Today’s Washington Post has an article about the use of biometric technology, and civil-liberties resistance against it.

Interestingly, the article conflates two separate ideas: biometrics (the use of physical bodily characteristics to identify someone), and covert identification (identifying someone in a public place without their knowledge or consent). There are good civil-liberties arguments against covert identification. But the overt use of biometrics, especially in situations where identification already is expected and required, such as entry to an airplane, should be much less controversial.

There might even be ways of using biometrics that are more protective of privacy than existing identification measures are. Sometimes, you might be more comfortable having your face scanned than you would be revealing your name. Biometrics could give you that choice.

By implicitly assuming that biometric systems will be covert, the article, and apparently some of the sources it quotes, are missing the real potential of biometrics.

(Caveat: Biometrics aren’t worth much if they can’t reliably identify people, and there are good reasons to question the reliability of some biometrics.)

An article by Rob Lemos at news.com discusses the differences between “white hat,” “gray hat,” and “black hat” hackers. The article lists me as a gray hat.

In my book, there is no such thing as a gray hat. If you break into a computer system without the owner’s permission, or if you infringe a copyright, then your hat is black. Otherwise your hat is white.

This article, like so many others, tries to pin the “gray hat” image on anyone whose actions make a technology vendor unhappy. That’s why the article classifies me as a gray hat – because my research made the RIAA unhappy.

As a researcher, my job is not to make vendors happy. My job is to discover the truth and report it. If the truth makes a vendor look good, that’s great. If the truth makes a vendor look bad, so be it.

As a computer security researcher and teacher, I was interested to see the White House’s draft cybersecurity plan. It looks to be mostly harmless, but there are a few things in it that surprised me.

First, I was surprised at the strong focus on issues late in the product lifecycle. Security is an issue throughout the life of a product, from the initial conception of the product through its design, implementation, revision, use, and maintenance. The usual rule of thumb is that an ounce of prevention is worth a pound of cure – that attention to security early in the lifecycle makes a big difference later.

Despite this, the White House plan emphasizes remediation late in the lifecycle, over prevention earlier in the lifecycle. There is much discussion of intrusion detection, management, application of patches, and training of users; and not so much discussion of how products could be made more secure “out of the box.”

In the short run, these late-lifecycle methods are necessary, because it is too late to redo the early lifecycles of the products we are using today. But in the long run a big part of the answer has to lie in better product design, a goal to which the plan gives some lip service but not much concrete support.

The second surprise was the section on higher education (pp. 33-34 if you’re reading along at home).

Cybersecurity is a big mess, and there is plenty of blame to go around. You would expect the plan, as a political document, to avoid direct criticism of anyone, but instead to accentuate the positive by pointing to opportunities for improvement rather than inadequate performance. Indeed, that is the tone of most of the plan.

Universities alone seem to come in for direct criticism, having “many insecure systems” that “have been … exploited by hackers” thereby “[placing] other sectors at risk.” Contrast this with the section on “large enterprises” (pp. 19-22). Universities “have been” exploited; large enterprises “can be” exploited. Universities “place other sectors at risk”; large enterprises “can play a unique role in developing resiliency”.

But the biggest surprise in the higher education section is that there is no mention of the fact that computer security education and research are taking place at universities. The discussions of other stakeholders are careful to genuflect to those sectors’ worthy training and research efforts, but the higher education section is strangely silent. This despite the fact that many of the basic technologies whose adoption the report urges were invented at universities. (Think, for instance, of public key crypto.)

This general lack of attention to the educational system is evident elsewhere in the report too. Consider discussion point D4-12 (emphasis added):

How can government and private industry establish programs to identify early students with a demonstrated interest in and/or talent for IT security work, encourage and develop their interest and skills, and direct them into the workforce?

That’s what we do at America’s schools and universities: we help students identify their interests and talents, we encourage and develop those interests and skills, and ultimately we help students direct themselves into the workforce. On the whole I think we do a pretty good job of it. We’re happy to have the help of government and industry, but it’s a bit dismaying to see this identified as somebody else’s job.