Information Security Index

This post is an index to posts at The Lippard Blog on the subject of information security. This is probably not a complete list; I've tended to exclude posts labeled "security" that don't specifically touch on information security and may have over-excluded.

"Richard Bejtlich reviews Extreme Exploits" (August 16, 2005) Link to Richard Bejtlich review of Extreme Exploits, a book I was the technical editor on.

"Sony's DRM--not much different from criminal hacking" (November 2, 2005) Summary and link to Mark Russinovich's exposure of the Sony rootkit DRM.

"Defending Against Botnets" (November 3, 2005) Link to my presentation on this subject at Arizona State University.

"Sony DRM class action lawsuits" (November 10, 2005) Comment on the Sony rootkit class action lawsuits.

"Another Botnet Talk" (December 11, 2005) Comment on my December botnet talk for Phoenix InfraGard, with links to past botnet presentations.

"Major flaw in Diebold voting machines" (December 23, 2005) A flaw that allows preloading votes on a memory card for Diebold voting machines in an undetectible way.

"The Windows Meta File (WMF) exploit" (January 3, 2006) Description of an at-the-time unresolved Windows vulnerability.

"New Internet consumer protection tool--SiteAdvisor.com" (January 25, 2006) Report on SiteAdvisor.com tool (now a McAfee product).

"Pushing Spyware through Search" (January 28, 2006) Ben Edelman's work on how Google is connected to spyware by accepting paid advertising from companies that distribute it.

"Database error causes unbalanced budget" (February 17, 2006) How a house in Indiana was incorrectly valued at $400 million due to a single-keystroke error, leading to wrongly increased budgets and distribution of funds on the expectation of property tax revenue.

"The Security Catalyst podcast" (February 18, 2006) Announcement of Michael Santarcangelo's security podcast.

"Controversial hacker publishes cover story in Skeptical Inquirer" (February 19, 2006) Critique of Carolyn Meinel's article about information warfare.

"Even more serious Diebold voting machine flaws" (May 14, 2006) Hurst report on new major flaws found in Diebold voting machines.

"Botnet interview on the Security Catalyst podcast" (May 23, 2006) Link to part I of my interview on botnets with Michael Santarcangelo.

"Part II of Botnets Interview" (June 4, 2006) Link to part II of my botnets interview.

"'Banner farms' and spyware" (June 12, 2006) Ben Edelman's exposure of Hula Direct's "banner farms" used to deliver ads via spyware.

"When private property becomes the commons" (June 12, 2006) Consumer PCs as Internet "commons," economics and information security.

"Network security panel in Boston area" (June 12, 2006) Announcement of a public speaking gig.

"Identity Crisis: How Identification is Overused and Misunderstood" (July 6, 2006) Quotation from Tim Lee review of book by Jim Harper with this title.

"9th Circuit approves random warrantless searches and seizures of laptops" (July 28, 2006) Bad decision granting border police the right to perform full forensic examination of the hard drives of laptops carried by people wanting to cross the U.S. border.

"Is it worth shutting down botnet controllers?" (August 18, 2006) A response to remarks by Gadi Evron and Paul Vixie that it is no longer worth shutting down botnet controllers.

"The ineffectiveness of TRUSTe" (September 29, 2006) A larger proportion of sites with TRUSTe certification are marked as untrustworthy in SiteAdvisor's database than of those that don't have TRUSTe certification.

"The U.S. no-fly list is a joke" (October 5, 2006) The no-fly list has major flaws, listing people who aren't a threat and not listing people who are--and presuming that terrorists will be identifiable by their names.

"How planespotting uncovered CIA torture flights" (October 20, 2006) How an unusual hobby allowed for traffic analysis to uncover CIA torture flights.

"Point out the obvious, get raided by the FBI" (October 29, 2006) Chris Soghoian gets raided by the FBI after putting up a web page that allows generation of Northwest Airlines boarding passes.

"Electronic voting machines in Florida having problems in early voting" (October 31, 2006) A report on voting machines registering votes for the wrong candidate due to touch screen calibration issues.

"The Two Faces of Diebold" (November 5, 2006) The difference between the public and private versions of SAIC's report on Diebold voting machine vulnerabilities.

"FBI eavesdropping via cell phones and OnStar" (December 4, 2006) Reports of vulnerabilities in newer cell phones that allow them to be used as listening devices even when powered off.

"Time to Stop Using Microsoft Word" (December 7, 2006) New unpatched malicious code execution vulnerability in most versions of Word.

"Staffer for Congressman tries to hire hacker to change grades" (December 22, 2006) Todd Shriber's failed attempt to retroactively improve his college career.

"My bank is on the ball" (January 6, 2007) My bank prevents theft of my money.

"Skeptical information and security information links" (January 23, 2007) Promotion of my security links and skeptical links sites.

"Schoolteacher convicted on bogus charges due to malware" (February 4, 2007) Connecticut teacher Julie Amero successfully prosecuted for showing porn to kids, when in fact it was the result of malware on a machine the school district refused to pay for antivirus software on.

"McCain proposes an unfunded mandate for ISPs" (February 7, 2007) McCain sponsors a bill to force ISPs to scan all traffic for and report child porn images they find.

"Warner Music: We'd rather go out of business than give customers what they want" (February 9, 2007) Warner Music says no way to DRM-free music.

"The economics of information security" (February 13, 2007) Ross Anderson and Tyler Moore paper on the economics of infosec.

"How IPv6 is already creating security problems" (February 19, 2007) Apple AirPort allows bypass of firewall rules via IPv6.

"Windows, Mac, and BSD Security" (March 8, 2007) Amusing video parody comparing the OSes.

"Bob Hagen on botnet evolution" (March 9, 2007) My former colleague on trends in botnets.

"The rsync.net warrant canary" (March 25, 2007) How rsync.net will communicate whether it receives a National Security Letter without breaking the law.

"FBI focus on counterterrorism leads to increase in unprosecuted fraud and identity theft" (April 11, 2007) The law of unintended consequences strikes again.

"Banning the distribution of AACS keys is futile" (May 3, 2007) You can't stop the communication of a 128-bit number as though it's proprietary.

"CALEA compliance day" (May 14, 2007) Commemoration of the day that VoIP providers have to be CALEA-compliant.

"Spying on the homefront" (May 14, 2007) PBS Frontline on FBI misuse of National Security Letters and NSA eavesdropping.

"The bots of summer" (June 6, 2007) Report on some media coverage of my botnet interview with the Security Catalyst from 2006.

"Microsoft's new Turing Test" (June 12, 2007) It's not often I get to combine animal rescue and information security topics, but this is one--using animal pictures to authenticate.

"Operation Bot Roast" (June 14, 2007) FBI prosecution of some botnet people.

"Google thinks I'm malware" (July 13, 2007) Google stops returning results to me in some cases because my behavior looks like malware activity.

"Asking printer manufacturers to stop spying results in Secret Service visit?" (July 14, 2007) MIT Media Lab project to get people to complain to printer manufacturers about their secret coding of serial numbers, which got one person a visit from the USSS.

"A marketplace for software vulnerabilities" (July 29, 2007) WabiSabiLabi's abortive attempt to create a market for the sale and purchase of vulnerability information.

"Another Sony rootkit" (September 5, 2007) F-Secure finds another Sony product that installs a rootkit--the Sony MicroVault USM-F memory stick (now off the market).

"Anti-P2P company suffers major security breach" (September 16, 2007) Media Defender gets hacked.

"Microsoft updates Windows XP and Vista without user permission or notification" (September 17, 2007) Nine executables get pushed to everybody even if Windows update is turned off--except for corporate SMS users.

"Lessons for information security from Multics" (September 19, 2007) Paul Karger and Roger Schell's paper on Multics gets attention from Bruce Schneier.

"Hacker finds vulnerability in Adobe Reader" (September 24, 2007) The era of attacks on applications rather than OS's gets a boost.

"Break-in at CI Host colo facility" (November 4, 2007) The role of physical security for websites.

"Spammers and criminals for Ron Paul" (November 6, 2007) Botnets used to send spam promoting Ron Paul.

"Macintosh security lags behind Windows and BSD" (November 8, 2007) Rundown on new Mac security features, some of which are negative in effect.

"Multics source code released" (November 13, 2007) Multics becomes open source.

"Untraceable looks unwatchable" (December 18, 2007) A post that generated a huge amount of response, about the Diane Lane movie that flopped at the box office, before it came out.

"Notorious major spammer indicted" (January 3, 2008) Alan Ralsky may actually get what he deserves.

"Boeing 787 potentially vulnerable to passenger software-based hijacking" (January 8, 2008) Passenger Internet access for the Boeing 787 is physically connected to the network for communication and navigation.

"'Anonymous' launches 'war' against Scientology" (January 22, 2008) Denial of service attacks and other pranks against Scientology.

"Tinfoil hat brigade generates fear about Infragard" (February 8, 2008) Response to Matt Rothschild's article in The Progressive claiming that InfraGard members have the right to "shoot to kill" when martial law is declared.

"FBI responds to 'shoot to kill' claims about InfraGard" (February 15, 2008) Commentary and link to the FBI's response to Rothschild.

"Malware in digital photo frames" (February 17, 2008) Viruses in unusual digital storage locations.

"Canada busts 17 in botnet ring" (February 21, 2008) News about law enforcement action against criminals in Canada.

"More InfraGard FUD and misinformation" (February 23, 2008) Response to Gary Barnett's InfraGard article at the Future of Freedom Foundation website.

