Category: Government

Posted on

What? Wait…

IowaCaucus.jpgI was reading about the Iowa Caucus.

The acting DHS secretary Mr. Wolf said that the application issue appeared to be a “Load” issue. By “Load” he means that the servers were unable to keep up with the number of requests.

Okay I’ll buy that is a possibility, if everyone in a state was voting at the same time. But as the number of voters decreased, the server would catch up and post each transaction in turn. If this was the problem then it’s pretty obvious whoever tested the software didn’t do any load testing and quite possibly didn’t do much testing at all.

Lets face it, we’re all familiar with online opinion polls, and I’d imagine the servers handling those are dealing with millions of votes a minute. Seems to me that Shadow (The company that apparently spent 3 years building the software,) would have looked to other examples of voting systems, during their development process.

For god’s sake, there are PORN sites that handle votes for performers without crashing. Given the prevalence of Porn Sites I’d guess they process something on the order of MILLIONS of votes per Second.

Then I read that the application was only for the 170 – 190 precinct captains. So the paper votes were cast, then counted, and the captains were to use an application to input those numbers?

You’re telling me that with 3 YEARS of development no-one ever tested with a measly 200 simultaneous users?

WTF?

As I sit reading more about this, I’m astounded.

I have Apple Time Capsules here in my home that can handle 50 simultaneous users on WiFi.

A low end Dell server purchased from Best Buy could probably handle 250 users from the moment it was plugged in, possibly more if all the server had to do was tally incoming data for ONE Single application.

I have to point out that I’m kinda talking out of my hat here because I don’t have all the facts. So take what I’m saying here with a salt lick.

My point is, that with something as important as votes, if I could put a system together with commercial of the shelf (COTS) equipment for less than 10K in hardware and a little web programming there is absolutely NO EXCUSE for the debacle we saw in Iowa.

Much less so when you factor 3 YEARS of development time.

Hell, with 3 years of development time, I could give you Web and Phone based access, Live updates, and auditing of figures entered by precinct, candidate, and user. Complete with state of the art security. I’d have also taken the DHS up on testing the system too. The DHS has an entire division dedicated to Cybersecurity. 

I’d probably have requested that the FBI and NSA take a look too, if they were willing.

WHY?

Because the product would have to be rock fucking solid and more eyes looking at a system are more likely to find flaws that can be corrected before its debut.

Especially given that over the last four years we’ve heard about nothing but Russian influence in our election process. I’d be wanting to make something that was so secure that there’d never be any question about the veracity of the product or its results.

Make no mistake, this is (or was) a product.

Shadow would have been in a prime position to resell the product to all 50 states and would have been reaping the benefits for decades with maintenance and upgrade contracts.

Now Shadow will fade into the morning light like a bad dream, having made millions (I’m guessing) for its principals and casting everyone below executive level to the unemployment line.

Oh, and they’ll have an added lovely parting gift of FAILED project on their resumes.

As I said, we don’t yet have all the facts and likely, we never will.

Online voting could be a reality. But only if we commit to doing it right. 

Don’t you find it interesting that we have more security in place online and over the phone to deal with our banking needs than we do when dealing with the direction of our country as a whole?

Posted on

In a time when privacy is of such concern…

thisisyourbrainontheinternet.jpgWhy is it that almost every single company you apply to for a job asks for you to create an account on their site?

Are we applying for jobs or are we providing information for data mining?

Well, I wouldn’t be surprised to find out, it’s both.

I detest having to create an “Account” just to apply for an advertised position, and I’m always concerned when a job application site asks me “Security Questions”

What’s your mother’s maiden name

Where were you born

What’s the name of your pet

What school did you attend

These bits of data, when aggregated with other bits gleaned from other sites can form a very complete picture of you as an individual.

Why do I need to create an account in the first place? The company I’m applying for hasn’t hired me, and in all likelihood we’re only going to have one time when we have contact with each other. The Odds of my returning to a particular corporate web site for anything other than prepping for an unlikely phone interview are exceedingly small. So why should I have to provide anything other than a resume and cover letter?

bigstock-210973132.jpgThere are currently something like 300 accounts stored in my web account password manager, at least 250 of those are from sites that I don’t visit or have only visited one time. Yet each one of those entries represents a corporation that has some amount of my personal information. This is information that I shared in the hopes of getting a job and it’s information that is no longer under my control.

