Coty's Weblog

Retrospective Irony

As Sanjay notes in his Funny Movie Quote About the NSA post, Sneakers is so 1990s:

Dick Gordon (Timothy Busfield’s character who works for the NSA): National Security Agency.

Martin Bishop (Robert Redford’s character who is a security expert): Ah. You’re the guys I hear breathing on the other end of my phone.

Dick Gordon: No, that’s the FBI. We’re not chartered for domestic surveillance.

Martin Bishop: Oh, I see. You just overthrow governments. Set up friendly dictators.

Dick Gordon: No, that’s the CIA. We protect our government’s communications, we try to break the other fella’s codes. We’re the good guys, Marty.

Martin Bishop: Gee, I can’t tell you what a relief that is, Dick.

(emphasis added by Sanjay and seconded by me)

Ah, the irony. The sad, sad irony.

Off to NYC for DIDW/FS

Umm, that's Digital Identity World/Financial Services. I'm heading up tonight. A lot of big players in financial services will be talking. Frankly, I'm more interested in what federated identity can do for smaller financial services companies, but I'll be interested in hearing what the big guys are doing.

I'll try to blog as I go, but I'm not promising anything.

Thanks for iChat, but how about simplifying encryption in Mail?

An unheralded new iChat feature rolled out in the latest Mac OS X release is simple encryption of iChat conversations. You need a paid for .Mac account for it to work, but if you have that it is a piece of cake. (Just go into your iChat account preferences and check the security tab.)

What seems odd to me, though, is the fact that Apple doesn't go ahead and do something similar in Mail. Mail has supported signing and encrypting for some time, but the process requires going to Thawte or Verisign to get an e-mail signing certificate. I don't think I'm going to have my mom go through that process.

Maybe it is just me, but I'd like to see e-mail signing and encryption popularized much more than IM. In my experience, people greatly overestimate the privacy of e-mail communication. The same can be said for IM, but given the relative permanence of e-mail as compared to IM, I'd argue that this misapprehension with respect to e-mail is more significant.

Imagine if Microsoft expended this kind of effort on real security

I don't know whether reading this whitepaper on "output content protection" in Windows Vista makes me want to laugh or cry more. So much engineering that could be directed into so many more profitable areas. It is sad. And it is funny, too, because I cannot be the only one who reads all of these grand plans and then thinks, "But I can just point a good camera and mic at the system and still get a good enough copy to bootleg." It is called the analog hole. As long as viewers/listeners remain analog receivers, it is pretty fundamental.

Ed Felten covers this in more depth in his Hollywood Controlling Parts of Windows Vista Design post on Freedom to Tinker. Ed touches on what bothers me about all this here:

Law-abiding people will be paying more for PCs, and doing less with them, because of the Hollywood-decreed micromanagement of graphics system design.

I wonder whether any industry groups in other countries see this as an opportunity to undermine Hollywood's dominance. They should.

Oracle, Oblix, Identity, and Integration

So, Oracle bought identity management vendor Oblix recently. I have to admit that I didn't get the significance of the acquisition at first. Then I read Oblix to help Oracle, PeopleSoft tools 'coexist' and realized what should have been obvious to me: it was about integration. Oracle previously acquired PeopleSoft—and JD Edwards along with it. Now, I'm sure there is a grand plan of unification—there always is. However, I'm also sure that it will take some time to deliver—if it ever does.

Given that, Oblix gives Oracle the ability to at least eliminate one of the single most annoying "features" of running multiple disparate application suites from a user perspective: multiple sign-on. Eliminating multiple authentication/authorization systems can also significantly reduce administrative and support costs.

This should have all been evident to me, as my old company acquired more than its fair share of overlapping application suites while I was there—and the integration was not easy. (That is something of an understatement/misstatement, but I'm not going into that now.) At my new company, I'm working to integrate applications from separate vendors using federated identity as a cornerstone. Agreeing on identity goes a long way toward integration, and federated identity offers some good patterns for loose integration.

ChoicePoint - It had happened before, too

I heard this news on NPR on the way home and found it in Google news in this San Diego Union Tribune article: ChoicePoint had another identity theft case years ago

A newly revealed case shows that the vast commercial database of personal information at Choicepoint Inc. was tapped by identity thieves in 2002 – contradicting a statement by its CEO that a much more recent breach was the first of its kind.

I continue to be amazed at how poorly ChoicePoint seems to be handling itself in the wake of this incident. Did ChoicePoint's CEO not think the prior incident was similar enough? If so, I think he was probably splitting hairs when he shouldn't be. Or did he not remember the prior incident? Even if he didn't, I find it hard to believe that nobody around him said something like, "This sounds just like that incident a couple of years ago."

