Canada and Afghanistan

In a recent conversation with a friend, I struggled to express my position on Canada's mission in Afghanistan:

[W]hile I still feel that it shouldn't be debated now - waffling is bad for morale, and I don't see how the situation could've changed that much since we first agreed to it, old gov't or not - answering Layton's questions during one or more question periods seems reasonable to me:

* What are the goals and objectives of this mission and how do they meet Canada's foreign policy objectives?
* What is the realistic mandate of the mission and how is it being enforced?
* What are the criteria to measure progress?
* What is the definition of success?
* And what is the clear exit strategy for this mission?

Reading the news this morning, I realized Rex Murphy did a much better job - than Layton, and certainly me - of isolating the major problem, and, very importantly, suggesting a way forward. I particularly liked this passage:

[F]rom the very beginning of this mission, from the long ago days of Mr. Chrétien through Mr. Martin's term as prime minister to this present moment, a clear, full, articulated case for the mission has not been made.

We've had everything else but the full statement of why the mission is important to us as Canadians, how it relates to our national interest and values and a full description of what we hope to see as a result of our troops being there.

Well said, Rex; well said.

The Middle East: Canada's bias

First, let me open by acknowledging that the best of this post benefits from many reasoned opinions that I've heard and read over the past week, including those of many folks at CKCU, and The Train. The cock-ups are all mine, however.

Second, while I haven't explored this to date, the United Nations' role in international affairs seems to have diminished over the years; this, in turn, must affect Canada's role in the arena. I accept this premise, and wish my country would succeed in spite of it.

I think Israel's response under the circumstances has been measured.

With this oft-quoted statement, and others, Stephen Harper expressed our country's bias, even as most of us were still struggling with the bad news.

Days later, seven Canadians were killed in an Israeli attack, and current estimates put the Lebanese, mostly civilian, casualties an order of magnitude above those of Israel. My point is not that Harper could have predicted this, but rather, that by throwing our support behind one side in this conflict, he has spoiled any role we could have played in negotiating some dialogue between the two sides, and cheapened our country's proud history in international affairs.

Subsequent statements by our government "urg[ing] all sides to act with restraint and take all measures possible to protect innocent civilian lives" strike me as obligatory.

On protecting Israelis...

While acknowledging that both the Israelis and Hezbollah are on questionable moral ground right now, the idea that Israel is simply protecting its citizens is ridiculous. Setting aside Israel's significant military advantage - which the U.S. is "rushing" to supply, by the way - Hezbollah's capturing Israeli soldiers needs to be considered in the context of the other prisoner exchanges between the two countries.

It's essential that Hezbollah and Hamas release their Israeli prisoners...

But, again, with this sort of rhetoric, Harper shows our, seemingly uneducated (frankly), bias. I'm not saying I agree with negotiated prisoner exchanges, but if Israel legitimized it in the past, one must acknowledge that it's possible that Hezbollah was simply attempting to start another round of negotiations; again, a possibility that Harper doesn't seem consider, let alone refute.

I'm ashamed of my Prime Minister's position is this conflict, and I sincerely hope that it isn't indicative of future Conservative foreign policy.

Balanced Copyright Reform

Here's a copy of an e-mail message I sent to my MP on the subject:

Hello Mr. Poilievre,

It's come to my attention that draft legislation concerning "copyright reform" could be drafted in coming weeks and months (building on Bill C-60). I suspect you've already received a form letter or two on the subject of "digital rights management" or DRM, so rather than add to that pile, I thought I'd quickly relate a personal experience on the subject, to give you some perspective.

My wife recently bought a number of CDs for a road trip. She'd had her iPod digital music player for a while, but this was to be the first time we took it as our sole source of music for any length of time. With the FM transmitter she'd bought for it, we would be able to play it through the car stereo, the portable stereo of anyone we visited along the way, etc.

However, she quickly became frustrated with the Nickelback CD she bought. She couldn't import it into iTunes (iPod management software), or even play it on her computer. The digital rights management software on the CD prevented it.

It's that DRM software prevents this and other legal uses of the merchandise we purchase that makes it such an important issue. (The fact that it can also open our computers to breaches of privacy and security is a separate, but equally important, issue: Sony-BMG's DRM software is a chilling example of this.)

While the Canadian Coalition for Digital Fair Access has some good information on this issue (as does the more recent Online Rights Canada), it's the "Consumer Technology Bill of Rights" put together by DigitalConsumer.org in the U.S. that succinctly captures what I would like to see in any DRM-related legislation.

I'll just quote the point that's relevant to my story:

2. Users have the right to "space-shift" content that they have legally acquired. This gives you the right to use your content in different places (as long as each use is personal and non-commercial).

(http://www.digitalconsumer.org/bill.html for the complete list.)

Thank you for your time, Mr. Poilievre.

Cheers,

John Jarvis

The politics of confrontation

A friend sent me an article on the Auditor General's gun registry report that was leaked. The tone of these opposition quotes sent me off on a tirade:

It's troublesome given that ethics, accountability, transparency, turning government around, cleaning government up are supposed to be one of the top priorities of the new government, said New Democrat David Christopherson.

And if they had any role whatsoever in leaking this then they're... betraying their pact with the Canadian people.

A Liberal press release offered more of the same:

This unprecedented affront to the office of the Auditor General, Sheila Frasier, makes a mockery of Prime Minister Stephen Harper's promise to operate with a higher ethical standard, said Mr. Wrzesnewskyj.

I think the Liberals (and their NDP terrier) are completely undermining the "new party" spin they've been cultivating around their leadership race with this whining and nitpicking - the "Look, they're worse than us!" tripe - that was the previous minority government's daily bread. Nothing has changed: the Liberals have no vision for the country, and no one to truly lead the way once they beg, borrow or steal one.

It hurts me to say that, by the way, because listening to Ignatieff speak around the time of his announcing his run for the party leadership sparked a hope in me that we might get past the bickering for a time; but it means nothing if he still has these petty vermin below him.

If they'd waited 'til the report came out and acknowledged the mistakes it will certainly include - I've read about the software development debacle, so I know I'm not reaching here - I can honestly say that it would've significantly reinforced that hope I mentioned: simply because it would've been so radically different from anything this squabbling mass of glad-hands has done in years.

The cost of these distractions is concisely stated in the following quote I read a few months back:

Institutional rivalry, lack of foreign policy consensus, and increased media coverage combine to create a foreign policy making environment that accentuates the normal advantage held by immediate policy questions and current intelligence over long-range issues. It also favours the politics of confrontation and competition over that of problem solving.

-- Glenn Hastedt, Public Intelligence: Leaks as Policy Instruments - The Case of the Iraq War, Intelligence and National Security, Volume 20, Issue 3, September 2005.

The Prime Ministers: Louis St. Laurent

My correspondence on the CPAC series continues:

Hmmm... This is a strange series. I didn't like this episode either. He was voted our greatest post-war Prime Minister, yet they spent little time explaining why he'd get the vote of so many historians. What truly positive material we did see came from his own family (relevant, but not very surprising, one would think).

This emphasis on the 'Uncle Louis' facade, and, later, his, and his cabinet's, air of entitlement - which seemed to be much worse than the situations that fall under that category today - were not flattering. And whatever the true proportion of these episodes during his entire leadership, by paying lip service to his great achievements and lack of involvement in the PR machine, the producers are passing judgment on the man.

And this isn't the first example of that. I just found this one to be particularly heavy handed. Man, and I thought CPAC was a more balanced alternative to the CBC; guess no one can resist the opportunity to spin.

Later correspondence focused on Byfield's negativity:

Well, he's a journalist, and I have to say, I valued his perspective on St. Laurent more than, say, on Laurier, because Byfield was there covering the '57 election, for example. The fact that he relates how all the old-timers in his profession were unhappy with the government at that time, for example, is fine with me. I want to know. But it's the producer's job to balance that with St. Laurent's earlier success, and give Byfield a chance to reflect on that, if possible (don't know if he was even working then).

And CPAC's spin:

Well, I for one would seize any media source that showed the sort of balance I'm talkin' about; and I wouldn't let 'em go. :-) I know there are other people who feel that way too. There is such a thing as scoopin' and spinnin' yourself to death, I think. You're certainly sentencing your credibility to death, let's say.

