Category Archives: Security

Civil War Vignere Cipher Code Decrypted

An interesting Telegraph story describes how a Civil War vignere cipher code message in a bottle has been decrypted.

A message in a bottle sent to a Confederate general during the Siege of Vicksburg, one of the key turning points of the American Civil War, has finally been deciphered [by the CIA] after 147 years.

Source: Daily Mail

See also the 2007 CIA publication “Intelligence in the Civil War” (PDF)

Rotten Chicken Sold to Black Neighborhoods

A row has started in South Africa over chicken targeted for sale in black neighborhoods. The BBC reports poultry makers now stand accused of being ‘racist’

Blade Nzimande said that the poultry industry was selling “rotten” meat to black people.

He said chicken past its best-before date was being recycled – thawed, washed and injected with flavouring – then sold to shops in black townships.

A spokesman for the poultry industry admitted the practice takes place, but said it was both safe and legal.

Is it fowl play to serve recycled chicken? In America it’s called Kentucky Fried Chicken. I’m kidding, of course…

Here is the real punch-line to this story. The South African poultry industry says not to worry because their internal safety practices are higher than baselines set by regulators. They themselves check the chickens before they try and squeeze a few more dollars out of those old smelly carcasses.

[A spokesman for the poultry industry said] the chickens were tested and certified by the producers before being sent out again and that these standards were actually higher than those required by the department of health.

But he also accepted that re-worked chicken did not go on sale in major supermarkets, which served the country’s wealthier suburbs.

Internally certified is like saying non-certified certification. I hear this kind of reasoning all the time in information security. Experts tell me their internal security practices are better than compliance. It’s a lot like contestants who get eliminated from American Idol and protest that the judges can’t tell real talent. So now I have to wonder if security professionals would take a different view on regulations if we’re talking about old chicken meat.

Which of them believes, in other words, they can trust the poultry industry standards more than the department of health? Does the department of health really allow chicken repackaging and resale, or is it a loophole? Maybe I should serve some chicken at the start of my next compliance presentation, tell this story, and see who keeps eating.

Sell-by and use-by dates are notoriously misleading and irregular in America. I often find people do not realize that they are not required by regulators for anything but food for babies. It clearly serves the industry to set expiration dates but not necessarily the consumer, as the above story illustrates.

The FDA page on Safe Eats – Meat, Poultry & Seafood, for example, does not mention anything about spoiled chicken indicators, but it has a section on fish.

“How can I tell if fish is fresh?”
Perfectly fresh fish and shellfish have virtually no odor. It’s only when seafood starts to spoil that it takes on a “fishy” aroma. Fresh fish will have these signs:

* The eyes are clean and bulge a little.
* Whole fish and fillets have firm and shiny flesh and bright, red gills free from slime.
* The flesh springs back when pressed.
* There is no darkening around the edges or brown or yellowish discoloration.
* The fish smells fresh and mild, not “fishy” or ammonia-like.

Note: Keep in mind that just because fish is fresh doesn’t mean it’s bacteria-free. You still need to follow the food safety tips above when handling or preparing fresh fish.

I confess I did not know about the bulging eyes. I thought all fish had bulging eyes. Maybe I have just been lucky and lived in the right neighborhoods? I would like to see that added to real-estate listings — quality schools near-by, fish with bulging eyes at the markets…

Back to the main point, expiration dates are not a regulation or law in America, as I have mentioned before here, here and here. America’s regulations are handled and explained by the USDA.

Is Dating Required by Federal Law? Except for infant formula and some baby food (see below), product dating is not generally required by Federal regulations. However, if a calendar date is used, it must express both the month and day of the month (and the year, in the case of shelf-stable and frozen products). If a calendar date is shown, immediately adjacent to the date must be a phrase explaining the meaning of that date such as “sell-by” or “use before.”

Dating by law? Even marriage is not required by federal law…but I digress. I have not yet found the exact food safety laws in South Africa. However, I can see that if this were a debate in America the poultry industry only would have to print the month with day of the month and a phrase like “use before we inject this with flavoring and sell in the other neighborhoods for less”. I’ll have to think some more about how that would be translated into cloud provider security. Maybe the question should be which security flavors are best for “aaS” injection.

In the meantime I have found an image to easily identify when chicken has gone bad:

A few more of these stories and I’ll have to start a poultry of information security site.

Polar Bears Destroy Surveillance Cameras

The Daily Mail gives all kinds of accolades to a Polar Bear that destroyed expensive camera equipment

Wildlife documentary-makers are going to increasingly cunning means to sneak into the secret world of their subjects but don’t think for a second that the animals are fooled, as these images prove.

Award-winning director John Downer had disguised one of his remote-controlled spy cameras as a large snowball to capture the journey of a polar bear mother and her cub crossing the sea ice in Svalbard, Norway, in search of seals.

But – in a documentary Dowler says captures the bears’ ‘astonishing intelligence’ – this adult male wasn’t having the wool pulled over his eyes.

Next time I see a surveillance camera I will smash it apart. The owners will see that I am merely exhibiting my astonishing intelligence. Or maybe they will think that their surveillance camera design is sub-optimal because some dumb human was able to break it?

The photos in the Daily Mail are humorous, to say the least. This is what they call sneaky?

At least the incident will give bears some more publicity, but as far as I can tell that fat white duck-looking thing with propellers had it coming. Good thing penguins were not around. They really would have torn it up.

German Airport Association President Calls for Profiling

The Dusseldorf airport’s CEO and new President of the German Airport Association has sparked a debate about passenger profiling

…he wanted to introduce passenger profiling in German airports to fight terrorism. The system would be similar to that used in Israel, where passengers are categorized as high or low risk according to their age, sex, ethnic background and other criteria.

“In this way, the security systems can be more effectively used to benefit all those involved,” [Christophe] Blume, who will become president of the German Airport Association (ADV) in January, told the German Newspaper Rheinische Post on Tuesday.

Although one might take this only at face value and wonder about the philosophical issues at stake with profiling, Blume’s profile brings up another point.

He signed a 10-year 200 million dollar outsourcing contract in 2005 that gave 70% ownership of IT operations to SITA.

I suspect, again from his executive profile, that he was sold by SITA on their “iBorders Advance Passenger Processing” system:

South Africa’s Department of Home Affairs was particularly interested in a proactive solution, which would enable them to analyze and pre-screen travellers before they arrived. If necessary, this would allow them to stop any unauthorized or ‘undesirable’ visitors at the point of departure – thereby avoiding any expenses associated with processing and repatriating these visitors.

His announcement is thus a way for him to say he will work to expand his financial relationship with them by bringing in another SITA project.

Maybe if he or SITA said something about the system increasing security or making flights safer I would be more encouraged. Instead I wonder if their focus on terms like expenses, efficiency and effectiveness is really a way of saying they want to get their hands on the money that has been going to other technology vendors and firms.

I won’t even bother to try and understand why he finds South Africa and Israel the appropriate models for German national security.