"New Mexico InfraGard conference" (February 24, 2008) Summary of the New Mexico InfraGard's "Dollar-Gard 2008" conference.

"Pakistan takes out YouTube, gets taken out in return" (February 25, 2008) Yesterday's events of political and/or religious censorship gone awry in Pakistan.

"Jeremy Jaynes loses appeal on spamming case" (March 1, 2008) The Virginia Supreme Court upholds Virginia's anti-spam law.

"Software awards scam" (March 25, 2008) Many software download sites give out bogus awards.

"Scammers scamming scammers" (April 7, 2008) Marco Cova looks at what some phishing kits really do.

"Bad military botnet proposal" (May 13, 2008) A response to Col. Charles Williamson's proposal to build a military botnet.

"MediaDefender launches denial of service attack against Revision3" (May 29, 2008) Anti-P2P piracy firm crosses the line and attacks a legitimate company.

"San Francisco's city network held hostage" (July 19, 2008) Some actual facts behind the hyped charges against the city's network administrator.

"Did Diebold tamper with Georgia's 2002 elections?" (July 20, 2008) Some troubling information about Diebold's last-minute patching on Georgia election machines.

"Expert tells China visitors to encrypt data as U.S. announces policy of laptop seizure" (August 1, 2008) Concerns about privacy in both China and the U.S.

"Military botnets article" (August 28, 2008) Peter Buxbaum's article on "Battling Botnets" in Military Information Technology magazine.

"Virginia Supreme Court strikes down anti-spam law" (September 12, 2008) Julian Jaynes goes free as Virginia's anti-spam law goes away.

"Sarah Palin's Yahoo account hacked" (September 17, 2008) Palin's Yahoo account is hacked, and the contents published.

"TSA airport security is a waste of time and money" (October 18, 2008) Link to Jeffrey Goldberg's article in The Atlantic.

"Behind the scenes during the election process" (November 6, 2008) Both major party presidential nominees suffered computer compromises.

"White House may be forced to recover 'lost' emails" (November 14, 2008) Lawsuit may require recovery from backups.

"Criminal activity by air marshals" (November 14, 2008) Multiple cases.

"PATRIOT Act NSL gag order unconstitutional" (December 19, 2008) Recipients of National Security Letters now can't be gagged without court order.

"The U.S. Nazi dirty bomb plot" (March 15, 2009) A little-covered story about a real terrorist plot.

"The Cybersecurity Act of 2009" (April 4, 2009) It's not as bad as it appears.

"Tracking cyberspies through the web wilderness" (May 12, 2009) How University of Toronto researchers have tracked online spying activity.

"Bad military botnet proposal still being pushed" (June 26, 2009) Col. Williamson's proposal to build an offensive U.S. military botnet is still being promoted by him.

"DHS still a mess, five years on" (July 16, 2009) Center for Public Integrity review of DHS.

"How Twitter got compromised" (July 23, 2009) TechCrunch gives the anatomy of the attack on Twitter.

Net Neutrality Index

This post serves as an index to the net neutrality posts on The Lippard Blog. I'll update this post with any future posts on the subject.

"Net Neutrality" (February 12, 2006) Critique of Bill Thompson's argument for net neutrality.

"Geddes on net neutrality" (February 14, 2006) Comment on and link to good Martin Geddes blog post on net neutrality.

"Commoncause.org: Spamming for 'net neutrality'" (March 9, 2006) How Common Cause deluged Mark Cuban with spam after depicting him with devil horns for not backing net neutrality.

"Talking Points Memo gets it completely wrong on COPE Act" (April 22, 2006) Critique of Josh Marshall and Art Brodsky's bogus claim that the bill transfers control of the Internet to the telcos (who have a much smaller percentage of consumer Internet customers in the U.S. than the cable companies).

"Misinformation in defense of net neutrality" (May 7, 2006) Critique of Adam Green and Matt Stoller who repeat the common misconception that common carriage requirements have applied to the Internet, which is the basis of their calling Mike McCurry a liar.

"Net Neutrality and Last-Mile Connectivity: An Analogy" (May 8, 2006) An analogy about net neutrality and last-mile connectivity in terms of taxicabs, in an attempt to elucidate some of the major points and misconceptions.

"Net Neutrality and the Pace of Innovation" (May 17, 2006) A look at the pace of innovation in the Bell System under monopoly in light of calls for nationalization of "the Internet backbone" (as though there is one such thing) by net neutrality advocates.

"Misinformation from 'Save the Internet'" (May 19, 2006) A critique of "Save the Internet"'s critique of the "Hands Off the Internet" flash animation cartoon, which seems to repeat the common confusion that common carriage requirements have applied to the Internet.

"Bad unintended consequences of HR 5417" (May 19, 2006) A criticism of the Sensenbrenner net neutrality bill.

"Yglesias on McCurry" (May 19, 2006) Critique of Matthew Yglesias on net neutrality guest blogging at Talking Points Memo.

"Net Neutrality and Fair Use" (May 22, 2006) Disagreement with Larry Lessig about an analogy between net neutrality and fair use. (I tend to agree with Lessig on intellectual property issues, at least about the dangers of ever-extending copyright terms, lack of registration requirements, and DRM.)

"Hillary Clinton and Net Neutrality" (May 23, 2006) The hypocrisy of Hillary Clinton's support of net neutrality on the grounds of protecting free speech (as pointed out by Adam Thierer).

"Consumer broadband last-mile competition in the Phoenix metropolitan area" (May 24, 2006) A summary of actual broadband options in the Phoenix area, listing eight separate providers.

"Net Neutrality expands to absurdity" (May 24, 2006) Critique of net neutrality advocate Jim Durbin, who thinks corporate web filters are a violation (which presumably he thinks should be made illegal). Also comment on Glenn Harlan Reynolds on pirate WiFi in the enterprise.

"Newmark vs. McCurry on net neutrality" (May 24, 2006) Comment on Craig Newmark's debate with Mike McCurry in the Wall Street Journal, in which Newmark is mightily confused about the technical facts.

"Dave Siegel on QoS and net neutrality" (May 26, 2006) Link to Dave Siegel blog post that summarizes how QoS is used in Global Crossing's network, and to a presentation by Xiao Xipeng on the same topic.

"Save the Internet: Fighting astroturf with astroturf" (May 26, 2006) How "Save the Internet" has generated astroturfed letters-to-the-editor while condemning astroturf from the telcos. I condemn both.

"More on last-mile options in Phoenix" (May 27, 2006) A response to criticisms of my list Phoenix-area broadband options from Douglas Ross.

"The Abstract Factory on net neutrality" (May 31, 2006) A link to a good commentary on net neutrality and astroturfing telco shills.

"Kevin Drum gets it wrong on net neutrality and common carriage" (June 1, 2006) Kevin Drum repeats the common misconception that common carriage requirements have applied to the Internet.

"Worst net neutrality analogy ever?" (June 1, 2006) A critique of Susan Crawford's horrible sidewalk analogy.

"George Ou explains QoS to Russell Shaw" (June 10, 2006) In a ZDnet debate, George Ou gives a good simple explanation of QoS to someone who wants to regulate something he doesn't understand.

"Martin Geddes on net neutrality, federalism, and U.S. vs. EU" (June 12, 2006) Link to a nice piece on Geddes' Telepocalypse blog where he provides links to his past positions on network neutrality and compares the U.S. to EU, and their respective regulatory regimes to networks.

"Verizon's Thomas Tauke on net neutrality" (June 12, 2006) Quote from and link to a Declan McCullagh interview with Thomas Tauke of Verizon about net neutrality.

"Bennett on Free Press net neutrality 'facts'" (June 12, 2006) Richard Bennett shows that the Free Press's network neutrality facts are mostly fiction, argues against the anti-QoS provision of Snowe-Dorgan and Markey in a note to Sen. Boxer, comments on tomorrow's Senate hearing, and on Matt Stoller's acting as a spokesman for admitted ignorance.

"'Hands Off the Internet' writes about me, then thinks better of it" (June 15, 2006) A post from the HOTI blog about me, recovered from Google cache. (Most of the content is actually excerpted from my own blog, with a bit of HOTI commentary.)

"The New Republic supports net neutrality, based on error" (June 15, 2006) The editors of The New Republic join the crowds of net neutrality supporters who incorrectly think that common carriage requirements have applied to ISPs and the Internet.

"Douglas Ross's Network Neutrality Index" (June 16, 2006) A link to an index of blog posts by an advocate of net neutrality regulation.

"Demonization of adversaries is wrong, Matt Stoller" (June 16, 2006) A criticism of part of Matt Stoller's presentation at YearlyKos.

"Andrew Kantor changes his mind on net neutrality" (June 16, 2006) The USA Today technology columnist no longer supports net neutrality regulations.

"Matt Stoller lies about site blocking" (June 18, 2006) Matt Stoller falsely attributes a problem between Craigslist.org and Cox's PC firewall software to the kind of discriminatory site blocking he thinks net neutrality regulations are needed to prevent--after already being informed of the real cause.

"Update on Cox blocking of Craigslist" (June 20, 2006) Update on who's said what, and a bit more detail on the underlying problem in which I disagree with placing blame on Craigslist.

"Content providers and ISPs: who really has the stronger hand?" (June 21, 2006) A look at a case of "reverse network neutrality" involving ESPN360 blocking access to ISPs.

