My Blogging

Blog regulars will notice that I haven’t been posting as much lately as I have in the past. There are two reasons. One, it feels harder to find things to write about. So often it’s the same stories over and over. I don’t like repeating myself. Two, I am busy writing a book. The title is still: Click Here to…

Blog regulars will notice that I haven't been posting as much lately as I have in the past. There are two reasons. One, it feels harder to find things to write about. So often it's the same stories over and over. I don't like repeating myself. Two, I am busy writing a book. The title is still: Click Here to Kill Everybody: Peril and Promise in a Hyper-Connected World. The book is a year late, and as a very different table of contents than it had in 2016. I have been writing steadily since mid-August. The book is due to the publisher at the end of March 2018, and will be published in the beginning of September.

This is the current table of contents:

  • Introduction: Everything is Becoming a Computer
  • Part 1: The Trends
    • 1. Capitalism Continues to Drive the Internet
    • 2. Customer/User Control is Next
    • 3. Government Surveillance and Control is Also Increasing
    • 4. Cybercrime is More Profitable Than Ever
    • 5. Cyberwar is the New Normal
    • 6. Algorithms, Automation, and Autonomy Bring New Dangers
    • 7. What We Know About Computer Security
    • 8. Agile is Failing as a Security Paradigm
    • 9. Authentication and Identification are Getting Harder
    • 10. Risks are Becoming Catastrophic
  • Part 2: The Solutions
    • 11. We Need to Regulate the Internet of Things
    • 12. We Need to Defend Critical Infrastructure
    • 13. We Need to Prioritize Defense Over Offence
    • 14. We Need to Make Smarter Decisions About Connecting
    • 15. What's Likely to Happen, and What We Can Do in Response
    • 16. Where Policy Can Go Wrong
  • Conclusion: Technology and Policy, Together

So that's what's been happening.

from https://www.schneier.com/blog/

Friday Squid Blogging: Squid Empire Is a New Book

Regularly I receive mail from people wanting to advertise on, write for, or sponsor posts on my blog. My rule is that I say no to everyone. There is no amount of money or free stuff that will get me to write about your security product or service. With regard to squid, however, I have no such compunctions. Send me…

Regularly I receive mail from people wanting to advertise on, write for, or sponsor posts on my blog. My rule is that I say no to everyone. There is no amount of money or free stuff that will get me to write about your security product or service.

With regard to squid, however, I have no such compunctions. Send me any sort of squid anything, and I am happy to write about it. Earlier this week, for example, I received two -- not one -- copies of the new book Squid Empire: The Rise and Fall of Cephalopods. I haven't read it yet, but it looks good. It's the story of prehistoric squid.

Here's a review by someone who has read it.

As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered.

Read my blog posting guidelines here.

from https://www.schneier.com/blog/

Many of My E-Books for Cheap

Humble Bundle is selling a bunch of cybersecurity books very cheaply. You can get copies of Applied Cryptography, Secrets and Lies, and Cryptography Engineering — and also Ross Anderson’s Security Engineering, Adam Shostack’s Threat Modeling, and many others. This is the cheapest you’ll ever see these books. And they’re all DRM-free….

Humble Bundle is selling a bunch of cybersecurity books very cheaply. You can get copies of Applied Cryptography, Secrets and Lies, and Cryptography Engineering -- and also Ross Anderson's Security Engineering, Adam Shostack's Threat Modeling, and many others.

This is the cheapest you'll ever see these books. And they're all DRM-free.

from https://www.schneier.com/blog/

Book Review: Twitter and Tear Gas, by Zeynep Tufekci

There are two opposing models of how the Internet has changed protest movements. The first is that the Internet has made protesters mightier than ever. This comes from the successful revolutions in Tunisia (2010-11), Egypt (2011), and Ukraine (2013). The second is that it has made them more ineffectual. Derided as "slacktivism" or "clicktivism," the ease of action without commitment…

There are two opposing models of how the Internet has changed protest movements. The first is that the Internet has made protesters mightier than ever. This comes from the successful revolutions in Tunisia (2010-11), Egypt (2011), and Ukraine (2013). The second is that it has made them more ineffectual. Derided as "slacktivism" or "clicktivism," the ease of action without commitment can result in movements like Occupy petering out in the US without any obvious effects. Of course, the reality is more nuanced, and Zeynep Tufekci teases that out in her new book Twitter and Tear Gas.

Tufekci is a rare interdisciplinary figure. As a sociologist, programmer, and ethnographer, she studies how technology shapes society and drives social change. She has a dual appointment in both the School of Information Science and the Department of Sociology at University of North Carolina at Chapel Hill, and is a Faculty Associate at the Berkman Klein Center for Internet and Society at Harvard University. Her regular New York Times column on the social impacts of technology is a must-read.

