Slashdot Mirror
FBI Raids Security Researcher's Home
Sparr0 writes, "The FBI has raided the home of Christopher Soghoian, the grad student who created the NWA boarding pass site. Details can be found on his blog including a scanned copy of the warrant. The bad news is that he really did break the law. The good news is that Senator Charles Schumer did it first, 19 months ago, on an official government website no less. The outcome of this trial should be at least academically interesting. At best, it could result in nullifying some portion of the law(s) that the TSA operates under." Read on for Sparr0's take on what laws may apply in this case.
Boiling down some of the legalese, the charges (if any are filed) will be "conspiracy to knowingly present a false and fictitious claim upon or against the United States, or any department or agency thereof in violation of USC 18 (secs. 2, 371, 1036, 1343, 2318) and USC 49 (secs. 46314 and 46316) and 49 CFR (secs. 1540.103 and 1540.105)" (edited for brevity).
Even faced with potential jail time, some people have a burning desire to be in the limelight. I wonder why Christopher Soghoian didn't just create a site anonymously. It would likely have the same effect, and he'd stay out of prison.
It's unfortunate that exposing holes in our security gets no press until someone actually leverages the hole to cause harm. For years before 9/11, the U.S. knew our airports were pitifully insecure, particularly Boston Logan, yet failed to do anything about it. So even though we'll be safer as a result of Christopher's work, he may be in prison. Unfortunately our society aplauds the whistleblower only well after the whistle has been blown, and the government aplauds them almost never at all.
Crack - Free with every butt and set of boobs
They're straight out of Compton yo.
God spoke to me.
Senators above the law, researchers aren't?
I'm in the wrong business....
The gov't doesn't like to look bad. They don't like flaws being publically seen of their great "system" of boondoggles which they have created.
We all now the TSA is a scam, we all know we are not one bit safer, we all know the airways are no better than they were before 9/11. Just a great hat trick.
Of course, at this point...I wonder if they even care that the public would be aware.
Buy Steampunk Clothing Online!
At least we know that he was arrested and charged, not undergoing extraordinary-rendition. Sadly without the prior publicity stating his intent, this may not have been the case.
We are all just people.
A conspiracy with who?
[Fuck Beta]
o0t!
Soghoian is setting up a legal defense fund. You can learn more and donate atd efense-fund.html
http://slightparanoia.blogspot.com/2006/10/legal-
If you are going to throw all the kings tea in the harbor, you make sure you and your friends are dressed in disguise and have plausable deniability.
Honestly, with the incredible smarts we have today, why dont you experts learn from the past espically with the incredible insanity and lack of freedom we have today.
Personally I really hope he does everything possible to make sure the case and events are in the news and getting LOTS of attention, because that is the only way this will be able to be won.
Do not look at laser with remaining good eye.
does that make cutting keys a crime?
The kid has a legal defense fund in the event that he can't find a lawyer to take the case Pro-Bono.
http://slightparanoia.blogspot.com/
Scroll down to the "Donate" link.
Let's help him out.
Look, if my house has poor security, you're still in trouble if you start a factory to create keys for criminals to break in.
What did he expect from this? It doesn't matter how good or poor security is -- what matters is whether you conspired to break that security.
What a fool. I have absolutely no sympathy for him. If he had just published a paper, then I'd be a bit more sympathetic. But the guy actively sought to bypass airline security. What, does the guy not realize that people are a WEE BIT CONCERNED these days about airline security?
Sometimes it's best to just let stupid people be stupid.
1. "If you don't like it, move away." Considering the fact that Congress is severely limited by the Constitution in creating NO law that infringes on our God-given (or inherent, if you prefer) right to speak freely on our property, the laws listed above have nothing to do with what he did. In fact, his website IS his property, he rents it, and he's protected. Congress here should be the ones behind bars for continuing to violate the Constitution they took an oath to uphold.
2. "He broke a law, he should go to jail." The court system should be mandated to tell the jurors in all trials about their right to nullify terrible laws. Jury nullifaction is more than a priviledge, it is a right even greater than serving on a jury.
3. "He didn't do anything wrong." This shouldn't matter either way unless he violated someone's property or person himself. I find it outrageous that people are arrested for inciting violence -- the gun doesn't kill, the inciter doesn't kill, it is the person who physically performs a violent act that is the cause of the violence. Not only did he do nothing wrong, we shouldn't even be considering whether or not he did or didn't. Did he harm anyone physically? Did he physically steal anything? Did he trespass?
On top of those 3, we should also realize that the laws pertaining to security are 100% unconstitutional. The airplanes are private. The airports should be privatized (I can't see how airports could be considered federally-regulated properties). The passengers are generally private citizens. The Constitution is clear on this, too -- it should be left up to the individual States and the people.
This is what you get when you have democracy -- even a republican form of it.
"Democracy is the most vile form of government...democracies have ever been spectacles of turbulence and contention: have ever been found incompatible with personal security or the rights of property: and have in general been as short in their lives as they have been violent in their deaths." James Madison
"Democracy... while it lasts is more bloody than either [aristocracy or monarchy]. Remember, democracy never lasts long. It soon wastes, exhausts, and murders itself. There is never a democracy that did not commit suicide." John Adams
The U.S. isn't going to hell in a handbasket, it's been there since 1913 (or 1865, if you consider the traitor Lincoln's actions).
Thankfully, there are a great number of opportunities to vacate from the system without leaving the lands of the "Nation." I can only hope that more freedom lovers just stop voting for authority and move forward to taking that authority back.
