RISKS-LIST: Risks-Forum Digest Monday 5 November 2012 Volume 27 : Issue 07 ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks) Peter G. Neumann, moderator, chmn ACM Committee on Computers and Public Policy ***** See last item for further information, disclaimers, caveats, etc. ***** This issue is archived at <http://www.risks.org> as <http://catless.ncl.ac.uk/Risks/27.07.html> The current issue can be found at <http://www.csl.sri.com/users/risko/risks.txt> Contents: Ohio -- ES&S's "experimental" patches (Bello/Fitrakis) South Carolina didn't encrypt hacked social security numbers ... (Jeffrey Collins via Lauren Weinstein) FCC Describes 911 and Cellphone Problems (Edward Wyatt and Brian X Chen via NNSquad) Russia launches massive Internet censorship list (Iain Thomson via NNSquad) "What to look for onsite when choosing a colo facility" (Matt Prigge via NNSquad) After Sandy, wired New Yorkers get reconnected with pay phones (Ben Cohen) After Hurricane Sandy: Lessons for the data center" (Paul Venezia via Gene Wirchenko) When your fuel pumps are below sea level... (Danny Burstein) NYU Hospital's Backup System Undone by Key Part in Flooded Basement (Monty Solomon) Why Do Hospital Generators Keep Failing? (Monty Solomon) Re: In Sandy's Wake... (Dimitri Maziuk) Re: Internet Voting in the U.S. (Monty Solomon) Re: Risks in Internet Voting (Joly MacFie) WEIS 2013 Washington DC June 11-12 - Call for Papers (Allan Friedman) Abridged info on RISKS (comp.risks) ---------------------------------------------------------------------- Date: Mon, 5 Nov 2012 14:41:01 PST From: "Peter G. Neumann" <neumann_at_private> Subject: Ohio -- ES&S's "experimental" patches (Bello/Fitrakis) More detail on the brief item in RISKS-27.06. Gerry Bello and Bob Fitrakis, *Free Press* 2 Nov 2012 [excerpted from their website entry on this article on 5 Nov 2012. PGN] http://freepress.org/index2.php http://www.freepress.org/departments/display/19/2012/4768 *The Free Press confirms installation, secret justification of uncertified last minute election tabulation reporting software in Ohio* The Free Press has obtained internal memos from the senior staff of the Ohio Secretary of State's office confirming the installation of untested and uncertified election tabulation software. Yesterday, the Free Press reported that "experimental" software patches were installed on ES&S voting machines in 39 Ohio counties. (see Will "experimental" software patches affect the Ohio vote? <http://www.freepress.org/departments/display/19/2012/4766>). Election Counsel Brandi Laser Seske circulated a memo dated November 1st renewing the already shaky justification for installing software made by Election Systems and Solutions on vote tabulation equipment used in 39 Ohio counties. The letter to Ohio Secretary of State personnel Matt Masterson, Danielle Sellars, Myra Hawkins, Betsy Schuster, and Ohio's Director of Elections Matthew Damschroder, clarified the dubious justification for not complying with the legal requirements for the examination of all election related equipment. Seske begins by explaining what she purports to be the purpose of the software patch: "Its function is to aid in the reporting of results that are already uploaded into the county's system. The software formats results that have already been uploaded by the county into a format that can be read by the Secretary of State's election night reporting system." According to the contract between the Ohio Secretary of State's office and ES&S, this last minute "experimental" software update will supposedly transmit custom election night reports to the Secretary of State's office from the county boards of elections, bypassing the normal election night reporting methods. In order to justify this unusual parallel reporting method, Seske explains "It is not part of the certified Unity system, so it did not require federal testing." This attempt to skirt federal and state law from one of the most partisan Secretary of State offices in the nation ignores basic facts of how modern information systems function. Seske continues "Because the software is not 1) involved in the tabulation or casting of ballots (or in communicating between systems involved in the tabulation or casting of ballots) or 2) a modification to a certified system, the BVME [Board of Voting Machine Examiners] was not required to review the software." These claims are factually unsound. The software, although not communicating actual ballot information, facilitates communication between systems upon which votes are tabulated and stored. Although the software purports to not modify the tabulation system software, it is itself a modification to the whole tabulation system. This is why certification and testing is required in all cases. Just as in 2004, the Ohio Secretary of State's office has enabled the possibility of a "man in the middle" attack. This software, functioning on a network through which votes are transmitted could act to