Privacy, Security & Government Surveillance

Oracle! Chalk one up for Oracle in its battle against its former allies at the Antitrust Division. Yesterday, a federal court threw out DOJ’s (somewhat screwy) challenge to Oracle’s takeover bid for PeopleSoft. Using some market share ledgermain, DOJ maintained that the merged firm would dominate some specific, narrow, carefully defined, somewhat imaginary sub-sub-markets of the business software market. Never mind that it’s quite a crowded field, with major competitors such as SAP, countless minor players, a looming giant (Microsoft of course), and changing technology that would undermine any dominance anyway. Despite the win, the issue isn’t settled yet, as DOJ may still appeal, and an investigation is still ongoing in Europe (remember SAP?). Of course, if Oracle needs any advice on how to proceed, there probably are a few folks at Microsoft who can share their experiences.

Spy Act, etc.

by on September 8, 2004

Good discussion-starter, Braden. Both these bills bring up some genuinely tough questions. Here’s what is clear (at least to me)…

One: the spyware problem–broadly defined to include all sorts of Internet pests, ranging from drive-by downloads of funky, unwanted toolbars to stealing your home phone number–is a serious one. People are frustrated. It is, for instance, the number one source of tech support calls to Dell. It’s also the source of quite a few calls to MacAfee, largely from my own household.

Continue reading →

Here in the U.S. we’re bogged down in determining whether the Communication Assistance for Law Enforcement Act (CALEA) applies to VoIP technology (the FCC unanimously ruled that it does, but a federal court will likely have the final word). In Canada, they’re debating who should pay for wiretapping. The Canadian Association of Chiefs of Police says it should be telephone users.

An article in the Halifax Herald reports that Canadian police want a surcharge of 25 cents on monthly telephone and internet bills. This charge would cover the costs of tapping into communications networks of suspected terrorists and criminals.

At first glance, it doesn’t seem like such a big deal. We already have a federal security surcharge of up to $10 per airline flight (aka the September 11 Security Fee) which serves to fund air travel safety, why not a similar charge on users of communications services to help law enforcement get the bad guys? But there are important differences here. While it may indeed be efficient to place the costs of safety on the user of the service, wiretapping laws do not make telephone users themselves safer – instead, it’s the greater society that purportedly benefits. So this proposal is a tax, not a “user fee.” Economists will tell you that it is inefficient and costly to administer and collect lots of little taxes.

To be sure, taxpayers will pay through general taxes if telephone users do not. But check out this fantastic comment by a Canadian police officer:

“From our perspective, it’s a slippery slope to start paying for the execution of search warrants or any kind of court order.”

Let me get this straight. It’s a burden for your agency to use its own funds for its own activities…to do your job? Should there be a special tax levied on light bulb purchasers for red and blue lights on patrol cars or for consumers of two-way radios so that police forces can upgrade their communications networks?

This is just another example of unfairly burdening a technology. If this proposal gets traction in Canada, it may migrate south to our country (with all the phone taxes already on our bills, who would notice?).

Associated Press is reporting that the South Dakota Animal Industry Board is developing a new animal identification system to track cattle. The mandatory national ID system is being put in place to protect the nation’s livestock industry from serious disease outbreaks. They plan on clipping RFID tags to the cows ears to track their movements. (Cows always have been a bit shady in my opinion; it’s about time we start tracking them).

And hey, wouldn’t you know it, U.S. Agriculture Secretary Ann Veneman announced last week that more than $11 million in grants will go to South Dakota and 28 other state and tribal projects to facilitate such tracking. Damn, I will clip a RFID tag to my ear and let the government track me for $11 million bucks. Hell, I’ll do it for just $50 bucks a week. In the meantime, who will stand up for these cows’ privacy rights! (Does EPIC have a white paper out on this yet?)

Seriously, though, my colleague Jim Harper has a nice paper out on “RFID Tags and Privacy: How Bar-Codes-on-Steroids Are Really a 98-Lb. Weakling.” Check it out. This is going to be a hot debate in coming years since the privacy fanatics are going to scream bloody murder as more corporations start rolling out RFID-enabled services and technologies. Again, it’s important we understand the difference between private sector vs. public sector uses of such technologies. See this other recent piece by Harper to see what I mean.

When phishing for solutions to online crime, lawmakers are bound to reel in two favorites: expanding statutory definitions of criminality, and broadening prosecutorial powers. Senator Leahy proposes the former (S. 2636), but amendments in committee would likely incorporate the later, as well as a few Federal Trade Commission rulemakings, and maybe even a GAO study.

Those of us who are unenthused about the prospect of such government encroachment tend to offer promises of technological solutions without reflecting adequately on whether or not a market exists to support their development. Not only do less than 5 percent of targeted consumers fall victim to phishing, but the primary consumers of these would-be innovations (online businesses) can opt instead to acquire collective (state) resources from pliable lawmakers at a fraction of the cost.

This dynamic is even more pronounced in this situation because the costs of phishing are predictably concentrated among a small subset of businesses and their consumers. According to data from the Anti-Phishing Working Group, 77 percent of phishing attacks are targeted against the financial services industry, with over 44 percent of those attacks against customers of Citibank, the largest bank (in market cap) in the world. Although the phishing infrastructure (mass emails and temporary web sites) is low cost, there are economies of scale involved. And to the extent that those targeted are not only the largest, but also the most reputable online businesses, phishing is a greater threat to brand equity than the more mundane trademark infringements these businesses already spend tens of millions each year to suppress.

Public concerns that consumers will shun all internet transactions after falling victim to fraud are unlikely to be as consequential as management’s concern that consumers will avoid future internet transactions with the business whose trademark was expropriated to commit the fraud. Publicly traded corporations with shareholder equity in excess of $90 billion do not need public subsidies in the form of prosecutorial resources to assist them in maintaining brand equity. And given estimates that suggest only 27 percent of phishing web sites are hosted in the U.S., supranationals may already be better positioned to police against phishing anyway.

“Phishing,” a.k.a. tricking an Internet user into handing over their data to thieves who steal their money and identities, is becoming a huge problem. There’s a few companies in Silicon Valley that are working on a tech solution to the problem, and Senator Leahy recently introduced a bill to stop it. Here’s a decent primer on the issue.