Modern Internet-fueled protest movements are the subjects of Twitter and Tear Gas. As an observer, writer, and participant, Tufekci examines how modern protest movements have been changed by the Internet­ -- and what that means for protests going forward. Her book combines her own ethnographic research and her usual deft analysis, with the research of others and some big data analysis from social media outlets. The result is a book that is both insightful and entertaining, and whose lessons are much broader than the book's central topic.

"The Power and Fragility of Networked Protest" is the book's subtitle. The power of the Internet as a tool for protest is obvious: it gives people newfound abilities to quickly organize and scale. But, according to Tufekci, it's a mistake to judge modern protests using the same criteria we used to judge pre-Internet protests. The 1963 March on Washington might have culminated in hundreds of thousands of people listening to Martin Luther King Jr. deliver his "I Have a Dream" speech, but it was the culmination of a multi-year protest effort and the result of six months of careful planning made possible by that sustained effort. The 2011 protests in Cairo came together in mere days because they could be loosely coordinated on Facebook and Twitter.

That's the power. Tufekci describes the fragility by analogy. Nepalese Sherpas assist Mt. Everest climbers by carrying supplies, laying out ropes and ladders, and so on. This means that people with limited training and experience can make the ascent, which is no less dangerous -- to sometimes disastrous results. Says Tufekci: "The Internet similarly allows networked movements to grow dramatically and rapidly, but without prior building of formal or informal organizational and other collective capacities that could prepare them for the inevitable challenges they will face and give them the ability to respond to what comes next." That makes them less able to respond to government counters, change their tactics­ -- a phenomenon Tufekci calls "tactical freeze" -- make movement-wide decisions, and survive over the long haul.

Tufekci isn't arguing that modern protests are necessarily less effective, but that they're different. Effective movements need to understand these differences, and leverage these new advantages while minimizing the disadvantages.

To that end, she develops a taxonomy for talking about social movements. Protests are an example of a "signal" that corresponds to one of several underlying "capacities." There's narrative capacity: the ability to change the conversation, as Black Lives Matter did with police violence and Occupy did with wealth inequality. There's disruptive capacity: the ability to stop business as usual. An early Internet example is the 1999 WTO protests in Seattle. And finally, there's electoral or institutional capacity: the ability to vote, lobby, fund raise, and so on. Because of various "affordances" of modern Internet technologies, particularly social media, the same signal -- a protest of a given size -- reflects different underlying capacities.

This taxonomy also informs government reactions to protest movements. Smart responses target attention as a resource. The Chinese government responded to 2015 protesters in Hong Kong by not engaging with them at all, denying them camera-phone videos that would go viral and attract the world's attention. Instead, they pulled their police back and waited for the movement to die from lack of attention.

If this all sounds dry and academic, it's not. Twitter and Tear Gasis infused with a richness of detail stemming from her personal participation in the 2013 Gezi Park protests in Turkey, as well as personal on-the-ground interviews with protesters throughout the Middle East -- particularly Egypt and her native Turkey -- Zapatistas in Mexico, WTO protesters in Seattle, Occupy participants worldwide, and others. Tufekci writes with a warmth and respect for the humans that are part of these powerful social movements, gently intertwining her own story with the stories of others, big data, and theory. She is adept at writing for a general audience, and­despite being published by the intimidating Yale University Press -- her book is more mass-market than academic. What rigor is there is presented in a way that carries readers along rather than distracting.

The synthesist in me wishes Tufekci would take some additional steps, taking the trends she describes outside of the narrow world of political protest and applying them more broadly to social change. Her taxonomy is an important contribution to the more-general discussion of how the Internet affects society. Furthermore, her insights on the networked public sphere has applications for understanding technology-driven social change in general. These are hard conversations for society to have. We largely prefer to allow technology to blindly steer society or -- in some ways worse -- leave it to unfettered for-profit corporations. When you're reading Twitter and Tear Gas, keep current and near-term future technological issues such as ubiquitous surveillance, algorithmic discrimination, and automation and employment in mind. You'll come away with new insights.

Tufekci twice quotes historian Melvin Kranzberg from 1985: "Technology is neither good nor bad; nor is it neutral." This foreshadows her central message. For better or worse, the technologies that power the networked public sphere have changed the nature of political protest as well as government reactions to and suppressions of such protest.

I have long characterized our technological future as a battle between the quick and the strong. The quick -- dissidents, hackers, criminals, marginalized groups -- are the first to make use of a new technology to magnify their power. The strong are slower, but have more raw power to magnify. So while protesters are the first to use Facebook to organize, the governments eventually figure out how to use Facebook to track protesters. It's still an open question who will gain the upper hand in the long term, but Tufekci's book helps us understand the dynamics at work.