intercept, alter or destroy votes from counties where it is not even installed, hence the "man in the middle" nickname. On September 19, the last minute contract between ES&S and the Ohio Secretary of State's office was inked. Within a week, Seske wrote "He [Matt Masterson] has reviewed and approved the changes." Masterson is the Deputy Director of Elections. After Masterson's approval, Seske acted to bypass the Ohio Board of Voting Machine Examiners required review. "Pursuant to the board's policy, each change will be approved unless three members of the BVME request a meeting to review a change within 15 days of today's date. Given the proximately of the upcoming election, please let me know as soon as possible whether you will be requesting a meeting to review the changes," wrote Seske. Government reports such as Ohio's Everest study document that any single change to the system could corrupt the whole voting process. <http://www.sos.state.oh.us/sos/upload/everest/00-SecretarysEVERESTExecutiveReport.pdf> An unelected, partisan group of attorneys appears to have conspired to install election software without testing and certification that they are professionally unqualified to pass judgment upon. These types of last minute installations of software patches on voting machines are considered suspect by knowledgeable and experienced election protection attorneys, in light of all the voting machine irregularities exposed during the 2004 election in Ohio. /Gerry Bello is the chief researcher at the Columbus Free Press. He holds a degree in computer security from Antioch College. Bob Fitrakis is the Editor of the Free Press. He holds Ph.D. in Political Science and a J.D. from the Moritz College of Law at Ohio State University. [Here are just a few of the Recent Election Issues Articles noted on their website. The complete list is rather astounding, and not included here. Please see the freepress.com website if you are interested. PGN] Another Husted dirty trick in Ohio: Secretary of State's Office admits direct reporting function of untested election software </departments/display/19/2012/4779> November 5, 2012 / Gerry Bello and Bob Fitrakis/ OHIO ? VOTE HEIST 2012? </departments/display/19/2012/4780> November 5, 2012 / Ecological Options Network/ Invoices prove Romney-related voting company Hart InterCivic does maintenance on Cincinnati voting machines </departments/display/19/2012/4782> November 5, 2012 / Gerry Bello and Bob Fitrakis/ The electronic architecture of voter suppression </departments/display/19/2012/4777> November 4, 2012 / Gerry Bello and Bob Fitrakis/ As Ohio Faces vote-rigging lawsuit, are dems, liberals, election officials ready to safeguard votes? </departments/display/19/2012/4776> November 4, 2012 / Art Levine/ Busting Election Theft Attempts </departments/display/19/2012/4778> November 4, 2012 / Ecological Options Network/ Will Your Vote Even Get Counted? </departments/display/19/2012/4774> November 3, 2012 / Sheila Parks/ The Free Press confirms installation, secret justification of uncertified last minute election tabulation reporting software in Ohio </departments/display/19/2012/4768> November 2, 2012 / Gerry Bello and Bob Fitrakis/ Will "experimental" software patches affect the Ohio vote? </departments/display/19/2012/4766> October 31, 2012 / Bob Fitrakis and Gerry Bello/ Why we fight to prevent stolen elections in 2012 and beyond </departments/display/19/2012/4767> October 31, 2012 / Joan Brunwasser, Sally Castleman, Victoria Collier, Bob Fitrakis, Lori Grace, Emily Levy, Mark Crispin Miller, Greg Palast, Jonathan Simon and Harvey Wasserman/ Mike Connell: Man in the Middle </departments/display/19/2012/4765> October 30, 2012 / John Wellington Ennis/ Gripping documentary exposes voter suppression and election rigging in the 2004 presidential election </departments/display/19/2012/4764> October 29, 2012 / Roger Hill/ Thom Pintello: I Just Want My Vote to Count" </departments/display/19/2012/4761> October 27, 2012 / A short film by Dorothy Fadiman/ 1021 E. Broad St. Columbus, OH 43205 | 614.253.2571 | truth_at_private <mailto:truth_at_private> ------------------------------ Date: Mon, 29 Oct 2012 21:41:01 -0700 From: Lauren Weinstein <lauren_at_private> Subject: South Carolina didn't encrypt hacked social security numbers ... Jeffrey Collins, Haley defends not encrypting taxpayer information, Augusta Chronicle via NNSquad, http://j.mp/WX2Qpn Up to 3.6 million returns from as far back as 1998 might have been compromised by the international hacker, who likely penetrated the [SC] Department of Revenue's system a month before the breach was detected by the U.S. Secret Service. "The industry standard is most Social Security numbers are not encrypted. A lot of banks don't encrypt," Haley said. "It's very complicated. It's very cumbersome. There's a lot of numbers involved with it." ------------------------------ Date: Wed, 31 Oct 2012 11:25:36 -0700 From: Lauren Weinstein <lauren_at_private> Subject: