Hacking is free speech!

Hacking Is Free Speech! (or is it?)

I should start by noting that not all speech is protected under the 1^st Amendment. For example, I can’t say to someone that I am a detective with Miami Metro Homicide, because I’m not. That’s called impersonating a police officer and carries a prison sentence. There are particular acts in speech that breakdown the structure of our society, so we don’t protect them. Libel. Slander.

The problem with laws governing fraud covering the Internet is that everyone is a fraud on the web. Why do we allow hate speech to be protected while we chastise hackers for typing in simple letters and numbers in URLs? One may very well incite violence, but the other is much more insidious somehow because we call it Cross Site Scripting? One is more insidious because a software company produced a terrible product and doesn’t spend enough resources keeping their software up to date?

Let’s face it. The Internet makes us bipolar. The whole point of the Internet is being connected, yet we put up barriers and firewalls to protect us. At the same time that we say we are worried about hackers and identity thieves ruining our lives, we believe news articles from people we don’t know the credentials of and we open up to complete strangers whom we’ve never met. Why can’t we just accept that you shouldn’t trust anyone on the Internet?

If we can accept it as true that nothing on the Internet should be trusted, then we wouldn’t be surprised when information was leaked or when sites went down. Should Hacking be considered protected speech under the 1^st Amendment? In other words, should hacking be free speech?

As security practitioners and government legislators, we should accept the reality of computer insecurity rather than fight the evil hoardes that attempt to subvert our pristine online ivory towers.

Why not have laws that make it illegal to ship a computer product that is susceptible to computer hacking? Why not make it illegal to not patch a known vulnerability within a reasonable period of time? Why not make create real penalties for failed security at companies that have high value targets just like we have for banks and other institutions?

Because it’s impossible to make a computer secure? Exactly my point!

Because it’s easier to label ‘hackers’ as bad guys and go after them than change our paradigm?

The truth is that we don’t really understand the virtual world enough to apply the law to them. While I can accept the application of RICO to rings of identity thieves, it makes no sense that a person can get jail time for being an internet troll. (Keep in mind the difference between US and UK law…in the US there is a church that goes to protest at military funerals.)

So you say you want a revolution? You say that as the computer elite you should be the ones to change the world? Okay, let’s say that hacking is civil disobedience. There have been some meaty articles written on this in The Guardian, Slate, and Shiny Ideas.

Okay, so instead of being a Civil Rights Worker, you’re a Hacktivist. Now what? You should be prepared to be arrested. Civil Rights activists had a specific goal they were working towards and they were prepared to be arrested to support their cause, for change. The very act of their arrest only added to their cause. If you are a Hacktivist and you believe in whatever cause you are supporting, then nobly stand behind it. But don’t undermine your own cause by trying to overthrow society itself.

This is the problem then. What is the cause that Hactivitism supports? Is there only one? Are there more parallels with Batman or Martin Luther King Jr.?

What Would Jesus Hack

Interesting article in the Economist about the connection between Christian values and the values of the Hacker/Open Source Community:

http://www.economist.com/node/21527031

The Privacy Bill of Rights

When it comes to the Federalist debates, I was always on the side that argued that creating a bill of rights would limit our rights rather than protect them. But, since we don’t live in that world, Congress is working on creating additional bills of rights (maybe this is just a fad). There was the recent Airline Passenger Bill of Rights. Now we’ve moved on to a Privacy Bill of Rights. Thanks goes to John McCain and John Kerry for putting their names behind this one.

The Privacy Bill of Rights would create 3 new rights for online users:

• The Right to Security and Accountability
• The Right to Notice and Individual Participation
• The Right to Data Protection (which includes Data Minimization, Constraints on Distribution of Information, and The right to Data Integrity)

Like many of the current proposals for a Federal data privacy law, there is no private right of action. The bill relies on state Attorney’s General to pursue actions against companies who fall short on their privacy protections. The bill also has the highest per day civil penalties, but only a moderate maximum penalty when compared with the other bills on the table.

The FTC will have to issue rules which translate the Privacy Bill of Rights into something meaningful which businesses can follow. The bill provides for 180 days for the FTC to issue that guidance, but realistically…that process could take years. The FTC Red Flag rules were not implemented for 2 years due to confusion on the part of businesses as to who was covered and how to comply.

The bill requires an opt in for collection of information as well as an opt-out for advertising. This will go a long way to change the de facto PII collection and storage polices of web-based companies.

The 3 rights that I’m calling Data Protection (Data Minimization, Constraints on Distribution of Information, and The right to Data Integrity) are the most interesting part of the bill and set it apart from the rest of the bills out there. For example, the bill will restrict transfers of information to “unreliable third parties”. Presumably this means that spammers or companies who have been repeatedly hacked won’t be able to get personal information. The bill will prevent companies from combining multiple sets of personal information from multiple sources as well, which will put limits on data aggregators.

