic.

"Behind the scenes during the election process" (November 6, 2008) Both major party presidential nominees suffered computer compromises.

"White House may be forced to recover 'lost' emails" (November 14, 2008) Lawsuit may require recovery from backups.

"Criminal activity by air marshals" (November 14, 2008) Multiple cases.

"PATRIOT Act NSL gag order unconstitutional" (December 19, 2008) Recipients of National Security Letters now can't be gagged without court order.

"The U.S. Nazi dirty bomb plot" (March 15, 2009) A little-covered story about a real terrorist plot.

"The Cybersecurity Act of 2009" (April 4, 2009) It's not as bad as it appears.

"Tracking cyberspies through the web wilderness" (May 12, 2009) How University of Toronto researchers have tracked online spying activity.

"Bad military botnet proposal still being pushed" (June 26, 2009) Col. Williamson's proposal to build an offensive U.S. military botnet is still being promoted by him.

"DHS still a mess, five years on" (July 16, 2009) Center for Public Integrity review of DHS.

"How Twitter got compromised" (July 23, 2009) TechCrunch gives the anatomy of the attack on Twitter.