Congratulations to the London Heathrow Airport Security Team on busting the dangerous character who had the AUDACITY to wear a tshirt depicting a picture of a fictional superhero holding a fictional gun. Who knows — perhaps that character could have jumped right out of fiction-land into reality and hijacked a plane.

I had no idea about this very serious threat to national security! I will heretofore make the sacrifice of leaving my Jessica Rabbit t-shirt at home from now on. I sure do wish my own country’s airport security crew was as observant and as quick to act upon credible security dangers; I admit I feel like I’m at risk in Canadian airports, where the security personnel would laugh heartily at the idea of a cartoon posing a risk to air flight. In fact, I won’t feel safe until we develop technology that can scan passengers to make sure they aren’t wearing Boba Fett Underoos…

Believe it or not, somebody has introduced a bill in the Mississippi legislature that would require restaurant owners to deny service to any patron with a body mass index (BMI) greater than 30.

This raises an interesting question: is weight-related information considered private? On first blush, such an idea makes no sense – anyone can look at you and judge your weight, the same way that anyone can judge your eye color — but to me, the difference between judging weight from 3 feet away and pulling out the calipers to do a body-mass-index (BMI) measurement is a difference that crosses a critical line.

Would you consider your annual income to be a private matter? Me too. You may be able to take a guess based on the car I drive or the house I live in — you may even conclude that I’m well off. I certainly cannot prevent you from deciding I make a good living. I can, however, refuse to provide details, thank you very much. Those details, as guessable as they might be, constitute my private business. Public disclosure of such details would be uncomfortable, embarrassing, and invasive.

By the same token, my body-mass-index is also my private business. It constitutes something only I need to know. It is a piece of data strongly connected to my dignity. The idea that this information has to hang out for the consideration & judgement of the hostess at TGI Fridays is frankly repulsive to me. There seems to be an idea that this is no different than denying alcohol to a drunk person; the difference being that government restrictions on public intoxication are not expected to cure alcoholism. Do these lawmakers really think that restrictions on public eating will cure obesity?

Oh Hushmail, you have failed us.

Here is what I naively would have expected to happen, when the feds showed up at Hushmail with a Canadian court order:

Feds: we need you to decrypt and turn over all email from the account of Mr. X — he is a very bad person.

Hushmail: gosh, we’d sure like to, but the whole point of our business model is that even if we wanted to, we couldn’t. Sorry ’bout that. If you want a whole bunch of encrypted mumbo jumbo to go play with, we’re more than happy to oblige, got a flash drive?

Here is my reconstruction of what seems to have happened:

Feds: we need you to turn over all email from the account of Mr. X — he is a very bad person.

Hushmail: well lemme look here… ooh! Whaddaya know! It just so happens that Mr. Bad Person X was stupid enough to not choose our uber-paranoid service, he instead chose the service where he trusts our servers for one single split second… What an eediot!

Feds: (rubbing hands together) excellent…. we’ll go get the flash drive…

Yeah, I get that Hushmail (the company) was in a bad spot, and I’m sure that this was not a joyous experience for them. I also understand that Hushmail (the service) is still a better choice than nothing at all, at least as long as you can keep yourself from being legally classified as a “bad person”.

I know that Hushmail has always gone out of its way to point out the extra risk attached to their more convenient service. I also understand that Mr. X probably really was a bad person.

None of that makes me feel better. My problem is not with the fact that Hushmail rolled over, it’s that they could roll over. Hushmail theoretically avoids liability and evokes trust as a secure service because the technology ensures that betrayal is not even a possible choice. Perhaps that trust should still be accorded to Hushmail for the more secure of their email services. Perhaps it’s true that there is no loophole for that second service. But if there is, we know that Hushmail could be compelled to use it. These days, anyone can be compelled.

I think the government should actually go one step further. I think they should take their inspiration from the North Dakota law enforcement team that invited 40 individuals with outstanding police warrants to an Alice Cooper pre-concert party so that the cops could arrest the criminals in a convenient and leisurely manner. The Powers that Be could create their own stooge “secure” service, then very comfortably sit back and let the privacy zealots come to them. It would be much more convenient and reliable than all this horrible mess with court orders, constitutional rights, citizenship, and so on. But wait, maybe they are way ahead of me? Perhaps this is what Dual_EC_DRBG is for… ?

From now on, make sure that the vanity searches originate from a different IP address than the how-to searches regarding killing, maiming, and dead people…

The AOL search data scandal is a welcome wakeup call. It is useful to remember that even a common, theoretically harmless internet activity might be used to correlate between normally segmented parts of a person’s identity. Data that people believe goes no farther than from the chair to the keyboard gets published, and one more illusion of privacy goes out like the baby with the bathwater.

Ever heard the abbreviation “TMI”? It means “Too Much Information”. Generally it applies when somebody volunteers embarrassing and/or revealing information over and above what is necessary in the context of the conversation, resulting in discomfort and/or disgust on the part of the conversational partner.

We are, as a population, entering the age of TMI. Scores of people (including myself) are busily working on data entry: their thoughts, biographies, portraits, proclivities, and personal habits are being eagerly keyed in. Some of them are bright enough to do so pseudonymously or anonymously. Regardless of how they do it, it seems to me that there is no guarantee whatsoever that their anonymity or pseudonymity, or even their expectations of freedom from webcrawler indexing will stand the test of time.

I think most people, whether they are aware of it or not, still believe in security by obscurity. Sure, if somebody worked hard it might be possible to realize that Mary Smith is “concernedParent” on motherhoodparenting.com, but “naughtyGirl” on sexymommies.com, but why would anyone think to correlate those identities together? Such a correlation today takes an active effort, and it’s difficult to conceive of why anyone would even bother.