FCC Describes 911 and Cellphone Problems (Edward Wyatt/Brian X Chen) http://j.mp/PmjziU (*The New York Times* via NNSquad) "Cellphone calls in the Northeast region were continuing to fail Wednesday because one-quarter of the transmission sites in areas ravaged by Hurricane Sandy were knocked out and many of those are not expected to come back online for several days at least, government officials said. " I frequently remind people thinking about going cell-only with no landlines, that cell service is usually the first to become overloaded and fail during major disasters. Microcell batteries often run out very quickly after power goes down, as well. ------------------------------ Date: Thu, 1 Nov 2012 13:39:38 -0700 From: Lauren Weinstein <lauren_at_private> Subject: Russia launches massive Internet censorship list (Iain Thomson) "The decision on what sites are to be banned will be enacted by the sinister-sounding Roskomnadzor (aka the Agency for the Supervision of Information Technology, Communications and Mass Media) and enforced with deep-packet inspection of all Internet traffic across the country, which must be reassuring for those using Russian cloud providers." http://j.mp/Wcfn9r (Register via NNSquad) Stalin Smiles. ------------------------------ Date: Mon, 05 Nov 2012 12:32:53 -0800 From: Gene Wirchenko <genew_at_private> Subject: "What to look for onsite when choosing a colo facility" (Matt Prigge) [`colo' refers to colocation, not Colorado! Both may be risky? PGN] Matt Prigge, InfoWorld, 05 Nov 2012 http://www.infoworld.com/d/data-explosion/what-look-onsite-when-choosing-colo-facility-206320 What to look for onsite when choosing a colo facility Hurricane Sandy provides an excellent reminder that no matter how good a colo's facilities look on paper, careful attention to detail is critical to picking a good one interesting sentence: In one case, a data center literally had to run a manual bucket brigade to lift diesel fuel to roof-mounted generators because the fuel pumps in the sub-basement were submerged in flood water -- an act that is nothing short of heroic. ------------------------------ Date: Thu, 1 Nov 2012 10:59:28 -0700 From: Lauren Weinstein <lauren_at_private> Subject: After Sandy, wired New Yorkers get reconnected with pay phones (Ben Cohen) "Not since the birth of the iPhone has the pay phone experienced such demand, thanks to Sandy. Natural disasters tend to vindicate the public pay phone. With their clunky bodies mounted high and sometimes behind glass stalls, they generally remain serviceable during power outages, even amid flooding. When times get tough, in fact, the biggest challenge is often keeping the devices free of coin overloads." http://j.mp/WbJON6 (Ben Cohen, *Wall Street Journal*, 31 Oct 2012, via NNSquad) It's worth noting that the push to eliminate POTS phone service -- being lead by AT&T who wants everything to be VoIP (mainly to evade regulations on traditional phone service) could have enormous negative implications for emergency situations when cellular and Internet service fails. The reason most traditional POTS lines stay up is that they are connected by copper directly to the central office and powered from massive batteries there. There are critical public safety issues to be considered in this entire area. ------------------------------ Date: Mon, 05 Nov 2012 12:28:56 -0800 From: Gene Wirchenko <genew_at_private> Subject: "After Hurricane Sandy: Lessons for the data center" They're coming out of the walls! DR commenters on hurricane Sandy. http://www.infoworld.com/d/data-center/after-hurricane-sandy-lessons-the-data-center-206304 Paul Venezia | InfoWorld, 05 Nov 2012 After Hurricane Sandy: Lessons for the data center You never want to say 'I told you so,' but now is a good time to bring up the need for better monitoring, backup power, and other improvements A commenter points out some generator failure modes and the difficulty in testing. ------------------------------ Date: Thu, 1 Nov 2012 00:12:35 -0400 (EDT) From: Danny Burstein <dannyb_at_private> Subject: When your fuel pumps are below sea level... [NY Times explanation for Bellevue Hospital's shutdown] "After pumping out 17 million gallons of water from the basement, the water is still two and a half feet deep in the cavernous basement where the fuel pumps apparently shorted out and became inoperable - unable to feed the 13th-floor backup generators, [Health and Hospitals Corp - which runs Bellevue - President] Mr. Aviles said." http://www.nytimes.com/interactive/2012/10/28/nyregion/hurricane-sandy.html Bellevue Hospital is only about 20 feet above sea level, and hence the basement is below the water table. And requires sump pumps. I've never been able to verify the story, but supposedly back in the 1965 blackout a similar event happened. The backup generators kicked in, but the sump pumps weren't hooked into the emergency circuit so a few hours later, etc., etc. True, the initial surge