Risks Digest 28.40

[RISKS List Owner <risko () csl sri com>]

RISKS-LIST: Risks-Forum Digest  Friday 5 December 2014  Volume 28 : Issue 40

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, moderator, chmn ACM Committee on Computers and Public Policy

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
  <http://catless.ncl.ac.uk/Risks/28.40.html>
The current issue can be found at
  <http://www.csl.sri.com/users/risko/risks.txt>

  Contents:
These 31 Builders Made Mistakes That Will Leave You BAFFLED
  (Gabe Goldberg)
NTSB report on Boeing 787 (Jeremy Epstein)
SmartDriver: a 16-year-old can see the risks (Richard A. O'Keefe)
Hacked vs. Hackers: Game On (Nicole Perlroth)
Hackers Pirate Sony Films and Leak Studio Salaries (Monty Solomon)
Sony Pictures' computers are still locked as hackers demand equality
  (engadget via Dave Farber)
It Gets Worse: Newest Sony Data Breach Exposes Thousands Of Passwords
  (Charlie Warzel via Monty Solomon)
Argument preview: Social media as a crime scene (scotusblog via
  Monty Solomon)
"Gangnam Style overflows INT_MAX, forces YouTube to go 64-bit"
  (Peter Bright)
"How to crash the data center with one word" (`Anonymous')
Apple entering a `whack-a-mole' era of malware defense (ZDNet via
  Bob Frankston)
"Fraudulent apps stalk Apple's App Store" (Simon Phipps via
  Gene Wirchenko)
"BYOD Brings Corporate Contradictions" (Tom Kaneshige)
New Snowden docs: GCHQ's ties to telco gave spies global surveillance
  reach (Sean Gallagher)
NSA subverts GSM standards processes with vulnerabilities (Ryan Gallagher)
'Regin' malware comes from western intelligence agency, say experts
  (Brian Randell)
The triumph of hope -- or hype? -- over experience (Robert L Wears)
The Trolls Among Us (Anne Applebaum)
This Net was Made for You and Me ??? (Julian Assange via Henry Baker)
I thought fleeting messages were bad (Dan Jacobson)
Re: Recent RISKS Problematic Posts (Martin Ward)
Re: "Silicon Valley's combination of power and irresponsibility
  (Chris Drewe)
Re: Uber's Underhanded App reporting data back w/o permission (George Sigut)
Abridged info on RISKS (comp.risks)

----------------------------------------------------------------------

Date: Sat, 29 Nov 2014 14:55:39 -0500
From: Gabe Goldberg <gabe () gabegold com>
Subject: These 31 Builders Made Mistakes That Will Leave You BAFFLED

Technology must have been involved somehow...
  http://www.viralnova.com/31-building-fails-gallery/
...here's what went wrong.

  [This item is decidedly *NOT* computer related, but I will bet some of
  these examples will appear in computer-related talks.  I'm reminded of the
  photo of the barrier in a road, with tracks of vehicles that went around
  it on the grass, which I must have seen in a dozen security talks by now.
  PGN]

------------------------------

Date: Tue, 2 Dec 2014 13:33:11 -0500
From: Jeremy Epstein <jeremy.j.epstein () gmail com>
Subject: NTSB report on Boeing 787

As one might expect, it wasn't a single problem, but a series of
interrelated problems.  It's a fairly simple matter to substitute "software"
for "battery", and see the state of security in the world today.

Flaws in manufacturing, insufficient testing and a poor understanding of an
innovative battery all contributed to the grounding of Boeing's 787 fleet
last year after a fire in a jet at Boston's airport and another incident in
Japan, according to a report released Monday by regulators.

The report, by the National Transportation Safety Board, assigned in the
starkest terms yet the blame for the 787's battery problems.

The safety board investigating the Boston episode suggested for the first
time that manufacturing flaws introduced defects that led a battery cell to
fail, though the board stopped short of drawing a firm conclusion. The
failure of that cell rippled to other cells, causing the battery to consume
itself in fire and smoke. [...]