La Convivencia

I just finished watching the BBC documentary An Islamic History of Europe. Its stirring depiction of la Convivencia, with Muslims and Christians sharing the best of their cultures in Spain, while hotly contested, got me thinking about these first decades of the 21st century: it may be naïve, but I feel that Canada is well placed to revive this idea of coexistence.

The Prime Ministers: William Lyon Mackenzie King

My correspondence on the CPAC series continues:

Well, in my opinion, the blame for [the seemingly harsh comments of Jack Granatstein and Ted Byfield] falls on the editors of this series; I was actually going to use the adjective 'stupid' in that sentence (take your pick of places; more than one's appropriate), but thought better of it. They are focusing on inconsequential crap, and, given that, I think both Granatstein and Byfield did a good job of relating what we - unfortunately - know about King's private life, in all its strange detail, but without dwelling on it, and then getting on to the "and so what?" of it all. Who cares? Byfield ends a segment with I think his decisions ultimately were always pragmatic. He did his job, in other words.

I [also feel it wasn't write to publish King's diary, instead of burying it with him, as was his wish]. Did his family make that decision? Did they come to regret it, I wonder? People are entitled to their private thoughts; and they're entitled to put them down for later review. You can't keep a life of thoughts in your head, and being able to read them would probably help one sort through a lot of problems. That aside, whatever his reasons for writing, the public doesn't have the right to read it, just because he wrote it.

The Prime Ministers: Wilfrid Laurier: Addendum

In the light of all this nonsense about Harper's waistline - no, I won't even hyperlink to it and give any 'news' site the satisfaction of traffic - I thought this later point in the correspondence was also germane:

... and Chretien made a point of saying the press didn't question [Laurier]. I thought that was fantastic! Imagine knowing no more about your prime minister's private life than, say, your doctor's.

It does not matter, people.

The job they're doing, that's what it's all about.

The Prime Ministers: Wilfrid Laurier

This is the first of a few posts on correspondence I've had re CPAC's The Prime Ministers television series:

When a Quebec supporter complained few immigrants were francophone, Laurier said, We trust in the long run they will come out right true Canadians.

I love this line. That was the highlight of the show, so I thought I'd lead with it. I'll be pullin' that one out in a future conversation with Dad, you can be sure, that, and the “tough” people that made Western Canada under him. (Canadians are English and French... Pffft!) ;-)

I was struck by how strongly people need heroes. The man described for most of the thirty minutes was well beyond his considerable 6' frame. Chretien said he was an institution in his family, and clearly he isn't alone. (I found him very convincing in that moment, by the way; very sincere. I didn't think much of his comments overall, but when he spoke about francophones talking their place after Laurier, I felt the importance of it.)

But clearly he was human. I mean, however reverently it was read, Laurier's thoughts on politics were clearly that the end - his “certain object” - justifies the means, which “could not be approved of”. I don't agree, but acknowledge that I prefer to think in the ideal, and have long since ruled out a career in politics as a result. :-)

Finally, all the comments on Laurier's appearance went over the top, eventually; somewhere around the comment that he probably spent a lot of time in front of a mirror. I certainly wouldn't want to be remembered that way.

Knee-jerk Trade-offs

Speakers more profound than I - including Adam Shostack and Bruce Schneier - have weighed in on the Western approach to terrorism countermeasures, a recent example of which is the searching of bags and packages carried by people entering New York City subway stations.

Countermeasures like this spring up far too quickly. They must be subjected to a more critical process, so, as one of the New Yorkers commented, the terrorists don't simply hit us where we're weak (e.g., shopping malls... before the decade's out, I'd bet). Otherwise, how are we to know whether the trade-offs we've accepted are good ones?

Information and Human Nature

Michael Gorman, president-elect of the American Library Association, created a ripple when he questioned Google's dream of taking over the universe by gathering all the information in the world and creating the electronic equivalent of, in their own modest words, the mind of God. (Search on Google and God's Mind if you don't want to register with the Los Angeles Times.) However, I think Google, Gorman and his detractors are all missing an important point, and it centres around human nature.

While Gorman makes some good points in Google and God's Mind, his notion that only certain books need to be digitized - "massive databases of digitized whole books, especially scholarly books, are expensive exercises in futility" - is really splitting hairs; how they're used afterward is more important, as he implies in his second piece, Revenge of the Blog People: I do not believe [Google Print] will give us anything that comes anywhere near access to the world's knowledge.

It's how the information is used afterward, how knowledge is accumulated, that's really important. I'll use another quote from Google and God's Mind to illustrate my point:

The nub of the matter lies in the distinction between information (data, facts, images, quotes and brief texts that can be used out of context) and recorded knowledge (the cumulative exposition found in scholarly and literary texts and in popular nonfiction). When it comes to information, a snippet from Page 142 might be useful. When it comes to recorded knowledge, a snippet from Page 142 must be understood in the light of pages 1 through 141 or the text was not worth writing and publishing in the first place.

Gorman says must be understood, but really it's up to the reader; if they want to draw their own conclusions from a paragraph on Page 142, that's their prerogative, and this is where my point about human nature comes in.

Morgan Jones talks about convergent and divergent thinking in The Thinker's Toolkit: 14 Powerful Techniques for Problem Solving, and how humans are convergent thinkers at heart. That is, in our reading and research, we are inherently trying to tie it all up and converge on a solution or opinion, if you will; that's the way our brain works. Now, going back to Gorman's example, what the Google Print project will facilitate is the converging of an opinion based on Page 142 of that particular book, and maybe a few pages from some other books, with the reader never having read pages 1 through 141, or the preceding pages of the other books.

But that's like saying guns kill people, John. Yes, you're absolutely right, and I'm not knocking the Google Print project. I say that Google, Gorman and others are missing the responsiblity that these sorts of initiatives place on our education system. As people read fewer books cover to cover, teaching people how to think critically and research becomes all the more important. Given our convergent natures, I can see a time when kids rate their research on the number of sound bites they've skimmed (and, no doubt, how quickly they've done it as well). Educating them on proper research techniques means that they'll be able to make the best use of the most powerful tools as they're developed (like Google Print).

Invisible Darkness turns Deadly

O.K., so the title is misleading: Deadly (2005), the film about Paul Bernardo and Karla Homolka’s psychological dance with death and depravity isn't based on the Stephen Williams' book Invisible Darkness; in fact, despite buying the rights to the book in 1994, Director Peter Simpson abandoned the project in the face of public outcry, especially from St. Catherines.

According to the Toronto Star, Deadly "was written through court transcripts and other evidence in the public domain... [and writer Manette Rosen's interviews] with police involved in the [Bernardo and Homolka] case at headquarters, as well as a crown attorney..."

I recently received a copy of the 2001 petition to stop Simpson's Bernardo film. (Whether it had anything to do with Simpson dropping the movie, I don't know.) Of the 70 or so names attached, over half were from St. Catherines, and all but a few were Ontarians. One signatory - at least I assume they signed it... as much as you can sign an electronic document without using a digital signature - included the comment:

Some things are just too important NOT to pass on - I hope you agree.

Of course I agree that some things are important enough to speak out about - some things are important enough to fight for, in my opinion - but I don't agree that the making of this movie qualifies.

Why? Because the story is out of my hands; it's out of everyone's hands. It happened, at least two books tell the story, and people will continue to talk about it, despite the heroic efforts - in scale only; the deliberate destruction of records is despicable and barbaric! - of Danson to wipe what really happened from the face of the earth: again, from The Star:

[Tim] Danson [lawyer for the families of victims Kristen French and Leslie Mahaffy] even won an order to have the Ontario attorney-general's office burn the Bernardo-Homolka videos, as well as autopsy photos and other evidence, in a precedent-setting move.

Burn, no less! The bile rises in my throat just thinking about it. Fahrenheit 451 made real! Whatever his motives, that was just wrong! And that gets back to the petition: I'm sure all those people from St. Catherines hoped they were helping the families of Bernardo and Homolka's victims in some small way by signing that petition - heck, maybe some of them even know one of the families - but you know what? It doesn't matter. Period.

The only thing that matters is how those families live each day: if they look to the world to forget what happened to their daughters, sisters, etc. - even for some period of time, because how long is enough? Who can say? - they will continue to be disappointed and hurt; and, no less importantly, they'll be killing those women again, and all they did with their lives. If, however, they look within themselves and to each other for support, nothing, not books, movies, not even tourists (think Jack the Ripper and you know they'll come), will be able to steal more moments of their lives.

