security


Unfortunately, I haven’t been keeping this site up to date as I’ve been blogging on the Stanford Law School Center for Internet and Society site.  To that end, here are my most recent posts:

The Unintended Consequences of CISPA

New Cybersecurity Bill Available

Revised Cybersecurity Act Needs Amendments for Privacy, Security

Thanks for following along.

 

New Research Suggests That Governments May Fake SSL Certificates | Electronic Frontier Foundation.

I say “probably” in this article Enter Stage Right: The “Cyber Czar”.

GRANICK SLATE CARD
PRIMARY ELECTION, June 3, 2008

Friends, Romans, Republicans*:

Welcome to the Granick Slate Card for the June 3, 2008 Primary Election. Lots of fun stuff on the ballot, though unfortunately we can’t vote for who is more wronged, Obama because Hillary insists that Florida and Michigan voters be counted even though Obama didn’t campaign there because they weren’t supposed to count, or Hillary because Obama insists that she death wished him by even mentioning RFK. Debate it elsewhere, we aren’t even talking about it here. No, we are not.

*Actually, its a primary and I’m registered Democrat, so the candidate picks below are only helpful for Democratic voters. If you aren’t registered D, see the “Some Housekeeping” section.

Some Housekeeping:

Its recently come to my attention that some fair citizens of San Francisco* are registered Independent, meaning American Independent Party. The AIP is not the fair-minded agnostic who just wants a chance to vote their conscience in a open primary, no. It is, according to those perennially youthful lads Matier and Ross, “anti-immigrant, anti-abortion, anti-NAFTA and anti-tax party”. For those of you in the same boat as Ms. Siebel, you might want to re-register. To become the independent voter you always wanted to be, you should pick “decline to state”. You can do so here.

*Who else made this gaffe? Why, future First Lady Jennifer Siebel did! So you are in good company. Reportedly, she went to Stanford!

Now that that’s settled, we’re off to the races.

United States Representative; District 8: Nancy Pelosi, Democratic

Pelosi is powerful. Pelosi brings home the bacon. Pelosi will face anti-war mom Cindy Sheehan in November. Pelosi will win this primary. Pelosi.

State Senator; District 3; Mark Leno

This is a tight race and, to my mind, one of two reasons to turn out and vote next Tuesday. Assemblyman Mark Leno is running against the incumbant Carole Migden and former Assemblyman Joe Nation. Nation made a name for himself with pro-environment legislation, before terming out of the State Assembly in 2006. He’s generally considered the most conservative person running for this seat, possibly because he says he’ll work across party lines, possibly because he takes money from the landlords promoting Prop 98 (see below) and also possibly because he’s the only straight guy. Hey, straight people can be liberals, too!

My vote goes for Leno. He’s been effective, principled and pragmatic. The Chron, which endorsed him, says “Leno’s work in shepherding his same-sex marriage legislation – bringing it from pipe dream to passage in 2005 and 2007, only to be vetoed each time by Gov. Arnold Schwarzenegger – was a textbook example of how an understated tenacity can pay off in the world of politics.” He was also instrumental in passing a state health care bill last year.

Sadly, Senator Migden’s personal and professional judgement make it impossible for me to vote for her, especially with Leno in the race. Remember the hit-and-run freeway crash, which she blamed on medication she is taking for previously undisclosed cancer, and the record fine from the Fair Political Practices Commission for campaign-finance law violations that included use of donations for personal expenses? How about the time she punched the “yes” button of a Republican legislator when he was in the toilet or something while her bill was being voted on in the Assembly? If there weren’t another great candidate, you might force yourself to overlook these things, but there’s Leno.

State Assembly: Tom Ammiano

He’s movin’ on up from the Board of Supervisors. He’s funny. He’s from New Jersey. He worked his ass off for this city. He authored the city’s domestic partners law. He authored the living wage law. He created the Children’s Fund and the the Rainy Day Fund law. He looks great in a dress. We’ll miss you, Tom, and we’re proud of you.

