Mr Harris, the TSA person whose business card I had been given never got back to me. Thus, after waiting 2 weeks, I decided to go ahead and contact his boss. This afternoon, I had a telephone conversation with Rich Adams, the Assistant Federal Security Director for Law Enforcement at TSA's Indianapolis Airport office.
The main points of the conversation were as follows:
TSA has many different configurations of checkpoints. At the gate/terminal that I went through, they have designed a special streamlined channel for SSSS (secondary screening passengers) to go through. They do not have enough physical space to allow for these SSSS people to opt for a manual pat down.
Other airports/terminals, where the SSSS people go through the same lines as everyone else may have more space, and thus, may allow people to opt out of being puffed by the creepy Smiths/GE entryscan machines.
The highlight of the conversation, for me, was after this;
Him: (the above bit of text, telling me why I could not decline to get puffered at this checkpoint if i was designated SSSS).
Me: Could you please send me that in writing, and include a copy of the specific regulation or law which documents and backs up that policy.
Him: No. It's classified as SSI (Sensitive Security Information).
Me: What? That doesn't seem fair. You're forcing me to follow a rule or law yet are not permitting me to see the text of the law. How can I know if your employees are following it properly?
Him: For security reasons, we do not allow this information to be made public.
Me: Have you heard of the book Catch 22 by Joseph Heller?
Him: Yes
Me: Does this not seem a bit similar, or perhaps, alternatively, to something by Kafka?
Him: *losing patience - he then reminds me of the TSA mission of keeping us safe, and that his employees are not out to hinder our "god given" rights*
I also complained about having to go up to 2 levels of supervisor to be able to take sex lube on the plane- even though this was listed as an acceptable item on their website.
He didn't seem to have any problems with this, and essentially said that they were always doing their best to educate their staffmembers, and that me pulling 2 supervisors over was a normal part of the security screening process.
Quite a fun conversation, i'd say.
Remember Kids: You're either with us, or are helping the terrorists.
Friday, October 06, 2006
Tuesday, October 03, 2006
A dystopian view of personal Tivos
At some point not to long into the future, we'll have personal recorders for our lives. The first versions will record all the audio we hear, and later, as storage/cpu becomes cheap, they'll start to record video too.
The killer technology that'll enable this will be speech recognition tech that actually works.
You'll carry this device on your person, it'll record all of the conversations that you participate in, will convert those to text which you'll then be able to easily search later.
This will solve that ever annoying problem of not being able to quite remember what so-and-so told you the other day. You'll just need to remember a couple of the words from the conversation and will be easily be able to go back and locate the conversation...
The other obvious benefit to this will be that you'll be able to easily figure out which song you heard on the radio, coming out of someone's car, or that you danced to in the Club. Song recognition technology is already out there, and so it's quite easy to imagine that this'd be rolled into such a device.
Due to the need to turn this info into searchable text, you're going to need to upload it somewhere for processing. It'll either be uploaded in real time over wireless/cellular networks, or maybe you'll dock the device at the end of your day for processing. Either way, it doesn't really matter for the purposes of this blog post.
Now, consider the fact that pretty much everyone has a cellphone on them. Cellphones all include GPS chips now - for E911 reasons (although, it's interesting to note that the ever-present greed of the cellphone companies is the main barrier to us having access to this GPS data right now. They want to make a buck each time you use this data to interact with a merchant).
And herein lies the problem. Consider the following scenario:
A crime occurs. The police contact the phone companies and get a list of everyone who was nearby to the crime when it happened (which they're able to get via the GPS/cell tower log data). Now, the feds demand that each person hand over the audio/video data from their personal Tivos so that they can piece together information on the crime.
This seems like a great idea. Right? Except when you consider the fact that large portions of society do not like the Police (this is due to many reasons - racial profiling, past abuses by the police, drug war overzealousness, etc).
If you witness a crime right now, it is quite easy for you to tell the police that you don't remember seeing anything. The real memories are your own, and so you have solid control over who you share these with.
Fast forward to the digital age of the personal Tivo - and suddenly, you do not have the right to keep this information from the police anymore.
Remember that you can only plead the 5th if you risk incriminating yourself. If you are incriminating someone else, you have no right to stay silent, nor keep your data to yourself.
Encryption - the magic pixie dust that has solved so many of the Security World's problems thus far, fails us... because the police can compel you to disclose your keys.
There are systems in place (StegFS, The Rubberhose filesystem) which aim to protect you against Rubber Hose Attacks (i.e. you being beaten by a CIA interrogator until you disclose your personal data). They work by essentially allowing you to say "I don't have any data on the disk"... Or by allowing you to have multiple encrypted files, one encrypted with your "real" key, and the other with a key which you give to the police when asked..
However, in the case of the personal tivo - through the GPS records that the Feds will gain from the phone companies, the police will know exactly where you are and when. Thus, if you give them bogus data, and they know you were walking past the Clocktower at noon - and your Tivo data does not have a clock chiming noon, they'll know you've given them false data.
Thus, we have an even more extreme form of the rubberhose attack. How do you protect your data from the police when they can 1. compel you to give it to them, and 2. They have a fair idea of at least some portion of the data on your disk? They can use what they know to verify if the data you later give them is in fact real.
It's a puzzling problem - and it's going to become real.... It's just a matter of time.
How do we solve this problem? I have no idea.
The killer technology that'll enable this will be speech recognition tech that actually works.
You'll carry this device on your person, it'll record all of the conversations that you participate in, will convert those to text which you'll then be able to easily search later.
