innismir.net

Over the past few weeks, the Lower Merion School District has been in the news due to their use of school issued laptops to photograph, monitor, and otherwise invade the privacy of students that used them. The information security community I follow on Twitter, Martin Mckeay in general, are up in arms regarding the school’s behavior, and rightly so. But, with the way things are blowing, at least in Massachusetts, are the things that LMSD did just a sign of things to come?

In Massachusetts, there have been a couple high profile suicides over the past year by students that were the result of being “bullyed” at school. While each death is a tragedy, the Massachusetts Legislature, backed by the public’s outrage, is trying to pass “anti-bullying” legislation in order to somehow fix the problem. The legislation covers the usual bases, making it illegal to harass students at school, but the bill also covers…

…bullying through, without limitation, electronic mails, cellular phones, instant messages, text messages or websites…

…and that each school district must prohibit…

…bullying through the use of the district computer system while on or off campus…

Of course, the legislation is, like any law, vague in how the school is to accomplish such things.

With schools keen to embrace the “computers and broadband for everyone” mantra, and with the possibility of it becoming illegal for students to harass one another online, are we going to see more mandatory school issued computers for students tightly locked down with monitoring software and all activities logged? With the recent groundswell of support by parents of stiffer penalties I worry about whether or not there would be similar outrage if such an incident like the one in LMSD occurs again. Will the general public be aghast or pleased at the fact that a school district monitors such behavior in a few years time? Even more concerning, as pointed out in ComputerWorld, schools get to slide sometimes as they have a sort of quasi-guardianship of students. It scares me that  if such legislation is passed and such an incident occurs again, the school may be able to legally hide behind such legislation saying that they’re trying to protect the general student populace as required by law.

Now, I am no fan of bullies, as I’m sure any computer geek that went to public schools can attest. However, despite the fact that everyone can agree that students harassing other students is bad, the schools should not have the right to monitor and investigate any behavior that happens physically off school grounds. Such areas are the parent’s and, if necessary, law enforcement’s domain. Also, as we start going even further down this slippery slope, are we going to see schools wanting to gain more access into student’s personal accounts if they access them from a school district computer? Wow! Check it out! This slope is slippery!

Any such legislation that mandates the protection of students must also mandate due process and protect the privacy of students, both the harassed and harassers. Otherwise we may start to see incidents like the one at LMSD stop being the exception and start being the rule.

So, I’ve had questions regarding the safety of using one’s amateur radio while operating for a while; but, over the last week, in the words of my sister “this shit just got real.” The Massachusetts House passed an anti-mobile phone bill that, while not banning mobile amateur radio operation outright, is sufficiently vague that such operation may be banned. While I often wonder about how safe mobile amateur radio operation is, I bit the bullet and wrote to my state senator asking for an exemption to federally licensed radio operators.

Now… This bill has caused a bit of a hoopla on the local amateur radio discussion lists I follow. After the house passed the bill, there was some questions and people were concerned regarding how it applied to Amateur Radio. Then, after the ARRL Eastern MA State Government Liason posted his analysis (Very timely! 2-3 days after the bill passed the House! Thanks for keeping us ahead of things!) people started posting e-mails that they were sending to their senator. The e-mails all consisted, more or less, of the message suggested by the SGL, which while a nice skeleton, left much to be desired. That, combined with the fact that everyone is sending e-mail, made me cringe. So, let me stand on my soapbox for a moment…

Ben’s Guide to Harrassing Lobbying Your Elected Official

For some reason, I like to put my two cents in when a topic that matters to me comes up on a state or federal level. I blame my Dad for being so active in elections when I was a kid. Since I seem to do it on a semi-regular basis, I seem to have developed a knack for it. So, let me attempt to offer some tips on lobbying (that’s right, you’re your own personal lobbyist) your elected official.