The board found a wide range of failings among manufacturers and
regulators. The battery's maker, GS Yuasa of Japan, used manufacturing
methods that could introduce potential defects but whose inspection methods
failed to detect the problem, the board found. Boeing's engineers failed to
consider and test the worst-case assumptions linked to possible battery
failures, it said. And the Federal Aviation Administration failed to
recognize the potential hazard and did not require proper tests as part of
its certification process, the report said. [...]

http://www.nytimes.com/2014/12/02/business/report-on-boeing-787-dreamliner-batteries-assigns-some-blame-for-flaws.html?emc=edit_th_20141202&nl=todaysheadlines&nlid=23103254

------------------------------

Date: Thu, 4 Dec 2014 18:54:25 +1300
From: "Richard A. O'Keefe" <ok () cs otago ac nz>
Subject: SmartDriver: a 16-year-old can see the risks

I recently got e-mail from the Tower insurance company promoting
SmartDriver, produced by a US company called DriveFactor.

The web page is http://www.tower.co.nz/insurance/car/smartdriver/
with a FAQ at
http://www.tower.co.nz/insurance/car/smartdriver/frequently-asked-questions.

This is an app for iOS and Android that purports to measure how safely you
are driving by using your device's sensors to record ``acceleration,
braking, cornering, trip frequency and duration'' and your GPS location,
more. You can get a discount of up to 20% if you are safe enough.

In no particular order,
 - I am very pleased to have a phone that is too dumb to support malware.
   (http://www.dilbert.com/2014-12-03/).  No discount for me!
 - Wait, I do have an iPad, and so does my wife.
   Sorry, it doesn't work on iPads.  No discount for me!
 - My wife *does* have a smart-phone.  It's a Windows phone.
   No discount for her!
 - The app will lack awareness of the context.  If a child or an animal
   runs across the road in front of me, and I brake hard enough to avoid
   a death, I will be penalised for unsafe driving, not rewarded.
   Similarly, a sharp turn to avoid an accident will count as unsafe,
   not safe.
 - http://www.drivefactor.com/how-can-traffic-affect-driving-behavior/
   suggests that they can tell light traffic from rush hour, but the
   statement ``the car experienced an additional 13.7 total g's of
   acceleration'' is a little confusing.
 - I wonder whether they compare your speed as reported by GPS with the
   speed limit for the relevant road, and just how accurate their maps are.
 - The app will lack awareness of the context.  We are often told these days
   that driving too slowly is dangerous, but the app won't know about rain,
   fog, or road works, and it doesn't appear to have any way you can
   tell it that you are towing something.
 -  Q. Can I get a copy of my data?
    A. We will provide access to your data that is readily available.
    Please note that we may ask you to pay a reasonable fee if your request
    is time consuming or costly.
   This is a non-answer.  A couple of Official Information Act requests
   have shown me that governments have a way of saying that information
   they *ought* to have had is not readily available, and I don't expect
   businesses to be any different.  And whose opinion of `a reasonable fee'
   applies?
 -  Q. Can the police request the data in case of accidents or
    investigations?
    A. If TOWER is legally required to share information with authorities,
    we will abide by our obligations under the law.
   This is an even more flagrant non-answer.  If the data are held in the
   US and analysed by DriveFactor, they can presumably thumb their noses at
   NZ law.  *Tower* might well not hold anything but summaries.

Longer term, I'm concerned by several things.

 - First people paid their bills over the counter at the post office, then
   Internet banking became available, and now you are charged penalty
   payments if you pay over the counter in real money.  How long before your
   insurance company starts charging extra to people who don't use such an
   app? (With a safe driving discount of up to 20%, I think we can see that
   the penalty paid by a Windows Phone user could be substantial.)

 - How long before inability to produce your logs counts against you in
   court?  (If you don't want anyone monitoring your driving, you must know
   you are a bad driver, so the accident must have been your fault.)

 - There is a privacy act in New Zealand, but under the principle of the
   sovereignty of Parliament, it could be gone tomorrow if John Key's
   business friends saw an advantage in getting their hands on data like
   this.  Of course much of this information can be gleaned from mobile
   phones anyway if you can plant what you want in them, and NZ is part of
   Five Eyes. But I like to turn my phone off when driving, for safety,
   ironically enough.  DriveSmart offers a financial incentive to keep your
   phone on.

