OnStar Redux

Back on October 12, 2007, we posted a piece Should OnStar Shut Your Car Down? on this blog. Well, lo and behold, the New York Times just reported this past Friday that,

"Automobiles, which will be increasingly connected to the Internet in the near future, could be vulnerable to hackers just as computers are now, two teams of computer scientists are warning in a paper to be presented next week." (See Cars’ Computer Systems Called at Risk to Hackers by John Markoff, May 14, 2010, web version May 13, 2010.)

The two groups found that, "they were able to remotely control braking and other functions," and "the car industry was running the risk of repeating the security mistakes of the PC industry" (before PCs became widely networked and there were relatively few security incidents).

The stuff they could do was really scary,

"We demonstrate(ed) the ability to adversarially control a wide range of automotive functions and completely ignore driver input — including disabling the brakes, selectively braking individual wheels on demand, stopping the engine, and so on.”

Can you imagine what it would be like to be in a car traveling at high speed while being subjected to such an attack?

And what would happen when you had to answer to the cops if you somehow survived? Well, the researchers

"also demonstrated what they described as 'composite attacks' that showed their ability to insert malicious software and then erase any evidence of tampering after a crash"

Oh boy! Things look bad. But how could a malicious hacker get access to your car's electronics when your car is not connected to the internet? Well, the Times article pointed out that, "Wireless connections are increasingly becoming available in a wide range of automobiles," and it singled out "services like the OnStar system from General Motors (which) now report(s) vehicle position and diagnostic information to the manufacturer."

In our original OnStar post, we asked for legitimate security researchers "to try to hack into OnStar (and other systems) just to find out how easy or hard it is to do."

The good news is that security researchers have started to do just that. The bad news is that it turns out to be easy to do. Toyota and GM and other automobile manufacturers, TAKE NOTICE.

The researchers report is Experimental Security Analysis of a Modern Automobile, and will be presented at a computer security conference this week in Oakland California.

The opinions expressed in this post are those of the author and should not be interpreted as an official position of The Julie Group.

--Chip Neville

Haiti Earthquake Donation Scams

Tom Kelchner, Sunbelt blogger, is reporting on malware that's targeting Haiti Relief efforts.

Schools and community organizations who are collecting relief funds or encouraging donations should caution everyone to be sure of the legitimacy of the web sites claiming to offer aid.

The Sunbelt blog link is here: http://sunbeltblog.blogspot.com/

As an ethical disclaimer, Alex Eckelberry, one of the founding members of The Julie Group is an executive at Sunbelt Software. Nonetheless, the warnings on that blog are worth noting.

- krasicki

Poorly Written Law, Chemical Neurowarfare, and Hacking

The intersection of recent technological advances and law are troubling.

YouTube documentation of the treatment of college students in Pittsburgh during the G20 summit raise serious questions about legislation that allows unconstrained, maliciously cruel, and disproportionate crowd control tactics to be used against unarmed civilian populations.

If we have learned in recent months that corporate behavior that goes unregulated can lead to disastrous social and economic consequences then just as surely we are witnessing warning signs that government empowered by ambiguous law and selective prosecution can strangle, intimidate, and muzzle constitutionally protected free speech.

The Stanford Law and Biosciences blog entry called, Militarized Neurotechnology: Incapacitating Chemical Agents by Kelly Lowenburg is a siren call.

Two recent pieces in Nature, an opinion and an editorial, discuss how non-lethal neuroactive chemical agents have been used by military forces (e.g. fentanyl-induced unconsciousness) and speculate about the potential development of more non-lethal weaponized chemicals (drug-induced lack of aggression, oxytocin-induced trust). Although using these chemical agents is prohibited by the Chemical Weapons Convention, an exception allows their use by law enforcement, for example, in domestic riot control (which may or may not include intrastate military actions).

And Kelly goes on to ask:

The divergent views on policy regarding incapacitating neuroactive chemicals leads me to ask, what about these chemicals makes them more alarming than other weapons? An understanding about why incapacitating chemical agents are uniquely worrisome should inform how they will be regulated.

Is it that they are difficult to defend against and therefore more effective? Is this a problem even though these weapons create non-lethal alternatives in otherwise deadly situations? Or is our real concern that, by incapacitating, they facilitate brutality toward a defenseless prisoner? If so, then the conversation should be about illegal soldier/police abuse, not the chemical agents themselves. Or is there something inherently unacceptable about militarized neuroactive chemical agents? Is acceptability determined by the intended effect (temporary unconsciousness)? By the mechanism (manipulating the brain)? By the amount of pain (fentanyl was developed as an anesthetic, so likely none)? By the size of its therapeutic index and how safe it is (when used to end a siege in a Moscow theater, fentanyl-derived gas killed 124 of the over 750 hostages)?

Should the Chemical Weapons Convention be amended to prohibit the use of incapacitating chemical agents by law enforcement? Or to permit their use by the military? Does permitting them in either context place us at the tip of a too steep slope of biological weapons with more prolonged and devastating effects (attacking fertility or the immune system)? Or does it save lives?