Time does not heal all wounds.

"Diamond" "Dimebag" Darrell Abbott, R.I.P.

I just saw a story on CTV Newsnet about a shooting in Ohio, pantera.com confirms it: Dimebag Darrell, of Pantera fame, is dead. I'm shocked.

5 Minutes Alone was an anthem for me in university, and Cowboys From Hell? No one was playin' that stuff then. Whatever the animosity among the band members in recent years, no one can take away the butt that Pantera kicked in the 90's.

R.I.P., Dimebag.

On challenging U.S. copyright law...

LISNews.com is reporting that, unfortunately, Kahle v. Ashcroft has gone the way of Eldred v. Ashcroft.

The Stanford Center for Internet and Society has a great summary of how the two cases differ:

In [Kahle v. Ashcroft], two archives [the Internet Archive and the Prelinger Archive] ask the U.S. District Court for the Northern District of California to hold that statutes that extended copyright terms unconditionally - the Copyright Renewal Act and the Copyright Term Extension Act (CTEA) - are unconstitutional under the Free Speech Clause of the First Amendment, and that the Copyright Renewal Act and CTEA together create an effectively perpetual term with respect to works first published after January 1, 1964 and before January 1, 1978, in violation of the Constitution's Limited Times and Promote...Progress Clauses.

Isn’t [Kahle v. Ashcroft] just Eldred v. Ashcroft all over again?

No... Eldred v. Ashcroft involved a challenge to the constitutionality of the Copyright Term Extension Act (CTEA), which extended the term of both existing and future copyrights by 20 years. In 2003, the Supreme Court rejected these challenges. Eldred focused narrowly on the constitutionality of the CTEA’s extension of the term of subsisting copyrights; the Court held that these extensions did not violate the First Amendment or the Progress Clause.

Kernighan, debugging and assurance

I read a great Kernighan quote at Marquee de Sells today. For those who aren't familiar with Kernighan, he helped design the awk programming language and coauthored the first book on the C programming language.

I was struck by the security implications of programmers writing computer programs that they aren't smart enough to debug. The analysis and testing that makes up a security evaluation is comparable to debugging, and yet many of the evaluators I've worked with are not as smart as many of the programmers I know. My experience with evaluator qualifications states that a college or university degree in engineering or computer science, plus a few years apprenticing, is sufficient for evaluating source code. Is this realistic?

Thinking about debugging and security brought me to the concept of a reference monitor: a reference monitor enforces the authorized access relationships (i.e., the policy) between the subjects and the objects of a system.[1]

One implementation of the reference monitor concept was called a reference validation mechanism. Early examples of reference validation mechanisms were called security kernels, or that combination of hardware, firmware and software which implements the reference monitor concept.[2] Three design requirements of these reference validation mechanisms (and security kernels) were: 1) It must be tamper proof, 2) it must always be invoked, and 3) it must be small enough to analyze and test with complete assurance.[3]

It would seem to me that Kernighan's point speaks to a caveat on the third requirement: it must be small and simple enough to analyze and test with complete assurance.

Footnotes

1. Anderson, J. P., Computer Security Technology Planning Study, ESD-TR-73-51, vol. I, ESD/AFSC, Hanscom AFB, Bedford, Mass., October 1972 (NTIS AD-758 206).

2. Computer Security Technology Planning Study.

3. U.S. Department of Defense, Department of Defense Trusted Computer System Evaluation Criteria, December 1985.

Security Certification for PIN Entry Devices

Having been inconvenienced by card skimming, I found this Register article on Visa's PIN entry device certification program very interesting.

My complaint to Toyota, Part 3

So, having given up on Toyota Motor Sales, U.S.A., Inc. (that's the American affiliate, I gather), I turned to Toyota Canada, Inc., even though no vehicle purchase was involved:

Hi,

I'm trying to submit a complaint to Toyota Worldwide [the parent company, also referred to as Toyota Motor Corporation later on --John], but there doesn't seem to be any means of doing this through the toyota.co.jp Web site.

I filed it with toyota.com and got the following response:

Response (Michael) 08/04/2004 07:59 AM
Thank you for contacting Toyota Motor Sales, U.S.A., Inc.

We apologize, Toyota Motor Sales, U.S.A., Inc. only handles inquiries for vehicles sold in the United States and manufactured to U.S. specifications. Please contact Toyota Canada, Inc. for further assistance with your inquiry.

--

My original complaint [posted earlier --John] follows. Any assistance would be greatly appreciated.

Toyota Canada, Inc. quickly responded:

Dear Mr. Jarvis,

Thank you for your recent correspondence.

We have noted your comments regarding the advertisement and have forwarded them to the appropriate departments within Toyota Canada Inc. for information purposes.

Thank you again for taking the time to write and for providing us with your feedback.

Sincerely,

Christine James
Toyota Canada Inc.

This left me puzzled... especially the information purposes part:

Thanks for the quick response, Christine. I am a little puzzled, however. First, I'd asked two questions at the end of my comments, so they weren't simply intended to inform. Second, am I to understand that Toyota Canada, Inc. was responsible for the production of the advertisement in question? I'd assumed it was produced by Toyota Motor Corporation for an international audience (dubbed in various languages, as appropriate). [I've since realized that the commercial is silent, greatly simplifying this job. --John]

If this is indeed the case, I would appreciate your help in forwarding my comments to Toyota Motor Corporation.

Cheers,

John

Their response was priceless:

Thank you for your recent correspondence.

We have noted your further comments. As well, we would like to take this opportunity to explain that Toyota Canada Inc. and Toyota Motor Sales, U.S.A. (TMS) are separate business entities, as such, we suggest contacting TMS's Customer Relations directly for comment at the following:

TMS
Customer Relations
19001 South Western Ave
Torrance CA USA
90509-2991
Phone: (800) 331-4331
Fax: (310) 618-7814

We would also like to mention that TMS can be contacted through their website - www.toyota.com - select 'Contact Us' at the bottom of the main page, next select the 'FAQ page' link. You may have to create an account with TMS.

Thank you again for taking the time to write.

Sincerely,

James Mcwade
Toyota Canada Inc.

That's right, folks: that smacking sound is me being batted back and forth between the American and Canadian arms of Toyota. :-) There's more to come, though; I'm not giving up yet.

My complaint to Toyota, Part 2

Well, Toyota responded this morning:

Response (Michael) 08/04/2004 07:59 AM

Thank you for contacting Toyota Motor Sales, U.S.A., Inc.

We apologize, Toyota Motor Sales, U.S.A., Inc. only handles inquiries for vehicles sold in the United States and manufactured to U.S. specifications. Please contact Toyota Canada, Inc. for further assistance with your inquiry.

Toyota Canada, Inc.
1 Toyota Place
Scarborough, ON
Canada M1H 1H9
888-869-6828

If we can be of further assistance, please feel free to contact us.

Toyota Customer Experience

An invitation to complete a customer survey followed this message. I responded to the questions about their Web site and customer service as follows:

I don't feel it's proper to expect people to create an account before they can submit questions or comments to your company. Someone (or some group) should be monitoring a feedback@toyota.com address. I felt my comments were important enough to warrant registering with your Web site; I doubt many others would bother.

As for the response I received, I was simply sluffed off to the Toyota Canada based on my location; it's obvious that the person didn't even read my complaint, since it had nothing to do with a vehicle I'd purchased (their excuse for the rebound). If anything, my complaint should've been forwarded on (by them, not me) to the appropriate department of Toyota Worldwide.

Up next: Part 3: Toyota Canada, Inc.

My complaint to Toyota

I saw your "splitting" Matrix ad (the one where the cars part and merge like drops of water) in the movie theatre again tonight, and, since it still offended me, I decided to write.

Specifically, I complaining about the way it opens, with the Matrix driving straight at the meridian before the tunnel. First of all, the fact that it's the first image that we're presented with tends to drill it into our minds for the length of the ad (and beyond), but, even worse in my mind, is it's being completely unnecessary; there are many other ways to introduce this idea of splitting that aren't nearly so evocative.