This essay originally appeared on Vice Motherboard.

The book on Amazon.com.

from https://www.schneier.com/blog/

The Quick vs. the Strong: Commentary on Cory Doctorow’s Walkaway

Technological advances change the world. That’s partly because of what they are, but even more because of the social changes they enable. New technologies upend power balances. They give groups new capabilities, increased effectiveness, and new defenses. The Internet decades have been a never-ending series of these upendings. We’ve seen existing industries fall and new industries rise. We’ve seen governments…

Technological advances change the world. That's partly because of what they are, but even more because of the social changes they enable. New technologies upend power balances. They give groups new capabilities, increased effectiveness, and new defenses. The Internet decades have been a never-ending series of these upendings. We've seen existing industries fall and new industries rise. We've seen governments become more powerful in some areas and less in others. We've seen the rise of a new form of governance: a multi-stakeholder model where skilled individuals can have more power than multinational corporations or major governments.

Among the many power struggles, there is one type I want to particularly highlight: the battles between the nimble individuals who start using a new technology first, and the slower organizations that come along later.

In general, the unempowered are the first to benefit from new technologies: hackers, dissidents, marginalized groups, criminals, and so on. When they first encountered the Internet, it was transformative. Suddenly, they had access to technologies for dissemination, coordination, organization, and action -- things that were impossibly hard before. This can be incredibly empowering. In the early decades of the Internet, we saw it in the rise of Usenet discussion forums and special-interest mailing lists, in how the Internet routed around censorship, and how Internet governance bypassed traditional government and corporate models. More recently, we saw it in the SOPA/PIPA debate of 2011-12, the Gezi protests in Turkey and the various "color" revolutions, and the rising use of crowdfunding. These technologies can invert power dynamics, even in the presence of government surveillance and censorship.

But that's just half the story. Technology magnifies power in general, but the rates of adoption are different. Criminals, dissidents, the unorganized -- all outliers -- are more agile. They can make use of new technologies faster, and can magnify their collective power because of it. But when the already-powerful big institutions finally figured out how to use the Internet, they had more raw power to magnify.

This is true for both governments and corporations. We now know that governments all over the world are militarizing the Internet, using it for surveillance, censorship, and propaganda. Large corporations are using it to control what we can do and see, and the rise of winner-take-all distribution systems only exacerbates this.

This is the fundamental tension at the heart of the Internet, and information-based technology in general. The unempowered are more efficient at leveraging new technology, while the powerful have more raw power to leverage. These two trends lead to a battle between the quick and the strong: the quick who can make use of new power faster, and the strong who can make use of that same power more effectively.

This battle is playing out today in many different areas of information technology. You can see it in the security vs. surveillance battles between criminals and the FBI, or dissidents and the Chinese government. You can see it in the battles between content pirates and various media organizations. You can see it where social-media giants and Internet-commerce giants battle against new upstarts. You can see it in politics, where the newer Internet-aware organizations fight with the older, more established, political organizations. You can even see it in warfare, where a small cadre of military can keep a country under perpetual bombardment -- using drones -- with no risk to the attackers.

This battle is fundamental to Cory Doctorow's new novel Walkaway. Our heroes represent the quick: those who have checked out of traditional society, and thrive because easy access to 3D printers enables them to eschew traditional notions of property. Their enemy is the strong: the traditional government institutions that exert their power mostly because they can. This battle rages through most of the book, as the quick embrace ever-new technologies and the strong struggle to catch up.

It's easy to root for the quick, both in Doctorow's book and in the real world. And while I'm not going to give away Doctorow's ending -- and I don't know enough to predict how it will play out in the real world -- right now, trends favor the strong.

Centralized infrastructure favors traditional power, and the Internet is becoming more centralized. This is true both at the endpoints, where companies like Facebook, Apple, Google, and Amazon control much of how we interact with information. It's also true in the middle, where companies like Comcast increasingly control how information gets to us. It's true in countries like Russia and China that increasingly legislate their own national agenda onto their pieces of the Internet. And it's even true in countries like the US and the UK, that increasingly legislate more government surveillance capabilities.

At the 1996 World Economic Forum, cyber-libertarian John Perry Barlow issued his "Declaration of the Independence of Cyberspace," telling the assembled world leaders and titans of Industry: "You have no moral right to rule us, nor do you possess any methods of enforcement that we have true reason to fear." Many of us believed him a scant 20 years ago, but today those words ring hollow.