The questions are both urgent and critical in light of a recent 'hacking' conviction in Ohio.

Kim Zetter authored a Wired article called, Court Upholds Hacking Conviction of Man for Uploading Porn Pics from Work Computer.

She describes the case;

An Ohio appellate court has upheld the felony hacking conviction of a man who was found guilty of unauthorized access for misusing his computer at work.

Richard Wolf acknowledged that his behavior was inappropriate when he used his work computer to upload nude photos of himself to an adult web site and view other photos on porn sites, but he didn’t think he should be convicted of hacking for doing so.

A jury disagreed and felt he exceeded his authorization on the computer, which the appellate court recently upheld (.pdf).

Mark Rasch, a former federal prosecutor of computer crimes, called the conviction a misuse of the computer hacking law.

“This goes to the whole concept . . . that violation of an internal policy on the use of a computer can be piggybacked to make a crime,” said Rasch, who now works as a consultant for Secure IT Experts. “His uploading of nude pictures is certainly inappropriate and something he could be terminated for, but it was perfectly legal. When you use the heavy hand of the criminal law to prosecute inappropriate behavior, it’s just an abuse of the criminal statutes.”

Wolf was also convicted of soliciting a dominatrix online for sexual services, a misdemeanor. Rasch says using the computer evidence for proof of this crime is appropriate, but charging him separately for felony hacking goes too far.

Rasch said the problem stems from an amendment that was made to the federal Computer Fraud and Abuse Act — the federal anti-hacking law — that states have added to their own statutes.

“The early statute only talked about unauthorized access — which is breaking into computer,” he said. “But then they amended it to say ‘or exceeding the scope of authorization to access a computer’.”

Richard Wolf may be guilty of many things but the inappropriate application of a computer hacking law targeting malicious hacking of machines is judicial malfeasance. So much so, that the courts need declare such laws unconstitutional and reject them not only for their blanket indifference to criminal behavior but for their dysfunctional effect on regulating such behaviors.

The vigilance of courts in ensuring the veracity of the claims of criminality against individuals must increasingly become a function of such prosecutions. Poorly written technology law must not be tolerated. In an age of mind-numbing technological change, the judicial branch of government must defer to and insist on clear and unambiguous language and appropriate application of law.

The concept of hacking is rapidly evolving from the quaint confines of computers and entering the realm of genetics and human self-determinism. The laws governing illegal activity concerning malicious modification to processes, machines, and human activity need to be re-examined and refined not by the politics of pornography, unbridled military industrial enthusiasms, or provincial social engineering tyrants.

Criminal behavior needs to be distinctly defined rather than broadly implied. And the governments of this world whose resources are unlimited in relative comparison to its citizenry must be constrained from loosing technology in its most punishing and draconian abuse against the inalienable rights of men and women.

Julie Amero: Unjust Justice

The felony charges against Julie Amero have been dropped. Instead of facing prison, she was allowed to surrender her teaching license, pay a $100 fine, and plead to a misdemeanor charge of disorderly conduct.

I am thrilled that Julie Amero has no more charges hanging over her head. And she is thrilled, too. But you should know that no justice was done here. None whatsoever.

Justice would have been full exoneration with a deep, heartfelt apology from the prosecutor for not fully investigating the possibility that malware had infected the computer in the classroom where she was substituting.

Justice would have been a public statement from the prosecutor and Mark Lounsbury, the so-called police forensic "expert" who gave false testimony in her trial.

Justice would have been a proper investigation at the outset before she lost her baby, her reputation, her job, and ultimately, her good health.

Justice would have been placing the responsibility for the whole debacle at the feet of the school network administrator who did not have a full version of anti-virus or anti-spyware software installed, had almost no security policies in place, and hadn't updated the virus definitions on what was on the computer for over three months.

Justice would be seeing the jerks who create malware thrown in jail with the key thrown out, forced to watch the same pornographic images they fed to unwitting PC owners over, and over, and over again, while handcuffed behind their back.

Julie Amero was hospitalized last week for symptoms relating to stress and a possible heart condition. Just four short years ago she was looking forward to the birth of her child and a life with her husband in a community she loved. She enjoyed substitute teaching, loves kids, was well-liked by the students in the school where she taught, and had prospects for a nice, quiet, drama-free life.

One day substituting in a classroom with a badly-infected computer changed her life, her future, and her career.

I went ballistic when I read this a few minutes ago:

But since that dramatic reversal, local officials, police and state prosecutors were unwilling to admit that a mistake may have been made -- even after computer experts from around the country demonstrated that Amero's computer had been infected by "spyware."

New London County State's Attorney Michael Regan told me late Friday the state remained convinced Amero was guilty and was prepared to again go to trial.

"I have no regrets. Things took a course that was unplanned. Unfortunately the computer wasn't examined properly by the Norwich police," Regan said.

"For some reason this case caught the media's attention,'' Regan said.

So that we're clear, it didn't catch the media's attention "for some reason". It caught the media's attention and the attention of forensic experts across the country because they all KNEW that typical behavior of a PC infected with malware is exactly what happened to Julie Amero in that classroom on that day. They were utterly appalled when she was convicted on those four counts of endangering the morals of a minor.

