Articles by Jim Harper

Jim HarperJim is the Director of Information Policy Studies at The Cato Institute, the Editor of Web-based privacy think-tank Privacilla.org, and the Webmaster of WashingtonWatch.com. Prior to becoming a policy analyst, Jim served as counsel to committees in both the House and Senate.


Gannett to Use Peer Production

by on November 7, 2006

News outlets are fascinated with the news business, so quite a few stories have been flying around the last few days about the Gannett newspaper chain’s decision to use citizen journalists.

Writes the Washington Post, for example:

Gannett is attempting to grab some of the Internet mojo of blogs, community e-mail groups and other ground-up news sources to bring back readers and fundamentally change the idea of what newspapers have been for more than a century. . . .

The most intriguing aspect of Gannett’s plan is the inclusion of non-journalists in the process, drawing on specific expertise that many journalists do not have. In a test at Gannett’s newspaper in Fort Myers, Fla., the News-Press, from readers such as retired engineers, accountants and other experts was solicited to examine documents and determine why it cost so much to connect new homes to water and sewer lines. The newspaper compiled the data and wrote a number of reader-assisted articles. As a result, fees were cut and an official resigned.

It’s all quite reminiscent of Friedrich Hayek’s articulation of how the price system turns local knowledge into a useful form and thus better organizes human action than any centrally planned system.

The blogosphere (writ large) can and often does surface relevant knowledge better than any group of reporters, no matter how smart or dedicated. Gannett is wise to recognize this and incorporate superior local knowledge-gathering into its business model.

SHARE:

Kahn on ‘Net Neutrality

by on October 31, 2006 · 2 comments

Venerated deregulator Alfred Kahn weighs in on “‘net neutrality” – the proposal to have Congress and the Federal Communications Commission decide the terms on which ISPs could provide service, and whom they could charge for what. Net neutrality regulation is advanced primarily by the political left. Here’s Kahn on his bona fides:

I consider myself a good liberal Democrat. I played a leading role under President Carter in the deregulation of the airlines (as Chairman of the Civil Aeronautics Board) and trucking (as Advisor to the President on Inflation), against the almost unanimous opposition of the major airlines and trucking companies and–let’s be frank about it–their strongest unions. Among our strongest allies were Senator Ted Kennedy, Stephen (now Supreme Court Justice) Breyer, and such organizations as Common Cause, Public Citizen, the Consumer Federation of America and Southwest Airlines.

On telecommunications competition:

In telecommunications, cable and telephone companies compete increasingly with one another, and while the two largest wireless companies, Cingular and Verizon, are affiliated with AT&T and Verizon, respectively, some 97 percent of the population has at least a third one competing for their business as well; and Sprint and Intel have recently announced their plan to spend 3 billion dollars on mobile Wi-Max facilities nationwide. Scores of municipalities led by Philadelphia and San Francisco, are building their own Wi-Fi networks. And on the horizon are the electric companies, already beginning to use their ubiquitous power lines to offer broadband–to providers of content, on the one side, and consumers, on the other.

His conclusion: “There is nothing ‘liberal’ about the government rushing in to regulate these wonderfully promising turbulent developments.”

SHARE: 2 comments

Government Doing Too Much

by on October 30, 2006 · 2 comments

CNN is running a story finding that people think government does too much. The gut-level feeling is supported by mind-numbing statistics:

Discretionary spending grew from $649 billion in fiscal year 2001 to $968 billion in fiscal year 2005, an increase of $319 billion, according to the Congressional Budget Office.

With the election just a week away, one of my little projects WashingtonWatch.com is featuring the laws Congress has passed over the last two years. (Usually, the site features pending bills.) Here‘s a write-up of what we’re doing.

Do yourself and your country a favor: Go check it out so you can be a smarter voter next week. Sign up for the e-mail list or RSS feed so you can be a better citizen year ’round.

SHARE: 2 comments

Fake Boarding Pass Generator Analyzed

by on October 27, 2006

I have examined the CAPPS program and the fake boarding pass generator in a longish post over on Cato@Liberty.

