According to a BBC story, Greek police have stepped up the pace of arrests in enforcing a new Greek law banning all computer games. Many Internet cafes have been shut down.
[Link credit: disLEXia]
New Feature: Fritz's Hit List
September 23, 2002 by
Today on Fritz’s Hit List: Big Mouth Billy Bass.
That’s right, your favorite wall-hanging, singing, dancing, animatronic fish qualifies for regulation as a “digital media device” under the Hollings CBDTPA. If the CBDTPA passes, any new Billy Bass will have to incorporate government-approved copy restriction technology.
Fight piracy – regulate singing fish novelties!
=======
What is Fritz’s Hit List?
Most readers have probably heard me, or someone like me, say that the Hollings CBDTPA has far-reaching effects – that it would regulate virtually all digital devices, including many that have nothing at all to do with copyright infringement. Though this argument is right, it is too abstract to capture the full absurdity of the CBDTPA’s scope.
To foster reasoned debate on this topic, I’m inaugurating a new daily feature here at freedom-to-tinker.com, called “Fritz’s Hit List.” Each entry will give an actual example of a device that would meet the CBDTPA’s definition of “digital media device” and would thereby fall under the heavy hand of CBDTPA regulation.
I’ll post a new example every weekday for as long as I can keep it up. Please email me if you want to suggest an example. (I have plenty of good ones in the queue already, but your suggestions may be better than mine.)
Tauzin Circulating Draft "Broadcast Flag" Bill
September 19, 2002 by
Rep. Billy Tauzin is circulating a draft of a bill that would restrict digital technology. One effect of the bill would be to mandate “broadcast flag” technology.
The bill has not yet been introduced.
Misleading Term of the Week: "Trusted System"
September 19, 2002 by
The term “trusted system” is often used in discussing Digital Rights/Restrictions Management (DRM). Somehow the “trusted” part is supposed to make us feel better about the technology. Yet often the things that make the system “trusted” are precisely the things we should worry about.
The meaning of “trusted” has morphed at least twice over the years.
“Trusted system” was originally used by the U.S. Department of Defense (DoD). To DoD, a “trusted system” was any system whose security you were obliged to rely upon. “Trusted” didn’t say anything about how secure the system was; all it said was that you needed to worry about the system’s level of security. “Trusted” meant that you had placed your trust in the system, whether or not that trust was ill-advised.
Since trusted systems had more need for security, DoD established security criteria that any system would (theoretically) have to meet before being used as a trusted system. Vendors began to label their systems as “trusted” if those systems met the DoD criteria (and sometimes if the vendor hoped they would). So the meaning of “trusted” morphed, from “something you have to rely upon” to “something you are safe to rely upon.”
In the 1990s, “trusted” morphed again. Somebody (perhaps Mark Stefik) realized that they could make DRM sound more palatable by calling it “trusted.” Where “trusted” had previously meant that the system’s owner could rely on the system’s behavior, it now came to mean that somebody else could rely on its behavior. Often it meant that somebody else could force the system to behave contrary to its owner’s wishes.
Today “trusted” seems to mean that somebody has some kind of control over the system. The key questions to ask are who has control, and what kind of control they have. Depending on the answers to those questions, a “trusted” system might be either good or bad.
Comments on White House Cybersecurity Plan
September 18, 2002 by
As a computer security researcher and teacher, I was interested to see the White House’s draft cybersecurity plan. It looks to be mostly harmless, but there are a few things in it that surprised me.
First, I was surprised at the strong focus on issues late in the product lifecycle. Security is an issue throughout the life of a product, from the initial conception of the product through its design, implementation, revision, use, and maintenance. The usual rule of thumb is that an ounce of prevention is worth a pound of cure – that attention to security early in the lifecycle makes a big difference later.
Despite this, the White House plan emphasizes remediation late in the lifecycle, over prevention earlier in the lifecycle. There is much discussion of intrusion detection, management, application of patches, and training of users; and not so much discussion of how products could be made more secure “out of the box.”
In the short run, these late-lifecycle methods are necessary, because it is too late to redo the early lifecycles of the products we are using today. But in the long run a big part of the answer has to lie in better product design, a goal to which the plan gives some lip service but not much concrete support.
The second surprise was the section on higher education (pp. 33-34 if you’re reading along at home).
Cybersecurity is a big mess, and there is plenty of blame to go around. You would expect the plan, as a political document, to avoid direct criticism of anyone, but instead to accentuate the positive by pointing to opportunities for improvement rather than inadequate performance. Indeed, that is the tone of most of the plan.
Universities alone seem to come in for direct criticism, having “many insecure systems” that “have been … exploited by hackers” thereby “[placing] other sectors at risk.” Contrast this with the section on “large enterprises” (pp. 19-22). Universities “have been” exploited; large enterprises “can be” exploited. Universities “place other sectors at risk”; large enterprises “can play a unique role in developing resiliency”.
But the biggest surprise in the higher education section is that there is no mention of the fact that computer security education and research are taking place at universities. The discussions of other stakeholders are careful to genuflect to those sectors’ worthy training and research efforts, but the higher education section is strangely silent. This despite the fact that many of the basic technologies whose adoption the report urges were invented at universities. (Think, for instance, of public key crypto.)
This general lack of attention to the educational system is evident elsewhere in the report too. Consider discussion point D4-12 (emphasis added):
How can government and private industry establish programs to identify early students with a demonstrated interest in and/or talent for IT security work, encourage and develop their interest and skills, and direct them into the workforce?
That’s what we do at America’s schools and universities: we help students identify their interests and talents, we encourage and develop those interests and skills, and ultimately we help students direct themselves into the workforce. On the whole I think we do a pretty good job of it. We’re happy to have the help of government and industry, but it’s a bit dismaying to see this identified as somebody else’s job.