My younger daughter will turn 16 tomorrow and is interested in learning to
drive.  When I told her about DriveSmart, she was able to grasp these
issues.

Welcome to the self-surveillance society.

------------------------------

Date: Wed, 3 Dec 2014 21:10:22 -0500
From: Monty Solomon <monty () roscom com>
Subject: Hacked vs. Hackers: Game On (Nicole Perlroth)

Nicole Perlroth, *The New York Times*, 03 Dec 2014 and the blog:
http://bits.blogs.nytimes.com/2014/12/02/hacked-vs-hackers-game-on/

There has been an awakening that online threats are real and growing worse,
and that the prevailing `patch and pray' approach to computer security will
not do.

  [Also noted by Matthew Kruk.  Those of you tired at rather pessimistic
  items in RISKS might also be interested in a companion article by Nicole
  Perlroth in the same issue of *The Times* and the same blog:
  http://bits.blogs.nytimes.com/2014/12/02/reinventing-the-internet-to-make-it-safer/
  PGN]

------------------------------

Date: Wed, 3 Dec 2014 20:20:04 -0500
From: Monty Solomon <monty () roscom com>
Subject: Hackers Pirate Sony Films and Leak Studio Salaries

The breach exposed two things the movie industry loathes -- the piracy of
films, and details about executive compensation.  It sent a ripple of dread
across Hollywood.
http://www.nytimes.com/2014/12/03/business/media/sony-is-again-target-of-hackers.html

------------------------------

Date: Wed, 26 Nov 2014 07:06:20 -0500
From: "David Farber via ip" <ip () listbox com>
Subject: Sony Pictures' computers are still locked as hackers demand equality

http://www.engadget.com/2014/11/26/sony-pictures-computers-are-still-locked-as-hackers-demand-equa/?ncid=rss_truncated

------------------------------

Date: Thu, 4 Dec 2014 18:18:04 -0500
From: Monty Solomon <monty () roscom com>
Subject: It Gets Worse: Newest Sony Data Breach Exposes Thousands Of Passwords

http://www.buzzfeed.com/charliewarzel/it-gets-worse-the-newest-sony-data-breach-exposes-thousands

------------------------------

Date: Mon, 1 Dec 2014 07:41:20 -0500
From: Monty Solomon <monty () roscom com>
Subject: Argument preview: Social media as a crime scene

... In this case, a thirty-one-year-old man, Anthony Douglas Elonis, who
lives in the small Pennsylvania community of Lower Saucon Township, was
convicted for postings on Facebook four years ago that prosecutors treated
as actual threats of violence. The jury agreed, leading to a guilty verdict
and a forty-four-month prison sentence. His messaging came after his wife
had left him and he was fired from his job at an amusement park because of
one of his postings. ...

http://www.scotusblog.com/2014/11/argument-preview-the-social-media-as-a-crime-scene/

------------------------------

Date: Thu, 04 Dec 2014 09:33:49 -0800
From: Gene Wirchenko <genew () telus net>
Subject: "Gangnam Style overflows INT_MAX, forces YouTube to go 64-bit"
  (Peter Bright)

Peter Bright, *Ars Technica*, 3 Dec 2014
Psy's hit song has been watched an awful lot of times.
http://arstechnica.com/business/2014/12/gangnam-style-overflows-int_max-forces-youtube-to-go-64-bit/

Although it's no longer 2012, apparently people are still watching the
YouTube video for Korean pop star Psy's smash hit song Gangnam Style.

The irritatingly catchy tune has racked up so many views that Google has
been forced to upgrade YouTube's infrastructure to cope. When YouTube was
first developed, nobody ever imagined that a video would be watched more
than 2 billion times, so the view count was stored using a signed 32-bit
integer.