Democratic Party County Central Committee; San Francisco County

Here’s who I know who is running in my district, the 13th.

Michael R. Farrah, Jr.

Here’s who the Bay Guardian endorses:

13th Assembly District

Bill Barnes, David Campos, David Chiu, Chris Daly, Michael Goldstein, Robert Haaland, Joe Julian, Rafael Mandelman, Aaron Peskin, Eric Quezada, Laura Spanjian, Debra Walker

12th Assembly District

Michael Bornstein, Emily Drennen, Hene Kelly, Eric Mar, Jake McGoldrick, Trevor McNeil, Jane Morrison, Melanie Nutter, Connie O’Connor, Giselle Quezada, Arlo Hale Smith

Superior Court Judge; San Francisco County: Mary Mallen (Not Thomas Mellon)

Current Judge Mellon should not be retained due to a general disrespect for public defenders and apparent fear of the people who appear before him as defendants and witnesses (see here. Gerardo C. Sandoval, a former public defender, is a doofus. That super doofus Sean Hannity outsmarted him. Mallen, another former public defender is my choice.

State Propositions

Proposition 98: End Rent Control, and Then Some: NO
Proposition 99: Protect Homeowners from Eminent Domain: Yes

These propositions are an effort to redo a previous proposition on eminent domain that was narrowly defeated by Californians in November of 2006. 98 takes all the parts of that proposition and makes it worse by including language that would defeat rent control. 99 is more narrowly tailored to prevent the government from taking a single family dwelling to sell that land to another private party.

The problem is that eminent domain, often used by government and environmentalists to stop private property owners from destroying communal resources, has more recently be used to take the little guy’s land and give it to developers or other property owners. The US Supreme Court approved the practice, so people feel that ED is out of control. Still, government power over real estate serves an important social function when properly deployed for parks, wetlands, reasonable rent control and the like. Proposition 98 has no balance whatsoever. It would encourage property owners to sue the government whenever it restricts the ways owners use their land, including zoning, land use and environmental reglations. Proposition 98 bars state and local governments from using eminent domain to acquire an owner-occupied residence, as defined, for conveyance to a private person or business entity. This one is balanced and acceptable.

Local Measures

Proposition A School Parcel Tax – Yes

$198 per parcel annually for schools. An effort to fix underfunding because of the anti-property tax movement of the 1970’s.

Proposition B Changing Qualifications for Retiree Health and Pension Benefits and Establishing a Retiree Health Care Trust Fund – Yes

This prop increases the years of service required for City employees to qualify for employer-funded retiree health benefits from 5 to 10 or 20 years, while increasing retirement benefits for those who do qualify. A way to save the city money while providing for long-term employees.

Proposition C Forfeiture of Retirement Benefits for Conviction of a Crime Involving Moral Turpitude in Connection with City Employment – No

Not a big enough problem to be worth the litigation over whether something is morally turpitudinous enough to merit the penalty. And yes, that is a word.

Proposition D Appointments to City Boards and Commissions – No

Another one of these non-binding policy statements San Franciscans love, this one saying more men and women of all races, ethnicities, sexual orientations and types of disabilities be appointed so that the interests of these people is better represented. It is both banal and false. Banal because everyone in San Francisco believes in equal opportunity for all who want to be in public service and false because the proposition assumes that identity politics is the truest way to egalitarianism, which I don’t believe is borne out by history.

Proposition E Requiring Board of Supervisors’ Approval of Mayor’s Appointments to the Public Utilities Commission and Creating Qualifications for Commission Members – No

This is another one of those salvos in the ongoing fight between our allegedly conservative mayor and the allegedly progressive Board of Supervisors over who has the most control. Right now, the mayor appoints people to the Public Utilities Commission (PUC) and the Board can only reject that person with a 2/3 vote. This would change that to a majority vote. A 2/3 vote should be enough of a safeguard against political hacks, without making PUC appointments a political football. If you trust the supervisors but not the mayor, you’ll vote the other way on this.

