Misguided Security Managers

In the July / August edition of Infosecurity Magazine, there is a fairly interesting article on security matters, and differences, in the public and private sectors. I cant find this article online so you will have to trust me.

There is a quote in the article, from an “anonymous” security manager which sadly echoes comments I have heard right across the public sector, when public servants discuss the need to protect public privacy:

One senior manager at a local council – who ask not to be named – told infosecurity that he would rather be brought before the courts for an information security charge, than because a child or other vulnerable person has been harmed as a result of data not being shared.

(Here, I get visions of Reverend Lovejoy’s wife crying out “wont anyone think of the children”)

In the article this is presented as a dilemma public sector information security professionals face on a regular basis. My experience of said individuals supports this. It is very tabloid friendly. It is also complete nonsense that infuriates me to the point of wanting to choke the life out of the idiots who say it. (note for any future court action – this is purely imaginary, I am not really planning to kill anyone now or in the future)

There are so many things wrong with this it is hard to know where to start.

This person is paid to be a security manager. They are not a child protection professional. They are there to manage the security of the information that the public have entrusted to the council. Nothing else. If their job description means they have to ensure that vulnerable persons are safe in their homes, then I suspect there is something seriously wrong going on.

As a public servant, this “senior manager” is paid by the public, who you would rightly assume should have some expectation of his behaviour. Unless we’ve moved into some weird world where the vulnerable pay more for their services he has no right to unilaterally assume what laws he will follow and what laws he will break. He has no right or authority to compromise my privacy and personal data because he thinks that doing so 100,000 times might save one vulnerable person.

Equally this “manager” (sneer quotes intended) has no way of knowing if he is placing the safety of vulnerable people in further danger. Privacy laws and restrictions on how your personal data can be handled are there to protect everyone. Yes this includes criminals but it also includes vulnerable people. If this senior manager feels sending a copy of the addresses of everyone “at risk” to an agency across town would be helpful sharing of their data, what would he do if it got lost? What is his defence if his information security failures allow a predator to get the details of the vulnerable people he seeks to protect?

Equally importantly, what about those who only become vulnerable because of his lackadaisical attitude? This idea that passing private information and personal data is inherently a GOODTHING™© is insane. An otherwise fine person who has their home address details passed into the hands of a criminal becomes a vulnerable person. They have, through no fault of their own, become open to a vastly different threat – one they may not be prepared for. Is this acceptable behaviour for public servants? Imagine a serial rapist who gets hold of modified electoral roll data indicating addresses (and telephone numbers) of every house in the area where a single female lives. Would you be happy with the response that he would rather be in court over an Infosec case?

I suspect the real problem is that privacy and information security statutes don’t have enough teeth. If this senior manager was facing 20 years in jail for an infosec compromise, I am sure he would think differently. As it stands, nothing he does will get him properly punished in a court of law, so he must be talking about the court of public opinion. This is, sadly, so seriously misled by the tabloids that it is easy to see he would be hounded to the brink of suicide if it turned out he had withheld data that might have possibly prevented the death of a child. In a similar manner, if it turned out he had lost a disk containing the personal details of 250,000 people it would get, maybe, a few column inches.

To an extent this is our fault. We want easy to digest news. We ignore the mights and possibilities in the first instance, so we can get to the meat of saving the child. In the second case, its too technical, too distant and probably doesn’t affect “us” so we don’t really care about it. We, the public, are stupid.

I’m a Photographer not a Terrorist

Spread the word – especially if you live in the UK. If you live elsewhere see if there are similar protests in your country. Visit Photographer Not a Terrorist.org to find out more.

Let there be no light

I am overawed by the predictive power of Leviticus, if I’m right in thinking that that’s the book that set the rules for orthodox jews.

As far as I can make out, from this BBC story, (Light sensors cause religious row) orthodox jews aren’t allowed to see by electric light on holy days.

A couple have taken legal action after claiming motion sensors installed at their holiday flat in Dorset breached their rights as Orthodox Jews.
Gordon and Dena Coleman said they cannot leave or enter their Bournemouth flat on the Sabbath because the hallway sensors automatically switch on lights.
The couple’s religious code bans lights and other electrical equipment being switched on during Jewish holidays.