Just on the off chance that you have no idea what that image of driving into a meridian evokes, it is almost the exact image that was presented to the world following the death of Princess Diana in the summer of 1997. I asked two other people - keep in my mind that it's only my second time seeing the ad - about the first thought that entered their heads after seeing the image, and they both responded with Diana's death. I'm confident that more asking would elicit similar responses.

Normally, I'm all for freedom of expression in art - it's what kept me from writing this complaint after my first viewing - however, I really feel that this ad constitutes a gratuitous use of that particular image, both in its placement (i.e., at the beginning of the ad) and its relevance (i.e., it's really not referenced again; cars split and merge without any catalyst, if you will, throughout the rest of the ad).

Now, I'm not suggesting that you pull the ad - again, I'm a firm believer in letting others decide for themselves what they deem to be offensive - but I am interested in knowing whether you were aware of the striking similarities between your footage of the tunnel meridian and the shots of the wreckage where Princess Diana and Dodi Fayed died, and if so, why you decided to include them.

Thanks,

John Jarvis

On protection from unreasonable searches and racial profiling...

My buddy's thoughts on Phillip Henry Mann's acquittal got me started... :-)

First, I don't agree that the story begs the question: should a criminal have a reasonable expectation of privacy? If the police have reasonable grounds for suspecting that someone's a criminal, then they can take that person downtown for questioning. So, yes, if they have reasonable grounds for suspecting someone's trafficking drugs, by all means, stop the guy and bring him downtown for questioning. The key point in this story is that after the initial pat down and questioning (which I completely agree with; I don't want to see a cop wounded or killed by some scared kid any more than the next guy), they got the guy to empty his pockets because they were curious about the soft object they'd felt (as I read it). If they were surprised by what it was (i.e., they didn't suspect they'd find it when they approached the individual), and they'd convinced themselves that they weren't in any danger prior to asking to see the contents of the pocket, then there's no reasonable grounds for the search.

See, as with any aspect of the law, you've gotta go out to the boundary cases... Those improbable, and often really scary, situations. In this case, yeah, you know, I'm not saying it'd be the end of democracy as we know it if this guy lost his weed, paid a fine, etc. But what about the 911: The Road to Tyranny footage of the woman being pulled over and eventually charged with obstruction of justice? For those who haven't seen that excellent documentary, think of ticket quotas or cop surliness taken to an unreasonable extreme. Legislation is our only protection against these, thankfully rare, sorts of abuse.

Now, on racial profiling, I'll just tackle a few of its many facets. First and foremost, one should always be mindful of the biases and mind-sets of the people involved; the concept of racial profiling should never be separated from the people involved in the real-world situation, because their biases will have a huge impact on how the concept is applied. For example, if it's obviously a crutch propping up sloppy work, then we, as a society, have a problem.

But, for the sake of argument, let's say that, from a counterterrorism standpoint, some degree of racial profiling makes sense strategically (as in your example of al-Qaida). That is, it makes sense to look for people of a specific ethnicity in the search for the rest of that particular terrorist group. Now, how that appropriateness is applied tactically, in certain American and Canadian cities, for example, is another kettle of fish entirely. We must compare them very carefully (as I mentioned), keeping in mind the freedoms that we enjoy and the concept of being innocent until proven guilty in a court of law.

It's scary stuff, man. If you're on the right side of the law today, then, yeah, sure, pull over, let them search your car, your home, your pockets; you've got nothin' to hide. But, s**t, look out if you happen to be on the wrong side of things tomorrow.

On wanting to believe versus believing...

I was doing my part to make Slashdot a better place, metamoderating away, when I came to a comment on Pascal's Wager: an argument for believing in God, basically. Well, in reading the context of the comment, I came to a reply by Dunbar the Inept that echoed my thoughts on belief.

My religious experiences didn't touch on this wager, or any other argument for believing or not. It's as if it was assumed that I believed because I was in Sunday school, because I was confirmed (O.K., maybe there was an argument for the assumption in that case) and because I read some of the Bible, when, in fact, I was conflicted.

And these experiences aren't limited to my United Church of Christ days: as I briefly discussed last month, I quickly became discouraged as I read the Qur'an, with its strong language against anyone who doesn't hold belief in their heart. What's amusing is that, were I able to flick belief on like a switch, I would be insane (as Dunbar pointed out).

On kids and the Web...

HaloScan's basic account restricts comments on the owner's site to 1000 characters. Who knew I'd have so much to say on this post by Deirdre?

Brian captured my thoughts on the first point; security through obscurity shouldn't be your only line of defense.

On the second point, I'll bite. From the MacCentral article on the ruling:

If the law hadn't been challenged, a workable solution would now be in place... Parents wouldn't be afraid to leave their kids alone in the room with the computer on.

I disagree. If I were a parent - and I'm not, so, yes, take that into account - I wouldn't be relying on legislation or technology to assuage my fears about what's going on behind closed doors.

Depending on the age and maturity of the child, I would rely on either supervised Web time only, or my child's judgment and our open relationship. Gone are the days of unsupervised research with the children's encyclopedia or Britannica. If my kid needed to do research on tadpoles, filtering software (even the ICRA functionality in Internet Explorer seems to work well, although it requires some work on the Web site author's part) plus my supervision would be the only way to go. As they got older, some unsupervised time could be introduced... It comes down to being my responsibility.

Having the government determine what the average person, applying contemporary community standards, would find obscene scares me, to be honest. We're talking about getting rid of the artistic merit defense up here in Canada too, and I just keep thinking that, yes, it sounds reasonable in many, even most, scenarios that proponents bring up. But what about the cases at the extremes of the spectrum? What about the filmmaker who shies away from the story that needs to be told for fear of going to jail?

Tread lightly, people. We have to live with these decisions.

Card Skimming

My bank disabled my banking card over the weekend; apparently, I used it at a location that's under investigation for card skimming. When I first got the call Sunday morning, I thought I'd pegged the compromised automated banking machine, but today the teller told me it could've been any location - including stores - I'd banked at in the last month. (They don't give out the location to avoid compromising the investigation.)

Now, one scheme I've heard of reads the information off the magnetic stripe on your banking card while a camera in the pamphlet holder records you entering your PIN. I learned today that a common scheme ignores the PIN, making a copy of your card and forcing a reset of the PIN with a master PIN, using the same machine you use to change your PIN at your branch. Schneier would love it! Foiled again by a global secret (in all card writers, in this case).

The good news is that so long as I notify the bank within 24 hours of learning my banking card has been lost or stolen, I'm not liable for any of the subsequent charges. Same goes for the scenario where the bank informs me of the compromise, obviously (which is why I still suspect that it was that ABM I used on Friday; the bank disabled the card right away because they knew they'd be footing any bill the skimmers or their friends racked up). Now, this all assumes that I haven't contributed to the compromise (e.g., helpfully writing my PIN on a Post-it stuck to my card, giving my card and PIN to my long-lost Uncle Bob so he can buy some smokes); should the bank be able to prove otherwise, I could be liable for even more than my account balance!

On Shapiro's Understanding the Windows EAL4 Evaluation...

I should've done this a long time ago. It seems like every time a Common Criteria (CC) story hits Slashdot, some would-be expert hyperlinks to Jonathan S. Shapiro's Understanding the Windows EAL4 Evaluation, like it's the CC's Brutus. However, as often happens in discussions involving the CC, people misunderstand (and often overstate) what the CC and an EAL say about the security a product provides.

How the Common Criteria Really Works

While Shapiro gets the general idea, you should understand that the Protection Profile (PP) hasn't caught on like most of the those involved in the project probably expected. It's optional, first of all, and requires a lot of time and effort from groups who are independent of the security product companies (e.g., consumer rights groups) to work. There are exceptions (e.g., the Smart Card Protection Profile), but, for the most part, the consumers, or their independent representatives, must define their own security needs for this step to be of some utility.

The reason is that if the consumer doesn't understand the PP - the Controlled Access Protection Profile is a good example - then they won't understand the company's security target that claims conformance to that PP, nor what the evaluation - and its associated assurance level - really means.

The Security Target (ST) is the required document that Shapiro should be referencing. It scopes the evaluation, detailing all the security requirements the product satisfies, how it satisfies them, and what assurance the consumer should have that they really are satisfied (that's the evaluation assurance level or EAL). The ST can get those security requirements from one or more PPs, but that isn't required, or, like I said, what normally happens.