Proposition F — No
Proposition G – YES

This is the other reason to vote in this election and is a hot political potato.

Hunters Point is neglected and languishing. Previous voter-approved ideas, like a shopping mall, have failed because there was not a comprehensive vision or a financial plan to make improvements work. Until now. Proposition G was placed on the ballot to get voter support for a Lennar Corp. development plan. The plan is elaborate, and promises parks, businesses, housing, clean up of the Navy Yard with federal money, a way to keep the 49ers and a way to use the land if they leave for Santa Clara. While Lennar’s initial promise was for 25% affordable housing, the corporation has upped its ante to 32%, (and thrown in a chunk of change for job training and home ownership programs) due to opposition from Prop F. It has also promised to build some of the housing for the poorest people, and some for the lower middle class. The plan, if it happens in this economic market, will be great for the area. That is why Sophie Maxwell, the supervisor for Bayview/Hunters Point is in favor of G.

Proposition F is the poison pill for Proposition G. Pushed by people who don’t trust Lennar’s promises can be enforced would require 50% of the housing to be affordable. The problem is that Prop F doesn’t say how that plan could be financed. Lennar says it can’t afford to do the development at that rate. Also, during the debate on KQED the other day, one of the Prop G proponents said that no project in the City has ever had more than 30% affordable housing. So if F passes, then the most likely scenario is that, once again and still, Hunters Point sits neglected. Lennar will drop its plan, and the area is unlikely to get another suitor.

Affordable housing is really important, as is avoiding gentrification that drives current residents away, as is avoiding the “barbell effect” where the really poor and the super rich can get access to homes in the city, and everyone else has to leave. The Lennar plan provides that housing, maybe not as much as you’d theoretically like, in the context of a well-conceived detailed plan that can actually happen. F puts the kibosh on that progress. And waiting carries its own price. Black residents are already being forced out of the Bayview area by a mixture of gentrification and violence. There’s always something not to like, but that is not a good excuse anymore. Vote yes on G and no on F.

Proposition H Prohibiting Elected Officials, Candidates, or Committees They Control from Soliciting or Accepting Contributions from Certain City Contractors – No

This is a poorly crafted rule that does not define the “controlled committees” that it allegedly regulates. As a result is will not make government cleaner. Both the Chronicle and the Bay Guardian are against it.

Thats all, folks. Remember to vote early, vote often. Polls are open from 7A to 8P. Viva la democracia.

HELPFUL LINKS

To find your polling place, go here,/a>: http://smartvoter.org/ca/sf/ (A great site with tons of resources, btw)
SF Chronicle
Endorsements: http://www.sfgate.com/endorsements/
SF Bay Guardian Endorsements: www.sfbg.com

–clipandvote—-clipandvote—-clipandvote—-clipandvote—-clipandvote—-clipandvote—-

United States Representative; District 8: Nancy Pelosi, Democratic

State Senator; District 3; Mark Leno

State Assembly: Tom Ammiano

Democratic Party County Central Committee

Michael R. Farrah, Jr.

13th Assembly District

Bill Barnes, David Campos, David Chiu, Chris Daly, Michael Goldstein, Robert Haaland, Joe Julian, Rafael Mandelman, Aaron Peskin, Eric Quezada, Laura Spanjian, Debra Walker

12th Assembly District

Michael Bornstein, Emily Drennen, Hene Kelly, Eric Mar, Jake McGoldrick, Trevor McNeil, Jane Morrison, Melanie Nutter, Connie O’Connor, Giselle Quezada, Arlo Hale Smith

Superior Court Judge; Mary Mallen (Not Thomas Mellon)

