Blogspam that’s not funny

Idly deleting the blogspam in Akismet I see that this blog appears to have got spam from… itself.

admin | info@www.whydontyou.org.uk | whydontyou.org.uk | IP: 85.153.7.194
Your investigation have been helpfull for me. I wish everybody writes article as this.

WTF? Well, I suppose it’s always possible that I am suffering from a brain disease that makes me both send out spam at random and forget that I’ve sent it.

Plus removes any native-speaking familiarity with the English langauge.

Not to mention that it seems that I’ve been absent-mindedly visiting Turkey without realising it. Because this host is what that IP resolves to (assuming, for no good reason, that the originating IP isn’t spoofed)

Turkey
City: Istanbul
Latitude: 41.0186 Longitude: 28.9647
Host: barbaros.turkbilnet.com
IP: 85.153.7.194

This really pisses me off. If the spammers are so prolific that they’ve spammed the blog they were using as a pretend source, how many other blogs have got spams that seem to originate from here?

Does anyone have any suggestions about what to do about this?

More MOD data goes AWOL

This week’s data-loss story is a Ministry of Defence hard drive that’s gone AWOL. Another example of the UK government’s seemingly bottomless commitment to freeing up access to its data, by distributing it at random around the globe.

Ministry of Defence, that was.

An investigation is under way into the disappearance of a computer hard drive which could contain the details of about 100,000 Armed Forces personnel.

And when it says detail, it means unencrypted detail:

There may also be some personal information including bank and driving licence details, passport numbers, addresses, dates of birth and telephone numbers.

Of serving members of the Armed Forces. Does information get much more personal? It’s not as if that sort of data would be any use to enemies in the ongoing TWAT. (*heavy sarcasm*)

How much confidence does that inspire in the security of the information they’ll have on us mere civilians, when the ID-card scheme includes us all? (*Rhetorical question*)

A commenter said in the Independent

The MoD didn’t lose this data, EDS did. Nobody cares about data that isn’t their own. If this data had been handled in house and the work not outsourced it wouldnt have been lost

EDS is the MOD’s main IT contractor. Here’s their web page.

.. as an HP business group, EDS delivers one of the industry’s broadest portfolios of information technology and business process outsourcing services to customers in the manufacturing, financial services, healthcare, communications, energy, transportation, and consumer and retail industries, and to governments around the world.

The About us page has US contact numbers. It seems to have been written by someone from a Dilbert cartoon. Everything they do is “innovative” and their

highquality, cost-competitive services are provided from the optimal mix of onshore, nearshore and offshore locations.

This determinedly shore-heavy focus may refer to their “related companies”(part-owned companies) which include companies based in the UAE, India (workforce:28,000+ ), the USA and other unspecified locations. One provides “Benefits, Payroll and other HR Administration services to more than 34 million active and retired employees from its client organizations.”

On the 8 September, 2008, prison officers were disturbed about EDS’s loss of their personal data, to the point of threatening a strike.

At that time, Computer Weekly pointed out that EDS already had something of a track record in the data-loss area. The Burton Review Report, published in April 2008, looked into an earlier loss of MOD personnel data, in which EDS were involved.

One of the themes emerging from the Strategy for Transformational Government (2005) was the increased emphasis on sharing services, particularly in information and infrastructure. The Armed Forces have been early pioneers of this approach, through a range of Private Finance Initiative (PFI) and Public Private Partnership (PPP) contracts. (from page 4, Burton Report)

Hmm. Need look no further for the culprit methinks: the whole processes for giving out PFI and PPP contracts.

You might assume that the UK must be desperately short of cash, if it’s prepared to hand over its most crucial information to any company that offers to undercut government employees, while providing a better service and still making a profit. (Well, it must sound convincing to UK governments,) But, it seems that the UK government has a bottomless pit of money for bailing out banks, so shortage of cash can’t be the reason.

If you are interested in looking up the track record of other private companies that keep public data, datalossdb.org could fill in an obsessive hour. Type the name of your chosen PFI company and see what turns up.

ID Cards for your own good…

Well, Orwell is still spinning in his grave. Despite some apparently premature optimism, it seems that ID cards are very much on the government’s agenda. Today’s news headlines have been very much about the “ID Card Rethink [bbc as example]” and how we are all going to end up with one.

This is all despite the House of Lords “setback” and the massive online YouGov poll that showed a significant percentage of the population were against the idea. To me, in addition to the hateful ideas of forced identity documents, the fact the government is able and willing to completely ignore over a million of the electorate’s opinions speaks volumes for how modern democracy works…

In a token gesture to people’s opinions, the government is planning to bring ID card by stealth in a phased manner. I assume the thinking is target the least popular / most vulnerable parts of society then, in a few years everyone will have come round to the idea and we will all carry one. Distasteful is an understatement.

In her speech announcing the new Identity Card plans, the Home Secretary, Jacqui Smith made the following statements:

I start from the premise that the National Identity Scheme is a public good.

Starting from a false premise is never going to lead to anything of value… This is largely, Smith saying the assumption was always we were going to have Identity Cards, like it or not.

As citizens, it will offer us a new, secure and convenient way to protect and prove our identity.