They saw unjust justice.

They saw Mark Lounsbury flat-out give testimony to falsehood. I am not saying that Lounsbury testified that way out of malice. I do, however, think he was untrained, had very little knowledge of viruses and spyware, and a full-blown ego that didn't allow for the possibility he was wrong.

They saw an investigation with very little process or integrity.

They saw Julie. And they knew this was not a woman who would walk into a classroom, boot up a computer, and start surfing porn sites in the middle of class.

They saw the truth. And when they saw it, they knew they couldn't sit idly by and watch an innocent person go to jail when the truth had not been told.

Experts, lawyers, and loudmouthed bloggers like me said "Not this time." They stepped up, they gave their time and expertise for free, and the loudmouthed bloggers started doing what we do best -- blogging it. Telling the truth. Telling those who want the real story to come over here and read about what really happened.

It is unfortunate that politics, or ego, or self-righteous certitude prevents Mr. Regan from understanding what everyone who has ever had a PC without the proper virus protection knows: Without proper anti-virus and spyware protection, your computer and maybe even your life is at risk.

Regan's pronouncement of his certainty of her guilt speaks to his ignorance and unwillingness to learn the facts of this case, and the facts of what PC viruses can do to a computer and in some cases, a life.

Julie Amero should have her teaching certificate back. She should have her hundred dollars back. She should be compensated for malicious prosecution. She should have her child in her arms.

She should. But she doesn't. Because a prosecutor thinks he knows it all, and has listened to a cop with enough information to be dangerous but no facts with which to be right.

Julie deserves better. But she accepts gratefully what she got. I only wish I could do the same.

More information and posts about Julie's case can be found here.

Star Simpson Update

An interview with Star Simpson from Boing Boing TV. Simpson has left MIT.

Justice for Julie Petition Tops 1,000

THE JUSTICE FOR JULIE PETITION REACHED 1,000 SIGNATURES a few days ago, and is now closed. We presume it will be sent on to Chief State's Attorney Kevin Kane, Thomas Griffin, and the various State's Attorneys in Connecticut. Thanks to all who signed.

FREE JULIE NOW!

The opinions expressed in this post are those of the author and should not be interpreted as an official position of The Julie Group.

--Chip Neville

Julie Amero: 432 Days, No Resolution. Still

We're just going to re-post today's blog piece by Karoli Kuns:

Julie Amero: 432 Days, No Resolution. Still

Or, as Rick Green said so well today, Julie Amero is held hostage for 432 days.

I’m waiting for the state to admit that this poor substitute teacher should never have been arrested, tried and convicted. I’m waiting for prosecutors in Norwich to do something: come up with some real evidence and try her — or drop the charges. Amero’s supporters, who include Internet security experts from around the country, have a petition urging Chief State’s Attorney Kevin Kane to drop all charges.

Perhaps the citizens of Norwich should tie yellow ribbons around their trees. It might even be more effective for them to ask their law enforcement officials to focus on real criminals and let the innocent be.

Please sign the petition. It’s time for Julie Amero to be freed from the chains she’s worn for 432 days.

And thank you, Rick Green, for being a responsible voice for justice.

--Chip Neville (quoting Karoli Kuns blog piece from today in its entirety)

The opinions expressed in this post are those of the author and should not be interpreted as an official position of The Julie Group.

And She Still Waits

Julie Amero is still waiting for word that she will be retried or her case dismissed. Meanwhile, there is a moving piece by Wes on the Julie Amero blog here. And please don't forget to sign the petition here.

The opinions expressed in this post are those of the author and should not be interpreted as an official position of The Julie Group.

--Chip Neville

Julie Amero Petition

A plea to the Connecticut's State's Attorneys. Please sign.

Link here.

The opinions expressed in this post are those of the author and should not be interpreted as an official position of The Julie Group.

--Chip Neville

Julie Amero Still Waits

Noted security exert Alex Eckelberry and Hartford Courant Columnist Rick Green report that Julie Amero's case is still on the trial docket in Connecticut. Details are here and here. It is disappointing that 13 months after it was conclusively proved that Julie was the victim of adware and spyware, and 13 months after she was granted a new trial on this basis, the case still drags on. But the best and most optimistic scenario is that her legal team is negotiating with the State as you read this. (We don't actually know, in fact we are as much in the dark as you.) But if this scenario is correct, things may be in a delicate state right now. So we would ask bloggers to be extremely restrained in their comments. In other words, if you must blog, please follow the sage advice, "Don't PO the prosecutor, don't PO the judge."

The opinions expressed in this post are those of the author and should not be interpreted as an official position of The Julie Group.

--Chip Neville

Notes added:

The Hartford Courant has a new editorial here. California journalist and blogger Karoli Kuns has a new piece here.

The Effects of Justice Delayed

An article in the Boston Herald by Laurel J. Sweet entitled Probe shows kiddie porn rap was bogus is a sobering reminder of how certain accusations are as bad and worse than being found guilty of more pedestrian crimes.