"The future of connectivity options" (June 22, 2006) Telco 2.0 looks at a variety of business models for different types of connectivity and projections for how they will change in significance over the next decade. It would be a bad idea to impose regulations which stifle innovation by prohibiting some business models.

"Matt Stoller refuses to come clean" (June 22, 2006) Matt Stoller, caught in falsehood, tries to avoid responsibility for his statements and instead accuses others of being "lying liars."

"A version of network neutrality I can endorse" (June 22, 2006) I attempt to put forth a minimal, non-FCC-regulated version of "Lippard Network Neutrality" that I think is reasonable, and explain how it differs from what many network neutrality advocates are supporting.

"Craigslist no longer uses TCP window size of 0" (July 14, 2006) Update on the Craigslist/Cox issue.

"VoIP quality degradation shows need for prioritization" (July 27, 2006) Brix Networks study shows quality of VoIP calls has declined over the last 18 months due to competition for network resources.

"ACLU incompetence and misinformation on net neutrality" (November 3, 2006) The ACLU comes out in support of network neutrality, making many of the same erroneous arguments which have been debunked here before, such as confusing common carriage with IP-layer nondiscrimination.

"Netroots and telecom" (July 19, 2008) Discussion about the description of the Netroots Nation "Big Telecom" panel and an Art Brodsky column about it.

"New Markey/Eshoo net neutrality bill" (August 3, 2009) Brief comments on the Internet Freedom Preservation Act of 2009.

42 innocent people killed by police paramilitary raids

Radley Balko at The Agitator reports on some examples of innocent people murdered by police (and for some reason they almost never get prosecuted), along with his current research tally:

The tally thus far from my research: 42 innocent people killed in paramilitary raids. 57 if you include police officers. Another 20 were nonviolent offenders (recreational pot smokers, gamblers, etc.) shot and killed either by accident or because they mistook raiding police for criminal intruders and were killed when they attempted to defend themselves, their homes, and/or their families.

Conditions of income mobility

Two studies reported in The Economist (pay content) show that income mobility--the ability for children to be more economically successful than their parents--is much greater in Scandanavian countries and the UK than it is in the United States:

The authors rank countries on a scale from one to zero, with one meaning no mobility at all (ie, a child's income is identical to its parents') and zero meaning perfect mobility (ie, a child's income bears no relation to its parents'). The Nordic countries score around 0.2 for sons, Britain scores 0.36, and America 0.54 (meaning that a son's earnings are more closely related to his father's in America). These figures are roughly in line with the conclusions of other studies, though they have the advantage of using standardised data, thereby minimising problems of definition that usually bedevil cross-country comparisons.

The biggest finding of the studies is not, however, about overall social mobility, but about mobility at the bottom. This is the most distinctive feature of Nordic societies, and it is also perhaps the most significant difference with America. Around three-quarters of sons born into the poorest fifth of the population in Nordic countries in the late 1950s had moved out of that category by the time they were in their early 40s. In contrast, only just over half of American men born at the bottom later moved up. This is another respect in which Britain is more like the Nordics than like America: some 70% of its poorest sons escaped from poverty within a generation.

The Nordic countries are distinctive in one further way: the sons born at the bottom (into the poorest fifth) earn roughly the same as those born a rung above them (the second-poorest fifth). In other words, Nordic countries have almost completely snapped the link between the earnings of parents and children at and near the bottom. That is not at all true of America.

The effect is attributed to two things--welfare programs and education. If the consequences of U.S. policies include not only growing income inequality but declining income mobility, the latter undermines a standard argument for the former, and provides a motivation for changing policies.

(The studies are “Non-linearities in Inter-generational Earnings Mobility” (Royal Economics Society, London) and “American Exceptionalism in a New Light” (Institute for the Study of Labour, Bonn). Both are by Bernt Bratsberg, Knut Roed, Oddbjorn Raaum, Robin Naylor, Markus Jantti, Tor Eriksson, Eva Osterbacka and Anders Bjorklund. The Economist also criticized the U.S. for declining income mobility in 2005, in an article that is available in full without a subscription.)

Valerie Pachulski and Gabi Plumlee's 2004 GOP contributions

How is it that a 1999 high school graduate, "GOP Babe Val," who recently worked as an administrative assistant for Arizona Right-to-Life had over $10,000 to donate [SEE CORRECTION BELOW] to the Nevada Republican Party between July and November 2004 (also see here) while working as a volunteer for Bush-Cheney '04 Inc. of Las Vegas?

In a May 31 Arizona Republic website feature of restaurant reviews from readers, Pachulski is the contributor and mentions that she has "moved to D.C."

Another Arizona donor of over $9000 to the Nevada Republican Party in 2004 [SEE CORRECTION BELOW], Gabi Plumlee, works for the Republican National Committee in D.C.

UPDATE July 8, 2006: As pointed out in the comments by "Kellen Rose", the Center for Public Integrity website I linked to for "over $10,000 to donate" has things exactly backwards--this isn't a record of donations (though CPI has extensive databases of donations to politicians and political campaigns), but a record of expenditures by the Nevada GOP to out-of-state entities. That is, Pachulski and Plumlee were on the GOP payroll, not making contributions. I failed to see what was staring me in the face on that website.

Accordingly, I apologize to Ms. Pachulski and Ms. Plumlee for my inaccurate statements and the suggestion that there was something unusual going on here. I'll leave this post as a historical record of my error and the correction. It was a stupid mistake.

UPDATE (September 24, 2007): Valerie Pachulski points out that she was not an administrative assistant at Arizona Right to Life, but the Director of Events.

Skeptics Society conference

I've returned from the Skeptics Society conference on "The Environmental Wars," and there wasn't much warring between speakers, though there were some debates among audience members between sessions. The most controversial speaker was John Stossel, who was the only person to proclaim himself a global warming skeptic (and did so without having witnessed any of the day's presentations, which made it abundantly clear that (a) there is global warming and (b) it is caused by human activity). Michael Crichton managed to avoid the global warming subject in his talk, though in the Q&A he agreed that (a) there is no debate that the globe is warming (contrary to the position in State of Fear that it's an artifact of city "heat islands"), (b) there is no debate that CO2 has increased as a result of human activity, and (c) there's no debate about the greenhouse effect.

I'll comment more later on at least some of the talks, but for now I'll refer you to conference presenter Jonathan Adler's live-blogged descriptions of the talks and Chris Mooney's summary of his initial debate presentation.

UPDATE June 7, 2006: Also check out desmogblog's coverage of the conference.

UPDATE (July 18, 2009): Looks like my only further comment was on Jonathan Adler's talk on federal environmental regulation, though I did post this on the JREF Forums on June 30, 2008:

I very much enjoyed the Skeptics Society "Environmental Wars" conference. I thought it was a good mix of long-term history on climate change (Prothero), current scientific evidence on climate change (Schneider), what to do about it from an economic perspective (Arnold), what doesn't work from a regulatory perspective (Adler), what wild and crazy mitigation techniques might be available and what they'll cost (Benford), and a little debate on politicization of science (Mooney vs. Bailey), and a couple of climate change skeptics who didn't really address any of the science presented during the conference (Crichton and Stossel). It was also a chance to see one of Paul MacCready's last public appearances before he died.

Michael Crichton and John Stossel were no Mike Reiss (Simpsons writer who gave a hilarious talk in 2005), but I still thought they provided entertainment.

Part II of Botnets Interview

Part II of my interview on Michael Santarcangelo's Security Catalyst podcast is now available.

(Part I is here.)

Kevin Drum gets it wrong on net neutrality and common carriage

Kevin Drum writes:

The 1996 Telecommunications Act defined two different types of service, information services (IS) and telecommunications services (TS), and cable companies were originally classified as IS and telephone companies as TS.

Right so far, except that Internet service is classified as an information service, not a telecommunications service. Keep that in mind as you read his next two sentences:

Although both cable companies and telcos provide local internet access, the backbone of the internet is carried exclusively by telcos, which were regulated as common carriers under the tighter TS rules. The common carrier rules effectively enforced the principles of net neutrality on the internet backbone.

This is just wrong. Common carriage rules require telcos to allow third parties to connect to their telephony networks or to use their networks for private line connections between two points. Common carriage does not require interconnection to anybody's Internet network. There is not and there has never been a legal requirement that any Internet service provider or backbone allow all comers to connect to their Internet services--and thank goodness, because that means ISPs and NSPs can deny services to spammers or other entities that don't agree to their terms of service/acceptable use policies. ISPs qua ISPs and NSPs qua NSPs are not common carriers!

While there are Internet backbone links that use telco networks, these were typically the networks of long-distance telcos (AT&T, Sprint, MCI) or next-generation fiber telcos (Qwest, Global Crossing, Level 3) rather than the last-mile telcos (such as the Regional Bell Operating Companies). Now AT&T, MCI, and Qwest have been acquired by or acquired last-mile telcos (SBC, Verizon, and U.S. West, respectively), but the last-mile telcos subject to common carriage didn't build the backbones.

Why do net neutrality advocates continue to get this wrong, even after being corrected repeatedly?

UPDATE: BTW, I should note that Harold Feld (who has commented here) has specifically agreed that he'd like to impose common carriage requirements on broadband providers (meaning that last-mile telcos and cable companies would have to allow others to provide services over their access networks, so you could buy Earthlink, AOL, Yahoo, or Panix Internet service from your local cable company or telco--the situation would be like it used to be with DSL providers and local telcos). I'm not sure what other elements he would advocate--whether he'd apply similar requirements to wireless providers (requiring them to let anybody be a mobile virtual network operator), ban QoS, ban anything less than full Internet service over any medium, count non-residential services as broadband, etc. (And Harold, if you read this, I'm still waiting to hear responses from you here (on your own blog) and here (on mine, about HR 5417).)