------------------------------

Date: Thu, 04 Dec 2014 10:06:46 -0800
From: Gene Wirchenko <genew () telus net>
Subject: "How to crash the data center with one word"

`Anonymous', InfoWorld, 3 Dec 2014
A single word on a simple button does not mean what an admin thinks
it means during what should be a routine weekend job
http://www.infoworld.com/article/2854353/it-jobs/for-major-outage-push-the-button.html

Techies and users often accuse each other of speaking different languages,
but truth be told, we in IT don't always understand one another either. Take
the case of the tech team who decided a simple one-word sign in the data
center would mean the exact opposite of all expectations.

As I paused outside of the closed door, I stared at a big, red button
labeled "Open" right next to the entrance. I'd seen it before and assumed it
would open the door. Logically, I pushed the button.

Instantly, a dreaded silence descended -- the sound of a data center that
has gone dead. The Open button must have shut off all power to the data
center! It certainly hadn't opened the door.

To this day I marvel at the lunacy of putting a big, red, completely
unprotected button next to a door, labeled as Open but in actuality meaning
"Open all power circuits in case of emergency only."

The label never changed, but our crew put a plastic box over it so you had
to flip open the box before you could push the button. Even with a small
staff, you can never assume that everyone knows what a sign like that
means. Clear communication is a necessity.

------------------------------

Date: 5 Dec 2014 14:48:22 -0500
From: "Bob Frankston" <bob19-0501 () bobf frankston com>
Subject: Apple entering a `whack-a-mole' era of malware defense (ZDNet)

http://www.zdnet.com/article/apple-entering-a-whack-a-mole-era-of-malware-defense/?tag=nl.e539
http://www.zdnet.com/article/apple-entering-a-whack-a-mole-era-of-malware-defense/?tag=nl.e539&s_cid=e539&ttag=e539&ftag=TRE17cfd61

------------------------------

Date: Thu, 04 Dec 2014 10:02:24 -0800
From: Gene Wirchenko <genew () telus net>
Subject: "Fraudulent apps stalk Apple's App Store" (Simon Phipps)

Simon Phipps, *InfoWorld*, 3 Dec 2014
Angry support queries fly, citing problems with mystery iOS apps --
that turn out to be scamware
http://www.infoworld.com/article/2854754/mobile-apps/fraudulent-apps-stalk-apples-app-store.html

selected text:

Many people think that the sort of scams Microsoft cleared out of its mobile
app store this year could never affect Apple. But how tight is Apple's
review process for the App Store? If you're competing with Apple, it seems
to be very tight, and the rules are constantly changing. But if you're a
scammer looking to make a fast buck, it appears that Apple process can be
defeated.

That's three apps that logic demands should never have been allowed into the
App Store in the first place if anyone was paying the slightest attention to
their names and icons, including one with a dummy URL for support and
another hollow shell that cannot possibly have passed any meaningful
scrutiny by an app tester. Yet they are all in the supposedly sanitary
iTunes Store. I found several other apps (1, 2, 3) using the name
Quickoffice (although without Google's icon). How many more apps like this
are there in the App Store?

I contacted Apple for comment but received no reply at press time.

------------------------------

Date: Tue, 02 Dec 2014 12:33:34 -0800
From: Gene Wirchenko <genew () telus net>
Subject: "BYOD Brings Corporate Contradictions" (Tom Kaneshige)

Tom Kaneshige, *CIO*, 1 Dec 2014
CIOs naturally want a BYOD policy in place to give them some level of
control, but the reality is that employees will do whatever they want
regardless of the policy.
http://www.cio.com/article/2852984/byod/byod-brings-corporate-contradictions.html

------------------------------

Date: Tuesday, November 25, 2014
From: *Dewayne Hendricks* <dewayne () warpspeed com>
Subject: New Snowden docs: GCHQ's ties to telco gave spies global
  surveillance reach (Sean Gallagher)

Sean Gallagher, *Ars Technica*, 25 Nov 2014
Access through partners such as Cable & Wireless pulls in gigabits globally.
http://arstechnica.com/tech-policy/2014/11/new-snowden-docs-gchqs-ties-to-telco-gave-spies-global-surveillance-reach/

Documents reportedly from the Edward Snowden cache show that in 2009, GCHQ
(and by association, the NSA) had access to the traffic on 63 submarine
cable links around the globe. The cables listed handle the vast majority of
international Internet traffic as well as private network connections
between telecommunications providers and corporate data centers.