Has anyone here used the script to make a fake boarding pass? Me, I took a look at the head line and didn't even dare look at the page. I had the feeling it was going to be a bit messy.
I was just wondering if anyone used it and had a visit from the ever so friendly FBI.
"You should always go to other people's funerals; otherwise, they won't come to yours." -- Yogi Berra
If the government knowingly maintain a broken security system that leads to a terrorist attack? I don't see what this kid did wrong, he created a proof of concept using skills possessed by tens of thousands of people in the US alone. I'm sure /the terrorists/ could hack a simple script together. When are the government agencies going to be put on trial?
"They've got to protect the country".
The most they should have done to "protect the country" from this man would have been to get the program file taken down from the site. Breaking the window, ransaking the home, taking computer equipment that will probably make his actual work as a graduate student much more difficult...and all of it in the middle of the night? It's not even security _theater_, it's just plain fear-mongering. Dorian Deligeorges was in charge of the scare tactics, and Kennard Foster approved it. Both of you: wouldn't it make more sense to fix the security hole? Why don't you push for asking for ID at the gate, fixing this and probably many yet-to-be-considered security flaws?
The cost of fixing the window and getting new computer equipment for research are examples of what might as well be a tax on Freedom of Speech. Continued disillusion in the ability of the government to solve a problem wisely are provided for free.
This guy is not a terrorist, he's a security researcher. I live in Bloomington as well and work with a guy who is taking a cryptographic protocols class with Chris. He says that Chris is a decent guy, which is probably the case. I for one commend Chris for releasing this kind of information to the public. Even if he had released it to the FAA or Northwest Airlines, its doubtful that the public would have ever known. He is simply doing what most security researchers do, its just that his research coincides with current hot topics in politics and public interest.
Dear Senator,
I would like to bring your attention to the outrageous behaviour our government agencies have displayed regarding the matter of security researcher Christopher Soghoian's comments on the TSA security procedures.
Quite frankly the FBI raid on his premises are beyond comprehension for a country that preaches freedom and respect for human rights.
Not only would I like you to help in resolving Christopher's plight, I would also ask that you investigate and bring to the public's attention the true nature of the effectiveness of the TSA policies as well as to the rather offensive nature of the "secrecy" of the policies upheld by the organization.
Public transparency of the government is very important to me and any help you can give to avoid being virtually disenfranchised due being unable to evaluate the performance of my elected officals is critical.
Sincerely
And so a corollary is that any security researcher who exposes a risk or danger is a criminal (;-))
--dave
davecb@spamcop.net
I think what needs to be looked at here, and what is often ignored by those with agendas to push, is intent. His intent was to improve security, not to see it subverted by enemies of the state. It is the government's fault, not his, that the only way to ensure the closure of this security hole was to engineer a tool to exploit it.
The fact that he published his identity and did this entire thing above-board settles the question of intent for me. He was not maliciously motivated. That is the basis by which we should judge him.
If I showed up at my apartment with the door unlocked, I would be rather annoyed. If I had had notes posted to my door for several years beforehand telling me my lock was insecure, and how to secure it with relative ease, and I then showed up at my apartment door to find it unlocked with a note saying "Told you so", I'd be embarassed. The key is, as long as the belongings inside are left untouched, all that's hurt here is pride. Pride is not something the law needs to be protecting.
occultae nullus est respectus musicae - originally a Greek proverb
The only way to get this situation under control.
Perhaps the law quoted in the summary is incorrect or out of context, but I don't see how he "knowingly presented a false and fictitious claim upon or against the United States". Wasn't the claim TRUE, which is why they are so mad about it?
Senators have constitutional immunity for what they say in the Senate. That might extend to his official website, though Proxmire set a precedent that points in the opposite direction.
More to the point is that Bruce Schneier was pointing out the boarding pass problem in _2003_.
The man affirmed that he created the page, the FBI had plenty of grounds to charge him. Why search his premises? Looking for other dirt to kick up in case the judge disagrees with the prosecutor?
Boiling down some of the legalese, the charges (if any are filed) will be "conspiracy to knowingly present a false and fictitious claim upon or against the United States, or any department or agency thereof in violation of USC 18 (secs. 2, 371, 1036, 1343, 2318) and USC 49 (secs. 46314 and 46316) and 49 CFR (secs. 1540.103 and 1540.105)" (edited for brevity).
So, in English, this means what? Slander/liable against the US government? So, if I say "Bush has an ass the size of Texas", I should expect the FBI soon?
Sounds like a foot-in-the-door technique. Like using mail fraud/tax code to get your nose into someone's papers, or using a "tail light it out"/"speeding" to pull over someone that looks like they're up to no good.
Either that, or the Federal government is visciously going after anyone that dares to suggest airline travel isn't safe, lest it hurt an already crippled and dying industry. Reminds me of the MBTA (Boston's subway/bus/commuter rail system) policy on photographic permits: you can film or take photos, but ONLY if the final product is vetted by the MBTA and does not show the MBTA in an "unfavorable" light or imply the MBTA system is "unsafe."
Please help metamoderate.
_If_ he did indeed break the law, and _if_ he gets convicted, and _if_ the sentence is jail _then_ ... I suggest he asks for the sentence to be changed to banning/exile.
US society gets rid of such a dangerous individual and he antecipates his emigration, which is anyway a good idea, considering some recent martial law developments.
I think that this case illustrates how incredibly messed up our legal system is. If an investigational news show such as 20/20 or Dateline showed how to do this, the Feds wouldn't dare go after them. No one is going after Charles Schumer, although the law is definitely broad enough to charge him with a crime. These people have power and money.
