Three weeks ago, I woke up to do my usual morning routine of stretching, deep breathing, and, of course, coffee, as I wait for my slow-as-a-lame-donkey computer to boot up. As I watched the screen, extending my neck and sipping my Espresso blend, a tiny white arrow appeared on the black screen. Then, the little blue circle began spinning next to the arrow. Finally, my NatGeo screen saver of a blue Amazonian frog filled the giant void of my tv sized monitor. But before I could even click on my Mozilla icon to check my e-mail, a strange red and white box appeared in the middle of the frog's head. "Warning! Your computer has been infected by a Trojan! Click here to remove it."
I wasn't stupid enough to click the giant box with "REMOVE TROJAN" spelled out in the biggest possible font. (This time) Instead, I did what I thought my sleeping husband would do: opened my anti-virus software and started a scan.
___
As I dressed in my exercise clothes to take a walk, I tried not to let myself worry about the malicious code that had infiltrated my computer. I knew the scan would take at least an hour, so I grabbed my I-pod and camera, and headed out into the brisk autumn morning. By the time I returned home 2.5 miles, and forty-five minutes later, the scan was done; but it had only located five cookies. No viruses, or trojans were listed in the scan results.
Thankfully, my husband woke up just as I was going to pour myself another cup of coffee. He was proud of me for not clicking the giant button, and even prouder that I had run the anti-virus software all by myself. (It goes to show you can teach an older dog new tricks!) But he was stumped as to why the AVG scan hadn't found anything. While I showered, he did a little research on his Sprint Evo, and found the proper free software to remove the trojan. By the time I was dressed and ready for my day, the invader had been vanquished and I was ready to write. But the question still boggles my mind: how did my computer get infected? Is my information safe?
This morning, as I sipped my Espresso blend and pursued the news section on Yahoo's front page, I spotted the following headline: US studying Australian Internet security program. I clicked, and quickly became immersed in Lolita C. Baldor's excellent explanation of the dilemma inherent in maintaining both privacy, and security, on the internet. Put concisely, the question posed by Baldor, as well as both the US and Australian government is as follows: Is there a way to increase online security, while maintaining civil liberties?
In a nutshell, the answer is probably no. Some form of control will need to be exerted over the "wild west" that is the internet to prevent cyber-terrorism. Which leads to the obvious trio of questions: how much control is too much, who should be in charge of the monitoring process, and what form should that supervision ultimately take?
Let's take each of these one at a time. First, how much control is too much? I am going to dismiss the idea that no control is needed outright, because I honestly believe it has no merit. With so much of our lives dependent on the internet, controlling it is long past due. As White House cybercoordinator Howard Schmidt poignantly stated, "Without security you have no privacy."
But how far is too far? What if your internet provider could shut down your service if they knew your computer had been infected with a botnet? "A botnet is a network of infected computers that can number in the thousands and that network is usually controlled by hackers through a small number of scattered PCs. Computer owners are often unaware that their machine is linked to a botnet and is being used to shut down targeted websites, distribute malicious code or spread spam." Would that be too much control?
Both US and Australian government officials are probably right in fearing public outrage if such a proposition were presented to Congress to be put into law. However, I would personally support it. If my computer is directly impacting the security of other peoples systems, it should be my responsibility to remove the virus. If I don't, ComCast should have the right to shut me down. If you disagree with me at first, think about it this way: you pay for services like water and heat each month. If your pipes burst, or your furnace leaks carbon monoxide, whose responsibility is it to fix the issue? And if you don't, isn't it in the interest of your neighbors, that the associated company turn off the services?
But, at the same time, I am not willing to live like the people of China, where every word I type and article I read is being documented by government employees. I don't think monitoring for botnets would invade my civil liberties, but I am not willing to live under any other form of internet control, such as content censorship.
Which leads well into the next question: Who should be in charge of monitoring the internet for hackers? I like the idea presented in the article. It makes sense for my internet provider to monitor my computers, via my modem, for botnets and hackers. Because the government is not directly in charge of the monitoring process, I feel like my civil liberties would remain intact. I would expect internet providers to help law enforcement officials in their investigations of cyber-crimes (like they do now), but would appreciate the fact that the day-to-day monitoring would be conducted by an outside organization.