Of course, security by obscurity definitely didn’t work for Thelma Arnold. Her identity was extracted using the AOL dataset and other publicly available information for no other reason than because it could be. I’ll bet the phone calls from the reporters were an unwelcome shock. Even data that cannot quite personally identify someone now might cumulatively do so later. Perhaps the AOL dataset links “concernedParent” to “naughtyGirl”, but one year later, a different body of data manages to link “concernedParent” to Mary Smith. At this point the link between Mary Smith and “naughtyGirl” is there for the farming. Imagine what will happen if anyone on the internet figures out who user #17556639 is. Even worse, imagine if they get it wrong.

So when will be the day that the right body of personally correlational data combines to reveal your secrets? Maybe never. Maybe tomorrow. Just because it is obscured now, doesn’t mean it will be forever. And once an internet search for Mary Smith links to “naughtyGirl”, it won’t go away — the problem with a TMI situation is that the damage cannot be undone.

All I can think to hope for is a partial solution: mutual assured TMI. If everyone has as much dirt as everyone else, the dirt might become less significant. At least the excusable indiscretions might be overlooked. MySpace, you might save us yet….

There seems to be a big kafuffle over this calendar, which features Aussie women in IT as famous Screen Goddesses. The goals are listed on the site, but generally include focusing media attention, raising awareness, and smashing stereotypes.

Some people are upset about using sex to sell a brainy career. Personally, I have never understood this idea that showing off the diverse talents of girl geeks somehow demeans them. We’re not robots, we are flesh & blood people who have jobs that we work hard at. Many of us are pretty damn good at what we do. Some of us are beautiful, some of us are introverted, some of us have crazy hobbies, some of us are just plain crazy. It’s true, the women in this calendar may not accurately ‘represent’ all women in IT. Oh SHUCKS. Name me the person who ‘represents’ all men in IT. I doubt there would be consensus there and why should there be?

My thoughts are that being intelligent does not mean we can’t also be sexy, or express ourselves in any number of other ways. Appearing in a calendar IN NO WAY reduces the intelligence of those women, and implying that somehow their beauty or their decision to be in an IT-associated calendar diminishes their ability to act as role models to young women considering careers in IT seems crazy to me. This calendar may not speak to all women, but it doesn’t have to. I’m sure there are many other recruitment initiatives in place (initiatives that this calendar is intended to help to fund BTW) that would meet the approval of even the most conservative critic. Diversity is good, both in people and in recruitment approaches, and if everybody disapproves, that should show in poor calendar sales.

Of course, I intend to buy a copy of the calendar, and I consider the whole exercise to be all about Grrl power. I *will* be objectifying these women. I will admire them from afar as being smart, successful and sexy. Just try and stop me.

Well then, back to your regularly scheduled identity-ish blog…

Do you prefer to be left alone? Do you wish for smooth, easy travel? Would you like to think that you can have an innocent conversation in the privacy of your home without worrying about who is listening to it?

There is a simple way to accomplish this. Get your name legally changed to Fitzblik Spixwallet.

Think I’m kidding? I am not kidding.

Ask anyone with a last name of Smith. Smiths deal with mixups all the time. All sorts of name-related problems crop up – reservations are mysteriously changed or deleted, people call looking for somebody else, all sorts of small inconveniences magically appear, to make life just a little more difficult. All it takes, for example, is for a person with the same name as you to wreck their credit rating — and you will have a harder time getting credit.

Your name is an index, and when that index is not unique, secondary information is necessary to discriminate between duplicate instances. Sadly, that secondary information is often not asked for, not accessible, or simply ignored, and in those cases, instances of an index are treated interchangeably.

“So what?” you may say. A few messed up restaurant meals or a few extra phone calls are hardly worth the hassle of spelling out ‘Fitzblik Spixwallet’ 10 times a day.

In these days of fear, however, taking the time to cast suspicion on the correct person is unfashionable. All it takes is a name collision – possessing the same name as a suspected terrorist – and you cannot bank on any of the simple things that many people take for granted today. You may be barred from air travel. You may have your conversations monitored. In extreme cases, you may be arrested and held for an indefinite period. Sound unlikely? Well, let’s just say that a simple name collision increases the odds significantly.

“That’s crazy!” you might say. Well I agree with you. It is crazy. The best part is, it provides brilliant camoflage for the bad guys. The bad guys are the only ones who CAN dodge things like the no-fly list, because they’re the only ones who have no scruples about flying with fake passports!

Case in point: Edward Allen.

If you have this name, change it. Whatever you do, if your surname is Allen and you have children, avoid ‘Edward’ at all costs. Why? That is the name of a known terrorist. That name will ring alarm bells in all sorts of places. People that you really don’t want to be showing an interest in you, will be. Now – maybe you figure – that’s ok, I’m not doing anything wrong. You may be right, there may be nothing to see – but they will have to watch you to find that out. The idea makes my skin crawl.

This poor kid found out early what kind of reception he will get every time he interfaces with the government:

4-year-old shows up on government ‘no-fly’ list

The moral of the story: Names are a ridiculous way to determine whether or not a person might be a terrorist. Unfortunately, the gov’t is willing to use names as a crude blunt object to bludgeon the populace with. Perhaps they will get a few terrorists in there – but if you can stay out of the way of the caveman’s club, you will ultimately live a happier, hassle-free, simpler existence.

I can’t tell you how happy it makes me feel to know that other people feel the same way about Terrorism (http://qntm.org/terrorism.html).