Instead, they attack a graduate student who they knew could not possibly defend himself financially.
I can sympathize with the FBI serving him notice warrant to take the site down. But they decided to do more than that and seize all of his property, and now they don't even need to charge him with the original crime. If they can't prove that he violated these security statutes, they can charge him with pirating software or having obscene pornography or some other crime.
Our law system has become so incredibly bloated that it has become an embodiment of Cardinal Richelieu's statement "If you give me six lines written by the hand of the most honest of men, I will find something in them which will hang him."
Mr. Soghoian made the fatal mistake of being a poor nobody. Yes, he probably broke the law, but that doesn't really matter much in this country anymore.
I wish I could propose a solution to this. The best thing I can think of is to demand accountability and transparency from government. The government should respect its people, and the people its government. Sadly, neither seems to be true today.
...don't you?
No one is above the law. Not only that but everyone is entitled to equal application of the law. If it is shown that the law is being applied unfairly to one group and not to another, that invalidates any convictions.
The prosecutor has to show why the senator was not prosecuted or has to prosecute the senator.
http://en.wikipedia.org/wiki/Rule_of_law
Title 18, 1036, 1343, and 2318
Attempting to enter a vessel by false pretenses:
Fraud by wire:
Trafficking in counterfit labels:
Personally I think he'll be vindicated of everything. Pointing out a security flaw is not an attempt to enter a vessel, commit fraud, or traffick in anything.
2. "He broke a law, he should go to jail." The court system should be mandated to tell the jurors in all trials about their right to nullify terrible laws. Jury nullifaction is more than a priviledge, it is a right even greater than serving on a jury.
Jury nullification in this case serves no long-term purpose. Sure, it could get this kid off the hook, but that's about it. The possibility remains that a future jury will convict rather than let someone off.
On the other hand, strict application of the law and an appeal to higher courts could, however, result in it being thrown out through the principle of Judicial Review - causing this kid a whole lot of headaches in the short term, but helping others in the long term.
The best way to overturn harmful laws is often by strictly applying them.
As to this:
I find it outrageous that people are arrested for inciting violence -- the gun doesn't kill, the inciter doesn't kill, it is the person who physically performs a violent act that is the cause of the violence.
True, one who incites to kill does not commit murder, but he or she could be no less culpable.
Osama Bin Laden, for example, did next to nothing to actually plan, finance (his own personal fortune was long gone by the mid 90's, according to most estimates), or carry out the 9/11 attacks or any other attacks on U.S. national interests. He just provided the idea that Americans should be killed and gave a green light to a plan to kill Americans (not to mention a hell of a lot of people from other countries). Should we, then, not target him as he has only incited others to kill?
This was already posted like 26 hours ago. Talk about your short-term memory!
2 4231
http://it.slashdot.org/article.pl?sid=06/10/27/21
"On a scale from 1 to 10, people are stupid"
I sincerely hope that his actions will make us all a little safer.
It only helps that I'm an Indiana University alum myself.
Go Hoosiers! Beat the FBI, rah rah rah!
of criminal copyright violation at the very least. The unauthorized use of Northwestern's logo is what will do him in.
I haven't checked the cited sections of the US Code, but it doesn't appear to me that he violated any of the cited sections of the CFR. It's possible that a third party might have, without his knowledge, used the boarding pass generator to violate these regulations.
The CFR 49 regulations say that:
You can't make a fraudulent or intentionally false statement in any application for an identification medium. He didn't. Since he didn't hand a generated boarding pass to a TSA officer, he didn't make any application.
You can't make a fraudulent or intentionally false entry in a record that is kept, made, or used to show compliance with this subchapter. He didn't, as the generated boarding pass was not presented to a TSA agent to be used as a record.
You can't make a reproduction or alteration, for fraudulent purpose, of any report, record, security program, access medium, or identification medium issued under this subchapter. He didn't attempt to use a generated boarding pass to get through security or onto a plane, nor did he induce any third party to do so, thus he had no fraudulent purpose.
You can't tamper or interfere with, compromise, modify, attempt to circumvent, or cause a person to tamper or interfere with, compromise, modify, or attempt to circumvent any security system, measure, or procedure implemented under this subchapter. He didn't modify or tamper with a real boarding pass, nor make any attempt to circumvent the boarding pass procedure, so he's clear on this one too.
You can't enter, or be present within, a secured area, AOA, SIDA or sterile area without complying with the systems, measures, or procedures being applied to control access to, or presence or movement in, such areas. He didn't.
You can't use, allow to be used, or cause to be used, any airport-issued or airport-approved access medium or identification medium that authorizes the access, presence, or movement of persons or vehicles in secured areas, AOA's, or SIDA's in any other manner than that for which it was issued by the appropriate authority under this subchapter. He didn't use an airport-issued or airport-approved access medium or identifaction medium. He made his own.
America. Your government has figured out how it all transpired.
Go back to bed, America. Your government is in control again.
Here. Here's American Gladiators. Watch this, shut up. Go back
to bed, America. Here is American Gladiators. Here is 56 channels
of it! Watch these pituitary retards bang their fucking skulls
together and congratulate you on living in the land of freedom.
Here you go, America! You are free to do what we tell you! You
are free to do what we tell yo
Can you tell me what the relative advantages would be of GNUNet versus Freenet?
It seems like Freenet was basically designed for doing something exactly like this, yet it seems like Freenet really never took off for anything (besides some minor anarchism and porn). I don't pretend to know exactly why Freenet failed to take off, but how does GNUnet improve on it, and how does it hope to avoid the same fate?