But if history is any guide, these things are cyclic. In another 20 years, even newer technologies -- both the ones Doctorow focuses on and the ones no one can predict -- could easily tip the balance back in favor of the quick. Whether that will result in more of a utopia or a dystopia depends partly on these technologies, but even more on the social changes resulting from these technologies. I'm short-term pessimistic but long-term optimistic.

This essay previously appeared on Crooked Timber.

from https://www.schneier.com/blog/

The Memoir: Fact or Fiction?

     How many people take themselves seriously enough, or think they are important or interesting enough, to write a memoir? (An autobiography is a full account of the author’s life while a memoir preents just a slice of it. EG: “Ho…

     How many people take themselves seriously enough, or think they are important or interesting enough, to write a memoir? (An autobiography is a full account of the author's life while a memoir preents just a slice of it. EG: "How I Climbed Mr. Everest" or "My Role in the Brinks Robbery," or "How I lost 600 Pounds Eating Donuts and Snicker Bars.") Judging from bookstore inventories, a lot of people. One would be hard pressed to name a well-known politician, entertainment figure, television host, professional athelete or writer who has not written (or had ghost-written) a memoir.

     Because so many memoirs are ghost-written, especially books "authored" by celebrities, the term "author," in the context of this genre, is rather ambiguious. Moreover, when reading a memoir, one can never be sure if the book in hand is fiction, nonfiction, or a blend of fact and fantasy. In recent years several best-selling memoirs have turned out to be, at their core, fiction, and therefore fakes. Examples include memoirs written in the subgenres of Holocaust, crime, addiction, sports, coming of age, and love story. Since 1996, three major Holocaust memoirs have been shown to be heavily fictitious.

     Greg Mortenson's 2996 memoir (co-authored with David Oliver Relinhis), called "Three Cups of Tea," a supposedly true story of how Mortenson's non-profit institute established more than 170 schools for girls in Pakistan, sold more than three million copies worldwide. In April 2011, CBS's "60-Minutes" reported that the memoir was a fabrication and that Mortenson had used his charitable organization as a "private ATM machine."

     On April 21, 2011, radio talk show host Steve Kelly (KSPI Palm Springs, California) asked me why authors of fake memoirs just don't present their stories as works of fiction to avoid the shame of being exposed. My answer: Many memorists want the freedom to create and take advantage of the power of nonfiction. Readers like true stories, but not all true stories are interesting. This is where fiction--and literary fraud--enters the picture and why so many book buyers now question the integrity of the genre.

     The following quotes from professional writers pertain to the genre in general:

A memoir is how one remembers one's own life, while an autobiography is history, requiring research, dates, facts double-checked.
Gore Vidal

Someone said that writing a memoir is like getting re-acquainted with the person you were a long time ago.
Tony Hillerman

It seems to me there are people who can write their memoirs with a reasonable amount of honesty, and there are people who simply cannot take themselves seriously enough.
Raymond Chandler

Perhaps...all memorists lie. We alter the truth on paper so as to alter it in fact. We lie about our past and invent surrogate memories the better to make sense of our lives and live the life we know was truly ours. We write about our life, not to see it as it was, but to see it as we wish others might see it, so we may borrow their gaze and begin to see our lives through their eyes, not ours. [Perhaps this is why readers don't trust memoirs.]
Andre Aciman

A memoir must be about you and something--and that something should usually be your relationship to something intrinsically interesting and bigger than you.
Stephan Koch

The memories of the mentally ill are full of confused action, failed promise, and grinding pain; they do not tend to make good narratives.
Dr. Alice W. Flaherty

Books like Christina Crawford's "Mommy Dearest" and the late Gary Crosby's "Going My Own Way" offered sensational, firsthand accounts into the family lives of Joan Crawford and Bing Crosby, proving that even in the [film] industry's Golden Age, Hollywood idols did not make top-notch parents. Nor most likely do their own children, comfortable performing literary blindsides on their star parents in pursuit of their own 15 minutes of fame. [The celebrity offspring hatchet-job has become a staple in the genre.] It's a vicious cycle.
Andrew Breibart and Mark Ebner

from http://jimfishertruecrime.blogspot.com/

Fatal Vows: 8 True Crime Books about Marriages That Ended In Murder

The brides and grooms of these books failed to understand “until death we do part” isn’t a licence to kill your spouse when your done with married life.

The post Fatal Vows: 8 True Crime Books about Marriages That Ended In Murder appeared first on True Crime Zine.

The brides and grooms of these books failed to understand “until death we do part” isn’t a licence to kill your spouse when your done with married life.

The post Fatal Vows: 8 True Crime Books about Marriages That Ended In Murder appeared first on True Crime Zine.

from http://truecrimezine.com