from the hurricane brought a LOT of additional water inside, but once the tide was back to normal levels the levels should have been brought under control pretty soon. ------------------------------ Date: Sat, 3 Nov 2012 13:27:13 -0400 From: Monty Solomon <monty_at_private> Subject: NYU Hospital's Backup System Undone by Key Part in Flooded Basement http://www.propublica.org/article/nyus-backup-system-undone-by-key-part-in-flooded-basement ------------------------------ Date: Sat, 3 Nov 2012 13:32:05 -0400 From: Monty Solomon <monty_at_private> Subject: Why Do Hospital Generators Keep Failing? http://www.propublica.org/article/why-do-hospitals-generators-keep-failing ------------------------------ Date: Mon, 05 Nov 2012 12:55:07 -0600 From: Dimitri Maziuk <dmaziuk_at_private> Subject: Re: In Sandy's Wake... [RISKS-27.06] "Tell me, Mr Weinstein, what good is your landline when you're unable to speak?" That is, I used to believe that myself, but over the years I've developed doubts. What you get * May or may not be a good old powered POTS circuit completely independent of the voice, data, and/or video fiberm and/or coax taken out by the disaster, * May or may not get taken out by the disaster that wiped out the above fiber/coax, * If still operational, may or may not be overloaded by all the emergency calls, * All that for a small price of a new ipad/year (assuming a private residence line after factoring in all the applicable taxes and fees as well as must-have "premium" services like unlisted number and call blocking to filter out the worst of the robo-calls). The tricky part about risk management is realizing that at some point you have to just let it go. Dimitri Maziuk, Programmer/sysadmin, BioMagResBank, UW-Madison http://www.bmrb.wisc.edu ------------------------------ Date: Sun, 4 Nov 2012 20:33:13 -0400 From: Monty Solomon <monty_at_private> Subject: Re: Internet Voting in the U.S. (RISKS-27.06) [In my desire to get the previous issue out, I neglected to provide an adequate reference for the Simons/Jones CACM paper. Here it is, thanks to Monty. PGN] Barbara Simons, Douglas W. Jones Internet Voting in the U.S. Communications of the ACM, Vol. 55 No. 10, Pages 68-77 10.1145/2347736.2347754 October 2012 http://cacm.acm.org/magazines/2012/10/155536-internet-voting-in-the-us/fulltext http://cacm.acm.org/magazines/2012/10/155536-internet-voting-in-the-us/pdf ------------------------------ Date: Sun, 4 Nov 2012 21:28:44 -0500 From: Joly MacFie <joly_at_private> Subject: Re: Risks in Internet Voting (RISKS-27.06) [From NNSquad] I just posted some video of a related event - a recent forum in NYC on the vulnerability of all e-voting systems to fraud. Some interesting stuff about a) ownership of the firms (some shady) that make/operate the systems, b) a general lack of oversight/ accountability, c) vulnerability to manipulation. According to two panelists, the MOVE Act's back end is now operated by a Spanish company. Several other countries, for instance Ireland, have dumped electronic voting entirely. <http://en.wikipedia.org/wiki/Military_and_Overseas_Voter_Empowerment_Act> <http://www.independent.ie/national-news/54m-voting-machines-scrapped-for-9-each-3153437.html>, Full Version http://www.youtube.com/watch?v=KAPqimT85o0 Highlights http://www.youtube.com/watch?v=ROftmMKkYbo ------------------------------ Date: Wed, 31 Oct 2012 18:13:53 +0000 From: Allan Friedman <AFriedman_at_private> Subject: WEIS 2013 Washington DC June 11-12 - Call for Papers 12th Annual Workshop on the Economics of Information Security June 11-12, 2013 Georgetown University, Washington DC http://weis2013.econinfosec.org/ CALL FOR PAPERS Information security continues to grow in importance, as threats proliferate, privacy erodes, and attackers evolve. Cybersecurity fears and privacy concerns dominate headlines. Yet the security of information systems depends on more than just technology. Good security requires an understanding of the incentives and tradeoffs inherent to the behavior of systems and organizations. As society's dependence on information technology has deepened, policy makers and business leaders have taken notice. Now more than ever, careful research is needed to accurately characterize threats and countermeasures, in both the public and private sectors. The Workshop on the Economics of Information Security (WEIS) is the leading forum for interdisciplinary scholarship on information security, combining expertise from the fields of economics, social science, business, law, policy and computer science. Prior workshops have explored the role of incentives between attackers and defenders, identified market failures in Internet security, quantified risks of personal data disclosure, and assessed investments in cyber-defense. This workshop will build on past efforts using empirical and analytic tools to not only understand threats, but strengthen security and privacy through novel evaluations of available solutions. We encourage