By contrast, Timothy Karr at Save the Internet has explicitly denied that he's equating net neutrality and common carriage, but hasn't said what he does mean. (And Tim, you haven't responded to my final comment here on your own blog, either.)

UPDATE June 11, 2006: Tim Lee rightly questions Drum on this point as well, asking whether Internet backbones have really been under such regulations, which leads to some further information about peering agreements. I've pointed him to this post from last November about peering (see in particular the linked Geoff Huston paper).

"The Environmental Wars" Skeptics Society conference

Einzige and I will both be at the Skeptics Society conference in Pasadena tomorrow and Saturday and would welcome greetings from any blog readers, assuming the intersection of our readership and the conference attendees is non-null. At least I'll be able to say hello to Chris Mooney, whose blog I read regularly...

Worst net neutrality analogy ever?

From Susan Crawford:

Think of the pipes and wires that you use to go online as a sidewalk. The question is whether the sidewalk should get a cut of the value of the conversations that you have as you walk along. The traditional telephone model has been that the telephone company doesn't get paid more if you have a particularly meaningful call -- they're just providing a neutral pipe.

If you're going to use a sidewalk as an analogy for a communications pipeline, then the users of the sidewalk need to stand for the communications traffic. Then the question becomes, should users of different types have to pay different rates for the use of the sidewalk to those who build and maintain it (not to the sidewalk itself!). Further, the sidewalk has to keep being made bigger to support all the traffic being carried, and some of the users are in a bigger hurry and are likely to collide with those who aren't, and some of the latter are holding big gatherings between their residences, like a block party in the neighborhoods. Should those guys get to do that for free, or at the same cost as their neighbors who aren't interested in a block party?

UPDATE: I had issued a trackback ping to Susan Crawford's blog post which was accepted, but apparently she decided to delete it. That's rather ironic--she supports net neutrality, but blocks critical trackbacks to her blog. I guess her support of net neutrality isn't based on any principle of fairness or free speech.

UPDATE (June 8, 2006): Susan Crawford responded to a query about this, and attributed the deletion to automatic anti-spam defenses, and invited me to re-issue a trackback, which I will shortly do. I retract the last two sentences of the above update, and apologize to her for my erroneous inference.

UPDATE (March 13, 2008): Actually, I never regained the ability to issue trackbacks or even to reference this blog's URL in comments posted on Susan Crawford's Blogware blog, so all of my comments there refer to my discord.org website instead. She moved her blog in late 2007, but I've not commented or issued any trackbacks to the new one.

Fuck jurisprudence

No, that's not an imperative, it's a description of a new area of law explored in a recent law journal article.

(Hat tip to John Lynch at stranger fruit.)

The Abstract Factory on net neutrality

"Cog" at The Abstract Factory has a good, thoughtful post on net neutrality--and gets hit by astroturfing shills in the comments who almost seem to be trying to change his mind. (He comments further on the shills, a few of which have appeared in the comments at this blog, here.)

Scientologists pay another web visit

As I noted in my "Scientology Sampler" post on March 4, my web sites still get periodic visits from Church of Scientology IP addresses, at that time most recently on January 1. They just came by again on May 22, attempting to look at my online copy of Russell Miller's biography of L. Ron Hubbard, Bare-Faced Messiah, as well as the article I co-authored with Jeff Jacobsen, "Scientology v. the Internet," and my skeptical links pages on Scientology. Here's an example web log entry:

[Mon May 22 11:42:00 2006] [error] [client 205.227.165.11] client denied by server configuration: path deleted/03.3.jl-jj-scientology.html, referer: http://www.google.com/search?hl=en&lr=&rls=GGLD%2CGGLD%3A2005-09%2CGGLD%3Aen&q=Jim+Lippard+Scientology

Then, yesterday afternoon, this blog got a visit and a comment (from a brand-new Blogger account) on my post on Arizona legislators accepting trips from the Church of Scientology in return for sponsoring bills for Scientology's front group the Citizens Commission on Human Rights. This poster, asking why I don't support Scientology's mental health efforts, came across the entry by Googling for "CCHR":

Time of Visit           May 29 2006 4:49:43 pm
Last Page View          May 29 2006 4:59:42 pm
Visit Length            9 minutes 59 seconds
Page Views              4
Referring URL           http://search.blogger.com/?ui=blg&q=cchr
Search Engine           search.blogger.com
Search Words            cchr
Visit Entry Page                http://lippard.blogs...ponsoring-bills.html
Visit Exit Page         http://lippard.blogs...ponsoring-bills.html
Out Click               a number of Arizona legislators have been sponsoring bills
http://www.azcentral...cientologists11.html
Time Zone               UTC-6:00

This individual's source IP, however, is an Ameritech/SBC IP out of Springfield, Illinois (not a big Scientology stronghold like Los Angeles or Clearwater, FL). Illinois is, however, the location where Scientology won a battle to get an exhibit that compares psychiatry to Nazis put back on public property in the Thompson Center--so it looks like the CCHR Chicago has a bit of pull.

Anyway, this is a good opportunity to recommend reading Janet Reitman's "Inside Scientology" from Rolling Stone magazine from February, an excellent overview and introduction to Scientology's beliefs and history.

Children detained at Guantanamo Bay

The London Independent reported yesterday that more than 60 detainees at Guantanamo Bay were under 18 at their time of capture, including some boys as young as 14. One child prisoner, Mohamed el Gharani, was accused of involvement in a 1998 al Qaeda plot in London, even though he was 12 years old at the time and living with his parents in Saudi Arabia.

British officials say the UK had been assured that juveniles would be held in a special facility called "Camp Iguana," but only three juveniles were treated as children.

A senior Pentagon spokesman says that no one being held now at Guantanamo Bay is a juvenile, though London lawyers say there are at least 10 still being held who were 14 or 15 when captured. (Those statements are not contradictory.)

Dishonesty from Paul Nelson

Paul Nelson, who has usually been known as one of the few honest major advocates of intelligent design at the otherwise disreputable Center for Science and Culture at the Discovery Institute, has fallen temptation to make his case stronger by being deceptive about what one of his opponents said in a debate. Ed Brayton gives the full account.

UPDATE (May 30, 2006): The discussion continues, with Paul Nelson's involvement in the comments, here.

Wine shipping in Arizona to become legal

Despite the attempted astro-turfing by beverage distributors, Arizona Senate Bill 1276 has passed. Actually, the wholesalers agreed to a compromise--the bill only allows shipping by wineries that produce less then 20,000 gallons of wine per year (and which obtain an Arizona domestic farm winery license and pay state taxes). The fact that the wholesalers agreed to a compromise based on wine production shows that they didn't really believe their own arguments that this created a new risk of underage drinking.

More on last-mile options in Phoenix

I've posted this as an update on the original post, but it's also worth bringing out as a separate posting. I've made a few minor changes here (e.g., to insert the point about Cable America that is made elsewhere in the original post).

Douglas Ross (directorblue) has called this list "bogus" and claimed that only two of the options (Qwest and Cox) actually count. He rightly dismisses Cable America from the list on the grounds that Cox entered into an agreement to acquire them in January of this year--I grant his point and that reduces the number of broadband providers by one.

He dismisses Covad because it uses Qwest last-mile wires, but goes on to say, inconsistently, that he would count other cable resellers if the Brand X decision had gone the other way and providers like Cox were forced to enter into relationships like Covad has with Qwest. My observation is that if those reseller relationships exist and the reseller provides access to its own Internet network, then that is enough to foster a competitive environment. It doesn't matter whether it's government-mandated, it matters whether it exists.

Doug rejects all the wireless options out of hand on the grounds of Verizon's EVDO terms-of-service. (His section about why WiMax isn't viable doesn't actually discuss WiMax at all, only EVDO terms-of-service.) He misses the point that Sprint Broadband and Sprint EVDO are *two different services*--he doesn't actually give a reason to reject Sprint Broadband.

He says he doesn't understand why I put the City of Tempe's municipal WiFi network in the list--I did so because Tempe is right in the middle of the Phoenix metropolitan area (and noted Chandler's metro WiFi in-development, which is just south of Tempe, for the same reason). These are real options for people moving to the Phoenix area and for anyone who is willing to move to get different broadband service. (And certainly broadband options in an area are an important factor in choosing a place to live.)

Finally, he rejects HughesNet because it is unsuitable for VOIP or P2P. At least he doesn't say that HughesNet should be mandated to change the laws of physics in order to provide those services under net neutrality.

Doug's position on net neutrality appears to be that nothing counts as broadband unless it supports every application he wants to use. But it's important to note that the net neutrality bills in Congress *do* count all these options and place regulations on them--they count anything as broadband that is greater than 200kbps in one direction, whether wired or wireless. I don't see Doug volunteering to exempt things he doesn't count as valid broadband options from broadband net neutrality restrictions.

It appears to me that Doug's position is that whoever builds an infrastructure capable of supporting what he wants has to provide it to him, without recovering the costs of that infrastructure by charging any third parties. But I bet he also is unwilling to pay an unsubsidized rate to use such a service.

(UPDATE: I was just looking at Doug's blogroll, and he's pretty strong evidence that net neutrality positions don't necessarily correlate with political positions. Doug's political blog links include Michelle Malkin, Little Green Footballs, and the dishonest nutcases at "Stop the ACLU.")