Prop A: Schools: Yes

Prop B: Retirement: Yes

Prop C: Moral Turpitude: No

Prop D: Policy on Appointments: No

Prop E: PUC Appointments: No

Prop F: Poison Pill: No

Prop G: Lennar Plan for Hunters Point: Yes

Prop H: Controlled Committees: No

To subscribe to the Granick Slate Card, visit http://
lists.granick.com/listinfo.cgi/slatecard-granick.com. The Granick
Slate Card issues before every California election and may be copied and freely shared for any non-commercial purpose, with author attribution. Derivative works need not make any attribution.
My recent post on the EFF blog talks about the difficulty that web security researchers have doing their work, in light of the Computer Fraud and Abuse Act and similar state statutes. While pen testers and other hired security guns can get written authorization to do security audits, members of the public have little leeway to explore the ways a website works or breaks, even when that vulnerability means that customer data is exposed to fraudsters. Read the post –Computer Crime Laws Chill Discovery of Customer Privacy Threats | Electronic Frontier Foundation– for more about the issue.

Tomorrow is my due date. Its common for first time mothers to give birth anytime around the “due date”, plus or minus about two weeks. However, it is much less common for multiple gestation pregnancies, like my twins, to go all the way to term. Like many women, I’m now confronted with the question of whether or not to induce labor. Below I review some of the freely accessible medical literature on this question and conclude that there is no “Answer” to how an educated consumer of medical care would answer this question.

First, though, the added factor that I’m carrying twins complicates an already complicated issue in a couple of ways. There’s an increased chance of stillbirth with at-term twins, so getting them born is a higher priority. Twins are hard to carry, so hanging on to them longer has an deleterious impact on my fitness and health. And, I’m already at risk for an increased c-section rate, so I’m not sure whether to give additional risk greater or lesser rate (if its going to happen anyway, who cares vs. its already bad why make it worse).

Second, I should say that I would just schedule the c-section or induction if the babies would be healthier with it, even if the choice would compromise my ability to care for them right after their birth. The end result you are looking for is healthy babies, healthy mom. But these babies are perfectly fine, and the non-stress test they are submitted to every week shows health and liveliness. So we’re talking about health risks in the absence of evidence of any problems.

My natural childbirth teacher and the midwife community rejects induction. I respect this view, but I do think it tends to be based on a quasi-religious belief that “natural” is better than “medical”. Without getting too deeply into this opinion, I’ll just say that the metaphor they always use for birth is what a cat does when it goes into labor. But we are not cats. Human babies have disproportionately gigantic heads. This causes a different set of problems than a mama cat faces.

My doctor, like many doctors, recommends induction at 41 weeks. This is because a 1999 study shows that induction at 41 weeks (versus waiting for spontaneous labor at 42 weeks) has no effect on c-section rates and decreases the stillbirth rate. I respect my doctor, trust her, and think she’s very competent. But, I think she’s trained to believe that the application of her skills increases the chances that everything works out ok, as opposed to doing nothing. I don’t believe that this medical view takes into account all the relevant health and emotional factors for either mother or babies, it is intended to maximize survival regardless of other costs. Which is great if survival is at stake. But what if its not?

For example, induction and an unnecessary c-section has far less of an impact on her than on me. Induction means being connected to an IV and to fetal heartbeat monitoring devices. That means being pretty restricted in terms of movement, which means that a lot of the labor management techniques I learned in childbirth class will not be available to me. As a result of the more powerful contractions brought on by induction drugs and the limitations on my movements, I’d be more likely to need the epidural, which has its own risks and rewards.

More troublesome for my decision making, there are studies that reject my doctor’s conclusion:

Here’s a 2005 study saying that induction at 41 weeks means longer labor, more epidurals and no outcome benefits for babies or mother.

Plus, there are several other studies that show that elective induction increases the risk of C-section in first time mothers:

October 2000

February 2002

In short, you can basically find a study to support either view about the risks and benefits of induction. To determine which is right, or perhaps “righter”, you need to look at the methodology of each in a much more in-depth way that is appropriately the domain of professional scientists and medical professionals, and not the casual medical consumer like myself. I can look up critiques of each of the studies, but even there I’m just going by what someone else says, since there are criticisms on both sides. Do doctors and scientists have a consensus, because if so, its not clear to me, and consensus is often wrong.