For the love of God, don’t e-mail if you have another way of making contact -  e-Mail is great. It’s quick, easy, and simple to send. This makes it a horrible medium for lobbying. Since so many folks do it, your message will likely be lost within the noise of all the other messages. The best way to contact your elected official is good old snail mail, it’s harder to ignore. When I brought this up on one of my mailing lists one of the curmudgeons replied “nah, they go through the shredder just fine…” While he is 100% correct, what’s easier to ignore? 100 e-mails in your Inbox or 100 letters being delivered by USPS?

Now, this is my personal opinion, but I feel the next best way to contact your elected official is via Fax. Fax edges out a phone call ever so slightly because there is a physical object delivered. While I’m sure that no receptionist would ever not write down your message, I think that a piece of paper showing up is just a bit more “real”

Be Informed – K3HI hit on this in his message. You’re speaking for all of us fighting to change the bill. If you look dumb, we all look dumb and you hurt our cause. Don’t berate, yell, or annoy. You’re not helping anyone.You attract more flies with honey then vinegar.

Be Brief – Don’t write a 20 page dissertation on the subject. Keep it to one page maximum. Say who you are and why you’re writing, list any credentials you may have on the subject, go into detail on your position, and close with what you would like your elected official to do.

Let me toot my own horn and show off my letter.

First off, I started with my name and address, and my senator’s name and address. This is a formal letter, so follow all those rules you learned in 7th grade English class (Mrs. McGuinness would be so proud of me!). Also, including your address will give the official a chance to respond.

Dear Senator Montigny:

Hello. As a constituent, I am writing you to ask you to oppose House 4475 in its current state. The definitions in this bill are vague enough that it could unfairly include amateur radio operators in its ban.

I started off with the fact that I’m a constituent. People write other people’s elected officials all the time because of the fact that they’re on some committee or just want to spam the entire legislative branch with their lobbying. By stating that I vote for him, I give myself a little more attention. I also state why I’m writing.

Now, I go into detail as to what I’m writing about. Lay it on thick. Tell a fun story. Why should your official see it your way? While this is 100% anecdotal evidence, but it is also 100% fact:

I am a FCC licensed Amateur (“Ham”) Radio operator. I have been since 1995. In order to reach my current license level (“Extra”), I’ve had to pass three separate exams. In these exams, safe operation radio operation is covered. I know that operating a radio while driving needs to be done with the utmost care, and shouldn’t be done in certain situations. Because of this, I also know that the same applies to mobile telephones. My wife often pokes fun at me because I don’t answer my mobile phone if I don’t feel the situation is safe enough. Amateur Radio operators have been operating in their cars for years, and we have never had issues with legislative action trying to ban us from operating. We only seem to be caught up in vaguely worded cell phone bans.

As much as I wonder how useful such services are, I decided to toe the party line and wave the bloody shirt of public service too…

Amateur Radio provides a valuable public service for the community at large. This past Wednesday during the snow storm, SKYWARN, an amateur radio weather observation group, passed information to the National Weather Service and MEMA regarding storm and road conditions. If this ban takes effect, this information will be limited to amateurs operating in fixed locations, which will limit the timeliness and accuracy of information.

I now wrap up by restating what I would like him to do. Note that I didn’t specifically ask for an exemption of Amateur Radio. I asked for an exemption of any FCC licensed radio operator. No sense in splitting hairs.

I am asking you to please oppose House 4475 in its current state. Alternatively, if you would like to support it, please amend the bill to include a exemption for federally licensed radio operators like myself operating radio equipment.

Finally, I always close with my contact information, on the off chance the official wants to talk further. I will be shocked if this ever happens, but I feel that it shows that I don’t mind having a dialogue. I also thank the official for his or her time. Always be polite!

If you would like to discuss this further, please do not hesitate to call me at <my telephone-o-rono>, or e-mail me at <my e-mail address>.

Thank you for your time.

There you have it. This fit onto one page with 11 point font and it was put in the mail today. I hope it will arrive on Beacon Hill by Tuesday and that it will start a revolution regarding exemptions for two-way radios in any future cell phone bill.