At the tail end, I say “The fake boarding pass generator does not create a new security weakness. It reveals an existing one. Though some people may want to, it’s important not to kill the messenger . . . .”

Michael Hampton of the enteraining and insightful HomelandStupidity.us quickly pointed me to the views of Congressman Ed Markey (D-MA), which are reflected in Ryan Singel’s post on 27B Stroke 6: Congressman Ed Markey Wants Security Researcher Arrested.

Update: Do check the post on this topic at HomelandStupidity. Scroll down for a YouTube video send-up of identity-based security.

SHARE:

Meet Grandma at the Gate This Thanksgiving!

by on October 26, 2006 · 6 comments

With the holidays approaching, a new program providing greater access to airport concourses is underway. At select airports throughout the country, non-travelers can now enter and meet arriving loved ones, as was routine just a few years ago.

Everyone entering the concourse will still be subject to physical security checks, but the program permits travelers to pass through security and board planes without showing ID to transportation authorities or by using a false/pseudonymous ID.

Has the Transportation Security Administration seen fit to restore convenience, privacy, and freedom to air travelers? Seen the light on identification-based security and relented on ID/boarding card checks? Well, no.

A PhD student in the Security Informatics program at Indiana University has created a generator that anyone can use to mock up their own boarding pass. He notes a number of different uses for it – among them, meeting your elderly grandparents at the gate, or evading the TSA’s no-fly list. So far, it’s only good for Northwest Airlines, but others would be equally easy to design.

Checking the ID and boarding pass is intended to communicate to personnel at the concourse checkpoint that a person has been run past the watch list and “no-fly” list. It provides a sort of second credential, linked by name to the ID of the person who has been reviewed. This spoof easily breaks that link. Fake a credential matching any ID you have, and you are in the concourse.

I wouldn’t recommend using this system without a careful check of the law – if you are allowed to see it. It’s probably illegal to access an airport concourse this way and the TSA would bring the full weight of its enforcement powers down on you if you were caught. Needless to say, making it illegal to evade security is what keeps the terrorists in line.

Hmm. Or maybe security procedures actually need to work.

And that’s the researcher’s point: Comparing a boarding pass to an identification document at the airport does little to prevent a watch-listed or no-fly-listed person from passing (except perhaps to inconvenience him a little more than everyone else). Indeed, identification-based security is swiss-cheesed with flaws.

The first problem is that you have to know who the bad guys are. If you don’t know who is bad, your ID-based security system can’t catch them. If you do know who is bad, you have to make sure that they aren’t using an alias. The cost of doing so may vary, but defrauding or corrupting identity systems is an option that will never be closed to wrongdoers. Making an identity system costly for bad guys to defeat also makes it costly for good people to use. Witness the REAL ID Act.

The linear response to the exposure of this flaw could be to “tighten up” the system – perhaps by discontinuing the use of self-printed boarding passes. The right response is to abandon the folly of identity-based security and use security methods that address tools and methods of attack directly.

There’s plenty on identity and identity-based security in my book Identity Crisis.

SHARE: 6 comments

Does Online Vigilantism Make Sense?

by on October 25, 2006

Clyde Wayne Crews of the Competitive Enterprise Institute has a new piece out on cybersecurity, online vigilantism, and white hat hacking. It explores the many avenues for countering bad actors in the online environment, and draws a line between reaching out to aggress against them and using deception and guile to confound and frustrate them.

The piece is apparently motivated by the the “Peer-to-Peer Piracy Prevention Act,” introduced a couple of years ago, which would have given the music industry immunity from liability for accessing peer-to-peer networks and attempting to prevent trade in their copyrighted material. Crews says “the industry is bound to try again.” His conclusion: “Explicit liability protection for particular classes of white hat hacking is ill advised. . . . A green light for hacking can work against broader cybersecurity and intellectual property goals, and there are alternatives.”

SHARE:

Should Government Identity Documents Use RFID?

by on October 24, 2006

Interesting question – and perhaps simpler than many people think.

