Fox News outs a "Terrorist" (not) - Media gets the story wrong

On Aug 7, John Loftus reported on the Fox News program "Weekend Live" that a terrorist is living in a house in La Habra, CA. And he gives the address. And the report and the address get picked up, and spread around, and posted on the internet. Except the "terrorist" moved out three years ago. And the family that lives there now - definitely NOT terrorists - starts getting nasty phone calls, and drive-bys, and misspelled graffiti spray-painted on their home, etc. And Fox, and Loftus, give the weakest of apologies.

Now, all the reporting has been about what these nice people who live there have been going through. And I sympathize with them. But what if this alleged terrorist DID still live there? He hasn't been arrested yet. Should he get threatening email, and hate messages sprayed on his walls, and menacing drive-bys? Do we want a bunch of vigilantes dealing with un-indicted terrorists in our midst? Giving out the address was wrong even if the original person DID still live there!

Has there been ONE comment in the media about this aspect? I have not seen any. The media basically treat it like a human interest story, about the poor family getting the brunt of this. And there is a little bit about how Fox and Loftus are handling it ("mistakes happen" - note the passive voice - not even "I made a mistake").

Background:

John Loftus is a Fox News analyst and President of the IntelligenceSummit.org (an "educational forum" for intelligence agencies). Here is a transcript of his report.

TSA Secure Flight use of commercial data

Bruce Schneier always has interesting insights in his Crypto-Gram newsletter. He wrote about the Transportation Security Administration (TSA) and the development of their Secure Flight system. His story is available here. I urge you to subscribe to his newsletter.

I had a few thoughts about "testing the use of commercial data".

I worked in a traditional IT environment for 35 years, and "testing" usually meant testing an application, or a prototype, or an algorithm. In any case, before you could test, you need to have something pretty well defined. If this is what the TSA is doing, they must have some rules or algorithm already defined for what they expect to accomplish. Have they explained that at all? Is there anyone they would need to explain that to - a working group similar to the one Bruce Schneier is on, or Congress? In any case, it brings up the question of how they will test - more on that below.

The other thing they might be doing besides testing an application/prototype/algorithm is analyzing the data - trying to discover ways to use the data to find threats. This is a reasonable approach from a purely theoretical view - altho it raises all sorts of privacy issues. I am not a statistician, but I think some such discovery tests look for data correlations that may be totally unexpected, and unexplainable. For example, they may "discover" that anyone who, say, reads Bruce Schneier's columns, is more likely to be a terrorist that someone who doesn't.

So now we get to the issue of determining the success or failure of their tests. It seems to me that the only thing they can do is match their results, from either program or data testing, against their list of known terrorists or threats. Of course, that means they will only find the TYPE of terrorist they already know about - it probably would NOT find terrorists like the ones who did the recent subway and bus bombings in London. If they think they have a way of finding new terrorists in the general population, how do they determine if it is accurate? Knock on your door and ask if you are a terrorist? Do a background check? Just add the names to the watch list? And what is the likelihood of getting accurate positive hits? Let's say there are 10,000 terrorists in this country (just to pick a number). That represents something like .003% of the population. So they are looking for a very small number of positive results.

I am sure these questions are not new, but I sure wish more answers were available.

ISP's blocking too much email as spam

Fred Langa publishes an excellent newsletter about a variety of computer issues. Recently, he mentioned that personal emails he sent to some subscribers were rejected by spam filters.

I consider these false positives a serious problem - they have effected my own personal email as well as my business email. I wanted to talk about my experience with two different web and email hosting services.

I had been using one service (let's call them Gomommy.com) for web and email hosting for several years. They had good prices, good features, good support - what more could you ask for? But over the last year or so, I started getting more and more reports of bounced emails. I would get notes from newsletters I had subscribed to saying that I was being dropped because emails to my address were bouncing. When I was lucky, these termination emails, coming from a different source, would get through, so I could re-subscribe from a different address. When I talked to Gomommy tech support, they always blamed the sender, and referred me to Spamhaus as the source of much of their blocking lists. I also had individual emails from some of my small business's customers rejected - and this is pretty much the kiss of death for customer relations. In these cases, Gomommy said "the servers sending the email must have a virus."

I finally determined I had to find a better solution. Unfortunately, most service providers include the "service" of blocking spam, and many use Spamhaus as well. I finally found one that let's ME decide what spam blocking features I want to use, and let's me disable all of them if I want. The service I am now using is Powweb. It is a little more expensive than Gomommy, but I am now receiving some newsletters I have not seen in months! I have disabled their use of Spamhaus's lists for my accounts. I do use a spam-blocking feature they offer called grey-listing - this rejects email from a new source with a "try again later" message - and most spam senders don't bother. I can see lots of spam blocked using this feature, on the Powweb control panel.