I can’t understand the problem, here. If the hallway sensors detect that it’s dark – the outside world will have street lighting, surely.

So the litigious couple can’t go in the street anyway, as far as I can see. Because then they would be in non-kosher electric light anyway….

Unless street-lighting doesn’t count because those lights are already on when the couple leave their home. In which case, I suggest that they trick the sensors and just switch the lights on permanently in advance of any jewish holiday… Lateral thinking, hey?.

Did Leviticus ban all electric light? Or just proscribe electric light switches and motion sensors but say some lights were acceptably kosher?

As I said at the beginning – this rulebook seems so amazingly farsighted. There must have been real prophets at work, if they foresaw electric lighting a few thousand years ago. Is there anything in there about when we get the jetpacks?

The abortion debate

One of Heather’s recent posts (Lies make the baby Jesus cry) has attracted a few comments. This is odd because most of our readers rarely comment (shame on you) but in some respects unsurprising because the post was on the constantly emotive topic of abortion. In a nutshell, Heather expressed some doubt on the “testimony” presented by an anti-abortion website which described very late term and post-birth “abortions” (murder to normal people) as if they were regularly carried out.

The source had a statement which read: “Generally the practice at the time….and up until 2002 was to end the life of an abortion survivor by strangulation, suffocation, leaving the baby to die, or throwing the baby away.” Heather quite rightly (IMHO) pointed out that this was most certainly nonsense. Strangling a baby after birth is not an abortion.

Anyway, one of the commenters (Lee) has brought up a few points that I felt needed to be elevated beyond the comment thread and given a post all of their own:

Aren’t you talking about an old issue? The girl in the video was born in the 70’s…

Got to answer this yes and no. This is an old issue in that people have argued (and lied) about abortion facts and figures for a long time. The website Heather addressed stated this practice continued until 2002 (old only in internet time). The post itself was made on 17 December 2008, that isn’t even old in Internet time.

The woman in the video was born in 1977 (still not “old”) and yes, US Abortion law has changed between then and now. The “landmark” Roe vs Wade was in 1973 and allowed for an abortion to take place up to three months into the pregnancy. This is not final term and is not post-partum.

Killing a baby after it has been born is now, and was then, murder. In 1977 it was illegal to terminate a baby who was about to be born naturally, unless a doctor stated the mother’s health was at risk (Doe vs Bolton). You can argue that “corrupt” doctors would sign off on anything being a risk to allow a late term abortion but that is a whole different discussion – and can never be prevented unless you rate the mothers life as subordinate to the unborn child.

Maybe I misunderstood the point of your post.

It seems likely, but I actually think you got the point.

It seemed to me you were implying that the girl in the video is lying about the circumstances of her birth.

Yep. If Heather wasn’t implying this, she should have been.

Now it gets fun:

I watched the video (thanks again for the link), it seemed interesting, she didn’t seem to be lying…

Ok. You watched it and thought she was telling the truth. I watched it and thought she was lying. Where do we go from there?

People lie for all kinds of reasons and people will also present a lie as the truth once they have become conditioned to believe it. If the woman in the video was brought up to think they were the circumstances around her birth, she will believe it with all her heart and can easily pass a polygraph. It doesn’t make it the truth though.

I did some research.

So did I. This is why I think there is a healthy dose of lying for jesus going on here.

Not extensive…

Maybe you should try to do some more extensive research. False modesty is not a virtue.

I’m just a blog reader, but it was pretty easy to find information that proved what the girl in the video claims.

I can search the internet and find proof the Earth orbits the Sun. I can find proof the Apollo moon landings were a hoax and proof that Einstein’s Theory of Relativity is false. Doesn’t make any of them true. What she describes is illegal, and was illegal in 1977. Who was prosecuted following this? Where are the court records of the trial?

I suppose lots of other people would have proved her birth certificate (signed by the abortionist) and her medical records wrong by now if she was lying.

How? Show me her medical records detailing her birth. Her birth certificate would have been signed by a doctor just like everyone else, it wont have “Abortionist” in big letters after his or her name. Equally, claims like this – which hit the emotional triggers of lots of people who want it to be true, rarely get subjected to scrutiny.

