Category Archives: Security

CA Snow Helmet Law for Minors

The Governor of California has until September to sign a bill into law that will require minors in California to wear a helmet when skiing or snowboarding.

The state Senate on Wednesday voted 21-11 to pass SB880, which requires helmets for snowboarders and skiers under 18.

The helmet law would be the country’s most restrictive if Gov. Arnold Schwarzenegger signs the legislation. The fine, however, would top out at $25.

The bill would require resorts to post signs about the law on trail maps, websites and other locations throughout the property.

There already is a bicycle, skate and skateboard helmet law for minors in California and a wealth of information on bike helmet laws at the Bike Helmet Safety Institute.

How much should UK phone hacker’s boss be paid?

I have been trying to maintain interest in the controversy regarding Andy Coulson, home secretary in the UK. Was he involved in authorization of “phone hacking” when he was editor of a paper? Very little technical detail is being discussed; it appears to be devolving into a political mud campaign. A good example is the BBC news that Ed Balls demands statement on ‘phone hacking’ claims

Leadership hopeful Ed Balls said David Cameron should ask Theresa May to assure MPs that the allegations would be properly investigated. […] “But look, we cannot have somebody being paid over £140,000 a year to run the government’s communications when there are questions about whether he misled Parliament or not, and whether or not he was systematically involved in illegally bugging the telephones of members of Parliament and wider citizens.”

Apparently it takes Balls to ask Cameron to ask Theresa to make a statement.

Sorry, couldn’t resist that line. Seriously, though, what does a salary have to do with anything? Balls appears to be trying to use it as a wedge to drive resentment against Cameron, or against Coulson, or both.

The issue I see first is whether or not Coulson was involved and second to what level. It would be nice to see a third part describing details of the incident. Tessa Jowell, for example, claimed 28 individual hacks on her phone. How were those counted as individual “hacks”? Many of the hacks seem to be just sloppy impersonations that left behind obvious indicators like messages being flagged as read before the mobile owner had read them — a PIN code was stolen once and then used repeatedly.

The New York Times suggested that Rupert Murdoch’s tabloid practice of privacy breaches and surveillance was widespread in the industry.

Scotland Yard collected evidence indicating that reporters at News of the World might have hacked the phone messages of hundreds of celebrities, government officials, soccer stars — anyone whose personal secrets could be tabloid fodder. Only now, more than four years later, are most of them beginning to find out. […] Andy Coulson, the top editor at the time, had imposed a hypercompetitive ethos, even by tabloid standards. One former reporter called it a “do whatever it takes” mentality. The reporter was one of two people who said Coulson was present during discussions about phone hacking. Coulson ultimately resigned but denied any knowledge of hacking.

Coulson is being pinned with raising the stakes in the game. Maybe that is why his salary as home secretary is being tossed out in debate even though it does not really belong in any of the three parts I mentioned. It does seem to fit into a “do whatever it takes” competitive culture.

I say it will be hard to isolate fault in tabloids for digging in and bringing everything to the front page when the same style of sensationalism is used by leaders in British Parliament. Coulson’s salary is perhaps public information, which would clearly differentiate it from details of his private communications, but the context still illustrates what might motivate tabloid surveillance. The fights get dirty.

The politics and arguments between those trying diligently to preserve privacy and those working to expose information hopefully will evolve into another story; how industry and mobile owners can detect and report surveillance regardless of source. Will the UK government, in other words, move now towards support of privacy that counters private industry surveillance, given that those same skills and tools will probably interfere with their infamous government-led surveillance?

Chimps outwit hunters

The BBC says wild chimps have learned to detect and avoid traps set by human hunters

Across Africa, people often lay snare traps to catch bushmeat, killing or injuring chimps and other wildlife.

But a few chimps living in the rainforests of Guinea have learnt to recognise these snare traps laid by human hunters, researchers have found.

More astonishing, the chimps actively seek out and intentionally deactivate the traps, setting them off without being harmed.

Linguistic Email Analysis Catches Fraud

At the RSA 2010 Conference in San Francisco last March I gave a presentation with linguistic anthropologist Harriet Ottenheimer. We explained how linguistic analysis of email can catch fraud and we gave the example of 419 scams, also known as advanced fee fraud (AFF). A pattern of “bad” language stands out. This is a concept we have developed and presented over several years.

The question we often are asked is whether this could be applied to email systems with automation. The answer is of course yes. Just as malware can be caught by looking for bad code, fraud can be caught by looking for a pattern of “bad” language.

I will present an update to our research at the International High Technology Crime Investigation Association Conference this month in Atlanta, Georgia.

SC Magazine reports today that Blare Sutton of Ernst and Young has found success with fraud investigations by manually applying our technique in the field.

Words that showed “subconscious” tendencies included problem, concern, revise, discount, correct, miss, Figure out, It’s OK, find it, complex. And when regulators such as the Australian Securities and Investments Commission were breathing down a company’s neck, Sutton’s team looked for incidences of their mentions in emails.

“It’s basic language,” he said. “There was nothing about the fraud [in the emails], it was subconscious language that led to an anomaly from which we could do a traditional investigation.”

Yes, just like a virus will masquerade as something else fraud language is not obvious, but calling it “subconscious” language is inaccurate. The story indicates Sutton is trying to statistically show correlation so the question now becomes whether we could predict fraud in advance or actually block fraud messages pro-actively. We are moving towards a warning system or prevention technique. Simply classifying language after the fact, which appears to be Sutton’s story, is interesting but not an ideal use case — his application comes across as “once we know there is fraud we can find indicators of it”.