Hope this might have given you some good ideas about writing and may have inspired you to start lobbying yourself. It’s hard to complain about the system when you don’t participate.

There has been a minor murmur in the TwitterSphere recently regarding th3j35t3r, a person who is launching Denial of Service attacks against websites that sympathize with or actively promote Islamic terrorism. The questions being asked are not new: Do two wrongs make a right? Is it ethical to attack “the bad guys” with a taste of their own medicine? Should we be condemning, condoning, or congratulating such behavior?

Neal Stephenson put it best in Snow Crash that “Until a man is twenty-five, he still thinks, every so often, that under the right circumstances he could be the baddest mother&^%#er in the world.” I think that deep down in every InfoSec professional’s heart, we want to be that mother&^%#er. We think, every so often, that we could go rogue, drop off the radar, and launch a one man war against the script kiddies, mafia types, and general ne’er-do-wells that inhabit the Internet. I think that’s why some of us are having a tough time reconciling th3j3st3r’s actions within their own moral code of being one of the “good guys”. I think everyone agrees that the sites being attacked are “bad” in the incredible sliding scale of morality. The question that comes up is: Does leveraging methods such as DoS attacks against “bad” sites result in a “bad” or “good” outcome?

I think that this question can be answered by one of Hollywood’s legendary bad mother&^%#ers, Harry Callahan. In the 2nd film of the “Dirty Harry” series, Magnum Force, the plot revolves around a group of cops that have “gone rogue” and are taking out criminals in San Francisco. Now, anyone who has watched the “Dirty Harry” series (You have, haven’t you? If not, go order it on NetFlix and watch it. Go Ahead. I’ll wait… Back? Good, huh?) know that Callahan is a cop who gladly tosses out the rulebook when it gets in his way of getting the bad guy. While trying to reconcile the rogue cops methods against his own playbook, there is an important quote by Callahan: “I hate the goddamned system, but until someone comes along with changes that make sense, I’ll stick with it.” This should be the mantra of every information security professional who deals with the scum of the Internet day in and day out. There is a system that we use, such as takedowns and working with ISPs to get bad material removed, and while it fails on a regular basis, it’s what we have to work with. I know how difficult it can be, as I have been on the front lines desperately trying to work with ISPs to take down a phish or a piece of malware from their servers and running into stone wall after stone wall. I’ve often wished for some kind of more effective system. While I don’t think anyone can debate the effectiveness of th3j35t3r’s tactics, I feel they cross a line that should not be crossed. While I feel that the removal of such sites is a good thing, the methods in which it is accomplished is not.

The question of morality aside, no one knows exactly “how” th3j35t3r is DoSing these sites, th3j35t3r says it’s “like a DDOS attack, except without the first ‘D’. There is nothing ‘distributed’ about this. It is possible with very low bandwidth and a single low-spec linux machine.” While judging from his description I have an idea of what his tool of choice may be, we likely won’t know due to the sites he’s choosing since they aren’t the ones who are likely going to run to the authorities. The ones that are talking are making their own assumptions and are mostly conjecture. So, it’s likely we won’t know any time soon exactly what he, or she, is doing. Does it affect other sites on the same network? Could it be disrupting critical services hosted on the same netblock? Are the attacks being pivoted across systems that did not give permission to be involved? Is there any collateral damage? Until we know exactly what’s going on, we can only guess.

There’s another quote from Magnum Force that I want to toss out here. The quote is “A man’s got to know his limitations” and I feel sums up the debate correctly. I think that, at least in my case, I know my limitations, and I think that DoSing sites, no matter how bad they may be, is beyond my limitations ethically.

UPDATE: Shouts to @Shpantzer for pointing out my ability to make “people operating outside normal or desirable controls” into “red or pink cosmetics for coloring the cheeks or lips” with a single typo.