Crucially, read / listen to what is actually said. The woman claims she was born alive before the “abortionist” arrived and was transferred to a hospital. Her records will begin there. She (and her parents) can make any claims they want about the precursor events.

The claims are unverifiable. They are improbable based on law at the time. They are unlikely based on human nature. What conclusion do you draw from that?

Are you saying that these kinds of failed abortions didn’t happen, or don’t happen? (now there is a law against letting infants die if they survive an abortion…so hopefully they don’t happen anymore).

“Failed abortion” is a wide-reaching phrase. Abortions are carried out in the first trimester (and were in 1977) so it is monumentally unlikely a natural, live and viable birth could take place while in the abortion clinic waiting room. I would be surprised if you honestly thought that US hospitals in the 1970s left babies to die.

The US congress took it seriously:
Born-Alive Infants Protection Act of 2001 [Linked to http://www.nrlc.org/federal/Born_Alive_Infants/BAIPA_%202001_HJC_report.pdf]

The link to the Right to Life website speaks volumes as to the selected choices of information sources. The fact that Congress were convinced to “take it seriously” in 2001 doesn’t lend much support. The blog Heather referenced said this was still going on in 2002 and, there is a tendency to pass legislation on things that are already prohibited if there is enough political pressure to do so. With abortion there is certainly the political pressure.

It does raise one big set of questions though. Prior to the legalisation, and regulisation, of abortions how many babies were left to die, how many were born then strangled, how many mothers died due to complications, how many women died in back street abortions? (etc). Anti-abortionists are not “Pro-lifers” if the mother’s health is sacrificed for the baby. Banning abortion does not make it go away.

If you really want to reduce abortions, without going down the dreaded road of contracption, then plough all your funds into making society better for the parents. Improve healthcare, improve education, improve social supports – just be ready for when a certain section of society realise they get paid for having kids and breed like rabbits. Despite what the anti-abortionist propoganda claims, 99% of abortions are not “lifestyle choices” made by people who feel a child will cramp their demon-worshipping activities.

UK Culture Secretary Fails Internet

In a terrible indictment on the UK government, Andy Burnham (Culture Secretary) demonstrates some fundamental gaps in his knowledge of both the mystical internet and what freedom of speech means.

From the BBC:

Film-style age ratings could be applied to websites to protect children from harmful and offensive material, Culture Secretary Andy Burnham has said.
Mr Burnham told the Daily Telegraph the government was looking at a number of possible new internet safeguards.
He said some content, such as clips of beheadings, was unacceptable and new standards of decency were needed.

Briefly defending him, Mr Burnham has only suggested it as an option. But that is as far as my charity will go.

First things first. Film style age ratings do not “protect” anyone from anything. Browser based implementations (such as blocking your browser from viewing certain ratings) would prevent people from seeing “offensive” material but that is a different matter. Film style age ratings are far from 100% successful in stopping people seeing offensive films (have you seen Mama Mia?) and they are only moderately sucessful in stopping people seeing age-inappropriate content. Why would they work on the internet?

Despite being culture secretary, Mr Burnham appears unaware that the internet is global in nature. This website is written by British people, hosted on a German server and has 60% of its traffic from the USA. Who gets to say what is, or isnt, appropriate here? Harmful content is very culture-specific and by its nature, the internet skips over these boundaries. Do we censor information that the Iranians find offensive? Or the North Koreans? Or southern-US Baptists? Who gets to choose what is harmful? What gives that person the right to say to me what is harmful for my children?

There are some common standards that could be applied, but I suspect there are less of these than Mr Burnham thinks there are. Some cultures think it is acceptable for people to watch criminals being executed, others don’t. Supporters of capital punishment talk about the death of the criminal serving as a deterrent to others. This only works if others know of the death, which is why most executions of this nature are public. Is it harmful (in this context) for people to see the punishment carried out? It is “harmful” in the eyes of a culture that does not condone the death penalty, but why should that culture control the internet?

One thing that screamed out at me was the idea that a video clip of a beheading was unacceptable, rather than the beheading itself… But, in my charitable mood that might have just been a turn of phrase.