Now, that all changed to some degree in January 2000, when what's now the U.S. Committee on National Security Systems issued the National Security Telecommunications and Information Systems Security Policy No. 11 (or NSTISSP #11), requiring that all products dealing with national security information (read anything sold to the U.S. government) be evaluated against the CC. Oh, and here's a bunch of PPs that you can conform to.

So, just because a lot of companies - like Microsoft - chose to conform to those PPs doesn't mean it's the only route; it doesn't even mean it's the best route. It all depends on what you, the consumer, are looking for. Concerned about what access control mechanisms are in your operating system? Well, pick up the ST (available at the CC Web site), flip to the security functional requirements section and see what it claims from the Access Control Policy family (i.e., FDP_ACC; you can find your whole shopping list in the second part of the CC).

But Shapiro's bang on when he says that the EAL, the PP (if there is one) and the ST don't mean diddly-squat if you haven't made sure that your shopping list is covered off.

The Controlled Access Protection Profile

Shapiro is correct in saying that the requirements in the Controlled Access Protection Profile (CAPP) aren't enough to protect an Internet-connected system; but who said they were? No one. (At least I hope Microsoft didn't say that.) To quote the Common Criteria Evaluation and Validation Scheme Web site:

The CAPP was derived from the requirements of the C2 class of the U.S. Department of Defense (DoD) Trusted Computer System Evaluation Criteria (TCSEC), dated December, 1985...

1985, people! And, I would argue, it wasn't that the CAPP was the most complete validated PP. Shapiro's right when he implies that Microsoft couldn't hope to satisfy other "ported" set of requirements: the Labelled Security Protection Profile or B1 replacement; and it's those very mandatory access requirements that we need on the Internet. This is where Shapiro's going when he talks about EROS (SELinux is another example), and how it won't work well with the ubiquitous discretionary access operating systems of today.

Evaluation Assurance Level 4

To quote the Common Methodology for Information Technology Security Evaluation (i.e., the CEM: the document that states how to conduct CC evaluations at the various EALs):

EAL4 provides a moderate to high level of assurance. The security functions are analysed using a functional specification, guidance documentation, the high-level and low-level design of the TOE, and a subset of the implementation to understand the security behaviour...

Shapiro compares this analysis to an audit of a company's business practices. The CEM is not ISO 9001; it demands, among other things, that the product's design be sound. For example, to quote the high-level design content element ADV_HLD.2.3C:

The evaluator should make an assessment as to the appropriateness of the number of subsystems presented by the developer, and also of the choice of grouping of functions within subsystems. The evaluator should ensure that the decomposition of the [Target of Evaluation's (i.e., the product) Security Functions or TSF] into subsystems is sufficient for the evaluator to gain a high-level understanding of how the functionality of the TSF is provided.

Shapiro states that "essentially none of the code is inspected," and that such an examination isn't even required at EAL4. This is false. Notice the last input to the analysis quoted above: a subset of the implementation (i.e., some of the code). The size of this subset is left to the evaluator, with the understanding that if concerns arise while examining the initial sample, sampling should continue until the evaluator is confident in the product's ability to provide its stated security functions. To quote the implementation representation content element ADV_IMP.1.1C:

Other factors that might influence the determination of the subset include:

1. the complexity of the design (if the design complexity varies across the [Target of Evaluation or TOE], the subset should include some portions with high complexity);


2. the results of other design analysis sub-activities (such as work units related to the low-level or high-level design) that might indicate portions of the TOE in which there is a potential for ambiguity in the design; and


3. the evaluator’s judgement as to portions of the implementation representation that might be useful for the evaluator’s independent vulnerability analysis (sub-activity AVA_VLA.2).

To continue the CEM quote on EAL4:

... The analysis is supported by independent testing of a subset of the TOE security functions, evidence of developer testing based on the functional specification and the high level design, selective confirmation of the developer test results, analysis of strengths of the functions, evidence of a developer search for vulnerabilities, and an independent vulnerability analysis demonstrating resistance to low attack potential penetration attackers. Further assurance is gained through the use of an informal model of the TOE security policy and through the use of development environment controls, automated TOE configuration management, and evidence of secure delivery procedures.

I'm not sure what Shapiro means by "no quantifiable measurements... of the software." No lines-of-code measurement? Something related to the number of system calls? While these properties certainly affect the keep-it-simple principle of security, I don't know that there are specific thresholds we could use in evaluating security products. (Well, beyond the extremes: I'm thinking of Schneier's Secrets & Lies... an estimated 60 million LOC in Windows 2000, over 3000 system calls in Windows NT 4.0!)

Certainly the CEM isn't that prescriptive. Things like the number of subsystems in the product's high-level design are left to the evaluator's judgment. Is the developer's choice of subsystems useful in understanding the product’s intended operation? Well then, whatever the number, it's served its purpose.

However, I do not believe, as Shapiro states, that an EAL4 evaluation "says absolutely nothing about the quality of the software itself;" in my opinion, the associated analysis is qualitative. I've mentioned the design requirements, but there's also ensuring that the developer has tested to that design, there's a verification of that testing and additional independent testing... And this is focused on the security functions claimed in the ST, remember. This evaluation says nothing about those functions that aren't security related. (Since they're where the money is, it's a safe bet that the developer's tested them.)

Documents related to the software development process are evaluated (e.g., configuration management and delivery), but the processes themselves are verified during a development site visit. And the quality of these processes is just as important as the quality of the software itself. If you can't guarantee that the evaluated software is what the customer is actually installing, what have you achieved?

Conclusion

Well, if you've made it this far, all I'm saying is that the CC is a tool; you, the consumer, can use it to specify your security needs (i.e., in a PP), and you, the developer, can use it to specify what your product secures and how (i.e., in an ST). That people compare products solely based on the EALs they were evaluated at is not the fault of the framework (use the STs, Luke!). Similarly, the levels themselves give the developer (or their sponsor) a choice in the amount of time and money they want to commit to the enterprise. How much assurance are your customers looking for? Do they simply want to know that the guidance documents you supply with the product will actually help them get it to a secure state (e.g., EAL1)? Or do they want to know that you've tested every single security function identified in your functional specification (e.g., EAL3)?

Having said all that, I would love to see a mandatory access operating system like SELinux go through a CC evaluation. If we could get that kind of security in the U.S. government, maybe, just maybe, it would get enough momentum to spill out into the U.S. population. And then? Oh, then the world, baby! :-)

Toward Choice

Well, the 38th General Election is almost upon us. I've decided how I will vote, and I've decided to reveal my decision here: I'll be voting for my Green Party candidate on Monday.

So, first, why Green? I heard about - and, just recently, read about - the political campaign financing reforms that set an annual public subsidy of $1.75 per vote for parties that win over two per cent of the popular vote. I've read that the Green Party has the support of about six percent of the voting public, so I'm reasonably confident that my vote will throw another $1.75 in the Green pot for next year.

So what, you say? Well, Green Party leader Jim Harris still has a day job. With a big enough pot, he could spend more of his time thinking about, and soliciting opinions on, the country's problems. (I don't think he'll drop the day job, since he's an author as well as a management consultant.)

Too often, Canadian politics is simplified to the resources available (read money). Oh, you have a problem? How much money do you need? Well, that'll force cutbacks elsewhere. I think the voters assume that solutions (but not money) grow on trees, and that with enough resources, we could solve all of Canada's problems. The fact is that we've thrown a lot of money at some problems for years, and they're still staring us in the face.

I've heard - CBC Radio One in the morning and evening is where I get most of my information, BTW - that the Green Party approach is frugal - fiscally conservative seems to be the vernacular - and thoughtful. That is, questioning the solutions that people take for granted, and trying to generate new ideas and discussions around them. This is obviously elusive, and it remains to be seen how it would work in practice, but I'm willing to give them the benefit of the doubt today.

So, finally, why reveal all this to the world? Well, to be honest, I still have a lot to learn about our political system and the problems that our "open society" is up against. (Dare I say I'm green?) :-) If you see flaws in my logic, have relevant information I'm not considering, or just want to share your point of view, add your comments at the end of this entry. (That goes for any entry, BTW, although I only just set up commenting this month. E-mail me about older entries; I'll probably create an new one based on your comment.)