Michael Fiola's ordeal within the justice system well documents what Julie Amero's and other's lives are like as they await her day of vindication.

The disastrous effect of rogue virues and malware on the lives of unsuspecting, innocent citizens across this country is incalculable. As you read this article, imagine a family member of yours getting caught up in a judicial system quick to punish, unwilling to seek out truth, and slow to absolve.

Nationally recognized computer forensic analyst Tami Loehrs told the Herald Michael Fiola’s ordeal was “one of the most horrific cases I’ve seen.”

“As soon as you mention child pornography, everybody’s senses go out the window,” she said.

Loehrs, who spent a month dissecting the computer for the defense, explained in a 30-page report that the laptop was running corrupted virus-protection software, and Fiola was hit by spammers and crackers bombarding its memory with images of incest and pre-teen porn not visible to the naked eye.

Two forensic examinations conducted by the state Attorney General’s Office for the prosecution concurred with that conclusion, Wark said.

Still, Fiola, 53, whose wife, Robin, described as “computer-illiterate,” wants his day in court. He intends to sue the DIA for “destroying our lives.”

“Our lives have been hell,” said Fiola, a former state park ranger now living in Rhode Island. “I hope to recover my reputation, but our friends all ran.”

- snip-

“There is no evidence to support the claim that Michael Fiola was responsible for any of the pornographic activity,” she wrote.

All the porn, she said, was located in the laptop’s cache, a computer feature that stores copies of Web pages. Consistently, Loehrs’ findings noted, there was “no apparent origin or user interaction preceding the pornographic activity,” some of which was downloaded “fast and furious.”

Citizens all over the country work on computers whose connections continue to be insecure due to expired anti-virus subscriptions or absence or lack of adequate anti-spyware and anti-malware software.

Yet in far too many cases, employers, police, and crazed fellow citizens are quick to assume that the people accused of possessing unlawful images must be guilty of something far more nefarious no matter what the evidence, their peer relationship, or common sense might indicate to the contrary.

The combination of manufactured and magnified fear, a relentless and mindless moral extremism, and poorly drafted laws that eliminate common sense are creating an ethical nightmare that threatens the very rule of law and guarantee to a fair trial for those falsely accused.

The judicial branch of government needs to reassess the concept of possession and intent in the virtual realms where the transfer and location of data and content may be wholly co-incidental to anything a real person on a given computer is actually responsible for.

Julie Amero and Michael Fiola are just two very visible examples of the need for more sophisticated law and guidance in cyberspace criminal proceedings.

The Star Simpson Resolution

A number of members of the Julie Group were paying attention to protracted case of Star Simpson. Of interest was how the judicial system in Massachusetts would handle the case of a college student sporting a decorative wearable computing device that was mistaken as a potential terrorist threat by local airport authorities.

Mit's The Tech newspaper in an article called, Star Simpson Receives Pretrial Probation
by Joyce Kwan reported,

An East Boston District Court judge sentenced Simpson to one year of supervised pretrial probation on a charge of disorderly conduct and ordered her to perform 50 hours of community service, half of which much be completed with veterans, and to publicly announce that she had made a mistake.

“I want to apologize for the results of my conduct on September 21, 2007. Although I never intended to act in a disorderly fashion, I now realize that the shirt I created caused alarm and concern at Logan Airport,” Simpson said in a statement released Monday by her attorney, Thomas E. Dwyer, Jr. “I am appreciative to the Massachusetts State Police for their diligence in protecting our citizens and apologize for the expense that was caused that day.”

And...

Simpson was originally charged with “possession of a hoax device,” a charge which would require prosecutors to show she meant to scare people with her circuit board, which contained light-emitting diodes in the shape of a star. But they “determined that they could not move forward on that count and dismissed it to the disorderly [conduct] charge,” according to a press release supplied by Wark.

Apparently this resolution is satisfactory by both sides but from the perspective of an interested observer, the public declaration that Simpson had "made a mistake" looks to be prosecutorial coercion.

Unfortunate as the incident was, Simpson had not made any mistake to speak of. While her university garb certainly frightened airport security, it is a difficult argument to make that Simpson or anyone else might know, a priori, that an LED device would be treated with near deadly force except the airport information administrator who translated teenage belligerence into a potential terrorist threat.

The feel-good one-upsmanship of the prosecution in this case is childish and demeaning to those who care about establishing civil operating procedures in sensitive public places. Simpson's apology for being young and impulsive will not prevent the next teen from being young and impulsive.

A smarter judicial system would have Simpson's community service be served at an airport educating information officers on what to look for in dangerous devices and what to ignore. And the airport itself would do well to re-examine the responses of information personnel to situations such as Simpson's.

One must also question the court's insistence that Simpson's community service "half of which much be completed with veterans". Why veterans? Why not active armed agents who can meet and talk to the person they were about to kill because an airport greeter got their nose out of joint? This would be a far more productive use of Simpson's time.

It is hard to understand why the court is establishing separate class distinctions in the defining community service. It seems to me that the community and not the courts should establish the guidelines to Simpson's service.