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
Notice how in all this discussion, everybody is implicitly assuming that the watch lists are actually worth anything. In fact, I think the reason this hole has existed for several years without any problem due to them is that the watch lists simply don't make any difference at all.
Which raises the question: why have the watch lists in the first place? I think they are more psychological than anything else: they give the impression that there is a continuing threat, they give the impression that the government is doing something, and they make people willingly give in to controls that they previously wouldn't have considered. Remember: you used to be able to travel across this nation without the government being able to track your every step.
"He really did break the law?" I don't think so, but I'm not qualified to make that statement and neither are you. It takes a judge or a jury to say that. To me, it doesn't appear that he conspired to do any such thing. He simply wanted to public to realize how insecure it really was. It sounds like this law requires such intent. There is also the question of whether Northwest Airlines would be considered a Government agency or department for the purposes of this law.
You're going to be the first one I hang against the smoldering backdrop of a successful Revolution.
Freedom requires that people stand up, publicly, for what they believe in. That is why the 1st Amendment reads:
Simply striking against a convenient target does not get you any closer to being Free. Nor does it keep you Free.
Freedom is not safe.
Fucking... What the fuck. Who the fuck fucked this fucking... How did you two fucking fucks...
FUCK!
Even if he did break a law, and I'm a lawyer and I'm far from convinced that he did, this is a prime example of when the US Attorney should use some prosecutorial discretion and, after investigating the matter and being content with the subject's explanation as to what happened and why he did what he did, decide not to prosecute. The worst thing this guy did was act imprudently. No terrorists got on airplanes, nor could they have. The best thing this guy did, and I don't think there is any question about his intentions, is to bring attention to a security flaw. He took down the website when asked (maybe even prior to that) and nothing bad resulted from his actions. He had no intent to hurt anyone, no intent to steal or deprive anyone of property, and no intent to help anyone actually break the law. So, even if he could be prosecuted, he shouldn't be. Not everyone who breaks the law should be charged with a crime.
Stupid people make stupid things profitable.
The fact that he is going through this for pointing out a flaw is pretty horrifying. That said, hopefully the justice system will 'do justice' to keep this guy out of prison. Even still at best he's going to be pretty shaken up by this for a while to come, and probably be out a fairly sizable chunk of money in legal defense; at worst, he's gonna have a pretty horrible time (can't check punishments as all but final 2 of the USC links The Fine Summary are 404s). All for pointing out what should be a fairly apparent flaw in a 'security' system. I guess the guys at the FBI just like arresting folk for things like that. Hell, why didn't they arrest Andy Bowers of Slate for his research / article too?
Also, can some pro-2nd amendment folk go and give him some "legal defence"? You know, protect people from the government and all that... ;-)
If all you have is a grenade, pretty soon every problem looks like a foxhole -- MightyYar
What exactly is he guilty of? Generating a specific pattern of pixels on his screen, and enabling others to generate similar patterns of pixels?
I encourage all other security professionals to do the same.
In the darkness of future past, The magician longs to see. One chants between two worlds, "Fire, walk with me!"
Did anyone else notice that a judge approved the warrant at 2:09 am? Why were they so desperate to get that warrant that they had to wake up at judge at 2am? Seriously, where was he going to go between 2 and say 7? Perhaps this is standard practice, but it seems the FBI is a bit off on their assessments of him...
terrorist noun A person who uses terrorism in the pursuit of political aims.
terrorism noun The use of violence and intimidation in the pursuit of political aims.
I quote from his blog:
This is a case of classic police-state gestapo tactics.
This guy hasn't done anything wrong, he hasn't even hilighted a previously unknown security flaw, and now he's subject to this kind of treatment...
Specialist Mac support for creative pros, Melbourne
If him pointing out a flaw in the airline system is such a huge deal to the government, why don't we see this kind of response against people who point out flaws in computer code? Sure, we use airplanes to move from place to place, but computers are used to run those planes, not to mention just about everything else in this country now-a-days.
This guy should get a medal and the senator should get a severe case of ass-kicking.
Congressman Markey is either dumb or incomptent to believe that closing eyes and ears to gaping security flaws and loudly chanting *our security is perfect* *our security of perfect* will magically prevent them from being exploited by a do-no-gooder. For heavens sake, Senator Schumer pointed out a similar exploit and NOTHING happened to fix it. *our security is perfect* *our security is perfect*.
I wish Congressman Markey would get his HEAD out of his ASS long enough not to order a FBI crackdown on a grad-student but to say "thank you for pointing them out, even though we ignored them so long, we will fix them" instead.
Finally, if he claims that this way the evil-doers will learn about new way to compromise security... guess what Mr. Congressman, I highly doubt they say "I want to do evil, let's browse the internet for exploits" - the amount of criminal energy required to perform those evil deeds we want to prevent usually means they also know something about "researching your target" and "planning" - so you can bet your ASS (including your head) that they already know about this weakness before a grad-student or a well-spirited senator stumble over them.
+++ MELON MELON MELON +++ Out of Cheese Error +++ redo from start +++
On the raid again
Just can't wait to get on the raid again
The life I love is makin' mess wherever I am
And I can't wait to get on the raid again
On the raid again
Goin' homes that I've never been
Takin' things you'll hardly ever see again,
And I can't wait to get on the raid again.
The standard case for equal application of the law is actually quite old but is still the standard precident.
http://islandia.law.yale.edu/sela/mendoe.pdf
"1) The United States. As is well known, Paragraph 1 of the Fourteenth Amendment of the
American Constitution establishes the principle of equality: ANo State . . . shall . . . deny to any person
within its jurisdiction the equal protection of the laws.@ This principle, known as the AEqual
Protection Clause,@ operates in a concerted fashion with the Thirteenth and Fifteenth Amendment.