The Fruits of the Immoral

The creators of The WB's Superstar USA were obviously part of the popular crowd growing up; either that, or they're acting out a perverted cycle of abuse. This show is as cruel and immoral as the school-yard to high-school game of letting the pariah hang out with the popular crowd to protract said loner's humiliation when their true status is finally revealed. It is heartless, and runs diametric to the spirit of the golden rule.

Close to a month ago, CBC's Ontario Today ran a phone-in on raising moral children. Unfortunately, I couldn't listen to the whole program - having to work in the afternoon 'n' all :-) - but what I heard got me thinking. What are the consequences of raising children who don't question why Sally is never invited to any birthday parties, or why Paul gets the snot beaten out of him every school day at 3:00 p.m.? What happens when the movers and shakers believe that that's life, and that those who are affected should suck it up and watch their backs so they're on the winning side next time?

Today, I think the answer is that shows like Superstar USA are produced, promoted and watched by millions of people. Is this a big deal? Not really, but I think it's a sign of things to come. One can only hope that the people behind the scenes don't see how this message feeds the fear of humiliation, putting the preservation of one's status - and one's self, ultimately - above all other considerations. The consequences of this are truly horrific when these people are asked to act morally, when many other lives hang in the balance. What will be going through their heads? Which outcome makes them look the best? It's scary... really scary.

The perfectly-legal, all-seeing eye

"We're at war," [Dennis R. Schrader, director of homeland security for Gov. Robert L. Ehrlich Jr.,] said.

This blanket justification for building a regional, closed-circuit, video surveillance system in Baltimore raised my blogging brow, but it was Schrader's flawed logic that pushed me over the edge:

Cameras will only observe and record that which a police officer or private citizen could legally see.

Each camera will only observe and record what could be legally seen! The aggregate of every camera's observation is something that no one could physically see, and it is such a limitation that is taken into account when laws are written. Remove this limitation, and we can no longer talk about what is legal or illegal until the effected laws have been revisited.

This is one of the few things that's scarier than the huge databases of information being compiled these days: decision-makers who are oblivious to the power of data. (What else is scarier? Corporations owning these databases, but that's another entry.) What may seem innocuous to one person (e.g., seeing Joe walk out of some apartment complex), may be a critical piece in someone else's puzzle: the final correlation in a list of evidence that means Joe's screwin' around, or he's an alcoholic, or a homosexual, or suffering from Parkinson's disease... The list is endless, as is the list of what people could do with that information, including nothing. The point is, it's out of Joe's hands. His privacy is in jeopardy.

:-)

Canadian Pentecostal... Terrorists?

I wish I could find the sound bite I heard on CBC this morning; I don't know if it was the same FBI agent (Ahearn), but someone from the FBI said something like, This sort of thing reflects the climate change since September 11, 2001. Yes, absolutely. The Western hemisphere will never be the same. Then he went on to say, "... and people need to watch what they say around these security measures." Uh... What?

This kind of thinking starts us down a very slippery slope; the problem is that the public buys it wholesale, feeding the fear that words and thoughts are dangerous, regardless of their context. I'm not saying that the FBI were wrong to investigate this complaint; all I'm saying is that this was their opportunity to put things in perspective, say that it's good to be vigilant, but we must also be rational. In what context were the words spoken? Are you responding to other indicators? What are they? The right to speak one's mind is so fragile in the face of all this fear.

This snowball of public opinion has another cost: no one questions the security trade-off - security is always a trade-off (to quote Schneier). In this case, we're trading the right to speak about a broad range of ideas for what? Security theatre (another Schneier phrase). It's irresponsible to let people believe that they're safer when they don't hear about terrorist acts, or bombs, when we're on the bus, in line at Wendy's, or on an airplane.

Yes, be vigilant (because, no, Pollyanna, the whole world isn't in love with Canada), but don't start looking for the gestapo every time someone says "bomb" or "anthrax."

May 27, 8:45 AM EDT

Plane Turned Around After 9/11 Discussion

BUFFALO, N.Y. (AP) -- A plane was turned around on the runway and returned to the gate after three men were overheard praying and discussing the Sept. 11 terror attacks.

The men - two ministers from Toronto and one of their cousins from the United States - were on a Continental flight Wednesday headed to Newark, N.J.

The pilot taxied back to Buffalo-Niagara International Airport, where members of the joint terrorism task force in Buffalo interviewed the men and fellow passengers.

The ministers were identified as the Rev. Komal Singh and the Rev. Yohan Heenatigala. The third man was not identified.

Singh was on his way to an evangelical crusade in Baltimore when he told another passenger that the passenger's last breath on Earth would be his first breath in heaven if he became a born-again Christian.

"My first reaction was someone was just talking and someone got nervous and that's exactly what it turned out to be, but it has to be checked out," said Peter Ahearn, FBI special agent in charge.

The men were released and the flight took off.

Copyright: 2004 Associated Press
Publication: AP Custom News

Personal Use: You may make a single copy of any portion of the content, or use this content online, solely for your personal, non-commercial use, provided you do not remove any trademark, copyright or other notice from such content.

The responsibility of artists

Today, the Independent Filmmakers Cooperative of Ottawa (IFCO) denied Ken Takahashi's grant application for his film Last Night with Jesse. The grounds for this verdict - fear of the film's running afoul of proposed law Bill C-12 and its lack of an artistic merit defence - while troubling, are not the subject of this entry.

What concerns me is City Councillor Jan Harder's position on the matter. Her self-proclaimed threat to pull the city's contribution to arts funding (about one third of the total amount) was particularly distasteful, and unprofessional. (Unfortunately, I heard the sound bite on CBC Radio One, and haven't been able to find it in print.)

Takahashi's position echoes my thoughts on the role of artists:

I think it's important for artists to push the envelope, to challenge the status quo. And the city council getting involved and dictating what forms of art should be concentrated on - I think that's a bad thing to do and a dangerous precedent. If art is going to be dictated by the government, then we've lost an important voice, and I'm very concerned about that.

I feel strongly that challenging the status quo - with or without taxpayer dollars - is key to preserving the liberties that make this country great, in much the same way as Sherman Kent urged intelligence analysts to avoid analytic or cognitive biases:

[Kent] urged special caution when a whole team of ana­lysts immediately agrees on an interpretation of yester­day’s devel­opment or a prediction about tomorrow’s. Especially regarding Viet­nam, he also cautioned against a “been-to” bias; field exposure can be valuable, but a quick trip doesn’t necessarily provide revealed truths. One path he recom­mended for coping with cognitive bias was to make working assump­tions explicit and to challenge them vigorously.

Just the fact that there's such an outcry against this film should give us pause. Will it send the message that aberrant sexual behaviour against children is acceptable as Ottawa resident A. Charles King suggests? The film is in pre-production, folks! It isn't saying anything yet!

In forcing us to reconsider our knee-jerk reactions, artists have a big responsibility. By acknowledging the importance of this role - in the form of arts funding - citizens are really "electing" artists and their approving bodies, trusting in their judgment. By insisting that city council have a say in how arts funding is granted, Jan Harder is implying that she too is an artist who knows how the status quo must be challenged (and how it must not, in this case). I don't know about you, but the films that really challenged what I thought I knew often horrified me, certainly coming out of left field. Would you trust the average joe on the street to judge the merits of that sort of art as it sits in the mind of an artist, an unrealized vision?

It reminds me of Former Prime Minister Pierre Elliott Trudeau's thoughts on democracy:

Nor do I believe that elected representatives should abdicate their responsibility by being nothing but the mouthpieces for their constituencies. In its extreme form this ceases to be representative democracy and becomes direct democracy. Though it may look more democratic, it's really tantamount to saying that policies and laws must be decided by the people themselves... It's a misunderstanding of parliamentary democracy, and it cannot be made to work in large societies, because small groups meeting to deal with very important problems from their regional or local point of view cannot have in mind the legalistic, administrative, constitutional functions of government that are the fabric society must have to function in an orderly way.

Similarly, I feel that Jan Harder's, or any other city councillor's, point of view inappropriately biases her judgment of how the status quo should be challenged. To a lesser extent, I feel the same way about the IFCO, which is why I'm glad that their denial was based on legal grounds. (Whether that law is right and just is another, equally important, matter.) This responsibility rests with the artists, in my mind, and it is the grandeur of their calling.