Finally, there is a data integrity component which requires companies to ensure the information that they collect is accurate. This is a very forward thinking aspect of the bill, and could have very broad reaching implications. This seems similar to requirements placed on the credit bureaus for credit scores.

Porn Pirates vs. Copyright Trolls

This summary is not available. Please click here to view the post.

How Many DMCA Notices does the RIAA send every year?

How Many DMCA Notices does the RIAA send every year? This is a question I've been asking myself (and others) for years now.

The solution was pretty obvious...on the tip of my proverbial nose the whole time. The RIAA appears to use a sequential numbering system in its case tracking system. There is no way to tell what percentage of the cases represented in their case tracking actually lead to a generated DMCA notice. Duplicates or false positives may account for some percentage of this figure. Judging by the number of duplicates and false positives that we actually receive, I would guess not. In looking at the volume, however, I’d be willing to bet that each case number represents an individual DMCA notice.

Using the sequential numbers as a framework, you can now estimate how many DMCA notices were sent on a monthly basis. The numbers also vary widely over time, so you can’t assume that the same numbers of notices are sent every day. In one twenty four hour period in July, the numbers increment by nearly 600,000. Most 24 hour periods see less than 100,000.

Based on the claims that billions of dollars per year are lost to illegal file sharing, these numbers might seem low, however, the RIAA and others have never claimed to be able to catch 100% of all file sharing. This is undoubtedly a fraction. If you still think that these numbers are low, however, think about what these notices do to ISPs and Universities. Each notice probably takes between 30 minutes to address the forensic work that needs to be done to find the user, validate that there was network traffic at that time, send a notice to the user, and interact with the user afterwards. Even if only 20% of DMCA notices go to Universities, that means Universities probably spent nearly a million man hours responding to DMCA notices in 2010. In only the first 7 months of 2011, the RIAA has sent 4 million more notices than in all of 2010, which means the total for 2011 will probably be double that of 2011.

Should There Be a CyberWar Treaty?, Part 1

The Department of Defense released their Strategy For Operating In Cyberspace in July. In the document, they add Cyber to the traditional 4 domains...Land, Sea, Air, and Space.

This paper raises the question, at least in my mind: Should there be a Cyberwarfare treaty? I think the short answer is a definite “Maybe.”

I think a longer answer is that a arms treaty, like chemical or nuclear, is meant to deter the production of those types of weapons by government entities. Even if such a treaty were to be ratified, it would not stop other entities, whether commercial, criminal, or private from creating the same.

Similarly, all computer software has a shelf life, and this is also true for computer viruses. A hacker creating a computer virus is reliant upon an operating system. When those operating systems are updated, patched, or replaced, the virus ceases to have value. This is not true for other types of arms control. A 50 year old nuclear warhead is still dangerous.

What would such a treaty say? Should it be specific to the types of code that shouldn’t be written? Should it ban countries from producing soldier-hackers? Should it create an outright ban on the types of computer warfare that are not allowed? Should there be a Geneva Convention for the Internet?

All these conventions don’t fit the makeup of the internet. This is the internet where companies and technologies, whole computer languages, have lifecycles measured in months, not years. Assuming that a written treaty could apply is a misunderstanding of how the Internet is governed. Every aspect of the internet is governed by social convention, software licenses, and terms of service. These conventions necessarily change very quickly over time. Not to mention that even if such a treaty could be ratified, it would be obsolete by the time the ink was dry.

It would be great if Governments were willing to commit to one another that they won’t attack each others nuclear reactors with computer viruses. Jails. Air traffic Control systems. This misses the point of the greatest protection we already have…the one that worked throughout the cold war…mutually assured destruction. Because of Globalization, an attack on the US, would have immediate and drastic economic consequences for every other nation state in the world. Even a small scale attack on a major country would have similar consequences…given the amount of damage that the world has felt the problems in Ireland, Greece, and Portugal. And there is no reason to think that an attack would be limited to only one country at one time. If such an attack were to take place, it would be just as easy to attack everyone that is against your particular point of view.

A treaty like this would probably be unnecessary given current Alliances.

The best idea for a treaty like this would be a world wide treaty that includes all major players to share resources, visibility, intelligence, to protect critical infrastructure against non-state actors. This would be very similar to how many organizations as well as state governments have developed inter-organizational Information Security Advisory Councils to share real time threat information. Some large ISPs like AT&T and Verizon are offering this kind of real time threat monitoring from a world-wide perspective, so it would be a huge step in CyberSpace if governments took the same measures.

Click here for part 2 of my series on Cyber Warfare Treaties.

Cyberwar - Cyber Arms Dealers

Business Week has a nice article on the Cyberwarfront arms race:

http://www.businessweek.com/printer/magazine/cyber-weapons-the-new-arms-race-07212011.html

I think the most interesting part about the article is the idea of a Cyber "Arms Dealer". This makes me wonder what other analogs to traditional warfare might be out there... Mercenary Hackers?