According to the Supreme Court, the Equal Protection Clause requires reasonability in administrative
classifications. The case traditionally cited for the constitutional doctrine that the application of the
law can violate equality is the 1886 decision in Yick Wo v. Hopkins. In this case, the Supreme Court
argued that the municipal ordinances of San Francisco were applied against the Chinese petitioners
Awith an interpretation so unequal and oppressive that in practice it comes to constitute a denial of
the principle of the equal protection of the law on the part of the State.@10 This doctrine has never
been modified by the Supreme Court. The American model embodied the doctrinal and
jurisprudential interpretation of the Equal Protection Clause, eloquently shows that equality demands
equality in both the application and the content of the law."
In other words, the senator and the researcher must both be prosecuted or neither may be prosecuted unless the prosecutor can show that there is some material difference between the cases.
Have any of you ever considered there may be honeypots out there? Although well meaning, exposing a honeypot is not helpfull.
One man's researcher is another mans troll.
I personally think the guy was an idiot to do what he did. Sure, he has a good point but he could have gone with far different routes and been far more successful. For example, go contact a major press outlet. Go talk to NYT, Washington Post, USA Today. Say "Hey, look at this - I think this is important and I want to get the word out." For one thing he'd have a lot of backing and a lot of legal advice right now.
Overall he's just a troll IMO. He just walked into a room with an open flame carrying a can of gasoline and started yelling, "HEY THIS IS DANGEROUS!" Yea. No shit Sherlock. If you're surprised how this has gone down, you got a lot of learnin' to do in this world Mr "Security Researcher"
Who wants to host a copy of the script on their website?
Just think, if we can get a couple hundred sites hosting it, everyone can get a new front door in a few weeks. Oh, and all that old computer equipment you want to get rid of, but don't have time to take it to the correct recylcing center, just leave it in the middle of your living room (after you've moved all the good stuff to a friends house).
Seriously. You saw the options.
Get the hell out while you still can.
I can't believe the government is so upset over what si literally a fill-in-the-blank HTMl generator.
ANYONE who knows HTML can fak a printable boarding pass AT ANY TIME. Hell you don't even need ot know HTML if you're good at photoshop!
Why was his really even classified as big news to the security community?
It's so dumb that it's laughable. I mean if this was in curt I would like to be up on the witness stand with a laptop justs o I can show the judge or jury how easy it is to fake not just this boarding pass, but any. Or fake anything printable online for that matter.
People need to wake up and realize anything printable is easily forge able. if it isn't later checked against some kind of database.
I mean, all he really did is expose flaws in the process (that the guards didn't barcode-scan the passes).
Forging the passes is mindless.
Hell, why didn't they arrest Andy Bowers of Slate for his research / article too?
Would that be "because Bowers didn't create a website for forging documents"?
That's just a guess.
Clear, Dark Skies
Damn... I just don't know what we can do to fix this anymore. I'm honestly beginning to wonder if there's any chance of getting our freedom back. And the media coverage of all these problems? Nil. How in the world do we get enough people to notice, at this point? Also, are we college students really so apathetic now? The draft for the Vietnam War started riots, but there's next to no noise on campus over these problems - even at liberal schools... I haven't lost hope yet, but how can we get the people of the United States to start caring again?
announcing that the emperor has no clothes and releasing a swarm of cloth-eating moths into his closet.
If all he had done was publish a paper or document the concern he'd be highly respected. But, instead, he took the hacker's approach of releasing an exploit in order to force them to close the hole.
Except, in this case, the exploit was in violation of federal law.
Clear, Dark Skies
The chance of them knowing is the probability of them finding the information multiplied by the probability of knowing the value multiplied by the probability of producing a workable exploit.
The chance of you knowing if they know is the probability of them knowing multiplied by the probability of you knowing who the bad guys even are, multiplied by the probability of obtaining real information (they can jam anyone monitoring them by flooding the information space with junk information), multiplied by the probability of you knowing you even have real information, multiplied by the probability of being able to determine what the information actually means.
Counterintelligence is an exceptionally difficult field with a painfully poor track record. Most published successes have been by a series of sheer fluke events and staggering luck. Most published failures were unlikely to be anything else. We don't know about the unpublished stuff, but percentagewise, are we more likely to see bragging over achievements or failures, if both can be equally hidden?
I'm not saying that everything should be published, merely that it should not be assumed that not publishing is the same as others not knowing.
Now, can a case ever be made for publishing everything? Yes. Game Theory requires that all "full information scenarios" have a strategy for one side and one side only that will ALWAYS result in the winning conditions being met, no matter what the other side does. It is possible to imagine situations, particularly in computing where there is essentially no randomness and a "full information scenario" is possible, where the outcome can be guaranteed, if you want it to be.
No matter what anybody else might say, it is not the job of an enemy to make your life easy, so we shouldn't expect them to. We should expect them to do the researcxh, the legwork, the analysis to figure everything out. They might indeed just wait until someone tells them, but that should be a bonus. It should not be your modus operandi. In computer security, you must assume that there are opponents out there who could have all of the industry-standard backdoor passwords, a complete printout of every Operating System and network device QA test that failed and got overlooked, and a copy of the highest-end vulnerability scanner the commercial sector has going for it.