In the end, I feel left with not much more than gut instinct. What do I follow, my doctor, or my anecdotally-based prejudice against induction? Whatever I decide, anything could happen. Take a simple game, like Blackjack. You play according to the odds, but sometimes you lose and sometimes you win. The same is true with medical decisions, and could be true for me. But I won’t have the mantra I recite to comfort myself when I lose at Blackjack, which is “at least I have the satisfaction of knowing that I played correctly”.

For the pregnant woman, there’s no odds cheat sheet to pull out of your wallet when you’re sitting at the green felt table.

In this week’s Circuit Court column, I write about the legislative battle over changing our communications eavesdropping laws and a related issue of giving telcos immunity for illegally helping the government surveil us. This issue is so important, now that the nominee for Attorney General, Judge Michael Mukasey, says that the President does not have to obey the law if he believes it contradicts his national security responsibilities. Of course, you could argue that the laws are actually less important if the President isn’t even going to follow them. However, if that’s true, lawsuits against telcos may be the only way for the public to find out what our government is actually doing. Read more about one possible future of freedom and privacy here: What’s at Stake in the Surveillance Debate in Congress

Nations Soul Is at Stake in NSA Surveillance Case

For those of you with whom I have not had the pleasure of speaking in the past five months, who do not read Valleywag, or my husband’s blog, Brad’s Sketchpad, I’m hereby formally announcing that Brad and I are expecting twins in early December.

For those of you who have known me for a long, long time, you are probably pissing yourselves with schadenfreudistic glee that not only did I get married and procreate like I said I never would but you always knew was bullshit, not only that, but also fate duped me into having two at one time.

Others may be thinking, and indeed, have said in not so many words to my very face, “fucking over-achiever, it figures.” Both responses are welcome insights into the vulnerabilities of my personality, more of which are sure to be revealed by the awesome task ahead.
My own feelings could first be described as “shock” and now as “awe”. The science of how your body changes to accomplish this feat of procreation is nothing short of miraculous. On the other hand, its also pretty uncomfortable, and doctors disagree on some of the most basic questions, the answers to which you would think we would know, given how long women have been doing this thing.

Now that I’ve come out as a pregnant lady, I’ll be blogging more about the stuff that occupies my mind these days. Its not much different from the stuff I usually think about, but just writ in a different context. For example, my interest in security means I think a lot about risk mitigation and the strengths and limitations of cost-benefit analysis. Now I’m translating that framework for policy making to the question of whether to eat sushi, what baby car seat to buy or whether to use plastic or glass bottles.

At the end of last year, I wrote a chapter on law and ethics for a new O’Reilly book on network security.  It was a bit of a challenge to say something useful, accurate and concise on the topic, which I’ve been studying for most of my legal career, but I think I managed to cover the bases in an interesting and enlightening way, without being either too shallow or too pedantic.  Now, the book is available for purchase and I’m thrilled.
OReilly Media — Bookstore: Security Power Tools

Let me know if you like the book, opinions about the chapter I wrote and whether you think that there’s a need for a longer examination of the issues, either for lawyers or for security researchers.  I want to thank Mike Lynn for thinking of me for the book, and Patrick Ames for making the process so smooth.

Michigan man dodges prison in theft of Wi-Fi | Tech news blog – CNET News.com

Arrgh! Why don’t these wi-fi users call me? I’d love to help fight a prosecution like this.  Apparently, Orin Kerr and I agree that there are a lot of solid defenses to this kind of charge.  I’ve even written a motion that is a broader corollary of the due process claim Orin describes.
The brief argues that Anglo-American jurisprudence usually requires that the criminal defendant have a guilty state of mind (mens rea) and that if a statute does not expressly state that the crime is one of strict liability, then courts must read mens rea into the statute.  What this means for users of open wireless access points is that the prosecution should have to prove that they knew their access was prohibited by the owner, and that lack of authorization can not be presumed, especially in the absence of security barriers or warnings.
Now I’m just waiting for an opportunity to use this argument.

Next Page »