Knowing how data can be scraped and related, and how easy it is to include similar results from other people, I’ve become concerned not only about my loss of control of that data, but also the veracity of data presented as “Me” on sites like Mylife.com, Beenverified.com, spokeo.com, and peoplefinders.com. That doesn’t even touch what Google may report.

The issue for me is, due to the proliferation of these sites, it could be a full time job just asking them to remove me from their records and verifying that they’ve done so.

I don’t particularly have anything to hide, but I am concerned that these sites could inexpensively be used to create a very convincing false identity, leading to successful identity theft. I’ve been through that once and have no desire to repeat the experience.

As a minor example of how easily data can get screwed up, I once had an argument with a lady, (who may or may not have been a very distant relative) on Ancestry.com over whether my Father was in fact my father.

According to her research, my step siblings were my Father’s original family and my half brother (we share the same father) and I didn’t exist. She had pictures of my Dad in her ancestry page but the birth dates were all incorrect for all of my step siblings. I figured “Fine” live in your own fantasy world lady, but I was there and I know who my father and mother are.

The problem was, that every-time I corrected the data for MY immediate family in my account, her data would override mine. Matters were made worse when my stepfather and mother started adding information from their ancestry page and my mom discovered her marriage to my biological father and my subsequent birth were being erased by this lady that we didn’t even know. My mother tried reasoning with this woman and got nowhere. You do not want to piss my mother off, she will rent a bulldozer and get certified as a heavy equipment operator,  just to smash your car into a pancake.

I lost interest after a while because I was beating my head against a wall. I signed off of ancestry and haven’t been back. I purchased an application that runs locally on my computer. That way I can maintain the integrity of my personal family data without having someone arbitrarily make changes.

You see, this stranger was searching for context and her locating my branch of the family was easier than finding the real branch of the family that she was connected to. So instead of doing the research, she started creating or editing data that fit her narrative.

Imagine a scenario like this in more important matters. Your job history, your credit history, your criminal history…

How would you even go about correcting it? Unless you ran a background check on yourself periodically you might not even know that you had been cross-linked with someone else. The problem there is, the longer the cross link exists the more “True” it becomes.

I explain all of the above to support my implied assertion that we are being “Programmed” to give away random bits of ourselves without much thought. The consequence of which is that our identities and security is being eroded.

SocialNetwork.jpgDo you really want your employer, your date, spouse, or your mother, to know about that rather large kinky sex toy you purchased on Dec 27 2005 at 3 PM in Los Angeles?  Or how about that time when you went to a shooting range with your boyfriend?

You may have purchased the toy as a practical joke, you may have gone to the shooting range to see what guns were all about and decided they weren’t for you, but the people looking at the sales records won’t know that, and you’ll never have the opportunity to explain because the folks looking at the data will never give you the chance.

We’re moving more and more toward a contextless world.

We see it in media coverage of political figures, Who cares if some politician dressed up in blackface AND a KKK outfit for Halloween in 1977, when they were 13 years old?

In a contextless society, that event reads as… Politician dressed in Blackface KKK robe. This insensitive leader must be removed from office immediately! It’s an outrage!

Not only do I not want to participate in that kind of society, I don’t want to hand a society the weapon to harm me.

So that’s why I’m very twitchy about websites demanding that I create an account for the simplest of things.

Call me paranoid if you wish, but that doesn’t mean I’m wrong.

Posted on

Just some food for thought…

JROppenheimer LosAlamos

I wasn’t planning on another piece about Apple v. The FBI. But here goes…

For all those pundits, wags, celebrities, politicians, and now Rabbis speaking out and telling Apple that they should decrypt the San Bernardino shooter’s iPhone, I submit this.

Apple is apparently applying the thought Robert Oppenheimer had after he helped create the atomic bomb.

When you see something that is technically sweet, you go ahead and do it and you argue about what to do about it only after you have had your technical success. That is the way it was with the atomic bomb.
– J. Robert Oppenheimer

I believe this quote is often paraphrased to;

Just because you CAN do a thing, doesn’t necessarily mean you SHOULD do a thing.

I’ve lived my life using that paraphrase as a test for certain actions. I look at it as a cautionary signpost for all scientists and researchers.

Project t virus by linkin368 d3gt57g

Just because you can modify the DNA of influenza to deliver a genetic update to all the people of the world… should you? What about murphy’s law? Can you really limit the unintended consequences? 

OR is it simply better to recognize that never creating the technology is the best course of action?

