November 27, 2024

On stolen data with privacy-relevant information

I just received a first-class letter from the State of Ohio, telling me:

The State of Ohio has confirmed that your name and social security number was contained on a computer back-up device that was stolen. It is unlikely that someone can access the data contained in the device without specialized knowledge and equipment. Because we have no information to date that the data has been accessed, everything we are doing, or suggesting that you consider doing, is preventative.

The State of Ohio is doing everything possible to recover the stolen device and protect the personal information that was on the device. We regret that the loss of this sensitive data may place an undue burden of concern on you.

The letter explains how I can sign up with Debix for their identity protection services, and provides a PIN for me to use. (So, now I can spread my SSN further. Wonderful.)

The last time I set foot in Ohio was over three years ago, when I testified about electronic voting security issues, so it seems odd that they would still have my SSN on file. I don’t recall if they specifically asked me for my SSN, but it’s common for these sorts of things to ask for it as part of reimbursing travel expenses. It’s also possible that my SSN was on this backup tape for other reasons. Some news stories say that sixty Connecticut citizen’s information were present on the tape; I’m from Texas, so that shouldn’t have affected me. The State of Ohio has its own official web site to discuss the incident, which apparently happened back in June, yet they’re only telling me now.

Okay, let’s see if we can figure out what’s going on here. First, the “back-up device” in question appears to be nothing more than a backup tape. They don’t say what kind of tape it was, but there are only a handful of options these days, and it’s not exact hard to buy a tape drive, making the “specialized knowledge and equipment” line seem pretty unlikely. (As long as I’ve been doing security work, I’ve seen similar responses. The more things change…) So what actually happened? According to the official web site:

The Inspector General investigation determined that: “OAKS administrators failed to protect confidential information by authorizing state employees, including college interns, to take backup tapes containing sensitive data to their homes for overnight storage”; “OAKS, OIT (Office of Information Technology) and OBM (Office of Budget and Management) officials failed to report the theft of confidential information to state and law enforcement officials in a timely manner”; and “OAKS administrators failed to protect confidential information by allowing personnel to store sensitive data in an unsecured folder on the OAKS intranet.” The Inspector General found no evidence to suggest state agencies or employees engaged in criminal or illegal behavior surrounding these circumstances.

At its core, Ohio apparently had fantastically poor procedures along with what Jerry Saltzer refers to as the “bad news diode“, i.e., bad news never flows up the chain of command. Combine those and it shouldn’t be surprising that something would eventually go wrong. In my case, such poor procedures make it believable that nobody bothered to delete my information after it was no longer necessary to retain it. Or, maybe they have some misguided anti-terrorist accounting rule where they hang onto this data “just in case.” Needless to say, I don’t know.

It’s reasonable to presume that this sort of issue is only going to become more common over time. It’s exceptionally difficult to keep your SSN truly private, particularly if reimbursement paperwork, among other things, unnecessarily requires the disclosure of a SSN. The right answer is probably an amalgamation of data destruction policies (to limit the scope of leaks when they happen), rational data management policies (to make leaks less likely), and federal regulations making it harder to convert a SSN into cash (to make leaked SSNs less valuable).

(Sidebar: when my wife and I bought a new car in 2005, the dealer asked for my SSN. “I’m paying cash. You don’t need it,” I said. They replied that I could either wait until the funds cleared, or I could let them run a credit check on me. I grumbled and caved in. At least they didn’t ask for my fingerprint.)

Why Don't NFL Teams Encrypt Their Signals Better?

Yesterday the National Football League punished the New England Patriots and their coach, Bill Belichick, for videotaping an opposing team’s defensive signals. The signals in question are used by coaches to tell their on-field defensive unit how to line up and which tactics to use for the next play. The coach typically makes hand signals and arm movements that the on-field players know how to interpret. (The offense also needs to send signals to players from the sidelines before each play, but they use radios.) The opposition gets an advantage if they know what play is coming, so they will try to figure out what the signals mean.

This is essentially a weak form of cryptography. The coaches apply a kind of encryption to translate the desired play into a ciphertext, which is a sequence of hand and arm movements. They transmit the ciphertext (by making the indicated movements) to the on-field players, who then decrypt it, recovering the original play that the coaches wanted to send. An adversary who can see the ciphertext is supposed to be unable to recover the original message.