The final troubling footnote to this episode is that

During the time between her arrest and the June 2 hearing, Simpson was banned from Massport property, including Logan Airport, and had to fly out of other New England airports. “It also meant I couldn’t attend the international symposium on wearable computing, as it was held at the Hyatt at Logan Airport,” Simpson said in an e-mail to The Tech.

It is unclear who issued the ban. Wark said the district attorney’s office had not requested this restriction. Dwyer could not be reached by press time.

This implies that the rule of law is suspended for those who are awaiting trial even though there sufficient evidence that the incident is an unfortunate mistake by all involved.

It is of special interest to know how the rights of American citizens awaiting trial can be suspended so mysteriously.

- krasicki

Clarifying the Securing Adolescents From Exploitation-Online Act, or SAFE Act

Bob Johnston's observations:

It appears that early reporting was very misleading and undoubtedly will create urban legend. When I read the first reporting it indicated that anyone with public Wi-Fi, including you or me should we be so foolish, could be prosecuted if someone used it to transport child porn. My immediate reaction was how would someone even know without monitoring all activity? A virtual impossibility.

Later coverage makes it clear that is not the issue and I wonder why the current bill is even necessary other than raising the penalties from $150,000 to $300,000. The current law makes it clear that if anyone sees child porn wherever....that is, not only digitally but also in print, that we must report it to law enforcement or risk prosecution for failure to do so. Knowledge of this law is important for anyone within the digital computer trade whether a forensic investigator, repairman or simply being a friendly neighbor.

Yes. If you help a neighbor fix his/her computer and observe child porn you must report it. When I take a forensic case, I always advise the client of this obligation. When I help a neighbor, I do not as I do not want to offend a friend but am beginning to wonder whether I should advise them as well. Not because I suspect anyone, but just because it could happen.

Do not misunderstand...I abhor child pornography but I do question laws that hold me accountable for reporting to law enforcement what I observe while practicing my trade. I recently saw a prosecution in the State of Connecticut of an attorney who did not see but had believable knowledge of the presence of child pornography on a laptop. He took the laptop and disposed of it. He was prosecuted under the federal statute and convicted. To me that is a stretch of the statute as I understand it. He was an attorney. When will we see the common man similarly prosecuted?

By way of example...I advise a potential client of my obligation to report child porn if I see it and the client decides not to engage me. Is that "believable knowledge"?

Should I report that to law enforcement?

Can I be prosecuted if I do not?

Should I be prosecuted if I do not?

What say you?

Since Bob discussed this in the private Julie Group blog a second issue is being discussed by Declan McCullagh over at CNet:

The definition of which images qualify as illegal is expansive. It includes obvious child pornography, meaning photographs and videos of children being molested. It also includes photographs of fully clothed minors in unlawfully "lascivious" poses, and certain obscene visual depictions including a "drawing, cartoon, sculpture, or painting."

Most reasonable adults, including home Wi-Fi providers or the Web sites affected by this legislation, can figure out what actual child pornography is. But when it comes to photographs of fully clothed minors in "lascivious" poses, and overly risque cartoon anime that might be "obscene" in one area of the country and permissible in another, it becomes trickier--especially when, legally, only a jury can determine whether an image violates local community standards.

The part I find a bit unsettling is the inclusion of pieces of art in these definitions.

Don't Get Burned Twice

As Randy Abrams in his blog piece Don't Get Burned Twice points out, "The current fires in Southern California are causing misery to hundreds of thousands of people ... As is the case with all disasters there are good people rallying to help and bad people trying to exploit the situation for profit. It may be a good time to remind people about some best practices to make sure that the money you earmark for helping people goes to helping people."

He offers some sage advice about how to avoid getting scammed, "First of all, do not respond to email messages soliciting donations, even from legitimate charities. These messages often are not sent by the charity itself. If you get an email from The American Red Cross and you wish to donate to this respected organization, do not use any information in the email as it may have been sent by a scammer that will redirect you to their fake Red Cross web site. Instead, look up the phone number for the Red Cross, or open your browser yourself and type in http://american.redcross.org." He then goes on to say that if the American Red Cross is not your favorite charity, "A site that can assist you with determining the legitimacy and effectiveness of a charity is http://www.charitynavigator.org/." And above all, "do not give cash to people claiming to represent charities. At LAX or other public places a person may approach you claiming to be collecting for victims of this or other disasters. They may even have impressive documents that are easily printed on a home PC. Some of these people are undoubtedly legitimate, but unless you are a psychic you probably won’t know. Take the information about the charity they represent and look it up before you part with your money."

As he says, "A few simple precautions will help prevent you and the victims you seek to help from being victimized."

And congratulations to Randy and his fellow employees at ESET LLC for volunteering their time and money to assist victims.

The opinions expressed in this post are those of the author and should not be interpreted as an official position of The Julie Group.

--Chip Neville

PS. Fellow Julie Group blogger Karoli has a dead-on post, Attention Mainstream Media: Quit Comparing SoCa Fires to Katrina! at odd time signatures.