Dave Siegel on QoS and net neutrality

Dave Siegel has given a very brief introduction to QoS (with some specifics about how it's engineered into Global Crossing's network today) and chimed in on the net neutrality debate.

A bit more detail about how QoS has been a problem in some networks but successfully engineered into Global Crossing's network can be found in this presentation by Dr. Xiao Xipeng of Alcatel, "The Elusive QoS" (PDF). Xiao Xipeng was one of the designers of QoS for Global Crossing and is the author or co-author of numerous IETF standards for QoS.

Good Math, Bad Math blog on Dembski's "Searching Large Spaces"

I'm about a month late in linking to this, but Mark Chu-Carroll has done a good job of debunking the Dembski's "Searching Large Spaces: Displacement and the No Free Lunch Regress." He shows that Dembski's use of the NFL theorems is dishonest and inappropriate (even after he's repeatedly been told that, even by the discoverer, David Wolpert), involves jargon-filled misdirection, and proves nothing.

Save the Internet: Fighting astroturf with astroturf

As the InOpinion blog has pointed out, Save the Internet-generated form letters have been published as letters to the editor here, here, and here. This is ironic given their complaints about astroturf by "Hands Off The Internet."

InOpinion has a project to identify astroturf where it appears, which appears to be nonpartisan.

35th Skeptics Circle

I've been a bit lax on reporting blog carnivals... the 35th Skeptics Circle is up at Skeptico's blog, and includes a contribution from Einzige.

Consumer broadband last-mile competition in the Phoenix metropolitan area

Net neutrality advocates claim that telcos (meaning the local telco providers) have a "virtual monopoly" on consumer broadband, or that they have a duopoly with the cable companies. In many regions, this is true, or nearly so (thus the "virtual" qualifier). (Note, however, that the statement becomes transparently false if it's not restricted to consumer broadband. There are far more options for Internet service for businesses, especially businesses that can put equipment into colo facilities.)

But if you look at the metropolitan Phoenix area, there are quite a few competing consumer broadband providers, e.g.:

* Qwest, the Regional Bell Operating Company formerly known as U.S. West, provides DSL services (as well as higher bandwidth wired connections from fractional T1 and up, and I think they still offer ISDN). This is one of the evil telcos that is enemy number one for many net neutrality advocates.
* Covad, a DSL provider that uses Qwest's last-mile network in Phoenix. In 2003 Covad acquired all of Qwest's business DSL customers, and it appears that they will or have exited the consumer broadband market--however, they can provide business-class DSL service to my residence (which is interesting because Qwest says they can't). Covad is also actively pursuing WiBro (wireless broadband, a Korean standard) and WiMax (wireless broadband, an Intel standard that will now be compatible with WiBro).
* Cox Communications, a cable company, provides cable modem services. (They also have higher speed connections for businesses.) Cox has done very well in recent years in taking away customers from Qwest for voice telephone services, as well as out-competing Qwest's DSL offering for consumer Internet access. I currently use Cox Business Services to my home.
* Cable America, a competing cable company, provides cable modem services in parts of the east Valley. (UPDATE May 27, 2006: As Douglas Ross (directorblue) has pointed out, Cox entered into an agreement to acquire Cable America in January 2006, so this doesn't really count as an independent broadband provider.)
* Sprint Broadband, a long distance and wireless provider, offers a point-to-point wireless broadband service (previously People's Choice, which Sprint acquired). Sprint also offers EV-DO mobile wireless service.
* Alltel, a wireless provider, offers EV-DO mobile wireless service (which is actually using Sprint's EV-DO network).
* Verizon Wireless, a wireless provider, offers EV-DO (3G) mobile wireless service.
* HughesNet, a satellite-based wireless provider (previously DirecWay, and DirecPC before that), offers satellite connectivity (with high latency as a drawback imposed by the laws of physics).
* City of Tempe municipal wireless service, provided and managed by NeoReach. Similar service is being deployed to the City of Chandler, also by NeoReach.

There are no doubt others I've missed--if you're willing to pay for business service, many providers can get that service to your home, which includes services like a T1 connection (where your provider, if not Qwest, will have to pay monthly local loop charges to Qwest and pass that along in your bill) and may include other sources of wireless service. When I had a Global Crossing T1 to my home, the local loop costs were slightly over $200/mo--consumer broadband, by contrast, costs substantially less for more bandwidth, at least in the downstream direction, when delivered to a residence. On the other hand, bandwidth costs in a colo facility can be as low as $10/Mbit/mo, in quantity, i.e., $1000/mo for a 100Mbps Ethernet port. You pay more per Mbit to get data to your residence because of the costs of getting the data out to all those residences and the overhead of dealing with a lot more customers whose individual bills are much smaller than those of a business, and who, on the average, need a lot more hand-holding and support.

Salt River Project, a power generation and transmission company (and a water delivery/irrigation company) that operates in Phoenix, also has about 1,000 route-miles of fiber throughout the city. It resells its excess capacity to businesses (including Qwest) from the entity SRP Telecom. I don't know if they would ever consider using their network to provide consumer services themselves, but there's clearly the potential for a consumer broadband provider to purchase capacity on their network in order to move data around the city.

In Phoenix, if one provider decided to start blocking access to or degrading certain kinds of services that their customers want, there are multiple alternative options. Any provider that engaged in such behavior would see an increase in churn, to the benefit of its competition.

UPDATE (May 27, 2006): Douglas Ross (directorblue) has called this list "bogus" and claimed that only two of the options (Qwest and Cox) actually count. He dismisses Covad because it uses Qwest last-mile wires, but goes on to say, inconsistently, that he would count other cable resellers if the Brand X decision had gone the other way and providers like Cox were forced to enter into relationships like Covad has with Qwest. My observation is that if those reseller relationships exist and the reseller provides access to its own Internet network, then that is enough to foster a competitive environment. It doesn't matter whether it's government-mandated, it matters whether it exists. Doug rejects all the wireless options out of hand on the grounds of Verizon's EVDO terms-of-service. (His section about why WiMax isn't viable doesn't actually discuss WiMax at all, only EVDO terms-of-service.) He misses the point that Sprint Broadband and Sprint EVDO are *two different services*--he doesn't actually give a reason to reject Sprint Broadband. He says he doesn't understand why I put the City of Tempe's municipal WiFi network in the list--I did so because Tempe is right in the middle of the Phoenix metropolitan area (and noted Chandler's metro WiFi in-development, which is just south of Tempe, for the same reason). These are real options for people moving to the Phoenix area and for anyone who is willing to move to get different broadband service. (And certainly broadband options in an area are an important factor in choosing a place to live.) Finally, he rejects HughesNet because it is unsuitable for VOIP or P2P. At least he doesn't say that HughesNet should be mandated to change the laws of physics in order to provide those services under net neutrality.

Doug's position on net neutrality appears to be that nothing counts as broadband unless it supports every application he wants to use (even though the proposed net neutrality bills count anything as broadband that is greater than 200kbps in one direction--they don't restrict it to wireline services), and that whoever builds an infrastructure capable of supporting what he wants has to provide it to him, without recovering the costs of that infrastructure by charging any third parties. But I bet he also is unwilling to pay an unsubsidized rate to use such a service.

Newmark vs. McCurry on net neutrality

Craig Newmark of Craigslist and Mike McCurry of "Hands Off the Internet" debate "Should the Net Be Neutral?" at the Wall Street Journal. I'm struck by a number of things that Newmark says:

Do you believe Yahoo should be allowed to outbid Google to slow down Google on people's computers? That's the kind of thing that the big guys are proposing.

In fact, nobody has proposed slowing down anything--the consumer broadband telcos have proposed adding new, higher-bandwidth physical circuits (fiber to the home) which contain virtual circuits dedicated to content with requirements for higher bandwidth and low latency and jitter, for which the primary application they have in mind is IP television. And they want to charge content providers to use those virtual circuits. Now, one can argue that dedicating bandwidth to new applications that content providers have to pay for will have a future consequence that Internet bandwidth will be consumed and not upgraded, leading to degradation for best-effort Internet services, but that requires argument to support the likelihood of that outcome in the face of competition from cable companies and wireless providers.

With all that empty fiber, bandwidth is not an issue. A bigger issue is that we're running out of [Internet protocol] addresses. The new net protocols, IPv6, address that, but the big telecoms are already very late implementing that. (Hey, I'm an engineer, and their engineers talk to me.)

Newmark is confusing Internet backbone bandwidth with last-mile consumer broadband bandwidth. I've addressed this confusion at length. BTW, IPv6 is rife with difficulties and not quite ready (or useful) for the average consumer, but my employer, Global Crossing, has been one of the first to make it widely available to its customers. (I run IPv6 on my home network via a tunnel to Global Crossing.)

No one's talking about "government lawyers and regulators engineer[ing] the future of the Internet," except, well, you, Mike. We're trying to prevent that, and trying to get Congress to maintain the level playing field we have right now, that the FCC just tried to ruin. We're just asking everyone to play fair.
...
I'm being completely straight: no one's interested in regulation in the sense you're thinking, we just want the existing level playing field to continue… Beyond that, we're not interested in mandating performance criteria, none of that stuff.
...
What we're looking for is just fairness, a level playing field, no regulation or stuff like that. In America we believe that if you play fair and work hard, you get ahead. We don't want the government to give special privileges to the big guys, particularly not at the expense of small business and consumers. We don't want more regulation and we don't need lawyers involved where the free market functions well. I guess we're for capitalism.