According to a report in the German newspaper Suddeutsche Zeitung, the
telecommunications company Cable & Wireless -- now a subsidiary of Vodafone
-- actively shaped and provided the most data to GCHQ surveillance programs
and received millions of pounds in compensation.

The relationship was so extensive that a GCHQ employee was assigned to work
full-time at Cable & Wireless (referred to by the code-name Gerontic in NSA
documents) to manage cable-tap projects in February of 2009. By July of
2009, Cable & Wireless provided access to 29 out of the 63 cables on the
list, accounting for nearly 70 percent of the data capacity available to
surveillance programs.

A Vodafone spokesperson did not deny the details when questioned by
Suddeutsche Zeitung but said that any taps were performed legally under a
warrant.

The cable access wasn't just used for surveillance -- it was also used to
pipe back data pulled from other networks through Computer Network
Exploitation (CNE) operations to populate Incenser (a GCHQ special source
collection system) running in a data center at GCHQ's signals collection
center at Bude in Cornwall.

One of the networks that was targeted by a CNE hack and accessed over Cable
& Wireless capacity, according to an NSA slide, was the Fiber-Optic Link
Around the Globe (FLAG), a global network operated by the Indian
telecommunications company Reliance Communications' subsidiary, Global Cloud
Xchange. Data pulled the FLAG network's connections span the globe, with
landing points in the US, Europe, North Africa, the Saudi Peninsula, India,
Malaysia, China, Taiwan, South Korea, and Japan. [...]

------------------------------

Date: Thu, 04 Dec 2014 11:40:21 -0800
From: Henry Baker <hbaker1 () pipeline com>
Subject: NSA subverts GSM standards processes with vulnerabilities
  (Ryan Gallagher)

Ryan Gallagher, *First Look*, 04 Dec 2014
Operation Auroragold: How the NSA Hacks Cellphone Networks Worldwide
The NSA continues to introduce vulnerabilities into GSM systems worldwide.
https://firstlook.org/theintercept/2014/12/04/nsa-auroragold-hack-cellphones/

In March 2011, two weeks before the Western intervention in Libya, a secret
message was delivered to the National Security Agency.  An intelligence unit
within the U.S. military's Africa Command needed help to hack into Libya's
cellphone networks and monitor text messages.

For the NSA, the task was easy. The agency had already obtained technical
information about the cellphone carriers' internal systems by spying on
documents sent among company employees, and these details would provide the
perfect blueprint to help the military break into the networks.

The NSA's assistance in the Libya operation, however, was not an isolated
case.  It was part of a much larger surveillance program -- global in its
scope and ramifications -- targeted not just at hostile countries.

According to documents contained in the archive of material provided to The
Intercept by whistleblower Edward Snowden, the NSA has spied on hundreds of
companies and organizations internationally, including in countries closely
allied to the United States, in an effort to find security weaknesses in
cellphone technology that it can exploit for surveillance.

The documents also reveal how the NSA plans to secretly introduce new flaws
into communication systems so that they can be tapped into -- a
controversial tactic that security experts say could be exposing the general
population to criminal hackers.

Codenamed AURORAGOLD, the covert operation has monitored the content of
messages sent and received by more than 1,200 email accounts associated with
major cellphone network operators, intercepting confidential company
planning papers that help the NSA hack into phone networks.

  [Long item truncated for RISKS. PGN]

------------------------------

Date: Tuesday, November 25, 2014
From: *Brian Randell* <brian.randell () newcastle ac uk>
Subject: 'Regin' malware comes from western intelligence agency, say experts

The (UK) Guardian:

Usual suspects -- Russia and China thought to be in the clear as attention
focuses on US, UK and Israeli agencies.  Symantec said the Regin malware was
likely developed by a nation-state.  But which one?

Regin is the latest malicious software to be uncovered by security
researchers, though its purpose is unknown, as are its operators. But
experts have told the Guardian it was likely spawned in the labs of a
western intelligence agency.

None of the targets of the Regin hackers reside on British soil, nor do any
live in the US. Most victims are based in Russia and Saudi Arabia -- 28% and
24% respectively.