Should OnStar Shut Your Car Down?

There has been quite a commotion over at Slashdot about General Motors' plan to "install OnStar systems on almost 1.7 million 2009-model cars." It seems our friends at GM plan to incorporate a "feature" which will allow "law enforcement (or anyone who cracks the system) to remotely shut down vehicles." And Lauren Weinstein writes, "Ready to turn over the keys of your vehicle to the cops, or that clever hacker in the next lane? How about that creepy guy following you on a lonely country road?"

These are good points. But so is the point made by the Cal Highway Patrol Deputy Commissioner, Joe Farrow, that about 15 percent of the pursuits are at speeds of 90 miles per hour and greater, and that, "There are some high-speed chases that we have out here that we'd like to bring to a halt." You don't have to be a rocket scientist to figure out that this stuff is dangerous, and as the AP story where Farrow is quoted points out, 404 people were killed in the US last year in high speed police pursuits.

Clearly, there is a balancing act here. We, the public, need to balance the number of injuries and deaths to be prevented by installing OnStar against the certainty that those nasty folks at evil.wicked.hackers.org will try, and for a time succeed, in hacking the OnStar system.

One way to do this balancing would be to demand public hearings in states like California on this issue. And the computer security community needs to be prepared to provide timely and accurate input. Perhaps we should ask the people over at The Shmoo Group, the people who gave us AirSnort and exposed just how vulnerable the WEP encryption scheme is, to try to hack into OnStar just to find out how easy or hard it is to do.

We need some data here folks! This is too important an issue to leave to GM (or slashdot). And GM, if legitimate security researchers need your exalted permission to hack OnStar, you need to be prepared to give it.

The opinions expressed in this post are those of the author and should not be interpreted as an official position of The Julie Group.

--Chip Neville

A Welcome Court Decision

Arstechnica today reports that an Ohio judge understands the issues involved with child pornography laws, teens, and computing. In an entry called Judge bars Ohio's attempt to keep "harmful" Internet content away from minors by Nate Anderson, he reports,

The state of Ohio this week found itself on the losing end of a judicial decision that struck down a state law banning all Internet transmission of content that is "harmful to minors" if the sender should know that someone on the receiving end is a minor.
Federal judge Walter Rice issued a permanent injunction against the law after pointing out the many ways that it could restrict legitimate speech between adults. The Supreme Court has already found that Internet users have reason to believe that there are minors present in every chat room, for instance; under the Ohio law, anything deemed obscene for minors that was uttered in a chat room could therefore possibly lead to prosecution.

The law was first passed in 2002 and immediately challenged by Media Coalition, a group of booksellers, newspapers, and providers of sexual health information. The judge soon granted a preliminary injunction, and the state amended the law in order to avoid several of the original problems. Despite the changes, Judge Rice still found the bill too broad when applied to the Internet, where it can be difficult or impossible to know the ages of every person that one interacts with.

Media Coalition's executive director, David Horowitz, praised the decision. "While we should have adequate legal safeguards to shield children from objectionable content," he said, "those safeguards cannot unreasonably interfere with the rights of adults to have access to materials that are legal for them."

Today, legislators, judges, and informed citizens must insist an end to witch-hunt prosecutions of citizens, in many cases minors, for possession of material that they may encounter due to legitimate online activity.

Consenting adults enjoy broad cultural interests that will occasionally intersect the lives of others. The underlying personalization automata of the internet is indifferent to social norms. Perfectly innocent people's computers are daily assaulted by malware, viruses, and ingenious scripts that can control and contrive artificial and unwelcome content on anyone's computer. If that content comes to the attention of the authorities, the unfortunate party can find themselves accused of crimes they did not commit.

Knowing what we know about artificial intelligences influencing personal computers, we need more judges insisting on free speech who can couple that conviction with an intolerance for nuisance prosecutions based on synthetic digital realities.

- krasicki

The Child Safe Viewing Act of 2007 Tackles the Wrong Problem

The Senate Commerce Committee today passed the Child Safe Viewing Act of 2007 (S. 602), which requires the Federal Communications Commission (FCC) to study the "existence and availability" of filtering technologies for audio and video content transmitted over "wired, wireless, and Internet" platforms, as well as other devices.

The stated purpose of the bill is to develop the "next generation of parental control technology."

While I have no objection to parental controls and filters overall, I am concerned that there is an over-reliance on these devices as a method to shield children from objectionable content while shifting the focus away from the source of the content -- those who create, distribute, and profit from pornography by employing deceptive marketing techniques, adware, and malware as their primary method of distribution.

There's also nothing wrong with studying different methods to protect children. However, this bill calls for the FCC to "consider measures to encourage or require the use of advanced blocking technologies that are compatible with various communications devices or platforms." It goes on to define those platforms as "wired, wireless, and Internet platforms."