The madness continues:

[Mr Burnham] also plans to negotiate with the US on drawing up international rules for English language websites.

Wow. So the UK and US will make a pact that dictates the rules for Australian websites? That sounds fair. What about Iranian websites translated into English? This is mind-numbing madness. Hopefully the US government is technologically literate enough to tell Mr Burnham to boil his head for a few hours. Equally, most video clips showing beheadings are on foreign language websites. What control does the US have over them (short of invading, although admittedly the US rarely stops short of that…).

“Leaving your child for two hours completely unregulated on the internet is not something you can do,” he told the Telegraph.

Another bit of madness. The internet is not a parent. It is not even a child minder. Parents need to be able to educate and assist their children, not rely on badly-thought out “ratings schemes.” Parents need to sit with their child as they surf the internet. Its like anything children do – if you abandon your child to do it, you have no control over what they do. You may think you have some say, but you dont. Take the ratings scheme: most children who are able to surf un-assisted will be able to change web-browers to one that ignores the ratings. Or better still, will be able to enter a URL without a .uk or .com ending where the UK/US RULE is ignored. Technologically backward parents will not be able to implement a control to prevent the child switching to [Lynx|Amaya|Chrome|Opera|FireFox|Mozilla|Safari|Etc]. Does Mr Burnham think every browser coder will be willing to implement a strong age-ratings control without new ones spawning up? Is he that foolish?

The final bit of oddness is: [Emphasis mine]

He went on to say it was time to review the accessibility of certain content on the internet and insisted he was not trying to curb free speech.
His plans are likely to anger those who advocate the freedom of the worldwide web.
You can still view content on the internet which I would say is unacceptable. You can view a beheading,” he said.
“This is not a campaign against free speech, far from it, it is simply there is a wider public interest at stake when it involves harm to other people.”

For a culture secretary, Mr Burnham is woefully ignorant of what “freedom of speech” means. Personally I am opposed to beheading people. I find the death penalty for any crime offensive. Not everyone shares my opinion and, as a result, there are websites where you can read about executions. There are even websites that support the death penalty. I would say they were unacceptable. Does that mean they should be blocked from your browser? No, it means I shouldn’t view them. If I find something offensive, then I shouldn’t look at it. With my children, I sit with them to educate them about what they see. Should I accept your view of what is acceptable for them?

Despite what Mr Burnham says, freedom of speech is not about being free to say things that he (or anyone else) finds acceptable. I find political diatribes offensive and I find religious websites offensive. Will Mr Burnham have them removed? Or would that be a violation of the concept of Freedom of Speech? (I suspect the answer is yes)

The world is full of things which people will find offensive. I find children dying of hunger in Africa unacceptable. Does that mean we ban video clips of it (there go those Oxfam adverts) or does it mean we try to prevent it happening in the first place?

Mr Burnham is right to be offended by the video clips of beheadings. So why dont we prevent the beheadings?

I am sorry, Mr Burnham. As culture secretary you fail.

Live by the sword…

For years now, politicians of all flavours have been busy manipulating public opinion and cherry picking how they present information – all with the aim of convincing the largely apathetic voting public to agree with their crackpot ideas. As you can imagine, however, this has its own share of problems.

As an example, today on the BBC Radio 1 news show (*), there was a terrible indictment of just how mixed up people are. Basically, the Prime Minster Gordon Brown is trying to gain some media-credits with his claims that he is “tackling knife crime.” Obviously the PM and current government are unpopular at the moment so here we see yet another example of how politicians no longer have a political view, but will do what ever they think they can to get support from the barely coherent, rabid, tabloid media.

The knife crime panic is a great example of this. All year, we have been subjected to scare stories in the media about how knife crime is on the increase; if you believe papers such as the Daily Mail there are more stabbings than there are people. I am not for one second trying to imply that knife crime isn’t devastating for the victims and their families – but we need some form of perspective. While there were pockets of increased incidents, the chances of Joe Blogs UK becoming a victim was pretty much the same as it always has been.