I don’t know what systems NFL teams use, but Belichick and the Patriots apparently thought they had a chance of breaking their opponents’ code.

There’s an interesting technical problem here: how to encrypt defensive plays into sideline signals securely, in a way that’s practical for real coaches and players in a game situation. I can think of at least one solution that is secure and practical. (Exercise for geeky readers: How would you do this?)

You might think that any solution would be too complicated for a mere football player to decode. If you think that, you’re underestimating the players involved. NFL defensive captains already cope with complex information and plans, and their teams’ current signaling systems already require decoding of symbols. Clever solutions can be pretty simple.

Crypto applies not only to designing a team’s signals, but also to analyzing rivals’ signals. Who will be the first NFL team to hire a cryptographer?

iPhone Unlocking Secret Revealed

The iPhone unlocking story took its next logical turn this week, with the release of a free iPhone unlocking program. Previously, unlocking required buying a commercial program or following a scary sequence of documented hardware and software tweaks.

How this happened is interesting in itself. (Caveat: This is based on the stories I’m hearing; I haven’t confirmed it all myself.) The biggest technical barrier to a software-only unlock procedure was figuring out the unlocking program, once installed on the iPhone, could modify the machine’s innermost configuration information – something that Apple’s iPhone operating system software was trying to prevent. A company called iPhoneSimFree figured out a way to do this, and used it to develop easy-to-use iPhone unlocking software, which they started selling.

Somebody bought a copy of the iPhoneSimFree software and reverse engineered it, to figure out how it could get at the iPhone’s internal configuration. The trick, once discovered, was easy to replicate, which eliminated the last remaining barrier to the development and release of free iPhone unlocking software.

It’s a commonplace in computer security that physical control over a device can almost always be leveraged to control it. (This iceberg has sunk many DRM Titanics.) This principle was the basis for iPhoneSimFree’s business model – helping users control their iPhones – but it boomeranged on them when a reverse engineer applied the same principle to iPhoneSimFree’s own product. Once the secret was out, anyone could make iPhone unlocking software, and the price of that software would inevitably be driven down to its marginal cost of zero.

Intellectual property law had little to offer iPhoneSimFree. The trick turned out to be a fact about how Apple’s software worked – not copyrightable by iPhoneSimFree, and not patentable in practice. Trade secret law didn’t help either, because trade secrets are not shielded against reverse engineering (for good reason). They could have attached a license agreement to their product, making customers promise not to reverse engineer their product, but that would not be effective either. And it might not have been the smartest thing to rely on, given that their own product was surely based on reverse engineering of the iPhone.

Now that the unlocking software is out, the ball is in Apple’s court. Will they try to cram the toothpaste back into the tube? Will they object publicly but accept that the iPhone unlocking battle is essentially over? Will they try to play another round, by modifying the iPhone software? Apple tends to be clever about these things, so their strategy, whatever it is, will have something to teach us.

Intellectual Property and Magicians

Jacob Loshin has an interesting draft paper on intellectual property among magicians. Stage magic is a form of technology, relying on both apparatus and technique to mislead the audience about what is really happening. As in any other technical field, innovations are valuable, and practitioners look for ways to cash in on their inventions. They do this, according to Loshin, without much use of intellectual property law.

This makes magic, like cuisine and clothing design, a thriving field that operates despite a lack of strong legal protection for innovation. Recently legal scholars have started looking harder at such fields, hoping to find mechanisms that can support innovation without the cost and complexity of conventional intellectual property law, and wondering how broadly those alternative mechanisms might be applied.

What makes magic unusual is that practitioners rarely rely on intellectual property law even though magic tricks are protectable by patent and as trade secrets. Patent protection should be obvious: patents cover novel mechanisms and methods, which most magic technologies are. Some classic tricks, such as the saw-a-person-in-half trick, have been patented. Trade secret protection should be obvious too: how to do a particular trick is valuable business information whose secrecy can be protected by the inventor. (The audience sees the trick done, but they don’t really see the secret of the trick.)