Hell, we know that a Russian spammer got a tier-1 backbone provider to turn off Blue Frog's Internet connectivity. Turning off a link like that is very traceable, but appears to have been regarded as mere amusement for the backbone provider. The same provider is hardly likely to show scruples when it comes to handing out internal or commercially-sensitive data, software or anything else. Given the repeatedly low scores on security for many US government departments and the almost routine mishandling of classified data, there are probably those in the information black markets who know more national secrets than the entire White House combined. If one backbone provider is riddled with corruption and pwned by organized crime, then we must assume that such people are unlikely to be avoiding big money out of a sense of decency and moral fortitude.
But if the most dangerous people have the most dangerous information already - and that includes whatever terrorists might actually exist - then most of the obscurity only serves to increase the value of what has already been stolen. This makes the thieves rich, the criminals dangerous, and the politicians popular for appearing to do something, but it doesn't make anyone else - users, vendors, bystanders - any better off at all. Illusions are fun on the stage, but they should be left there.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
When it comes to something as critical as a large airline's boarding and security system, there is no excuse for what Christopher Soghoian did. If he truly wanted to do the right thing, he would have contacted Northwest Airlines and provided them the details of this exploit. Then, after it was fixed, he could publish his information and get all the credit/glory he wants. Now, he's in a shitload of legal trouble, and looks like a jackass in front of the world for being too arrogant to help a company when they really needed his information. His actions exposed a temporary security threat to the air travel system, that could have been exploited in the very short time it was available. I'm not saying that he should go to prison for this, or that the search of his house was justified. But he is *not* a hero, and his actions were dishonorable. Considering his level of education, he should have known better.
So, when you have 25 people on your "friends" list, you'll publicly reveal your secret identity? Or 50? Or 100?
They may not have covered this in your history classes, but if we had lost the war, the British would have rounded them up and hanged them for treason.
Freedom is NOT about being one sheep in a flock.
There were 56 people who signed it. They signed their names. The British would have no trouble at all hunting down 56 people. Particularly since many of them were known to each other.
Really?
Then those 30-40 other "researchers and professors" will be standing up
In the fight for Freedom, 56 people were willing to sign their names, knowing that they were signing their death warrant if they lost the war.
Now, you're advocating that one guy, fearing a court case, should hide until he can find 29-39 friends to publicly demonstrate that a process is not very secure at all and could allow bad men access to airplanes.
Let's see
Somehow, I don't see the problem here.
And who told you that Freedom was easy or safe?
Our forefathers believed that it was better to die Free than to live under tyranny. I agree with them. Whether or not 30-40 other people agree with me. This is about Freedom, not popularity.
He broke the law. The law doesn't pronounce you innocent because you have good intentions, and the prosecutor won't have leniency. His best hope is to convince the jury that he shouldn't go to jail because he had good intentions, but the prosecutors will probably do a better job of convincing the jury that he should.
If I were on the jury, and the facts pointed to convicting him, I'd have to vote to convict, despite his good intentions.
http://www.fakenamegenerator.com/?gen=male
President George W. Bush signed today a new law limiting how much oxygen each american can consume per day. Anyone passing their limit must hold their breath for the time remaining until their next quota.
"For those who consider themselves unable to hold their breath for extended periods of time can now purchase 'air units' from the govermental environmental enforcement agency" stated president Bush after signing this historic bill into law.
When asked if anyone had any questions for him no one replied since all the news press seemed to have passed out on the floor and misteriously turning blue in the face.
I know this is sort of the long way around to coming to a point but it is this: When everything has been made illegal then everyone will always be breaking the law no matter what they do. It is only a matter of finding something even remotely plausable when some individual becomes bothersome for the powers that be to be able to but him or her away somewhere.
A bad analogy is like a leaky screwdriver.
http://www.lockpicks.com/
There are lots of these places around. They don't hide; generally they'll sell you stuff without problems. In most places, lockpicks, along with crowbars, hack saws, bolt cutters, slim jims, glass drills, etc. are perfectly illegal unless there is some reason that someone thinks they're going to be used for a crime, in which case they become "burglar's tools."
Aside from the fact that I think this is really terrible law -- it puts far too much interpretative power in the hands of the police, inserting ambiguity where there really doesn't need to be any (the crime itself is already illegal, whether you use tools to do it or not shouldn't really matter; if we want to discourage people, why not just make the punishment for the actual crime more severe?) -- it still requires some indication that the tools are going to be used for a nefarious purpose before they become illegal. I used to have a slim jim because I drove a car that had a bad habit of locking itself up automatically, and it was perfectly legal. Likewise, anyone who's ever installed a fence probably has a pair of large bolt cutters in their garage. Yet if you put those same bolt cutters in the trunk of your car when you were driving around the wrong part of town, you might find yourself in hot water.
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
But Senator Schumer detailed this weakness more than a year ago: http://www.senate.gov/~schumer/SchumerWebsite/pre
So what, exactly, would one have to do to draw attention to it, beyond having a Senator describe it in detail on a government website?
and the Executive Branch just got more power...Weeeeeeeeeeeeeeeeeeeeee!!!!
I want to go there.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
Did anyone here vote on that law? Does anyone here know anybody at all who voted on that law?
My guess is no. Whatever law this was was passed in vacuum, rendering it null and void.
I think I'm going to start passing out my own laws and passing out my own fines, summons, and warrants. If I can (and I can) pay for my own police force to enforce them (as a secret police) then more power to me.
The fun part is, I'm not going to publish these laws in any public library where you can get access to them. Oh, I'll have a copy here, for sure, but you'll have to travel thousands of miles to read it. Woe to you for breaking these laws you have no idea what they are.