Thumb01m

All these people saying Apple should crack the phone, have no idea what they’re talking about. It’s not an easy task, even for Apple. Cracking encryption isn’t what you see in the movies. 

You don’t just plug a widget into a port, have some dialog about how cool you are and then hear a beep as the NSA computers start spilling all their information onto your impossibly small storage device.

At this point it’s unclear if the iPhone in question is using something as simple as a 4 digit code. It’s likely, but depending on the IOS version being used, the phone could be locked using a phrase.

If there’s a passphrase the odds of success hacking it with a brute force attack drop precipitously with each character added to the passphrase length.

James comey fbi

The brute force attack that the FBI is describing is crude and there is no guarantee that if they win in court, forcing Apple to be their bitch, that when they finally get into the phone there won’t be a nasty little application that has encrypted all the files the FBI wants using an entirely different algorithm, from another manufacturer.  If that’s the case, is the FBI going to get another court order? Probably not, because this is about the FBI making an example. Apple just happens to be the biggest target. 

It’s just as likely, this Jihadi fucker was using a messaging application that wiped the messages 5 minutes after they were read.

Federal and state fbi agent

If the guy was at all concerned about security, He probably turned off all the Apple Tracking software, I know I did right after Edward Snowden blew the whistle.

I’m not a criminal, but I value my privacy and am willing to forego my phone being able to tell me where the nearest Häagen-Dazs is, to maintain my privacy.

This means that Apple providing a custom operating system to disables the automatic wipe on the phone and allow unlimited access to the phone’s password system is likely not going to get the FBI anything more than they already have based on cell tower records.

By the way, because of the number of towers in the San Bernardino area, cell tower data can pinpoint the movements of this Jihadi asshole to within a couple hundred feet or less.

The NSA Actually Has A Program Called SKYNET

So the FBI is lying right from the get-go, when they say they want access to the phone so they can figure out where this Jihadi and his diseased rancid whore of a wife, were before, during the shooting, and after. 

The cell tower records would already provide that information and if the guy turned off his phone while visiting some nefarious underworld figure. Or dropped it in a Faraday bag or cage…

LOKSAK SHIELDSAK Flexible Fabric Faraday Cage Anti RF Protective Bag RF Fortress Radio Frequency Camouflage NDIA SOFIC 2014 David Crane DefenseReview com DR 10

Then the FBI would still get nothing from the phone because at that point the phone would have been cut off from the cell tower or any GPS information and likewise wouldn’t have been able to transmit any of that information.

But we know that the FBI has nine OTHER phones they want to force Apple to help them unlock. 

Apple icon apple

The problem here is that Apple has never created the software to unlock or hack their devices.

Why should they?

Apple tells you, “don’t lose your password, we cant help you if you do.”

So they have a secure device, and they can insure the device’s security because they’ve never created any software to undo their encryption or their locking mechanism.

Just because you CAN do a thing, doesn’t necessarily mean you SHOULD do a thing.

Achmed

Dear Apple customer… “If you loose your password, you can wipe the phone and start over. We strongly recommend you have the data backed up. Apple provides the iCloud service for this purpose.“

It’s recently come to light, that the FBI ordered the San Bernardino County IT department to change the password on the iCloud account and therefore broke a link that could, with Apple’s help, have gained access to the phone.

Now the FBI wants to use a court order to force Apple to UNFUCK their fuckup. But that’s not the end game.

The end game is that the FBI wants to force manufacturers to build government backdoors into all devices. 

BMZ9g3ZCMAAvZN2

The FBI is using “terrifying terrorists” and criminals, to spook congress and the courts into passing legislation that mandates government access be built into all machines. They and their supporters are using the time honored B.S. line;

“For the safety and security of the public…” or that old favorite “We do this for THE CHILDREN”

I’m not sure I believe in the slippery slope argument but I do think it’s a very short walk to losing rights that we’ll never get back.

That walk begins with statements that start out, “It’s worth losing a little privacy, or freedom, or changing the laws, or, or, or,  for safety.” see; The Patriot Act

 When I see our government behaving this way, and I hear people saying, “it’s just a little invasion,” I can’t help but think of the poem The Hangman.

I could see a time in the future when it’s illegal for you not to have your phone on your person.

After all, the government would only want to keep track of your movements and communications to insure your safety… Right?

Back doors in our devices are, I think just a stepping stone to full surveillance.

“You have nothing to fear, if you have nothing to hide.”