The Powweb setup is a little more complicated than Gomommy - you need to be a little more technical - but it is very flexible.

Powweb also actually TELLS me about occasional outages - something Gomommy never did. (Gomommy would not even ADMIT problems when I called.) And Powweb has an active customer community that provides help and support. I should say that some customers have published complaints about support, billing, and availability in these forums - but I have had good experience in the few months I have been on Powweb. Most of the complaints seem to be 6 to 12 months old, or more, so they may have had some service problems that have gotten fixed.

I do use a free spam blocker on my own PC, called K9 from Keir.net. I find it does an excellent job of blocking spam - altho I am not getting any more via Powweb than I was via Gomommy. I think grey-listing is doing most of the work.

Iraq - No Way Out - comments about KCRW's To The Point with Warren Olney

Warren Olney is the host of No Way out on Public Radio. This is an excellent program that brings together authoritive voices on both sides of many important issues, and forcing them to engage in a real debate about those issues.

I was listening to today's show, about the war in Iraq, and I had a few reactions. The various speakers talked about the best and worst possible outcomes. I think the problem is that Americans are very pessimistic about the possibility of the best outcome - a stable, democratic Iraq. We see very little to make us believe this is likely to occur. But we do worry about the worst possible outcome - civil war, insurgents running large parts of Iraq, and a breeding ground for terrorists, who would stop attacking our troops in Iraq, and start attacking the US homeland. We see no way out of this mess, and it sickens us.

Right now, we are caught in the middle. And our soldiers are targets for ongoing attacks, and their only role is suppressing the insurgency, HOPING that Iraqi troops can take their place, and HOPING that the Iraqi's can form a government. How many soldiers and their families would continue to support the war, if they were told the PLAN was for them to be sacrificed to save the homeland? In computer security, it's called a honey pot - a computer made available to hackers, to learn their methods, and to keep them busy, away from the really important computers.

Personally, I think the Democrats blew the opportunity during the last election to say "given the mess that Bush created, we have to stay the course - so we have no plan for Iraq different from Bush's - but we ought to throw out the bums who got us into this situation, and did such a bad job of planning for the post-Hussein power vacuum." Also, I see no evidence that Bush CARES that his ratings are low - since he is a lame duck, and does not even need to worry about getting is VP elected in his place. Jeb Bush may care - and other Republicans may care - but they probably believe that Karl Rove can manipulate the public again, and Republican governers can manipulate the voting enough, to win in 2008.

Questions I would ask the US Generals in Iraq

On the Today show, Matt Lauer did a story with one of the US Generals there - sorry I did not get his name. He asked a lot of good questions - but I always want more.

I wish he had asked another question about the "mission." I think most Americans perceive the mission now as "suppress the insurgency (we cannot kill it), and survive until there are enough Iraqi troops to do a reasonable job against the insurgency." And we don't really believe that will happen any time soon. So do we just keep grinding through our troops until that happens? Do we really believe that an approved Iraqi constitution is going to significantly change these parameters?

Why don't we have more precise metrics of Iraqi capability? Maybe for security reasons - but does SOMEONE have them? And do the Iraqi's have weapons and armor and vehicles to match the staffing they need?

Another question that Americans don't have a good handle on - we perceive the insurgency as primarily attacking through IED's and car bombs. We don't hear of many American soldiers (or Iraqi's) being shot (which is good). Is this an accurate description? What else are the US troops doing? Presumably going out on raids, rounding up suspected insurgents? What would happen if the troops WEREN'T there? Increased, real attacks by insurgents on Iraqi's? So our mere presence prevents that?

Information Organizers - Keynote - security of your data

Walt Mossberg writes a column in the Wall Street Journal - a recent story talked about information organizers.

If this interestes you, you might want to take a look at Keynote. It's a free organizer from Tranglos Software. I converted from Info Select because I got tired of paying $50/year for their software subscription. Both IS and Keynote had a couple of key security features I considered critical. Both allow for password protection of the information. More importantly, if you use a laptop that might get lost or any kind of shared PC environment, they automatically CLOSE the file after a specified idle time. This forces re-entry of the master password. I keep credit card numbers (along with lots of other info) in my organizer, so I want to maximize security of that info.You should consider these issues before putting identity info into an organizer.

I have also started using Splash-ID (a Palm utility with a desktop component) for this kind of information - this way, I can have strong passwords on web sites, etc, and access them at home (using Firefox's password memorization feature) but also access them away from home, using the same info stored in my Palm Treo phone.