Ireland had the third highest number of targets - 9% of overall detected
infections. The infections lists doesn't include any five-eyes countries
-- Australia, Canada, New Zealand, the UK and the US.

``We believe Regin is not coming from the usual suspects. We don't think
Regin was made by Russia or China,'' Mikko Hypponen, chief research officer
at F-Secure, told the Guardian. His company first spied Regin hiding on a
Windows server inside a customer's IT infrastructure in Northern Europe.

Only a handful of countries are thought capable of creating something as
complex as Regin. If China and Russia are ruled out, that would leave the
US, UK or Israel as the most likely candidates.  ``There are no other
countries I can think of,'' said F-Secure researcher Sean Sullivan, when
*The Guardian* put this suggestion to him.

Full story at:
http://www.theguardian.com/technology/2014/nov/24/regin-malware-western-surveillance-technology

------------------------------

Date: Thu, 04 Dec 2014 07:18:41 -0500
From: "Robert L Wears, MD, MS, PhD" <wears () ufl edu>
Subject: The triumph of hope -- or hype? -- over experience

Yet another techno-fantasy disaster -- after 15 years, $16 billion CAD, a
province-wide EMR system is a disaster and should be thrown out and redone
from scratch.  The risks reported here were only (!) financial -- no telling
what risks may have been borne by patients and workers from poorly designed,
dysfunctional systems.  But, the technocratic wish is so strong, hospitals
and governments are mindlessly rushing forward anyway.  *The Montreal
Gazette*

http://montrealgazette.com/news/local-news/quebecs-electronic-records-plan-a-disaster-barrette-says

Robert L Wears, University of Florida, wears () ufl edu  1-904-244-4405 (ass't)
Imperial College London, r.wears () imperial ac uk +44 (0)791 015 2219

------------------------------

Date: Sun, 30 Nov 2014 11:53:42 -0500
From: Monty Solomon <monty () roscom com>
Subject: The Trolls Among Us (Anne Applebaum)

If you want to comment on this article, you shouldn't be allowed to be
anonymous.

Anne Applebaum, *Slate*, 28 Nov 2014
http://www.slate.com/articles/news_and_politics/foreigners/2014/11/internet_trolls_pose_a_threat_internet_commentators_shouldn_t_be_anonymous.html

------------------------------

Date: Thu, 04 Dec 2014 11:45:26 -0800
From: Henry Baker <hbaker1 () pipeline com>
Subject: This Net was Made for You and Me ??? (Julian Assange)

  [FYI -- Perhaps not.  HB]

Who Should Own the Internet?  Julian Assange on Living in a Surveillance
Society, *The New York Times*, 4 Dec 2014
http://www.nytimes.com/2014/12/04/opinion/julian-assange-on-living-in-a-surveillance-society.html

It is now a journalistic cliché to remark that George Orwell's *1984* was
`prophetic'.  The novel was so prophetic that its prophecies have become
modern-day prosaisms. Reading it now is a tedious experience.  Against the
omniscient marvels of today's surveillance state, Big Brother's fixtures --
the watchful televisions and hidden microphones -- seem quaint, even
reassuring.

Everything about the world Orwell envisioned has become so obvious that one
keeps running up against the novel's narrative shortcomings.

I am more impressed with another of his oracles: the 1945 essay *You and the
Atomic Bomb*, in which Orwell more or less anticipates the geopolitical
shape of the world for the next half-century.  ``Ages in which the dominant
weapon is expensive or difficult to make will tend to be ages of despotism,
whereas when the dominant weapon is cheap and simple, the common people have
a chance ... A complex weapon makes the strong stronger, while a simple
weapon -- so long as there is no answer to it -- gives claws to the weak.''

  [Long item truncated for RISKS.  PGN]

------------------------------

Date: Sun, 30 Nov 2014 22:13:25 +0800
From: Dan Jacobson <jidanni () jidanni org>
Subject: I thought fleeting messages were bad

I thought fleeting messages were bad. You know, the kind that assume you are
still in front of your computer and your eyes also just happen to be glued
to that spot on the screen and then disappear in one second.