Given ChoicePoint's communication to date, we may never know.

I did notice on the News Center/Books section of the ChoicePoint site that in his book Risk Revolution ChoicePoint CEO, Derek Smith, "calls for a more robust discussion of personal privacy." I'd like to see a more robust, candid, and contrite discussion of this incident on ChoicePoint's part. I notice the site also has a video of Smith in an interview with WSB. Perhaps I'll find it there.

ChoicePoint CISO Comments

In an earlier post, I lamented the fact that the only comments I'd seen from ChoicePoint were from their CMO. While I wrote that I thought it was important for the CEO to be out in front, I also hoped that we would hear from someone like a CISO.

Now that I've read comments from ChoicePoint's CISO, Richard Baich, I think they should have stuck with Mr. Lee—or Mr. Lee should have coached Mr. Baich better. To split hairs about whether this was a hack or a fraud really misses the point. It was a breach. At this point, ChoicePoint should be expressing deep, sincere regret and talking specifically about how they are making sure similar incidents will not happen in the future.

In a way, I understand where Baich is coming from. My first thought when I understood what really happened was, "They weren't hacked. It was just some social engineering." Well, that is fine for me to think and others to debate, but ChoicePoint just needs to apologize. Defensiveness and pedantry isn't going to get them anywhere.

Oh, and saying that "frauds happen every day" doesn't help either. It doesn't get ChoicePoint off the hook at all. Neither does hypothesizing about how other companies might have handled the situation even worse.

Thanks to Bruce Schneier for the pointer in his Choicepoint's CISO Speaks post.

More ChoicePoint

Following up from my previous post, I thought I’d pass along some other links to ChoicePoint coverage.

I found Michael Zimmer’s Thinking About Technology to be a great jumping off point for all sorts of information and commentary on the incident and privacy in general. (I immediately added him to NetNewsWire.) I think I found his blog from the ChoicePoint tag page on Technorati.

Michelle Malkin also has a number of interesting ChoicePoint links up. Some of the more interesting ones come from the Say Anything blog, which is run by a private investigator who uses ChoicePoint’s services. It includes a posting of his Message from ChoicePoint. ChoicePoint’s CMO, James Lee, replies to his post in a comment. It is interesting to get the perspective of a user of ChoicePoint’s services, and I plan to read the followups to see how things progress there.

Emergent Chaos has another ChoicePoint Roundup with some good links. Adam’s When The Future Has No Shadow post is worth a read, as well.

ChoicePoint

There isn’t much that I can add to Bruce Schneier’s comments—which is hardly surprising. Bruce even took the clever play on ChoicePoint’s name that I was planning to use: NoChoicePoint.

Perhaps that is the one thing I will add. One of the core problems with the whole system of distributing personal data that ChoicePoint operates within is the lack of control that individual’s have with respect to their data. I would like to see the system changed so that ownership of such data was returned to the individual. Then I would make it incumbent on the individual to decide who will broker his information. Some companies like ChoicePoint might do the job for free and make money solely on access charges. Others might charge a fee to the individual and provide services such as explicitly requiring authorization for access requests. I’d hope to see a federated system established where a central registrar tracks who is responsible for each individual’s data and many separate brokers provide differing levels of service. This will all require a combination of legislative and market changes, but I think the market element is the most important.

One other thing. Bruce points out that “ChoicePoint's behavior is a textbook example of how to be a bad corporate citizen,” and he couldn’t be more right. The thing that I find most pathetic is the fact the only ChoicePoint voice I hear is ChoicePoint’s Chief Marketing Officer, James E. Lee. If this isn’t a time for the CEO to be visible and audible, then I don’t know when is. Further, whoever is talking for ChoicePoint needs to be unsparingly frank. This is not the time for equivocation or exaggeration, and I’m sorry, but comments about the sophistication of the perpetrators sound exaggerated. What I’ve heard sounds like very simple social engineering. If it wasn’t, I’m ready to hear details.

I think it should be "Fewer Databases..."

But that is nitpicking at an insightful post by Chris Ceppi at his relatively new blog: Arbitrage.

…

Try to add up the number of databases on the network that contain  a row with your social security number and you get a sense for the distributed and redundant nature of the storage of your digital identity.

The integrity of these identity repositories is a factor of the competence (and trustworthiness) of any number of dba's +/- the level of process and enforcement of access control within each organization that stores my credentials and attributes +/- the quality of the software that runs the systems that house the applications and repositories.

…

With all the automatic password reset systems out there, think too of all the databases with information like your mother’s maiden name, your pet’s name, your city of birth.

Reducing the proliferation of all this “private” data is an aspect of federated identity that doesn’t get much play. It deserves more.