Yet Loshin, and apparently most magicians, think that patent and trade secret are a poor fit. There are basically three reasons for this. First, part of the value of a trick is that the audience can’t figure out how it’s done; but a patent must explain the details of the invention. Second, tricks are subject to “reverse engineering” by rival magicians who watch the trick done, repeatedly, from different parts of the audience, then do experiments to try to replicate it; and of course trade secrets are not protected against reverse engineering. Third, there’s a sort of guild mentality among magicians, holding that knowledge can be shared within the profession but must not be shared with the public. This guild mentality can’t easily be implemented within current law – a trade secret must be carefully protected, and so cannot be passed around casually within a loosely defined “community”.

The result is that the guild protects its secrets through social norms. You’re accepted into the guild by demonstrating technical prowess and following the guild’s norms over time; and you’ll be excommunicated if you violate the norms, for example by making a tell-all TV special about how popular tricks are done. (There’s an exception for casual magic tricks of the sort kids do.) The system operates informally but effectively.

As a policy guy, I have to ask whether this system is good for society as a whole. I can understand why those inside the profession would want to limit access to information – why help potential competitors? But does it really benefit society as a whole to have some unelected group deciding who gets access to certain kinds of information, and doing this outside the normal channels that (at least in principle) balance the interests of society against those of inventors? It’s not an easy question.

(To be clear, asking whether something is good or bad for society is not the same as asking whether government should regulate it. A case for regulation would require, at least, that the regulated behavior be bad for society and that there be a practically beneficial way for government to intervene.)

The best argument that magicians’ guild secrecy benefits the public is that tricks are more valuable to the public if the public doesn’t know how they are done. This is almost never the case for other technologies – knowing how your iPod works doesn’t make it less valuable to you – but it just might be true for magic, given that it exists for entertainment and you might enjoy it more if you don’t know how it’s done.

But I have my doubts that publishing information about tricks actually makes them less entertaining. Goldin’s patent on the saw-a-person-in-half trick – which explains pretty clearly how to do the trick – was issued in 1923, but the trick is still a staple today. In theory, anybody can read Goldin’s patent whenever they want; but in practice hardly anybody has read it, and we all enjoy the trick despite suspecting how it’s probably done. And do we really need to read Gaughan’s patent to know how a “levitating” magician stays up in the air? Gaughan’s cleverness is all about how to keep the audience from seeing the evidence of how it’s done.

One effect of the guild’s secrecy is that the public rarely learns who the great innovators are. We know who puts on a good show, but we rarely know who invented the tricks. The great innovators may be venerated within the profession, but they’re unknown to the public. One has to wonder whether the field would move faster, and be more innovative and entertaining, if it were more open.

HR 811 Up For House Vote Tomorrow

H.R. 811, the e-voting bill originally introduced by Rep. Rush Holt, is reportedly up for a vote of the full House of Representatives tomorrow. Passing the bill would be an important step in securing our elections. I have supported H.R. 811 from the beginning, and I am still firmly behind it. I hope it passes tomorrow.

H.R. 811 gets the big issues right, requiring a voter-verified paper ballot with post-election audits to verify that the electronic records are consistent with the paper ballots.

The bill is cautious where caution is warranted. For example, it gives states and counties the flexibility to choose optical-scan or touch-screen systems (or others), as long as there is a suitable voter-verified paper record. Though some e-voting activists want to ban touch-screens altogether, I think that would be a mistake. Touch screens, if done correctly – which no vendor has managed yet, I’ll admit – do offer some advantages. Federalism makes sense here: let localities make their own choices, as long as basic standards, such as the paper-trail and audit requirements, are met. Down the road, we may be glad that we left room for better touch-screen systems to develop.

The current version of the bill allows inferior paper-trail systems, such as ones storing ballots on a continuous reel of relatively fragile thermal paper, to be used through 2010, in places where they were already in use. The full requirement of a durable, permanent, privacy-preserving paper record takes effect everywhere in 2012, but starts immediately in places not already using a paper trail. Though less than ideal, the grace period is the best reasonable choice under the circumstances. A change of this magnitude takes time, so some kind of grace period is necessary. We could argue over whether it should be two years or four years, but at this point the most important thing is to start the clock ticking, by passing a bill.

If your representative is on the fence, this is a good time to call and urge a vote for H.R. 811.

[UPDATE (Sept. 6): The schedule has slipped so the bill will not be up for vote today. So there’s still time to call your congressperson.]