However, our media-hungry politicians (on all sides) read the building tabloid-frenzy and jumped in early. For months we had debates about how bad knife crime was, and what were the government going to do about it. This was stoked with the public being drip fed “news” each time a cute, innocent kid got stabbed. Each one was delivered in that wonderful way the tabloids have of making their readers think that the one incident they report is just the tip of the iceberg – in reality, when things are so commonplace, the media loses interest in them… Seeing a great chance, the government (and opposition) built upon the general irrationality of people – isolated incidents were blown out of proportion, personal anecdote was given much greater emphasis etc. So far, so typical. This is all politicians have done for over a decade.

Today, the PM tried to deliver his latest great accomplishment.

The PM announced that the new “crackdowns” implemented by Police in high-risk areas had managed to bring down knife crime. Wonderful. I am sure he expected nothing but fanfare… Sadly, the general public are too depressed and gloom-laden to take good news like this. Also, for years we have been indoctrinated into the idea that out microcosm of life is more representative of society than anything else – which means no matter what the PM claims, people think things are getting worse. From the BBC Pages:

The Prime Minister has spoken to Newsbeat after the government said the latest police crackdown was working.

The government says stabbings are down and fewer teenagers are carrying blades in the 10 parts of England and Wales where there’s been a big effort to tackle the problem.

The figures also show under-18s going to hospital for stabs and cuts are down by a quarter and more serious attacks have dropped by a fifth.

Great news. It doesn’t really say much about the government policies though. Nothing like enough time has passed to know if this is a long term change or a simple “blip”  in the numbers. Equally, there is no way of knowing if the “massive” (**) increase was a statistical blip. The information provided doesn’t tell us if the crime has simply moved elsewhere, or if this is part of a national downturn in knife crime. It really is a non-news item. There isn’t enough information for the viewer to do anything but rely on how the sparse numbers are spun to the public.

Shocking, but this is how the government have wanted us to interact with news for many a year now. If the public were given all the information that drove national policy, half the crazy things we suffer now would never have survived.

Equally comical, is how Gordon Brown reacted to the predictable nonsense questions. According to the BBC, the text messages from their listeners saying things like “I was stabbed 2 years ago, how has knife crime gone down” were a valid counterpoint to the governments figures. A normal, sane, educated person would have laughed and said “shut up crazy fool.” But this is gold to politicians – they want people to think like this so that future crazy laws can be passed. This lead to a very bizarre exchange:

Newsbeat: The statistics on knife crime say one thing. We’re hearing other things from our listeners.
Gordon Brown: That’s why we want to get knives off the street. I’m not complacent at all. A lot of young people are stopping carrying knives but we’ve got a long way to go. And that’s why today you’ve got all these people from all different walks of life; sports people, from the world of entertainment, from radio, from television, all saying, working with the community groups, no to knives. (blah… blah… blah…)

A touch strange. The PM is saying nothing as an actual response. It is certified 100% content free. Isn’t that nice. That was just mildly odd but it was followed by this:

Newsbeat: The stats that you’ve published today seem to show that knife crime is down. A nurse at Bristol Royal Infirmary says stab wound admissions are going up.
Gordon Brown: What I want to know is how we can actually get knife crime down and how we can make sure it stays down. Making sure it stays down is more policing that’s visible on the streets, a presumption to prosecute if you’re seen to be carrying a knife, tougher police and prison sentences when that happens, shops banned from selling knives to young people and schools and community groups doing an educational process whereby young people are discouraged from carrying knives.

What? Listen to it on the radio. Newsbeat phrase their statement as a question. You can hear the question in the reporters voice. She is expecting an answer. Granted she seems unable to actually ask questions, and just makes statements with a rising emphasis at the end to imply a question, but if you speak English you can hear the questioning tone.  However, our glorious PM ignores it. It is really like he has been asked a different question and Newsbeat dubbed their own over the top of it. Nothing he says bares any relation to the question.

Bizarre.

Are we really in such a disconnected world that any of this makes sense? Do politicians think this is acceptable? Do reporters? (He wasn’t challenged on it).

