Category Archives: Security

Terrorist caught in Wisconsin

The Associated Press reports this story as a “river ambush”.

Was this an act of terror?

A dragnet ended Friday with the arrest of a man accused of emerging from woods in camouflage and opening fire with an assault rifle on a group of young swimmers who had gathered at a river. Three were killed and another wounded.

Scott J. Johnson, 38, was in camouflage as he walked out of some woods near the scene of the shooting and dropped his weapon as officers approached, said Jerry Sauve, chief’s sheriff’s deputy in Marinette County.

Seems to have been a terror motive but perhaps it is too early to tell.

Brings to mind the recent shooting in Tennessee, where the attacker killed two people in a church for being too liberal

[Police Chief] Owen said at a Monday news conference that police had recovered a four-page letter in which accused gunman Jim Adkisson, 58, expresses his hatred of liberals and indicated he would keep shooting until police killed him.

Another US veteran who turns to terrorism at home? Joe Lauria seems to say yes. Given that the killer’s house was filled with material associated with well-known anti-liberal groups, the question should become 1) how culpable a group becomes when and if they advocate action against another group and 2) how all the new domestic surveillance will come into play. Humor and commentary of speech obviously plays a confusing role here, as does the privacy of one’s reading choices. If we can ever get beyond those quagmire issues, the shotgun was purchased only a month before the attack. Tragedy, yes. Terrorism?

Symmetric Key Services Markup Language 1.0

Our Enterprise Key Management Infrastructure (EKMI) Technical Committee (TC) has finally been approved by OASIS to release our specification to the public.

Symmetric Key Services Markup Language (SKSML) Version 1.0 public review started July 24 2008 and will end 23 September 2008.

Comments may be submitted to our TC by anyone on the OASIS TC comment system .

Submitted comments (for this work as well as other works of that TC) are
publicly archived. Please note that comments submitted to OASIS are subject to the OASIS Feedback License, which ensures that the feedback you provide carries the same obligations at least as the obligations of the TC members.

The specification document and related files are available here:

Editable Source (Authoritative):
http://docs.oasis-open.org/ekmi/sksml/v1.0/pr01/SKSML-1.0-Specification.odt

PDF:
http://docs.oasis-open.org/ekmi/sksml/v1.0/pr01/SKSML-1.0-Specification.pdf

HTML:
http://docs.oasis-open.org/ekmi/sksml/v1.0/pr01/SKSML-1.0-Specification.html

Schema:
http://docs.oasis-open.org/ekmi/sksml/v1.0/pr01/schema/

Abstract:
This normative specification defines the first (1.0) version of the Symmetric Key Services Markup Language (SKSML), an XML-based messaging protocol, by which applications executing on computing devices may request and receive symmetric key-management services from centralized key-management servers, securely, over networks. Applications using SKSML are expected to either implement the SKSML protocol, or use a software library – called the Symmetric Key Client Library (SKCL) – that implements this protocol. SKSML messages are transported within a SOAP layer, protected by a Web Services Security (WSS) header and can be used over standard HTTP securely.

Salmonella and US Security

One of the lessons of 9/11 was supposed to be greater centralized management of intelligence to improve security in America. It would seem that the salmonella outbreak is proving how well the US government has learned and adapted to the challenge.

The the Associated Press reports that fingers are pointing all over the place, and the industries losing money want answers:

One agency probably zeroed in on tomatoes too early, the committee concluded, while a second failed to tap industry and states’ expertise in trying to trace the source of the contamination.

To the chairman, Rep. John Dingell, D-Mich., the case reminded him of “a Keystone Kops situation.” An investigation that should have taken hours or days instead has stretched on for weeks and months, he said.

This is just the detection side of things. Imagine if a TSA-like approach is used from now on for prevention…

Several lawmakers said the fact that no single agency is in charge may be part of the problem. The CDC is responsible for identifying the pathogen and the type of food that has been contaminated; the FDA is supposed to trace the outbreak to its source.

A single agency? Surely people can figure out how to collaborate? That is the message from outside the government as well:

Thomas Stenzel, president of the United Fresh Produce Association, suggested that public health officials might want to tap outside sources.

“We’re not asking to run the investigation, but there’s an abundance of knowledge in the industry that can help protect public health,” he said.

Not sure I would trust the UFPA, given how tasteless and uniform-looking the tomatoes are in America. Even so, they should certainly be allowed to assist with investigations. Collaboration is good. Compliance and governance is good. Too bad people have such a hard time working together on this.

Separately, the FDA rejected the Mexican government’s assertion that U.S. investigators had erred in identifying irrigation water at a Mexican pepper farm as a possible source of contamination. Mexican authorities said Thursday the sample their U.S. counterparts called “a smoking gun” came from a tank that had not been used to irrigate crops for more than two months.

Have to keep all this in mind the next time I speak about using centralized management and correlation tools. Federation of information is probably the better answer for massive data-sets spanning organizational boundaries.