Category Archives: Security

UK Faces Private Parking Placard Plague of Pounds

The BBC calls them cowboy clampers.

Apparently it is legal for anyone (claiming property rights) to place tickets on a vehicle and demand payment for use of space. More interesting is that people in the UK actually pay tickets issued by random private entities that are not “registered” with any authority.

To prove how easy it is to do that, we purchased two “DIY parking enforcement kits” on the internet.

One cost £60, the other £30.

For that outlay, you get a couple of signs to warn motorists that the land is private, and that parking is not allowed.

One set of signs indicated that the fine would be £90.

The kits also come with a book of tickets, and waterproof envelopes.

To complete the effect one of them also contains a yellow high-visibility jacket.

If the parking enforcement firm is registered with the British Parking Association (BPA), it can track down any offenders through the DVLA computer.

If it is not registered it can just chance its arm by placing a ticket on your windscreen.

30% of offenders just pay up, with no questions asked, to avoid the hassle of challenging the ticket.

It says a lot when 30% would rather comply than deal with the “hassle” of refusing to pay. That data might be skewed, however. There was a problem of wheel clamping. That is now illegal, so only tickets will continue. Far less hassle to refuse a ticket than remove a clamp. Still, my guess is this entire scheme would go nowhere in most other cultures or even lead to revenge and counter-measures like property vandalism.

Twitter Visualization and the Kremlin

Link analysis can be very useful for security investigations as I explained last June with regard to the NYC Incident.

Mentionmap is a tool that allows you to graphically display conversations (e.g. replies and hashes) — link analysis for Twitter.

I started by looking at @Number10gov, the official UK government Twitter account (http://apps.asterisq.com/mentionmap/#user-umber10gov). It was fairly rich with connections. Note the connection to @whitehouse at the top of the image:

Compare that with the official Russian Twitter account (http://apps.asterisq.com/mentionmap/#user-Kremlin_e)

The Kremlin led a very well publicized technology tour through the Silicon Valley three months ago and even met with executives at Twitter.

Their account has been active since then, yet they have no links. I checked the Russian version (http://apps.asterisq.com/mentionmap/#user-KremlinRussia) but found the same result.

Differing state-level social media relations policy? Isolationism? Unfriendlyism? Twitter syntax unfamiliarism? I will let you draw (pun not intended) your own conclusions.

Cloud E-Discovery

Interesting thoughts on the cloud from a blog on e-discovery by the authors of specialized software for e-discovery.

The key phrase “possession, custody or control” is something to be examined more closely in the context of Cloud Computing environments, where typically the cloud customer is the party in control and the cloud service provider is the party in possession and custody. In cases where the cloud customer is the party in litigation, it is natural to serve pre-trial a discovery request under Rule 26 (b) to the cloud customer and expect that since they are the party in control, and can therefore instruct the cloud provider to perform at least some form of collections. Now the question that remains is whether the same request can be made of the cloud provider, since they are the party in possession and/or custody. It is evident that requesting the cloud provider to perform a discovery request on behalf of their customers is impractical since any assertion of privilege or confidentiality would require the cloud customer to be involved in the discovery request. Besides, the cloud provider producing documents without consent from the customer of the cloud would run afoul of the Stored Communications Act (SCA). For these reasons, the broader three-pronged test of “possession, custody or control” embodied in Rule 34 (a)(1) should be revised to mean only “party in control”.

That says to me that discovery should no longer hinge on where data resides; the only test would be access to the data. This argument is said to be based on a notion of cloud provider possession and custody but delegation of control to a customer.

Their blog explains that removing a possession and custody test removes the chance a client will try to waive an obligation for e-discovery in the cloud. It also removes the obligation of a cloud provider to respond to e-discovery if they have only possession or custody.

Two things come to mind from this. First, it supposes that e-discovery is easier with a client than a provider — a provider may have no knowledge of what data constitutes a business record subject to discovery. A provider that turns over a cloud environment can easily over-deliver and provide more data than required. Second, it supposes that a client can know the inner workings of a provider well enough to understand archives and residue of their data.

These two points are counter to each other. Only the provider knows where data goes, but only the customer knows what data is relevant. Without the first half there is a real possibility that data will exist and never be found by a client during e-discovery. This is not far from pre-cloud environments where an IT department would not be involved in discovery. A legal department might install a tool to answer discovery requests, which technically would not address the residue policies and procedures known by IT.

Take email, for example. A company policy could say that local mailboxes are prohibited. A central mail server would have a master repository of messages, as is usually the policy set forth by legal. However users might still have a regular habit of archiving local copies, as is usually the behavior in response to policies set forth by legal. The non-IT manager of a centralized mailbox — client in control — would likely respond to discovery with an incomplete set of data while the IT managers — provider in possession or custody — would be more likely to provide a more complete picture of the mail ecosystem and include localized backups and copies of deleted messages.

A lack of obligation on the provider will mean a lack of pressure for the technical tools and techniques to serve a technology shift in discovery. A customer is unlikely to push for this capability, or even realize the capability exists. Thus possession and custody tests still seem relevant to me.

Ok, three things come to mind. A company that sells e-discovery software might not want possession and control to be part of the definition in a cloud environment because it may challenge their current software capabilities. The cloud provider could introduce technical issues (e.g. VM volume residue) that current e-discovery software may be unable to accomodate.