Equally sad, but much more common, is the idea that the experiences of a nurse at the Bristol Royal has such an insight into national trends that their comments outweigh national reports. Even if they are the person who records every admission (and the cause) they have no idea what is going on in Liverpool, Barnsley, Truro, Southampton (etc.). The national statistics are based on reporting from various sources and show the national trend. Knife crime can go down 90% nationally but still show an increase in a region. That an otherwise well educated nurse doesn’t understand this element of statistics gives me concern over how disease surveillance is carried out.

The BBC mentions the “crime hotspots” that were targeted, and show a reduction:

The 10 knife crime hotspots are London, Essex, Lancashire, West Yorkshire, Merseyside, the West Midlands, Greater Manchester, Nottinghamshire, South Wales and Thames Valley.

Unless the Bristol Royal has moved across the River Severn  into Wales, it is not in that list. It could show a trillion percent increase and the governments figures for the crime hotspots would still be down. This nurse’s experiences may be 100%, but they are irrelevant. The only way this person could have had real impact was if the debate was about knife-crime admissions to the Bristol Royal Infirmary. But it wasn’t.

Still, in this day and age of citizen journalism, no one was going to say this. The nurse’s (and others) comments were treated as valid counterpoints to the report and dutifully skipped around by the PM. Are the BBC’s news reporters really so empty that this seemed reasonable?

Sadly the answer seems to be “yes.” Well done Great Britain, I am so proud.

(*) Please note, this is a link to the current newsbeat page – the actual content I am talking about here may have gone by the time you read this. If you can, though, this is worth listening to. Its almost like they re-recorded the PM and asked him different questions…

(**) For an arbitrary value of massive.

Ministers object to normal treatment

You have to feel sorry for members of the government and their allies. I mean, how dare they be treated like mere mortals, when they are so obviously in need of special treatment – like being assumed innocent until proven otherwise.

In an interesting example of double standards, the former home secretary lashed out at the police for their heavy handed tactics: (from the guardian)

David Blunkett, the former home secretary, yesterday led a cross-party attack on the police for what he described as “overkill” in arresting the shadow home office minister, Damian Green, after he published Home Office documents allegedly leaked by a civil servant.

As fresh details emerged of a nine-hour police operation against Green, whose parliamentary computer was seized and whose wife was forced to witness a search of their London home, Blunkett questioned police tactics.

Drawing a parallel with police behaviour in the cash-for-honours affair, in which a former Downing Street aide was arrested in a dawn raid, he spoke of “the danger of overkill, of treating every case as though we are dealing with a suspicious character”.

Woo, cry me a river Mr Blunkett. The irony here is astounding.

Lets look at this: The police were investigating a possible crime and as part of this they seized items of evidence (computer) and conducted a warranted search of the home address. Gosh. I have a suspicion that in London alone this will have happened 100 times that day. Nationally, there will be over a thousand people who have “witnessed a search of their house” – most will turn out to be innocent. Interestingly, despite the claim in the paper, his wife wasn’t forced to watch – she could have left them to it.

In a nutshell, this is routine police work. Thanks to Mr Blunkett’s drive to increase the draconian powers of the police this is happening to people all over the country every day. We are closer and closer to being “guilty until proven innocent” and it is (largely) down to things that happened on Mr Blunkett’s watch. That he can now whine about overkill almost defies belief. That this gibberish has news coverage is equally bizarre.

Equally weird is the subheading that “Brown and Smith were not consulted” – why should they be? Police investigate illegal activity daily. That is their job. If they had to consult the PM before every police investigation it would truly grind to a halt (and the Bill would be a lot less interesting).

The actual case in question here is of so little interest it has hardly generated any news coverage. For example, the only reference to it in this particular article is:

The police inquiry began when the Cabinet Office made a complaint to the Met about the leaking of confidential information from the Home Office.

Yawn. It happens all the time so who cares. Politicians have become so slippery in their urge to court tabloid popularity they think nothing about “Leaking” things on purpose, so should we really get upset when it happens without their explicit approval?

The reality of daily life for normal people is that if the police think you have committed a crime (or are planning to, or thinking about, or know someone who has, or look like someone who has, or live near someone who has) then a dawn raid, followed by a house search and computer seizure is a constant possibility. This is the world Blunkett et al created (and Cameron will only perpetuate), why are they upset to live in it?