Here, Newmark is simply failing to recognize what's in the actual network neutrality bills in Congress, which have unintended consequences about how networks are engineered, what can be in acceptable use policies, what kinds of contracts network providers are permitted to enter into with their customers, and how they can charge for access to different services--rules that to date have not existed for Internet services.

Today, many Internet providers have acceptable use policies that prohibit spam, going beyond the requirements of the relatively weak federal CAN-SPAM law. Under all of the net neutrality bills I've seen, providers must permit customers to send or receive any "lawful content," which forces them to reduce their AUPs to the lowest common denominator of whatever is prohibited by law in the jurisdictions where they provide service. These bills prohibit providers in the United States from setting the conditions of contract with their customers regarding activities they consider abusive which are not codified in law. The "pink contract" would thus become a government mandate.

UPDATE: FCC Commissioner Michael Copps and U.S. Supreme Court Justice Clarence Thomas back up McCurry's statement in this debate that the FCC already has authority under Title I to prevent anti-competitive discrimination without the need for new statutory powers from Congress.

McCurry at the WSJ:

And doesn't the FCC have authority already (under Title I) to step in and act if necessary?

Copps:

The Federal Communications Commission has authority under current law to ensure that broadband-access providers -- currently mainly cable and phone companies -- do not discriminate against Web-based providers of content, search services and applications, FCC commissioner Michael Copps said Tuesday.

Thomas:

“The [FCC] remains free to impose special regulatory duties on facilities-based [Internet-service providers] under its Title I ancillary jurisdiction,” Justice Clarence Thomas wrote in National Cable & Telecommunications Association vs. Brand X Internet Services.

This means net neutrality advocates who support the bills in Congress don't think this is enough, and owe an explanation of specifically what powers they want to add to the FCC, what rules they want the FCC to make, and how those rules will be enforced.

"Net Neutrality" expands to absurdity

Jim Durbin writes that he supports net neutrality because of fears about companies blocking access to certain websites at the enterprise. In his opinion, apparently, net neutrality not only means that ISPs can't block access to lawful content, neither can employers. No net neutrality bills would take away the ability of enterprises to restrict corporate Internet access to business-related content and use products like web proxies, but it's a symptom of the fuzziness of "net neutrality" that Mr. Durbin thinks this is a reason to advocate it. What's next, a claim that the use of firewalls is contrary to net neutrality principles?

Durbin approvingly links to an article by Glenn Harlan Reynolds about employees using pirate WiFi or resorting to bringing in personal equipment with EVDO cards in order to get their Internet or blogging fix at the workplace. Reynolds and Durbin both seem to think that companies should have no right--or at least no ability--to ban such things from the workplace unless they have "big trade-secret issues" or involve national security. Now, there's a big distinction between pirate WiFi (connecting an unauthorized device to a company's internal network, most likely exposing its internals to the outside world) and using your own equipment over a wireless connection to a provider that you pay for yourself. In the former case, it's making unauthorized changes to the company's own network and security mechanisms, while in the latter the issue is more an issue of whether you're doing the job you're being paid to do. But none of this should have anything to do with the "net neutrality" debate.

Hillary Clinton and Net Neutrality

Adam Thierer of the Cato Institute expresses his bafflement over why people have such faith that instituting government regulations to enforce net neutrality will result in beneficial protection for free speech, when historically Congress has shown little support for the principle. He points out the irony of Hillary Clinton calling for net neutrality in the name of protecting free speech, when she has on multiple occasions called for and supported government restrictions on free speech, including on the Internet. She supported the Communications Decency Act, most of which was overturned by the U.S. Supreme Court as unconstitutional. She supports regulation of video game content. She pushed the V-chip.

Does anyone really believe that the regulated Internet Hillary Clinton wants to see won't ultimately result in any new restrictions on freedom of speech? Especially since the net neutrality bills propose giving regulatory authority over the Internet to the FCC, the same agency that is more aggressive at fining broadcasters for "indecent" content than addressing telemarketing fraud?

David Siegel, Global Crossing: telco blog pioneer

Martin Geddes has interviewed my co-worker Dave Siegel, and the results are up at his blog, Telepocalypse.

Botnet interview on the Security Catalyst podcast

I did an interview over the weekend with Michael Santarcangelo of the Security Catalyst about botnets. Part I of that interview is available now as a podcast (you can subscribe via Yahoo or iTunes).

UPDATE: Part two is here.

Bush administration on NSA suit: Courts have no right to address the issue

Ed Brayton points out a paragraph from an AP story that says:

The Bush administration has urged a judge to dismiss a similar case, saying it threatens to divulge state secrets and jeopardize national security. The government argued in briefs that the courts cannot decide the constitutionality of the president's asserted wartime powers to eavesdrop on Americans without warrants.

As Ed observes,

If the courts cannot decide the constitutionality of such programs, then we might as well not have a constitution or courts at all.

Net Neutrality and Fair Use

Larry Lessig has posted an interesting blog article comparing net neutrality to fair use, and asking whether there's a problem in consistency on the part of those who favor one but not the other. As someone who more strongly supports laws recognizing fair use than regulated net neutrality, I agree with the reasons given by several of the posters (including Kevin Farnham, Jeremy, Cory Doctorow, three blind mice, and poptones). It seems that some of the better reasons to question creating a regulatory regime for net neutrality are present in these comments--I'm pleasantly surprised to see that the comments appear to be dominated by net neutrality skeptics.

Some of the highlights:

* Fair use is a limitation on rights pertaining to intellectual property, while net neutrality is a limitation on rights pertaining to physical property--Lessig's own excellent book Free Culture points out that intellectual or creative property is different from physical property in significant ways.
* The burden of proof on a fair use claim is on the person claiming fair use, not the copyright owner; in net neutrality the burden is on the property owner.
* Fair use is really a limitation on a government regulation (copyright), while net neutrality is a regulation that's a limit on business models, contracts, and technology.
* Net neutrality advocates have not been clear about what they would require and prohibit, how violations will be detected/measured, and what the enforcement mechanisms will be. (I don't trust Congress to tell network engineers how to do their jobs.)

Dirty Politician: William Jefferson

Rep. William Jefferson (D-LA)'s Washington office was raided last night, and the FBI has disclosed portions of recorded conversations last year between Jefferson and an informant. The informant had paid Jefferson $100,000 in $100 bills (caught on videotape by the FBI) to be delivered to an official in Nigeria. In a telephone conversation on August 1 which the FBI has partially disclosed, Jefferson and the informant spoke to each other in code about the bribe money, which was recovered from Jefferson's freezer during a police search on August 3. In that conversation, the informant asked about the status of "the package." Jefferson replied that "I gave him the African art that you gave me and he was very pleased."

Jefferson apparently had the objective of getting work in Africa for a communications company, and getting his children a cut of that deal.

Via Talking Points Memo.

Yglesias on McCurry

Matthew Yglesias, covering for Joshua Micah Marshall at Talking Points Memo, writes of Mike McCurry's battle with bloggers over net neutrality:

People disagreed with McCurry about the net neutrality issue because people disagree about issues. People got so mad at him precisely because of this kind of patronizing attitude. He was peddling flimsy arguments as if it never occurred to him that the blogosphere is full of people who know a lot about the internet and could handle a grown-up argument (see a non-flimsy, though ultimately unpersuasive, anti-neutrality piece if you're interested).

One of the most neglected aspects of the blogosphere, in my opinion, is that precisely because it's (mostly) composed of people who aren't professional journalists, it's composed of people who are professional doers of something else and know a great deal about what it is they "really" do. Consequently, the overall network of blogs contains a great deal of embedded knowledge. The consensus that emerges from that process can, of course, be mistaken but even though the most prominent people expressing that consensus may not be experts in the subject at hand (the most prominent bloggers tend to be generalists), the consensus will almost always be grounded in some kind of well-informed opinions. If you want to push back on that, in other words, you'd better know what you're talking about and not treat your audience like a pack of mewling children.

While I agree that McCurry was occasionally patronizing in what he posted, at least he hasn't gotten his facts as wrong as Matt Stoller at MyDD, Adam Green at the Huffington Post, the "Save the Internet" Coalition, or Art Brodsky at Talking Points Memo. These guys don't know the difference between net neutrality and common carriage, don't understand who or what common carriage applies to, don't understand how or why network service providers interconnect, don't understand the utility and current uses by providers of QoS, don't understand the unintended negative consequences of bills like HR 5417, and have a naive faith that the FCC will act only as a force for freedom and goodness.

The fact is that most of the material being posted by bloggers in favor of net neutrality regulation is by people who are not experts in how the Internet works--while there are certainly advocates of net neutrality among those who operate Internet networks (and I myself am supportive, with qualifications, of the four principles in the FCC policy statement), my perception is that most of them favor keeping government out of it as much as possible and agree with the additional six principles advocated by McCurry's organization, "Hands Off the Internet."

Bad unintended consequences of HR 5417

(I should preface this by saying that I am not a lawyer, only a relatively well-informed layman who has demonstrated the ability to win lawsuits against telemarketers without using an attorney.)

Some network neutrality advocates are promoting James Sensenbrenner and John Conyers' HR 5417 as a step in the right direction for putting network neutrality into law. But HR 5417 is a badly written bill with some serious negative implications. (There are a bunch of other network neutrality bills in the works, which I haven't yet examined.)