The Center for Democracy and Technology released this statement earlier this week in response to the language contained in the measure:

The Senate Commerce Committee today passed the Child Safe Viewing Act of 2007 (S. 602), which requires the Federal Communications Commission (FCC) to study the "existence and availability" of filtering technologies for audio and video content transmitted over "wired, wireless, and Internet" platforms, as well as other devices. CDT does not oppose a purely fact-finding study, but maintains that a neutral, non-regulatory body such as the National Academy of Sciences would be better suited to such a project. More importantly, CDT is concerned that this legislation may represent a step toward expanding the FCC's censorship authority to include Internet content.

This measure aims at the wrong end of the beast. It would be far more productive for the lawmakers in this country to concentrate their resources at the creators and beneficiaries of illegal content on the Internet and leave decisions regarding what parents do and do not wish for their children to view to the parents. This is the view of the Progress & Freedom Foundation as well, as expressed in their paper released earlier this week discussing the implications of content regulation. From their press release:

In his paper, Thierer asserts that there is no need for Congress or the FCC to mandate tools that already exist. Moreover, if the FCC starts "approving" certain technologies, it is likely to slow the development of new blocking technologies.

Thierer's view is that the measure, while well intentioned, would create unnecessary regulation where there is no market failure at work.As he pointed out in his recent Progress and Freedom Foundation book, Parental Controls and Online Child Protection: A Survey of Tools and Methods, "There has never been a time in our nation's history when parents have had more tools and methods at their disposal to help them decide what is acceptable in their homes and in the lives of their children."

Everyone wants to protect children from rogues, no matter what space they inhabit. That's why I taught my kids not to talk to strangers, not to walk anywhere by themselves, and other basic safety measures to keep them safe on city streets, playgrounds, and even their front yard. Safe internet, television and wireless phone use is also a parental responsibility. What I rely on lawmakers and associated agencies to do is enforce the laws to hold the lawbreakers -- those who create, produce and distribute harmful content -- accountable for the harm they do with their selfish acts.

Filtering content on a mandatory basis pushes all of us down the slippery slope of accepting others' value judgments about what is, and what isn't "dangerous content" that should be subject to blocking. This measure calls for the FCC to craft rules that ignore existing rating systems in favor of defining the scope of the filters through some other subjective basis.

Will the art of the Old Masters be deemed to fall into the category of objectionable content? There are some who would say that it should be included if it includes depictions of genitalia, while others (including me) would not. What about sites which discuss legitimate issues surrounding sexuality and relationships? How would mandatory filtering be enforced? Through the telecommunications and cable companies or by the individual?

Filtering technologies have proven inherent flaws that will not disappear, simply because human communication is too complex and too nuanced to be fed into a database of prohibitions. For every rule there are 10 exceptions. The appropriate approach is to identify and prosecute creators and distributors of clearly illegal content, and exercise parental discretion and supervision over Internet, wireless and television viewing.

What do you think? Do filters work? Parents, how do you keep your children protected on the Internet?


The opinions expressed in this post are those of the author and should not be interpreted as an official position of The Julie Group

--Karoli

Bonus Link: Berkman Center for Internet and Technology: 2007 OpenNet Initiative

A Curious Conundrum

There I was, minding my own business - well, complaining about Adware - when the verdict from the Chris Langham trial popped onto the TV. Though I missed the bulk of the news report, I did pick up one of the legal type guys saying something that can be summed up like this:

"These sort of images (child pornography) don't just pop onto your screen. You have to go looking for it".

Now, it's clear that in this case, Langham did indeed "go looking for it", though only he can truly know if the motive was "research" or not.

However. The above statement seemed to come across as a more general, sweeping, non-Chris Langham specific statement.

This is sort of dangerous.

Already, we've had a web browser that fires up illegal porn without the permission of the person using it. There are currently plans in the UK to make certain kinds of extreme porn - rape, for example - illegal. But here's a hijack from a few days ago involving supposedly normal blogs immediately redirecting the end-user to rape porn.

Bam, just like that. Have some potentially illegal porn, on the house. Quick, free, easy and totally without warning.

I have little faith in UK law at the best of times, especially where cases of a technological nature are concerned. To put out the message that you "have to go looking for it" is spurious at best, and not a mindset the public at large should be fooled into believing.

I never liked TV anyway.

Substitute Teachers and School Attendance Software

In recent discussions of the Julie Group's volunteers an interesting observation surfaced that sheds considerable light onto the plight of Julie Amero's experience in the classroom when confronted by the pornado of inappropriate images on a school teacher's computer.

In many schools across the country, the software that monitors attendance makes no accommodations for substitute teachers. The regular classroom teacher's account exclusively controls classroom access and privacy to that classroom's student attendance records.

And attendance is critical to the central administration of the school. Administrators are made aware of unusual absences because regular and substitute teachers enter the data in realtime. Pulling the plug on the computer by a substitute teacher creates a crippling situation for that classroom and potentially the school.

Critics of Julie Amero or other substitute teachers who follow the rules of not shutting off classroom computers do not understand the gravity of doing so. Shutting off that classroom computer compromises critical school administrative functionality that safeguards the students and staff in the event of a true emergency.