Netiquette Guidelines

Request For Comments: 1855 - Netiquette Guidelines was published in 1995, but it is still very relevant today. Granted, many Internet users are paying a flat rate for their bandwidth these days - taking some of the sting out of the argument that quoting whole messages costs your recipients, for example - but goodness knows a thought to brevity wouldn't hurt Internet traffic levels.

I got to thinking about this RFC after I received what I considered to be a rude e-mail at work. The subject was in uppercase, and there was no salutation or complimentary closing. Worse still, it included the question: how did you figure that one?

Now, the tone of that question makes all the difference in the world. Friends, or even acquaintances, could admonish one another easily by putting a teasing spin on it; that spin would force a leap of faith between strangers, but it could still fly, depending on the personalities involved. But take the facial expressions and tone out of the equation, and it will fall hard 9 times out of 10, in my opinion.

I had never met the woman who sent this e-mail. (I'd also done nothing wrong - she had made an incorrect assumption - but that's beside the point.) My response directed her to the proper person, but I'm wondering if I should follow it with a copy of Netiquette Guidelines... Seems like I'd be violating some other etiquette though, and that would defeat the purpose of the whole exchange, no?

Muhammet Kalem and me

This is a picture of a street corner in Konya, Turkey; the city where the 11-storey apartment building (according to the CBC; Reuters has it as a 10-storey building) collapsed on February 2, 2004.

Muhammet Kalem was pulled from the wreckage today, having indicated his position to rescuers by moving a piece of plastic tubing. As I look at pictures of Konya, I'm stunned by how much it resembles many Canadian cities. I lived in four apartment buildings over a six-year span of my life, and not once did I doubt, or even consider, their structural integrity. Strict building codes are yet another luxury I enjoy without thought.

I understand that Muhammet's father (who had gone out earlier and avoided the collapse) had already arranged his burial plot. What mixed emotions he must be dealing with today: his son alive beyond all hope, his wife (and second child?) still missing.

Still on the subject of trademark infringement, HaidaBucks legal battle ended well last summer. (I like that name a lot, actually.) It looks like Mike Rowe's will also. Here's to the power of public opinion!

Uzi Nissan's Plight

I was reading about Mike Rowe's recent run-in with Microsoft when I found comments comparing it to Uzi Nissan's problems. Up until then, I'd been unaware of Mr. Nissan's legal battle with Nissan Motor Co., Ltd. The car maker has been trying to wrest the nissan.com domain name from Mr. Nissan since 1999, despite his every right to it. Unbelievably, as it stands right now, Mr. Nissan still owns the domain name and nissan.net (what used to be the home of his Internet service company), but he can't use them for commercial purposes. Talk about stripping ownership of its value! Now that his appeal has been rejected, he waits. What I can't believe is that the judge ruled that Mr. Nissan's critique of this lawsuit on ncchelp.org proved the actual dilution of the Nissan Motors trademark, as required by the Federal Trademark Dilution Act. I sure hope this ruling is sent back for review. The man has a right to express his opinion!

The US-VISIT Program

Bruce Schneier wrote a great piece on the US-VISIT program for the current Crypto-Gram. My first thought, upon reading about the program on Slashdot about a week ago, was: where does Canada fit in it? This came up in answering one of the frequently asked US-VISIT questions on the U.S. Department of Homeland Security Web site: while Canada is not part of the U.S. Visa Waiver Program, existing agreements with the U.S. exempt most Canadians from having to submit their biometric data. Of course, this can change based on national need.

My second thought was retention. It's easy to collect data, but keeping track of what you've collected, throwing it out when you're done with it, that's tougher. To their credit, the U.S. DHS conducted a privacy impact assessment on the US-VISIT program that addressed many of the fair information practices, including limited collection, accuracy and individual access:

There is also some duplication in the types of data collected by each system. These inconsistencies and duplication result in some heightened degree of risk with respect to integrity/security of the data, and to access and redress principles, because personal information could persist on one or more component systems beyond its period of use or disappear from one or more component systems while still in use. These risks are mitigated, however, by having a Privacy Officer for US-VISIT to handle specific issues that may arise, by providing review of the Privacy Officer’s decision by the DHS Chief Privacy Officer, and, to the extent permitted by existing law, regulations, and policy, by allowing covered individuals access to their information and permitting them to challenge its completeness. Additionally, as an overarching mechanism to ensure appropriate privacy protections, US-VISIT operators will conduct periodic strategic reviews of the data to ensure that what is collected is limited to that which is necessary for US-VISIT purposes.

What's interesting is that this quote is taken from the section entitled Retention and Destruction. At no point does it discuss the destruction or deletion of the biometric data. And, again, it's easy to keep data around just in case. The scary part is, though, when new systems are being developed and those involved are looking for ways to save money, to avoid reinventing the wheel, these piles of data are pretty enticing. What happens if I'm separated from my biometric data? Oh, that's John because he sent us this biometric data electronically, and look! It matches. No, actually it's just the person who has access to that data; it's been sitting on this decommissioned kiosk for the last two years, but hey, no worries, because you know what? John's fingerprints don't change a whole heck of a lot.

Yes, I know most sensible systems will only use stored biometric data in comparisons with what they get from me, right there, but convenience, assumptions, time constraints... System designers, project managers... They make mistakes. I'd just prefer that my data trail wasn't there, ready to be mucked with.

Overcome With Expression

I am shy. I'm more outspoken than I was 10 years ago, but, on the introvert-extrovert spectrum, I'm still an innie. Those moments when I feel the need (or see the opportunity) to express myself are rare. However, when they come, I experience some strange physiological changes: my skin starts tingling, and my extremities start to sweat and cool. If it takes me a few minutes to write my thoughts down, or speak them, or even complete some sort of public test (of skill or strength) - the key is expressing myself to others - I'll become so cold that I'll start to shake. This can be really annoying, if, for example, the test is a multiplayer game of Halo: sweating all over my keyboard while shaking my mouse makes it tough to shoot the enemy.

Am I alone? Again, it's an excitement, as opposed to an anxiety. Believe me, I know the difference. In Grade 9, I had to speak on my favourite song for a few minutes in front my (English? Social Studies?) class; by the end, I was getting one or two words out between gasps, seconds from hyperventilating. That was anxiety, and my public speaking is much improved today, I'm happy to say. But this excitement is still distracting. Sometimes I shake so badly that I can't type. And my wife loves it when I hug her with my corpse-like hands. :-)

New Year Blogs

Lately, I've gotten in the habit of reading a few of the fresh blogs to the left of the home page after I log out of Blogger. Of course, it's the interesting names that catch my eye (and yes, I'm aware that mine doesn't qualify... It's placeholder for my portfolio when I start writing seriously). I've heard some statistics on this, but I'm still surprised by the number of blogs with less than a dozen entries. Today, many are New Year blogs.

I'm sure to read something about this is the coming weeks, just like I read about (and deal with) the spike in gym membership every New Year. And I'm sure the coming months will see a similar trickle of abandonment as motivation dwindles. But blogs are different than gyms: they're only a few keystrokes away for most of the Internet community. No getting up early nor putting off supper for an hour nor spending the best parts of your evening going to and from (depending on your gym routine). So why do people stop blogging?

One answer is: they run out of things to talk about; and that's a good one. I, for one, don't want to read filler. But I would guess that people are always thinking about something. See, I got around this by starting another blog of limited scope: what I'm watching. I wasn't always thinking about things worth blogging about here, but I was watching lots of movies and a bit of TV. And as the credits were rolling on these shows, thoughts were always bouncing around in my head. Now I've just forced myself to sit down and type those thoughts out, in much the same way that many successful writers live, as I understand it. I guess I'm hoping that this limited exercise won't be so limited one day.

So, if everyone has thoughts bouncing around in their heads, the obstacle may be the process of typing them out. Without these aspirations, would I bother sitting down and typing as often as I do? History has shown the answer to be no, despite the fact that I enjoy it once I've started. And then there's another possibility, one that equally applies to me: the fear of looking stupid. Yes, John, I have a thought every few seconds, but none of 'em are particularly intelligent. I have religiously followed that Better to be thought a fool advice my whole life, and I suspect I'm not alone.