This will solve that ever annoying problem of not being able to quite remember what so-and-so told you the other day. You'll just need to remember a couple of the words from the conversation and will be easily be able to go back and locate the conversation...
The other obvious benefit to this will be that you'll be able to easily figure out which song you heard on the radio, coming out of someone's car, or that you danced to in the Club. Song recognition technology is already out there, and so it's quite easy to imagine that this'd be rolled into such a device.
Due to the need to turn this info into searchable text, you're going to need to upload it somewhere for processing. It'll either be uploaded in real time over wireless/cellular networks, or maybe you'll dock the device at the end of your day for processing. Either way, it doesn't really matter for the purposes of this blog post.
Now, consider the fact that pretty much everyone has a cellphone on them. Cellphones all include GPS chips now - for E911 reasons (although, it's interesting to note that the ever-present greed of the cellphone companies is the main barrier to us having access to this GPS data right now. They want to make a buck each time you use this data to interact with a merchant).
And herein lies the problem. Consider the following scenario:
A crime occurs. The police contact the phone companies and get a list of everyone who was nearby to the crime when it happened (which they're able to get via the GPS/cell tower log data). Now, the feds demand that each person hand over the audio/video data from their personal Tivos so that they can piece together information on the crime.
This seems like a great idea. Right? Except when you consider the fact that large portions of society do not like the Police (this is due to many reasons - racial profiling, past abuses by the police, drug war overzealousness, etc).
If you witness a crime right now, it is quite easy for you to tell the police that you don't remember seeing anything. The real memories are your own, and so you have solid control over who you share these with.
Fast forward to the digital age of the personal Tivo - and suddenly, you do not have the right to keep this information from the police anymore.
Remember that you can only plead the 5th if you risk incriminating yourself. If you are incriminating someone else, you have no right to stay silent, nor keep your data to yourself.
Encryption - the magic pixie dust that has solved so many of the Security World's problems thus far, fails us... because the police can compel you to disclose your keys.
There are systems in place (StegFS, The Rubberhose filesystem) which aim to protect you against Rubber Hose Attacks (i.e. you being beaten by a CIA interrogator until you disclose your personal data). They work by essentially allowing you to say "I don't have any data on the disk"... Or by allowing you to have multiple encrypted files, one encrypted with your "real" key, and the other with a key which you give to the police when asked..
However, in the case of the personal tivo - through the GPS records that the Feds will gain from the phone companies, the police will know exactly where you are and when. Thus, if you give them bogus data, and they know you were walking past the Clocktower at noon - and your Tivo data does not have a clock chiming noon, they'll know you've given them false data.
Thus, we have an even more extreme form of the rubberhose attack. How do you protect your data from the police when they can 1. compel you to give it to them, and 2. They have a fair idea of at least some portion of the data on your disk? They can use what they know to verify if the data you later give them is in fact real.
It's a puzzling problem - and it's going to become real.... It's just a matter of time.
How do we solve this problem? I have no idea.
Tuesday, September 26, 2006
TSA = arbitrary rules
When you're pulled over by a Police Officer for speeding, things are fairly cut and dry. He tells you you're speeding, and if you have any questions as to why this is a problem, he can cite the specific local/state laws which prohibit the type of behavior/speeds that you were engaged in.
When you're ordered to do something by TSA, or worse, told that you're breaking the rules, you're in rough shape. Mainly because most of their rules are secret. As amusing as it was to test the TSA screening rules against a bottle of sex lube, I was at least lucky enough to be testing a rule which they post on their website.
Their rules for who must or need not show ID, or who can decline to go through puffer machines (and if so, what they must submit to in exchange for this) are all covered by secret rules that the TSA keep to themselves. TSA deems these "Secret Security Directives" and as such, is not required to share these with the public. Even though you are forced to submit yourself to these rules, and in spite of the fact that the TSA employees cite the rules when telling you what to do, you have no way of keeping them in check.
Checks and balances are extremely important. Without them, we become victims of those who abuse their powers. One day, they enforce the rules, the next day, they don't. They can pick and choose who to enforce them against (i.e. males with darker skin, those who don't shave, or anyone with a foreign sounding name).
I've sent an email to Rene Harris of the Indianapolis TSA office to seek clarification for their seemingly arbitrary rules regarding who can and cannot opt out of the puffer machines. Esp. after successfully avoiding them at DCA, it'll be very interesting to see what he says.
When you're ordered to do something by TSA, or worse, told that you're breaking the rules, you're in rough shape. Mainly because most of their rules are secret. As amusing as it was to test the TSA screening rules against a bottle of sex lube, I was at least lucky enough to be testing a rule which they post on their website.
Their rules for who must or need not show ID, or who can decline to go through puffer machines (and if so, what they must submit to in exchange for this) are all covered by secret rules that the TSA keep to themselves. TSA deems these "Secret Security Directives" and as such, is not required to share these with the public. Even though you are forced to submit yourself to these rules, and in spite of the fact that the TSA employees cite the rules when telling you what to do, you have no way of keeping them in check.
Checks and balances are extremely important. Without them, we become victims of those who abuse their powers. One day, they enforce the rules, the next day, they don't. They can pick and choose who to enforce them against (i.e. males with darker skin, those who don't shave, or anyone with a foreign sounding name).
I've sent an email to Rene Harris of the Indianapolis TSA office to seek clarification for their seemingly arbitrary rules regarding who can and cannot opt out of the puffer machines. Esp. after successfully avoiding them at DCA, it'll be very interesting to see what he says.
Subscribe to:
Posts (Atom)