But now I read http://en.wikipedia.org/wiki/Wickr :

Sell, who "berated an FBI agent who asked her to install a backdoor into
Wickr," reportedly "prides herself on the fact that Wickr is designed by
professional cryptographers and that it knows absolutely nothing about its
users."  The firm "spent years designing the most fleeting message on the
market," stated Time Magazine, noting that messages are instantly "scrambled
by military-grade encryption technology"...

------------------------------

Date: Sat, 29 Nov 2014 11:33:58 +0000
From: Martin Ward <martin () gkc org uk>
Subject: Re: Recent RISKS Problematic Posts

> > Subject: House Republicans just passed a bill forbidding
> > scientists from advising the EPA on their own research

> ... The government should seek and require peer review of funding done by
> people that aren't funded to do that research by the government. ...

The purpose of tenure is to ensure that even though the scientist is funded
by the government, the government has no influence on the scientist's work,
and the scientist's work has no impact on their funding. This allows the
scientist to be unbiased, and therefore give unbiased advice to the
EPA. (This means that the vast majority of scientists should be given
tenure: which is unfortunately not the case).

On the other hand, a "think tank" of lobbyists funded by oil companies in
order to push their agenda *cannot* be independent: their jobs depend on
presenting a certain point of view.  When the politicians (who are also
funded by the same oil companies) pass a bill forbidding the scientists from
advising the EPA, while at the same time allowing the lobbyists to advise
the EPA, it is clear that there is a problem.

> > Subject: The safest computers are iPhones and iPads (Galen Gruman)
> > But rarely do you see smartphones and tablets in these reports. Why?
> > Because they're more secure than computers and data centers.
>
> Bingo - the jackpot in in poor reasoning.

This one I agree with.  Why do thieves rob banks?  It's not because banks
are less secure than other places, but "because that's where the money is."

Dr Martin Ward STRL Principal Lecturer & Reader in Software Engineering
martin () gkc org uk  http://www.cse.dmu.ac.uk/~mward/

------------------------------

Date: Sun, 30 Nov 2014 21:14:28 +0000
From: Chris Drewe <e767pmk () yahoo co uk>
Subject: Re: "Silicon Valley's combination of power and irresponsibility

Recent RISKS have highlighted increasing tensions between Internet
businesses and governments.  For a British take, here are some excerpts
from an article in last week's *Telegraph* on the topic.
<http://www.telegraph.co.uk/technology/facebook/11256524/Why-the-Government-has-unfriended-Facebook.html>

  The problem in this case, however, is not what Facebook shows us, but what
  we put up there ourselves. Playing host to all human life means,
  unfortunately, that you get exactly that -- all human life, including the
  criminals, terrorists, racists and lunatics. ...  Facebook's argument has
  always been that it can't, and shouldn't, be held responsible for what its
  users post. And there's certainly something to that.  Keeping tabs on more
  than a billion people would be a huge technical challenge.  ...  Building
  a proper system of surveillance would require enormous resources, involve
  huge intrusion into our privacy, and throw up all manner of false
  positives.  In short, it is not just impractical, but probably impossible.

  But while this argument is valid, it is also enormously convenient. It
  allows the company to keep its customer services team -- the number of
  people devoted to interacting with other human beings, with all the mess
  that involves -- as small as possible, thereby raising profit margins and
  ensuring that most of its staff can get on with doing cool things with
  code. And it also allows it to wash its hands of the social consequences
  of the software it produces. ...  David Cameron is saying, in effect, that
  Facebook must use its enormous power wisely and responsibly -- or the
  state will step in to ensure that it does. Facebook is saying that it is a
  tool of its users, not of governments. The old order is asserting itself
  against the new, and the new against the old. Even if an accommodation is
  eventually reached on this particular issue, it is a racing certainty that
  they will clash again.

IMHO I feel that this is a difference between European and American
cultures.  What seems to be wanted is for social networking sites to be
fully moderated and only accessible to vetted registered users, which would
probably virtually kill them, but European governments may well regard this
as an acceptable outcome.