And yet, with all these obstacles, one in seven (or so) of the fresh blogs I stumble upon has been going strong for at least a year, sometimes two. I want to be able to say the same of at least one of mine.

About the new layout...

Hopefully this recommendation doesn't violate the terms of this service: until Pyra Labs (Google now, I guess) brings back their upgrade plans, I recommend using the Mozilla Firebird browser. I only recently realized that this layout doesn't work well with the advertisements, and Mozilla Firebird can block them. Yes, I realize this service wouldn't be free for very long if everyone took me up on this, but I will be putting my money where my mouth is as soon as possible (and feel free to call me out if the ad-free plan is offered again and you're still seeing the ads).

Well, a little over a week ago the Copyright Board of Canada decided to freeze existing private copying levies at their current levels. In addition, they introduced new private copying levies on the non-removable memory in devices like MP3 players.

I think everyone realizes that these levies are a compromise. There's no silver bullet with "music piracy" engraved on it. And with that in mind, I was happy with the board's decision. By distinguishing between CD-Rs and those bizarre audio CD-Rs - to the tune of 51¢ per disc - they are acknowledging that people do use CD-Rs for legitimate purposes. Denying the Canadian Private Copying Collective's request to establish a levy on removable memory cards is another good example of how the board recognized the utility of these technologies. Again, the decision isn't perfect: apparently there are different minidisc formats, for example, some of which can store any type of data. It isn't clear whether this was considered in the decision to charge a 72¢ levy on all minidiscs. In all fairness, it sounds like few people are using data minidiscs.

In his latest Crypto-Gram, Bruce Schneier talks about the value of quantum cryptography:

I don't have any hope for this sort of [quantum-cryptographic] product. I don't have any hope for the commercialization of quantum cryptography in general; I don't believe it solves any security problem that needs solving. I don't believe that it's worth paying for, and I can't imagine anyone but a few technophiles buying and deploying it.

While I see his point, my understanding of the value of quantum cryptography - based almost solely on Simon Singh's The Code Book - is that it's yet to be seen. Secure communications that can only be broken today by an infeasible number of calculations will be broken in the time it takes to perform one such calculation in the age of quantum computing. This will be a new security problem that quantum cryptography can solve.

Update: 8:12:00 PM: Bruce responded to my message:

My point is that software and network security are so lousy that breaking communications never comes down to the calculations, feasible or otherwise. It makes no sense to put a third lock on your front door if your windows are wide open.

It's a pretty amazing time we're living in. I often find myself taking it for granted; at no time is this clearer than in conversations with older generations. I'll be talking with my mom about a movie, and she'll wonder whether a particular actor was in a particular movie. Immediately I'm thinking about the Internet Movie Database, and if I'm on the portable, I'll be there in a flash, spitting out the answer with nary a second thought. This, of course, still floors my mother. She doesn't own a computer, so beyond the growing tendency of a brief punch of information, with more available - to many, but not her - on the World Wide Web, she's oblivious to the potential of the Internet.

But that's just the tip of its utility. If I hear an expression, if someone refers to a historic moment, if I have any sort of question, my knee-jerk reaction is to bring up my browser and start searching for more information. If I live to see the day of ubiquitous, wearable, Internet-connected technology, it could very well be the end of me. I can see it now:

Man Perishes on Park Bench: Forgets to Eat During Three-day Search for Atlantis

I bring all this up because I'm amazed at how much the Encyclopedia of Arda is enhancing my reading of The Lord of the Rings. I've just started Book II - the Council of Elrond is met - and I'm sure I've already spent two hours reading encyclopedia entries, following the hyperlinks through the ages of Middle-earth and lands beyond. It's truly a wonder! For example, as soon as Merry mentioned the men of Carn Dûm (in his daze after being rescued from the Barrow-wight), I looked up their entry in the encyclopedia.

In reading the book(s) for the third time, my plan is to continue through the appendices to The Silmarillion, The Book of Lost Tales and the other volumes in the history of Middle-earth. With the Encyclopedia of Arda just a few keystrokes away, I'm sure to save many hours of hunting through books for references that I can't quite remember. And since all the entries are dated, you always have an idea about which book(s) contain the original material.

In Fame vs Fortune: Micropayments and Free Content, Clay Shirky references the idea of mental transaction costs, and their role in the failure of micropayment systems. While I understand his rationale, I find myself hoping that time will prove him wrong.

I know that I don't mind paying for content; I gladly coughed up some change for Scott McCloud's The Right Number, for example. I would like to think that there are other, equally-frustrated readers who would pay for the diamonds in the rough, so to speak, or even for help in finding them. Shirky claims that "the good stuff is becoming easier to find as the size of the system grows" and I find myself shaking my head. Google is an amazing tool, but it's no substitute for a good recommendation.

To use another example, I would make micropayments for issues of First Monday. I can't imagine trying to find essays of that calibre using Google, but even if I could, there are many topics that I've only developed an interest in after reading that journal. My respect for their editors makes that time investment less of a gamble. And really, this is all about using my time wisely (to quote one of my high-school teachers). I could troll the ocean of amateur blogs, or I could pay someone else to.

As you may have noticed (from the bottom of this page), I'm concerned about my right to fairly use the copyrighted material I purchase. I don't see any problem with copying such material to a different medium, and possibly converting it to different format in the process, so long as it is for my personal use and convenience. (These concepts are captured in points #2 and #5 of the Consumer Technology Bill of Rights.)

Since Canadian copyright legislation has been in the media a lot lately, I took it upon myself, being the concerned citizen that I am, to learn more about it. Initially, I was surprised to discover that the Copyright Act defines the copying of a musical work embodied in a sound recording for private use in terms of the copier, not the owner. In other words, so long as you do the copying, copying music for your own use does not infringe the artist's copyright. It doesn't matter whether you own the CD, cassette tape or musical file.

However, what I couldn't figure out was whether I had fewer rights to use the copy than I did the original. Was a copy of a copy illegal? Well, the answer seems to be "Maybe." According to Neil Herber, even though the Copyright Act makes no mention of the source (i.e., whether you're copying the original sound recording or a copy of it), your original intent behind making the copy is important (i.e., you planned to loan your copy to your friends).

Well, Pete Lindstrom is at it again. This time, he's quoted in a Register article on some Diebold ATMs that were infected with the Nachi worm. While not as boneheaded as his comparing virus writing and sex, this quote is still a beaut:

I think of ATMs as a relative of SCADA systems, as those things not really being on the Internet, but being on some network, says Peter Lindstrom, an analyst with Spire Security. In some ways, it's kind of ironic, that I think standardization across the board has created some of the issues.

Merriam-Webster defines irony as 3 a (1) : incongruity between the actual result of a sequence of events and the normal or expected result (2) : an event or result marked by such incongruity.

So, what exactly is incongruent about standardization causing security problems? It may not be intuitive, but, as security professionals know, it's one of the disadvantages of homogenous systems, to be balanced against their many advantages. Defense-in-depth ring a bell, Pete? If your network design calls for layered firewalls, use different products at each layer. Exploits that work against one layer will likely fail against the other.

Man, this guy is really starting to bug me.

By the way, for a peek at the lighter side of my life, check out what I'm watching.

The London Free Press is running a story about Ontario's Internet and telephone voting options. I'm surprised by the amount of media coverage this is getting; it's a municipal election, after all. Heck, even the Slashdot community is throwing in their two cents.

Of course, boosting voter turnout is the focus of the London Free Press article. Security and privacy requirements get a paragraph:

Church [the president of CanVote Inc.] said the system uses security measures based on world standards for financial transactions like those used in online banking or credit card transactions.

Has anyone considered the possibility that the security and privacy requirements for financial transactions may differ from those for on-line and telephone voting? Limited liability plays a big role in the security of financial transactions (in North America, anyway; I understand the U.K. is a bit different). Would it play any role in on-line voting? It isn't like a voter can point to an unbalanced cheque book at the end of the month when something goes wrong. I read about Elections Canada's interest in this system, and I find myself doubting whether these questions have been asked, let alone answered.

Federal Government House Leader Don Boudria planned to observe the system in action tonight as ballots are tallied.

"As minister responsible for the Canada Elections Act, electronic voting is of particular interest to me," Boudria said.

"Voting electronically addresses issues such as time and distance that sometimes prevent people from voting."