Go into any public library and ask for a set of law books containing the current laws. Good luck. They don't have any. That's right, they have no obligation to publish them for public access. The only place you'll find such things are in private law libraries. It hasn't been until the rapid evolution of the internet and the ubiquitous web interface that we hear about these appalling backroom schenanigans, lies, and goings on by corrupt politicians and lawmakers.
Except it's not actually a right under the Constitution. It's a de facto power and it's debateable as to whether it has any Consitutional merit.
don't make a tool to DO it
you do sound as if you think the guy spent five years of his life to "make a tool" -- as far as I can read into the story, it is a bit of regex hacking in URL name to replace one name with another!
If this is going to escalate any further, expect t-shirts with 3-line Perl scripts and taglines "this helps terrorists!?"
"Tools" (in your definition) are too easy to make...
Paul
What law did he break? And why hasn't Senator Charles Schumer been arrested for making a public press release about the exact same thing in February 2005?
According to this Northrop Grumman security expert, "Bruce Schneier, a security expert who has done significant work for the US government, wrote about the exact same flaw in 2003".
So please, why would you be compelled to vote "guilty" on the jury?
I have been rather disturbed by the proposed fence on the southern border. It is not at all clear to me whether its primary purpose is to keep illegal immigrants out, or to keep me in should I decide to try an escape on foot in the future as this country becomes ever more oppressive. Of course, Mexico is worse, so surviving the trek across Mexico would be a long shot. But still, I don't like seeing my options reduced.
Schumer today laid out the following scenario in which someone on the terrorist watch list can get through airline security undetected:
1. Joe Terror (whose name is on the terrorist watch list) buys a ticket online in the name of Joe Thompson using a stolen credit card. Joe Thompson is not listed on the terrorist watch list.
2. Joe Terror then prints his "Joe Thompson" boarding pass at home, and then electronically alters it (either by scanning or altering the original image, depending on the airline system and the technology he uses at home) to create a second almost identical boarding pass under the name Joe Terror, his name.
3. Joe Terror then goes to the airport and goes through security with his real ID and the FAKE boarding pass. The name and face match his real drivers license. The airport employee matches the name and face to the real ID.
4. The TSA guard at the magnetometer checks to make sure that the boarding pass looks legitimate as Joe Terror goes through. He/she does not scan it into the system, so there is still no hint that the name on the fake boarding pass is not the same as the name on the reservation.
5. Joe Terror then goes through the gate into his plane using the real Joe Thompson boarding pass for the gate's computer scanner. He is not asked for ID again to match the name on the scanner, so the fact that he does not have an ID with that name does not matter. [Since Joe Thompson doesn't actually exist it does not coincide with a name on the terrorist watch list] Joe Terror boards the plane, no questions asked.
Based on the above press release by a US Senator, shouldn't Schumer be charged with similar crimes?
Edward Markey is your representitive, send him a message: http://markey.house.gov/
m l?tw=rss.index.
Here is a copy of what I sent him:
As a Computer Engineer at the University of Utah, I commonly read articles from technology oriented magazines. I recently came across this article: http://www.wired.com/news/technology/0,72023-0.ht
I'm also active politically, and a lifelong Democrat. Is the characterization of you in this article fair? Are your positions intentionally being misrepresented to alienate your base? If this is an accurate depiction of your stance--- I feel your position does not in any way represent the spirit of our free society, and the Democratic party. I would hope, upon further inspection, you would have the humility to reverse that position.
Mr. Soghoian may himself be a rather talented computer scientist--- but it would not take a talented, or advanced, computer scientist to forge boarding passes using Photoshop. I think my Grandma possesses the technical expertise to do so. Mr. Soghoian's software only illustrates capabilities enemies to our country absolutely already have thought of, and developed.
Often, security exploits will come out for Microsoft Windows. The discoverer, being a decent human being, would often report it to Microsoft in full. In the past, Microsoft would wait for an inordinate period of time to issue a patch. In the meantime, other more nefarious people would learn about these exploits independently, and use them to their advantage.
Eventually, the initial reporter would become so frustrated about the inactivity--- that it became clear the only way to prod Microsoft to issue some kind of patch to protect its users, would be to fully disclose the exploit to its users. Nefarious individuals, this entire time, exploiting it for personal and financial gain.
Microsoft's initial response to this was to try to silence reporters through threats of lawsuits, or criminal prosecution. This would clearly have a chilling effect on any other potential reporters wanting to deal with Microsoft in the future. Microsoft wasn't as interested in actually securing its operating system, but instead simply giving its users a false semblance of security.
Do you want to make a chilling effect to alienate technologically knowledgeable Americans from the United States Government? Mr. Soghoian's software does not aid terrorists, it reveals nothing that certainly wasn't already known of. It only replicates functionality that could be reproduced by any Grandma with a 40 dollar scanner, and Photoshop.
This is a production of a concerned American citizen, to illustrate to other American citizens a danger we face. It was made to prod an inactive republican majority in congress, and a republican controlled executive, to take 'real' action to protect our airport security. A danger, that so far, our political organizations haven't acted upon.
The current administration seems completely reliant on frightening people, and espousing their supposed commitment to national security to alleviate these fears. In reality, they have done very little for homeland security, and are the most likely to actively support Americans who are experts in these various fields being made criminals, and silenced, for attempting to remedy security issues.
I'm certain you're concerned with protecting the security of American families. The best way to go about this is to rely on the talent, and good intentions of concerned American citizens--- not to alienate and criminalize their free speech.
People like him can not be tolerated.
Off to Gitmo with him!