Finally, how should the internet be secured from botnets and hackers; what form should the monitoring, and correction process take? I like the following idea from Baldor's article:
"Comcast Corp. is expanding a Denver pilot program that alerts customers whose computers are controlled through a botnet. The carrier provides free antivirus software and other assistance to clean the malware off the machine, said Cathy Avgiris, senior vice president at Comcast."
I would appreciate an e-mail alerting me to such an invasion, and even use any free software provided to try to rectify the problem. If I cannot fix the problem, and ComCast knows that my computer is actively infecting other computers, then I would understand the need for them to shut it down. On the other hand, if I cooperate in helping to eliminate internet security threats, I should not be charged a repair fee. In fact, I should be given a discount for being a conscientious web surfer!
___
11/3
Google In 'Significant Breach' Of Data Law, U.K. Says (NPR, by AP, 11/3/2010)
While collecting data with it's famous Street View cars in Great Britain, Google was inadvertently tapping into supposedly secure internet connections, snagging e-mail and passwords from businesses and individuals. The company will not face criminal charges, but that is beyond the point in my mind. The very fact that a car can drive around, and somehow manage to snag my bank account information makes the hairs on my neck stand on end.
___
11/18
Computer virus Stuxnet a 'game changer,' DHS official tells Senate (CNN, by Pam Benson, 11/18/2010)
I remember hearing about the global virus Stuxnet that rampaged through government computer systems this past July. Only today did I realize how truly threatening, and honestly petrifying, such malware can be. According to Sean McGurk, the head of the Cybersecurity Center at the Department of Homeland Security:
"'"This code can automatically enter a system, steal the formula for the product you are manufacturing, alter the ingredients being mixed in your product, and indicate to the operator and your anti-virus software that everything is functioning as expected.'"
60% of the infections this summer were isolated in Iran. But the U.S. was not immune. of the 44,000 infections, 1,600 were here. Even more reason to push for nuclear non-proliferation. Get those warheads off of the launch pads now!
___
11/18
Report: Chinese company 'hijacked' U.S. web traffic (CNN, by Dugald McConnell 11/18/2010)
"For 18 minutes, about 15 percent of all web traffic was redirected through China, including traffic to and from the sites of the U.S. Army, Navy, Marine Corps, Air Force, the office of the Secretary of Defense, the Senate and NASA, according to a report delivered to Congress by the U.S.-China Economic and Security Review Commission."
Regardless of whether this diversion was intentional, the simple fact that it occurred demonstrates well our cyber susceptibility. According to the DoD, nothing of true importance was at risk, but I don't buy that. I agree with Mr. Wortzel's assessment; it's not what the hackers get out in the 15 minutes, but rather what they manage to put in. Our government needs to watch the classic movie, and wake up I think (Hackers has Angelina Jolie before she was famous, btw).
Furthermore, I don't think RatDiem's comment is that farfetched:
"They are probing our systems to find weaknesses that they can exploit for the purposes of commercial and military espionage and they are developing a cyber warfare capacity that may give them a tactical advantage in the event of war. Wake up folks, China is our enemy."
___
11/18
China sentences woman to labor camp for Twitter post (CNN, by CNN wire staff, 11/18/2010)
Be glad we don't live in China. A woman was sentenced to a year in a labor camp for re-tweeting her husband's mockery of Japanese protesters. The Chinese court found that she had disturbed the social stability.
___
11/18
China Web hijacking shows Net at risk (The Red Tape Chronicles, by Bob Sullivan, 11/17/2010)
The above linked article does a very good job of explaining the April incident described in the two posts above.
"[T]he April incident is far more mysterious, and consequently makes some security experts more nervous. It involved what are called "route announcements," which are made by telecom providers to the wider Internet. Servers can advertise that they offer the best route for Internet traffic headed to specific destinations, and like obedient bits and bytes, the traffic automatically follows -- even if the advertisements are incorrect. That means an e-mail sent from Congress to the White House could be tricked into traveling through China, if a server were configured that way."
It also explains a separate incident that occurred in March.