What is new about it? How is it more secure than, say, a passport or driving licence? Equally, how the **** does the existence of an ID card protect your identity?

And it will provide us with the reassurance we need that others who occupy positions of trust in our society are who they say they are as well.

This is odd, and the radio news made a big deal about this. What people who occupy positions of trust don’t already carry a form of ID? Lots of news sources go on about how Airport staff will be early ones to get them – oddly, you already need to have an ID card to get airside at an airport. What will have actually changed? Are the current procedures flawed?

Now, at this point I was going to do a line by line rebuttal of her claims but as they are all insane it will take much too long. Nearly every sentence she utters in her speech contains falsehoods and spin to trick people into thinking ID Cards will solve the worlds problems. They wont.

In an effort to be brief, I will try to address her main points.

Surveillance is everywhereFirstly, ID cards are supposed to be brought in to prevent crime and terrorism. Wow. If having to carry an ID card would prevent someone from being a terrorist, why are there still terrorists in the world? Same with crime. Neither activity will be deterred simply by the existence of a voluntary ID scheme. The best that could possibly be hoped for would be for a compulsory ID card, with fingerprint data, that may enable the police to catch people after a crime(*). In years gone by crazy ideas were often supported with a “wont anyone think of the children” (as parodied by the Simpsons), now we have Prevent Terrorism as the buzzword. If the government want to pass laws people will hate it is always linked to prevention of terrorism. Didn’t anyone watch “In the Name of the Father?”

Secondly they are supposed to prevent Identity Fraud. How this happens is never, ever, mentioned and, frankly, defies even the most cursory examination. Again reading through Ms Smith’s speech is an exercise in logical fallacies, there are more appeals to fear than I care to count. The phrases basically go along the lines of criminals steal identities so get an ID card. This sounds good and there is a half-hearted example of one person who defrauded the state out of £2.5m over five years. Compare this to Northern Rock who have taken over £100billion from the state in as many months. Who is the worse criminal? On a more personal level, ID theft is a terrible thing and I genuinely feel for anyone it happens to. Would the national ID card prevent it? Ninety nine times out of a hundred the answer is no, and in the other one is it a maybe.

CCTV Cameras Cover the CountryFor example, if some one hacks your Ebay account and runs up charges would an ID card have protected you? Same with anything online (where most ID theft apparently takes place) and in the offline world it only works when it interacts with the government. Someone can steal your ID and apply for credit cards, loans etc., and unless the issuing authority has access to the central database there is no way to find out.

This leads to the other problem. The database itself becomes a single point of failure. All a person needs to do is attack that to gain a legitimate, but false, identity. As recent months (and years) have shown, the Government is a largely inept organisation when it comes to protecting the data it holds. The news has covered dozens of “accidents” where huge amounts of personal data have been lost into the public domain. Do you feel safe thinking that a group with this track record will hold the gold standard of data about your identity?

Ms Smith has considered this and some reassurance is given:

Private firms will be encouraged to set-up “biometric enrolment centres” where passport and ID card applicants will be fingerprinted. [BBC news]

WTF! To make matters worse, this personal and private data will be collected by non-accountable organisations who have, by definition, their primary goal of making profit. By Toutatis this is madness. Here we will have the situation where staff on a minimum wage will be responsible for inputting your ID details and making sure no one else can get access to them. People who can be bribed with the price of a pint down the pub. Terrifying.

When Ms Smith talks about how they will protect the data the ID system will store, she manages to confuse me as to how it will work:

 The way in which we are designing the National Identity Register, with separate databases holding personal biographic details physically and technologically separately from biometric fingerprints and photographs, will greatly reduce the risk of unauthorised disclosures of information being used to damaging effect. …(followed by)…  I should make it clear that none of the databases will be online, so it won’t be possible to hack into them. [BBC transcript]

Now call me an old fashioned security professional, but there is a bit here that makes sense. By preventing people from getting access to the data you really do reduce the risk of unauthorised disclosure. However, and this shows more madness, if huge segments of society can’t access the data it is useless. The idea as I see it is that you go into the bank to open an account and show them your ID card. They scan it and compare it to the record of you. If it matches you get account. Seems easy, except now it looks like the bank wont have access and even if they did there is an air gap between the two technologies.

How is it supposed to work?

Lastly (phew, I hear you cry), the introduction by stealth. This shows the government KNOW this is an unpopular idea and it would never get off the ground if they tried to roll it out now. Instead they are going to play on the “white working class fear” of the Evil Immigrants by making them carry ID cards (why not force them to carry a sign round…(**)). What effect this will have is beyond me because if I was an immigrant and challenged by “authority” I would simply say I wasn’t an immigrant. Prove me wrong. Next come the “UK citizens and EU nationals who work in ‘sensitive’ airport jobs” who already carry ID cards and aren’t likely to complain, but again the question is “why?” Finally in 2011 it will be an opt-out option on passport renewals. Passports already have biometric data and are acceptable as proof of ID the world over. Why do we need another form of ID?

That is it in a nutshell, though. Why on Earth do we need another form of ID?

(*) remembering to account for the error bars of partial fingerprint matches when you have a database of 60+ million entries, and hoping the criminals are too stupid to wear gloves…

(**) Hmm. This seems familiar. I wonder why…