economists, computer scientists, business school researchers, law scholars, security and privacy specialists, as well as industry experts to submit their research and attend the Workshop. Suggested topics include (but are not limited to) empirical and theoretical economic studies of: - Optimal investment in information security - Measurement and modeling of online crime - Risk management and cyberinsurance - Security standards and government regulation - Privacy, confidentiality and anonymity - Behavioral security and privacy - Security metrics and organizational performance - Psychology of risk and security - Vulnerability discovery, disclosure, and patching - Cyberwar strategy and game theory - Incentives for information sharing, cooperation and coordination Of particular interest this year are papers that can address the global problems of cybersecurity policy, including international conflict and coordination, government regulation and private sector solutions. A selection of papers accepted to this workshop will appear in an edited volume aimed to offer insights to policy makers, managers and practitioners, as well as the larger academic community. Important Dates Submissions due February 25, 2013 Notification of Acceptance April 12, 2013 Workshop June 11-12, 2013 Submitted manuscripts should represent significant and novel research contributions. Please note that WEIS has no formal formatting guidelines. Previous contributors spanned fields from economics and psychology to computer science and law, each with different norms and expectations about manuscript length and formatting. For questions, please contact the program chair Allan Friedman at info_at_private [Thanks to Jeremy Epstein, who forwarded this to RISKS. He says, ``I highly recommend this very interesting conference, now in its 11th year.'' PGN] ------------------------------ Date: Sun, 7 Oct 2012 20:20:16 -0900 From: RISKS-request_at_private Subject: Abridged info on RISKS (comp.risks) The ACM RISKS Forum is a MODERATED digest. Its Usenet manifestation is comp.risks, the feed for which is donated by panix.com as of June 2011. => SUBSCRIPTIONS: PLEASE read RISKS as a newsgroup (comp.risks or equivalent) if possible and convenient for you. The mailman Web interface can be used directly to subscribe and unsubscribe: http://lists.csl.sri.com/mailman/listinfo/risks Alternatively, to subscribe or unsubscribe via e-mail to mailman your FROM: address, send a message to risks-request_at_private containing only the one-word text subscribe or unsubscribe. You may also specify a different receiving address: subscribe address= ... . You may short-circuit that process by sending directly to either risks-subscribe_at_private or risks-unsubscribe_at_private depending on which action is to be taken. Subscription and unsubscription requests require that you reply to a confirmation message sent to the subscribing mail address. Instructions are included in the confirmation message. Each issue of RISKS that you receive contains information on how to post, unsubscribe, etc. => The complete INFO file (submissions, default disclaimers, archive sites, copyright policy, etc.) is online. <http://www.CSL.sri.com/risksinfo.html> *** Contributors are assumed to have read the full info file for guidelines. => .UK users may contact <Lindsay.Marshall_at_private>. => SPAM challenge-responses will not be honored. Instead, use an alternative address from which you NEVER send mail! => SUBMISSIONS: to risks_at_private with meaningful SUBJECT: line. *** NOTE: Including the string "notsp" at the beginning or end of the subject *** line will be very helpful in separating real contributions from spam. *** This attention-string may change, so watch this space now and then. => ARCHIVES: ftp://ftp.sri.com/risks for current volume or ftp://ftp.sri.com/VL/risks for previous VoLume http://www.risks.org takes you to Lindsay Marshall's searchable archive at newcastle: http://catless.ncl.ac.uk/Risks/VL.IS.html gets you VoLume, ISsue. Lindsay has also added to the Newcastle catless site a palmtop version of the most recent RISKS issue and a WAP version that works for many but not all telephones: http://catless.ncl.ac.uk/w/r <http://the.wiretapped.net/security/info/textfiles/risks-digest/> . ==> PGN's comprehensive historical Illustrative Risks summary of one liners: <http://www.csl.sri.com/illustrative.html> for browsing, <http://www.csl.sri.com/illustrative.pdf> or .ps for printing is no longer maintained up-to-date except for recent election problems. *** NOTE: If a cited URL fails, we do not try to update them. Try browsing on the keywords in the subject line or cited article leads. ==> Special Offer to Join ACM for readers of the ACM RISKS Forum: <http://www.acm.org/joinacm1> ------------------------------ End of RISKS-FORUM Digest 27.07 ************************Received on Mon Nov 05 2012 - 17:11:28 PST
This archive was generated by hypermail 2.2.0 : Mon Nov 05 2012 - 17:52:56 PST