"The March incident involved a flaw in the way the Internet converts friendly website addresses -- like msnbc.com -- into their reference IP addresses – such as 128.206.11.1. The conversions occur through a system of networked computers called Domain Name Servers. A key tool in China's internal "Great Firewall" censorship tool is the rerouting of Web page requests through Domain Name Servers away from potentially subversive Web sites. Requests for some Web sites are simply dropped; others are redirected to China-friendly sites. But domain name conversion tables, when handled incorrectly, can spread themselves upstream on the Internet. In March, some domain servers around the world were "poisoned" with China's censored list, causing some users in Chile and the United State to be blocked from social networking sites for about a day. The problem was readily fixed, and some researchers believe the cause might have been an honest mistake."
___
11/22
Videogame Uses Camera to Target Ads (Discovery News, by David Teeghman, 11/22/2010)
Microsoft told it's investors that the new Kinect camera ad-on for it's X-Box 360 system would allow the company to target advertisements to people in the room at any given time, using facial recognition techniques. They then backtracked, denying this planned marketing strategy. But, in this day and age, it is perception that counts. After reading the above linked article, I will never put a Kinect camera in my home. What happens if the camera says "off," but is really on, recording things for Big Brother? I don't have anything to hide, but would be very uncomfortable having this type of monitoring device in my home.
___
12/2
Wikileaks is in the news again, this time for the release of "embassy cables."
"The cables, which date from 1966 up until the end of February this year, contain confidential communications between 274 embassies in countries throughout the world and the State Department in Washington DC. 15,652 of the cables are classified Secret." (http://cablegate.wikileaks.org)
I know that I am in the minority, but I believe Wikileaks founder, Mr. Assange, is a hero. As Americans, we have every right to know what is said and done in our name. There are times and places for secrets, but diplomacy amongst representatives of vast populations should not be one of them. We have been seduced into inaction, and ignorance for so long that most people don't even realize the breaches of basic democratic principles the secrecy inherent in diplomacy breeds. Mr. Assange, and his organization, provide a small glimmer of hope that someday governments will act in true transparency, in the interest of the people that they represent, not because they want to, but because of the kind of accountability Wikileaks provides.
___
3/17
New Concern: The social media divide (The Red Tape Chronicles via MSNBC, by Bob Sullivan, 3/16/2011)
As I read the article linked above before bed last night, I kept nodding my head in agreement with Mr. Sullivan. I see the same radical stances on this issue causing a rift in society that will not be easily mended. However, I think that the definition of "privacy" needs to be examined to get a better understanding of the apparent discrepancies in peoples views regarding if and how to control it.
I consider myself pro-privacy. I shred all of the mail I receive with even the tiniest bit of personal information on it. I do not participate in social networks, like Facebook or MySpace. My blog and website are done anonymously, and my email address does not contain my real name.
However, I do post on Twitter under a pseudonym. I also gladly give my personal information to my favorite stores. I do not mind the constant e-mails and "junk" mail, because I love coupons and find value in these "nuisances."
For me, staying private on the internet means keeping my anonymity when and where I choose. I do not care if companies get my information and track what I like shopping for. However, I do not want certain folks from my past being able to find me now. I do not want my mother having access to every aspect of my life. And, most important of all, I do not want my identity stolen.
I think the people who post everything they do on Facebook are crazy. Just because you can do something doesn't mean that you should do it. Five years ago, before there was a place to share your entire life online, the thought of doing so would have freaked most people out. But, due to the same peer pressure that makes high school kids do stupid things at parties, adults and teens alike are acting like it is all-of-a-sudden ok.
Now, if you ask me whether the government should be getting involved in protecting these fools, I am still undecided. I am against government controls on most things, but I truly believe it is society as a whole that will eventually pay for the transparency that has overtaken so many lives. Just because my husband and I choose not to use Facebook, doesn't mean our information isn't getting on it anyway. So many of our friends and coworkers DO use the social networking site, that it is inevitable one of them will post our picture, or let our name slip. Unfortunately, the bills in Congress at the moment do not address this issue. The "Do Not Track" list is a good idea in principle, but will be impossible to enforce. Unlike its telephone counterpart, there will be no way for folks to know if they are being tracked.
So, what is the moral of this post? Don't use Facebook, and if you are going to ignore this advice, at least don't write about me on your wall, or whatever it's called!
No comments:
Post a Comment