[Chris also noted this article.  Included entire text removed for RISKS.  PGN]

Robert Colvile, *The Telegraph*, 27 Nov 2014
Why the [UK] Government has unfriended Facebook
The Lee Rigby case has brought the simmering tension between Silicon Valley
and the state out into the open.
http://www.telegraph.co.uk/technology/facebook/11256524/Why-the-Government-has-unfriended-Facebook.html

------------------------------

Date: Sat, 29 Nov 2014 08:25:24 -0500
From: GMS <george.sigut () gmail com>
Subject: Re: Uber's Underhanded App reporting data back w/o permission (Blain,
  RISKS-28.39)

> http://www.gironsec.com/blog/2014/11/what-the-hell-uber-uncool-bro/
... and when you read the blog followups, you will find a big
discussion of fact and conjecture, including the link
http://thenextweb.com/apps/2014/11/27/ubers-app-malware-despite-may-read/
-- which dismantles the whole issue.

1247 Fort Miller Road, Fort Edward, NY 12828,   +1 518 695 4794

------------------------------

Date: Mon, 17 Nov 2014 11:11:11 -0800
From: RISKS-request () csl sri com
Subject: Abridged info on RISKS (comp.risks)

 The ACM RISKS Forum is a MODERATED digest. Its Usenet manifestation is
 comp.risks, the feed for which is donated by panix.com as of June 2011.
=> SUBSCRIPTIONS: PLEASE read RISKS as a newsgroup (comp.risks or equivalent)
 if possible and convenient for you.  The mailman Web interface can
 be used directly to subscribe and unsubscribe:
   http://mls.csl.sri.com/mailman/listinfo/risks
          ^^^  [PLEASE NOTE UPDATE.]
 Alternatively, to subscribe or unsubscribe via e-mail to mailman
 your FROM: address, send a message to
   risks-request () csl sri com
 containing only the one-word text subscribe or unsubscribe.  You may
 also specify a different receiving address: subscribe address= ... .
 You may short-circuit that process by sending directly to either
   risks-subscribe () csl sri com or risks-unsubscribe () csl sri com
 depending on which action is to be taken.

 Subscription and unsubscription requests require that you reply to a
 confirmation message sent to the subscribing mail address.  Instructions
 are included in the confirmation message.  Each issue of RISKS that you
 receive contains information on how to post, unsubscribe, etc.

=> The complete INFO file (submissions, default disclaimers, archive sites,
 copyright policy, etc.) is online.
   <http://www.CSL.sri.com/risksinfo.html>
 *** Contributors are assumed to have read the full info file for guidelines.

=> .UK users may contact <Lindsay.Marshall () newcastle ac uk>.
=> SPAM challenge-responses will not be honored.  Instead, use an alternative
 address from which you NEVER send mail!
=> SUBMISSIONS: to risks () CSL sri com with meaningful SUBJECT: line.
 *** NOTE: Including the string `notsp' at the beginning or end of the subject
 *** line will be very helpful in separating real contributions from spam.
 *** This attention-string may change, so watch this space now and then.
=> ARCHIVES: ftp://ftp.sri.com/risks for current volume
     or ftp://ftp.sri.com/VL/risks for previous VoLume
 http://www.risks.org takes you to Lindsay Marshall's searchable archive at
 newcastle: http://catless.ncl.ac.uk/Risks/VL.IS.html gets you VoLume, ISsue.
   Lindsay has also added to the Newcastle catless site a palmtop version
   of the most recent RISKS issue and a WAP version that works for many but
   not all telephones: http://catless.ncl.ac.uk/w/r
 <http://the.wiretapped.net/security/info/textfiles/risks-digest/> .
==> PGN's comprehensive historical Illustrative Risks summary of one liners:
    <http://www.csl.sri.com/illustrative.html> for browsing,
    <http://www.csl.sri.com/illustrative.pdf> or .ps for printing
  is no longer maintained up-to-date except for recent election problems.
 *** NOTE: If a cited URL fails, we do not try to update them.  Try
  browsing on the keywords in the subject line or cited article leads.
==> Special Offer to Join ACM for readers of the ACM RISKS Forum:
    <http://www.acm.org/joinacm1>

------------------------------

End of RISKS-FORUM Digest 28.40
************************