First, it turns all NSPs and ISPs into "broadband network providers" even if they don't provide any residential consumer services. All that matters is whether you provide two-way Internet at speeds of 200 kbps or greater.

Second, it prohibits preventing anyone from sending or receiving traffic that is legal. This means ISPs cannot have acceptable use policies against spammers that go beyond what is required by the federal CAN-SPAM law except in states which have stricter laws, and they have to sell service to known spammers who comply with CAN-SPAM, and you can't kick adware companies off your network until and unless the specific abusive actions they are taking are made illegal.

Third, it says that if you provide a custom service like IP Video or VOIP interconnection at a higher class of service, you must allow your customers to connect to that "type" of service to any other provider of IP Video or VOIP, regardless of location, whether those providers are customers of yours or not. But if you don't provide those services over the Internet, who is supposed to bear the costs of interconnection to providers who aren't customers?

Fourth, it prohibits all restrictions on what devices users can connect to the network except on grounds of physical harm or degrading the service of others. But what if you offer a specialized service that only supports some vendors' equipment, and has to have a particular configuration to function properly? This seems to say that you have to let customers configure unsupported or incorrectly configured equipment to the network.

This bill is a nice example of bad unintended consequences.

(Also see Richard Bennett's Original Blog.)

Misinformation from "Save the Internet"

The little cartoon movie from "Hands Off the Internet" (an organization funded by member organizations that include major telcos and equipment vendors) has led to a response from "Save the Internet" (advocates of net neutrality funded by MoveOn.org and others).

"Save the Internet" claims that the cartoon is "a clever piece of industry propaganda that is riddled with half-truths and outright lies." It then quotes a few passages from the cartoon and offers responses. Unfortunately, it is "Save the Internet"'s response that contains misinformation, and it fails to point out any alleged lies.

In what follows, I'll quote directly from the "Save the Internet" response (including the quotes from the "Hands Off" cartoon they are responding to) and then respond to each point.

The big telecom companies say: "Is the Internet in Danger? Does the Internet need saving? It keeps getting faster. We keep getting more choices."

The truth: Right now AT&T and others want to take away your choices and control what you can do and watch online. They're on their best behavior while trying to convince Congress to hand over the Internet. But if their high-priced lobbyists get their way in Washington, the Internet as we know it will be gone. Network Neutrality has always curbed the control of the network owners, invited competition and encouraged innovators. It's what made it possible for entrepreneurs and creative thinkers to prosper online. None of the big ideas that made the Internet the innovative engine it is today came from the cable or telephone companies.

Notice that there's no evidence supplied to support the claim that "AT&T and others want to take away your choices and control what you can do and watch online." What the telcos want to do is build new last-mile consumer services by installing a new fiber-to-the-home infrastructure, over which they can offer services in addition to and distinct from the public Internet, just as they currently offer voice telephony as a service separate and distinct from the public Internet. Specifically, they want to offer digital television services and potentially new services which they control, following the model of the cable industry. The telcos' real desire is to compete with the cable industry and be regulated in much the same way. They further want to be able to charge content providers to be able to provide services over this new fiber, because they know that consumer fees alone are not sufficient to recover their costs in rolling out this new infrastructure. (BTW, my opinion is that just as the cable companies lost leverage over content providers as a result of competition from direct broadcast satellite, telcos will lose or fail to gain leverage over content providers using new services over fiber-to-the-home, as a result of competition from wireless broadband providers, as well as from cable companies.)

The big telecom companies say: "Building the next generation of the Internet is going to take a lot of work and cost a lot of money. And some big corporations can't wait to use it.... They're going to make billions. But they don't want to pay anything. Instead they want to stick consumers with the whole bill."

The truth: Nobody is getting a free ride on the Internet. Any Web site or service you use on the Internet has already paid these providers to reach you -- just like you pay to send e-mail and download files. In fact, total expenses from major content and service providers to expand network capacity totaled about $10 billion last year. But the cable and phone companies want even more -- forcing content providers to pay protection money to get a spot in the fast lane. Who do you think will pay that bill? You will … big time. The costs will be passed directly to consumers. If Net Neutrality is so bad for consumers, why do ALL the major consumer groups support it and ALL the major phone companies oppose it? Who do you trust more to defend your Internet rights? Without meaningful protections of Net Neutrality, there will be less choice on the Internet and higher prices, at a time we're already falling far behind the rest of the world.

It's true that content providers are paying Internet providers today to reach the "eyeball customers" of the telcos and cable companies. But they are reaching them over today's best-effort Internet, not over the new infrastructure they want to build out. Now, here there is a real issue, but it's one that advocates of net neutrality have tended to obscure rather than illuminate, and that is that today, telcos are required to allow other Internet providers to provide service over their last-mile consumer broadband (DSL) circuits, and the courts recently ruled that this will no longer be required, putting the telcos on the same footing as the cable companies, which have never been required to share their networks. The difference between the two is that the telcos were given free rights-of-way to build their networks, were given monopoly status for local telephony status, and received huge tax breaks and subsidies in the form of universal service fees collected from long distance providers; this form of public funding justified the common carriage requirements that made them allow their networks to be used by other players that compete with them. The cable companies, by contrast, got none of these benefits and have to pay a portion of their revenues to local municipalities as part of their franchise agreement in an area. The cable model actually seems to be a better model and to be more competitive, though I think both are far from ideal. In any case, the empirical evidence is that the more competition there is for broadband Internet services, the lower the costs to consumers and the more innovation we see.

The big telecom companies say: "These corporations are asking Congress to create volumes of new regulations to control how content is delivered over the Internet. Should politicians and bureaucrats replace network administrators? It will be the first major government regulation of the Internet and it will fundamentally change how the Internet works. These big corporations and the SavetheInternet campaign want the government to take control of the Internet."

The truth: There's nothing new about Net Neutrality. It has been a fundamental part of the Internet since its inception. As a tenet of communications policy, it goes back some 70 years. Only last year did the Supreme Court uphold a bad decision by the Federal Communications Commission to do away with the rules that forced cable and phone companies to open up their networks to competitors. Those rules protected Internet freedom by ensuring lots of competition (think of all the choices you've had for long distance service or dial-up Web access). In fact, these rules still protect the Internet under a temporary FCC ruling. All a Net Neutrality law would do is maintain the even playing field we've always enjoyed -- by preventing big cable and telephone corporations from taking over as gatekeepers.

Now here's where "Save the Internet" goes completely off the rails. Net Neutrality has not been "part of the Internet since its inception" nor does it go back 70 years. This is a confusion about common carriage requirements on telco's networks vs. Internet services. When other DSL services use telco last-mile circuits to reach their customers, they are providing their own Internet services, not the telcos. They aren't using the telco's Internet networks at all. ISPs have never been classified as "common carriers" or required to connect anyone to their networks. Rather, they've been classified as information services or enhanced services, and exempted from common carriage requirements. Internet interconnection is governed by peering arrangements which are arranged either privately between two ISPs or network service providers, or by connecting to a public peering point and governed by the rules of the organization managing that peering point (itself a private, not government, organization).

The sentence about the Supreme Court upholding a bad FCC decision "to do away with the rules that forced cable and phone companies to open up their networks to competitors" is just mistaken in its inclusion of cable companies. Cable companies have never been required to open up their networks to competitors.

(UPDATE May 21, 2006: Timothy Karr of Save the Internet says that the "goes back some 70 years" remark does not refer to common carriage, but he hasn't yet told me what it is referring to. I'll update this entry when he does.)

The big telecom companies say: "The net neutrality issue is a fundamental question about who should control the Internet: The people or the government? And it's a fight about who's going to pay: multi-billion dollar corporations or you?"

The truth: Who should control the Internet? Now that's a good question. But the real choice we face is whether we're going to keep the good government policy that has protected Internet freedom, created a truly free market in content and services, and encouraged free speech to flourish online -- or let predatory companies like AT&T and Comcast rewrite our telecommunications law and place their chokehold on online content and services. For the entire history of the Internet, Web sites and online ideas have succeeded or failed on their own merit based on decisions now made collectively by millions of users. Getting rid of Net Neutrality will hand these decisions over to a cartel of broadband barons. Do we really want Ma Bell and the Cable Guy picking the next generation of winners and losers on the Internet?

This repeats the false claim that net neutrality has been a government policy in force all along, when in fact what "Save the Internet" is advocating is the introduction of new laws which give the FCC the power to regulate the Internet. What "Save the Internet" fails to recognize is that the telcos are an extremely powerful lobbying force in Washington, D.C., and that giving the FCC this power will not change that. Further, the FCC is run by commissioners who want to do more to regulate content for "indecency," and, if given the power to regulate the Internet, that would likely not be far behind. If they have the power to say that ISPs must allow service to X, they're probably also going to have the power to say that ISPs must not allow service to Y. But those are decisions that should be left in the hands of the ISPs, in a competitive environment where the consumer has the power to switch ISPs.

"Save the Internet" tends to avoid spelling out specifically what they are asking for, which is the biggest problem with "net neutrality" advocates. The term seems to mean different things to different people, and a lot of people interpret it to mean prohibition on certain kinds of contractual arrangements and services between providers of network services and their customers that are already common and extremely useful today (e.g., paying for different classes of service).

If you want a better understanding of the issues in the "net neutrality" debate, I can't recommend a better source than the Stifel/Nicolaus analysis, "Value Chain Tug of War" (PDF). Read it, and whichever position you argue for will be better served.