Unfortunately, even school administrators are oblivious to the software's catch-22 defect. The software works fine only when regular classroom teachers are all present and accounted for or if all their logins are functioning properly. Otherwise, substitutes are hostage to making sure the computer is not shutdown (because they can't get back in). This is a requirements blindspot in designing the software.

In Julie Amero's case, no one mention the fact that Julie had done the right thing by leaving the computer running and logged in. The inference was that she should have done more to "protect the students". And the prosecution did nothing to disspell this idea either. The public was mistakenly lead to believe that pulling the plug on the computer was a no-brainer and legitimate option. It wasn't and isn't for most substitute teachers.

In fact, Julie did the only thing she could - leave the software running and deal as best she could with an awful classroom crisis. When substitute teachers are put into compromising positions about turning off computers these facts must be presented fairly in their defense. They are justifiably following procedures that keep the system whole and healthy. They have no other real administrative choice.

- krasicki

Recent Decisions of Interest

Recently two court decisions came to the attention of the Julie Group. Both demonstrate an enlightened approach toward ruling on digital porn cases.

The first, from Pennsylvania, is linked from a site called out-law.com run by an international law firm that we are not in any way affiliated with. The link entitled, Pennsylvania court says viewing child porn 'not illegal' goes on to clarify... "A US court has ruled that viewing child pornography on a website without deliberately saving it to a computer is not a crime. The judge said that the state penal code was ambiguous, so he must rule in favour of the defendant."

Anthony Diodoro, a 26-year-old from Delaware County, Pennsylvania admitted knowingly viewing 370 child-porn images online. He also admitted that he had intentionally visited the websites for the purpose of viewing child porn.

State law says that a person must have "knowing possession" of child pornography in order for it to be a crime. A panel of three judges in the Pennsylvania Superior Court concluded that Diodoro could not be convicted of knowingly possessing the images because there was no evidence that Diodoro knew that his computer was storing the images in its internet cache file.

"Because this is a penal statute with an ambiguous term when it comes to computer technology, it must be construed strictly and in favour of the defendant," wrote Judge Richard Klein.

"A defendant must have fair notice that his conduct is criminal," wrote Klein. "Because of the ambiguity, sufficient notice was not provided here. For this reason, we are constrained to reverse [a previous decision] and leave it to the Legislature to clarify the language if it intends to make the mere 'viewing' of child pornography a crime."

The article further discusses this decision.

The second case is detailed in Law.com. The entry called, Appeals Panel 'Reluctantly' Tosses Child Porn Case by Alyson M. Palmer, Fulton County Daily Report discusses a case in which "Judges of the Georgia Court of Appeals last week said they must "reluctantly" issue an opinion that may make it more difficult for the state to prosecute people who look at child pornography." It goes on to give us some details.

A three-judge panel on June 21 reversed the conviction of a North Georgia man on 106 counts of sexual exploitation of children because, the judges found, prosecutors didn't prove that the man knew he had pornographic images stored in his computer hard drive.

In what it said was an issue of first impression in Georgia, the panel of Judge M. Yvette Miller, Chief Judge Anne Elizabeth Barnes and Presiding Judge J.D. Smith narrowly construed what it means to "knowingly" possess child pornography under the state's sexual exploitation law. It's not enough, wrote Miller for the panel, to prove a defendant has pornographic images in the inaccessible cache files of his computer.

The district attorney whose office prosecuted the case, Herbert E. Franklin Jr. of Walker County, said the ruling will make his job harder.

"With the computer savvy folks out there ... it's going to limit our ability to prosecute, I would think," he said.

But the lawyer who won the appeal, Daniel J. Ripper, of Luther-Anderson in Chattanooga, Tenn., said the opinion just gives prosecutors a roadmap for handling child pornography cases. "This is a case that says, 'Here are the facts that you need,'" said Ripper, a member of the State Bar of Georgia who said about half of his work is in Georgia.

In fact, the Julie Group is finding a disturbing number of nationwide prosecutions that are based on pornographic images stored on a person's computer. The unlikely suspects are teachers, police, teens, and others who find themselves fighting for their lives and, in some cases, bankrupting their resources to prove that they were unaware of the computer activity.

Courts are wise to require clarity in the law where it may be ambiguous. Imprecise criminal statutes can lead to conviction by opinion rather than conviction under the law and can ensnare the innocent as well as the guilty. Innocent people are routinely subjected to automations whose sole purpose is to control content on that person's machine with benign (blind?) disregard for the consequences. The authorities too often assume the automations are invited or actively engaged or are unaware of the phenomenon altogether. Instead of tracing the pornography to its source, it is raced to its destinations - often unsolicited destinations.

And laws that make no distinction between motive to possess such material and mere coincidental possession, entrap people who happen to use the internet. Everybody and anybody accused then becomes a target of the state to prove their immoral fitness to fit the crime.

Judges, courts, and juries who demand and honor the concept of innocent until proven guilty beyond a reasonable doubt are not promoting child pornography, violence, or immoral behaviors. They simply assert that innocent citizens are not criminals for co-incidental and the unsolicited, automated behaviors of computers in their charge. This is often referred to as justice.

- krasicki/js