Back in June, the Department of Homeland Security’s Data Privacy and Integrity Advisory Committee (on which I serve) published a draft report on the use of RFID for human tracking.  The report poured cold water on using RFID in government-mandated identity cards and documents.  This met with some consternation among the DHS bureaus that plan to use RFID this way, and among the businesses eager to sell the technology to the government.

Despite diligent work to put the report in final form, the Committee took a pass on it at its most recent meeting in September – nominally because new members of the Committee had not had time to consider it.  The Committee is expected to finish this work and finalize the report in December.

But skeptics of the report continue to come out of the woodwork.  Most recently, the Center for Democracy and Technology wrote a letter to the Privacy Committee encouraging more study of the issue, implicitly discouraging the Committee from finding against RFID-embedded government documents.  CDT invited “a deeper factual inquiry and analysis [that] would foster more thoughtful and constructive public dialog.”

If the correct answer is “no” do you have to say “yes” to be constructive? RFID offers no anti-forgery or anti-tampering benefit over other digital technologies that can be used in identification cards – indeed it has greater security weaknesses than alternatives.  And RFID has only negligible benefits in terms of speed and convenience because it does not assist with the comparison between the identifiers on a card and the bearer of the card.  This is what takes up all the time in the process of identifying someone.   (If that’s too much jargon, you need to read my book Identity Crisis: How Identification is Overused and Misunderstood.)

I shared my impression of CDT’s comments in an e-mail back to Jim Dempsey.  Jim and CDT do valuable work, but I think they are late to this discussion and are unwittingly undermining the Privacy Committee’s work to protect Americans’ privacy and civil liberties. My missive helps illustrate the thinking and the urgency of this problem, so after the jump, the contents of that e-mail:

Continue reading →

SHARE:

Loathesome Police Incompetence

by on October 23, 2006

Child predators. Before we go down the road of locking them up and throwing away the key, we should read of this botched raid, by police who had used the wrong IP address to determine who were suspects. Weirdly, Shaquille O’Neal was part of the goon squad.

(ht: Balko)

SHARE:

Antigua: Land of the Free

by on October 20, 2006 · 2 comments

Radley Balko at The Agitator notes that Antigua may retaliate against U.S. anti-Internet gambling law (already found to violate World Trade Organization rules) by refusing to enforce U.S. intellectual property law:

There’s no appetite for slapping trade sanctions on US goods; that would hurt Antiguan companies and consumers far more than Americans. Instead, the country may refuse to enforce American patents and trademarks. This would make it possible for Antiguan-based companies to produce knock-offs of American intellectual property, like video and music recordings or computer software. Such a tactic would get the attention of major US firms like Microsoft Corp. and entertainment titan Time Warner Inc. It would also put tiny Antigua’s trade war against the United States on front pages around the world.

Antigua, land of the free . . . downloads?! That may be too free for some people’s tastes, or the wrong kind of free, but it’s interesting to see how the digital world / information economy disrupts traditional power arrangements.

SHARE: 2 comments

Google Office vs. Government “Request”

by on October 18, 2006

In this recent post, TechCrunch briefly assessed some concerns with Google’s office strategy. As most TLFers probably know, Google has online offerings in the works that could substitute for the word processing and spreadsheet software on your computer – just like Gmail did with e-mail.

And just like Gmail, documents and information would remain on Google’s servers so they can be accessed anywhere. This is a great convenience, but brings with it several problems, namely:

The fact that unauthorized document access is a simple password guess or government “request” away already works against them. But the steady stream of minor security incidents we’ve seen (many very recently) can also hurt Google in the long run.

Arrington’s post goes on to highlight a series of small but significant security lapses at Google. If Google wants companies and individuals to store sensitive data on their servers, they have to be pretty near perfect – or better than perfect.

Then there is government “request.” Arrington makes appropriate use of quotation marks to indicate irony. Governments rarely “request” data in the true sense of that term. Rather, they require its disclosure various ways – by warrant or subpoena, for example, by issuing “national security letters,” or by making a technical “request” that is backed by the implicit threat of more direct action or regulatory sanctions.

Continue reading →

SHARE:

← Previous Entries

Next Entries →