(UPDATE May 20, 2006: Here's a much better commentary on the "Hands Off" cartoon from a net neutrality advocate, Harold Feld, though he also gets some facts wrong. For example, he says that at the time of "Computer Proceedings I" (1971) AT&T was "the only telephone company." It was by far the major player and had attempted earlier to acquire the rest, but this was put to a stop in 1913 via anti-trust action when it tried to acquire Western Union. It was required to allow the remaining independent local telco players to interconnect. These included Rochester Telephone in NY (which was my employer when it was called Frontier). In 1971 AT&T had 100 million subscribers and the independents had 25 million.)

Late 1990s NSA program

The Baltimore Sun has reported on a shelved 1990s NSA program to collect and analyze phone records which had the following features:

*Used more sophisticated methods of sorting through massive phone and e-mail data to identify suspect communications.

* Identified U.S. phone numbers and other communications data and encrypted them to ensure caller privacy.

* Employed an automated auditing system to monitor how analysts handled the information, in order to prevent misuse and improve efficiency.

* Analyzed the data to identify relationships between callers and chronicle their contacts. Only when evidence of a potential threat had been developed would analysts be able to request decryption of the records.

Perhaps this program was brought back after 9/11? If such records were maintained with phone number and caller information encrypted until needed, and decrypted only with appropriate legal authorization, would that enable Verizon and BellSouth to truthfully deny having supplied the records to the NSA? I don't think so, unless the system was in the possession of the phone companies and didn't release data to the NSA until legal authorization was obtained. But would such a system be objectionable? So long as the controls genuinely prevented abuse and legal authorizations were really obtained for each use, I don't think it would be. (Via Talking Points Memo.)

BTW, in a New York Times story in which Verizon denied turning over records to the NSA (which BellSouth has also denied), Tony Rutkowski of Verisign is quoted suggesting that the NSA may have collected long-distance phone records rather than local calls. The article notes that Verizon's denial seems to leave the door open to the possibility that MCI, which Verizon recently acquired, had turned over data. Verisign, it should be noted, has been attempting to develop a business where it acts as a third-party manager for subpoenas and wiretapping for phone companies. While the telcos have strongly attempted to block attempts by the government to expand its wiretapping capabilities into the VOIP and Internet arenas (in part on the grounds that the CALEA statutes do not cover them, and also because the infrastructure expense is placed entirely on the telcos), Verisign has supported the government's efforts, as these filed comments with the FCC make clear (red means support for expanded government wiretapping capability, blue means opposition).

You'll note that Verisign is uniformly supportive of the government, and of the three telcos that have come under fire for giving data to the NSA, two are uniformly opposed (BellSouth and SBC (now AT&T)) and one is partly opposed and partly supportive (Verizon). I'm happy to note that my employer, Global Crossing, is not only on record as opposed, but filed comments which addressed more of the issues than most of the other filers.

(UPDATE May 19, 2006: Apparently the 1990s program was called ThinThread.)

Cory Maye's new attorneys file legal brief

Radley Balko at The Agitator is on top of it:

If you’ve read anything at all about this case, I’d urge you to take a look at the brief. I realize that a brief’s legal effectiveness is a very different thing than its general pursuasiveness, particularly briefs filed in almost perfunctory post-trial motions like this one. Since I’m not really qualified to comment on its legal merits, I’ll keep my comments limited to its general pursuasiveness.

To that end, it’s devastating. The difference between the top-notch legal representation Cory Maye has now and the minimal representation he had at trial is striking (and frightening, given the stakes). I can’t see anyone reading this thing through and still believing that Maye is the slightest bit guilty, much less that he should be executed. At worst, you could perhaps make the case that Maye acted recklessly, and might have been tried for manslaughter. I wouldn’t agree. But I probably wouln’t be making trips to Mississippi to investigate, or blathering endlessly on my blog, either. Of course, I still think the guy should not only be released from prison, but compensated.

The brief, from Bob Evans, Orin Kerr, and attorneys at D.C. firm Covington and Burling, is here (PDF). There's also a forensics review here (Word doc), and a review of the autopsy report of Officer Jones here (PDF).

I've had the pleasure of meeting and briefly working with some Covington and Burling attorneys in the past (though none of the ones who worked on this brief), and found them to be incredibly bright and professional people. They also won a multimillion-dollar lawsuit against Fax.com, which makes them good guys in my book.

Net Neutrality and the Pace of Innovation

Some advocates of net neutrality have advocated nationalization of "the Internet backbone" (see, for example, the comments of Paul and Frank at Richard Bennett's Original Blog). The idea that there is such a thing as "the Internet backbone" is itself a confusion about what telcos contribute to the Internet, but what was the pace of innovation when telephony was a highly regulated government monopoly in the United States?

Touch-Tone was developed in the late 1950's.

It was promoted at the Bell System Pavilion at the 1962 Seattle World's Fair, as can be seen in this fascinating short film, "21st Century Calling" (a bonus feature on the DVD of the Mystery Science Theatre 3000 episode, "The Killer Shrews"). Other features promoted in the film include call forwarding and three-way calling.

Bell Labs officially announced Touch-Tone as a feature (PDF) in 1964.

Touch-Tone was rolled out to consumers in the 1980s as a feature which consumers had to pay extra for, even though it cost nothing more to provide. The SS7 electronic switching infrastructure costs were covered by consumer fees such as the monthly fee for Touch-Tone service, and then used to roll out new services to businesses, subsidized by consumers.

Time from innovation to deployment: over two decades.

VA Hospital Spiritual Assessments

Mark Vuletic at the Secular Outpost reports on the Freedom From Religion Foundation's lawsuit against the Department of Veteran's Affairs for conducting "basic spiritual assessments" as part of admissions procedures. The "spiritual assessments" are used to determine whether patients require treatment for "spiritual injury or sickness."

Forever Pregnant / Start Making More Babies

Today's Washington Post reports (via Donna Woodka's blog):

New federal guidelines ask all females capable of conceiving a baby to treat themselves -- and to be treated by the health care system -- as pre-pregnant, regardless of whether they plan to get pregnant anytime soon.

Among other things, this means all women between first menstrual period and menopause should take folic acid supplements, refrain from smoking, maintain a healthy weight and keep chronic conditions such as asthma and diabetes under control.

And, as Stephen Colbert pointed out on last night's Colbert Report, Fox News' John Gibson on May 11 advised his viewers to get busy making more babies:

Make more babies. That's the lesson drawn out of two interesting stories over the last couple days.

First, a story Wednesday that half the kids under 5 years old in this country are minorities. By far, the greatest number are Hispanic.

Know what that means? Twenty-five years and the majority population is Hispanic.

Why is that? Hispanics are having more kids and others, notably the ones Hispanics call gabachos — white people — are having fewer.

Now in this country, European ancestry people — white people — are having kids at a rate that sustains the population, even grows it a bit.

That compares to Europe where the birthrate is in the negative zone. They're not having enough babies to sustain the population.

...

To put it bluntly: We need more babies. Forget that zero population growth stuff of my poor, misled generation.

Why is this important? Because civilizations need populations to survive.

So far we're doing our part here in America, but Hispanics can't carry the whole load.

The rest of you: Get busy. Make babies.

Or put another way, a slogan for our times: Procreation not recreation.

That's My Word.

(Note that the full context of his remarks is not blatantly racist, as it appeared on The Colbert Report.)

Even more serious Diebold voting machine flaws

Harri Hursti of Black Box Voting has released a report (PDF) on yet more flaws (on top of others reported back in December) in Diebold TSx and TS6 Direct-Recording Electronic (or DRE) voting machines. Having a few minutes of physical access to a machine makes it possible to install software, using simple, easily available tools, which will completely compromise the machine in such a way that it will be impossible to tell whether future software updates are successful or not.

Ed Felten and Avi Rubin give more detail at Felten's blog, Freedom to Tinker, and question whether it makes sense to build voting machines based on commodity hardware and operating systems due to these risks. This certainly seems like an application where you'd want hardware-enforced verification of a stripped-down trusted computing platform.

Hursti's report says that there are three layers of software in the Diebold machines: a boot loader, an operating system (customized Windows CE), and an application program (the voting software). Each of the three layers has backdoors which allow bypassing security controls. The report states that "Different files on the system carry various subsets of the following features: Signature check, mode check, and integrity check. None of these can be considered security features against tampering. For example, the integrity check is [redacted]. This check can be equated to a very crude spell-checker. It is effective against accidental typing errors but not deliberate attacks."

The redacted portion, based on the description, is apparently a weak checksum such as CRC (cyclic redundancy check), rather than a cryptographically stronger checksum like MD5 or SHA1 (both of which have weaknesses of their own).

The Hursti report describes how an attacker could exploit the weaknesses at multiple levels to prevent the removal of malicious code. One such flaw (the details of which are redacted from the report) is that inserting a standard PCMCIA memory card into the machine containing a file with the appropriate name will cause the boot loader to reflash itself, installing the code in that file as the new boot loader on the system. As Hursti points out, "Due to the fact that the boot loader is the primary mechanism for its own reprogramming, if the boot loader is compromised with a deep attack, using the boot loader itself to install a known clean version of a boot loader is no longer a viable option as a recovery path to clean the system."

The report goes on to show similar flaws in replacing the operating system image, and points out a voter-accessible hidden button (labeled "battery test") that could be exploited by malicious code as a trigger for an attack.

The recommended defense against attacks is to physically protect the machines--as a machine can be compromised with less than five minutes of physical access, chain of custody evidence must be maintained from the machines' origin to final use, with no unsupervised access.