Skip ------ See the latest from http://www.anArchyFortWorth.com
His blog already talks about how he learned to show up with no government issued ID and get bumped to the front of the security line. If it is also possible to change your boarding pass to read "Boarding Group 1" or whatever goes first, traveling can be made a lot easier.
Unless he used false documents to bypass airport security, or the government can demonstrate that others did, it's going to be tough to make a case. A security researcher publishing an embarrassing hole in our False Hope brand security system right before a pivotal election...his lawyer should have a field day with that one. It's going to be tough to prove intent and all it takes is one of us on the jury. It would be goofy to take this to trial.
Instead of fixing the glaring hole our tireless defenders of the homeland instead expend a huge amount of time and government resources to attack the messenger. Brilliant. The icing on the stupid cake was breaking the window instead of just getting a locksmith. That genius strategy had to come right from Gonzales. No underling could be that ignorant and not have the idea slapped down as utter stupidity. No, the really stupid ideas have to come from way up. High enough for anyone with a mortgage to be afraid to point out the obvious.
But none of that will matter to the right wing. There doesn't seem to be any new data or weight of evidence that will make them change their mind. Amazing in their intractability.
That's our life, the big wheel of shit. - The Fat Man, Blue Tango Salvage
We won't be ANY safer after Christopher's work. Not because he was wrong about his claims but because he is right. We only have security theatre.
No rational allocation of resources would have beefed up passenger screening after 9/11. I don't care if you do get a AK-47 on a plane nowadays you won't be able to hijack it and crash it into a building for the simple reason that the people on the plane KNOW they will die if they let you fly the plane.
9/11 was a one time deal. It worked because no one expected terrorists to fly planes into buildings. After 9/11 any hijacking would end like flight 82. While this would be a horrible tragedy it would be far easier to create such a tragedy with surface to air missiles, gas attacks in subways or a hundred other ways we aren't guarding against.
The real risk now is new attacks not a repeat of 9/11. We should be spending our money securing chemical plants or defending our water supply not inconveniencing people in airports. Any security in airports beyond pre 9/11 levels is nothing but a show designed to make people think they are safer while wasting resources.
Christopher is showing that the post 9/11 security measures are total theater. He isn't being arrested because he put people at risk, he is being arrested because he made uncomfortable.
If you liked this thought maybe you would find my blog nice too:
I think an often overlooked factor in cases like this is the fact that the IT security community's tactic of publicizing security flaws in order to increase security is totally alien to most law enforcement agencies and the general public.
/. are well aware of the fact that government agencies, like corporations, are generally slow in fixing security flaws unless publicly shamed in doing so. To the average man on the street though, publishing exploits, workarounds or tools designed to get around security features probably seems cavalier at best, if not downright criminal.
Most citizens and law enforcement officers probably operate under the assumption that agencies like the TSA are generally open to fixing flaws pointed out to them through private channels. We on
I think the security industry needs to come up with some way to educate the general public about the basic premise behind publicizing security exploits. With 30 seconds of education, I think most people would see why security researchers have to resort to using this tactic and would probably agree with it. In the absence of that sort of education however, folks like Soghoian will simply be branded somewhere between attention whoring annoyances and terrorist sympathizers.
I think the real question is why wasn't the senators house raided to see if some further evidence that might allow a charge could be found? It is a clear cut example of violation of equality before the law -- allowing the executive branch to choose to get a warrant and make your life hell if you are a verbose researcher but not do the same if you are a talkative senator. But can such a clear violation be used as a defense at trial?
...then you have not been paying attention.
Any one else find it frightening that it has come down to where we are asking the government permission to enter a plane?
I had a discussion about this with a friend from work the other day about this very topic. He didn't seem concerned about the eroding of our freedoms.
Checking identification does not stop the criminals. It just forces them to go the extra step to steal your identity first. If the potential terrorist enters a plane without weapons then they are not a threat. If there are crew, passengers, and hopefully a marshall, on board willing and able to subdue any one that poses a threat to people or the plane then they are not a threat.
Checking for knives, guns, and explosives before entering a plane makes me feel safe. Checking my identification before I have done anything wrong makes me feel like I have had my freedoms eroded.
"Uncle Sam? May I please get from point A to point B?" "Papers please?"
I am armed because I am free. I am free because I am armed.
If this dude had simply put up a site that said "I made a fake boarding pass, here's how I did it, and maybe here's some suggestions to fix the problem", I'd be sympathetic to his cause.
Instead, he put up a website that said (or so the articles claimed...I wasn't about to go to such a site using my own machine) "I made a fake boarding pass, here, let me make one for you too with this website".
Look at it this way. If I discovered an easy way to make a working key to your house without your knowledge or permission or one of your existing keys, made one for myself, and then demonstrated for you how it was done, you'd probably be greatful and take steps to fix the problem. However, if I found a way to make such a key to your house, and sat up a machine three blocks from your house that allowed *anyone* to make a key to your house for free, I bet you'd be a bit less greatful, eh?
Do I think he should see jail time or a major blotch on his record? No. But do I think he should be tossed out the door with no consequences, its never mentioned again, and he's treated like a hero? That would be a "no" too.
I want a new quote. One that won't spill. One that don't cost too much. Or come in a pill.
"But none of that will matter to the right wing."
Way to toss in a tangential jab at The Hated "Right Wing". Every career politician in Washington wants to appear "tough on terror" (or on whatever else the emotional public thinks they should be tough on). Perhaps you forgot or are conveniently ignoring this, but the one thumping his chest and sucking up to the Bush Administration (Markey) is a Democrat. Not that there's a big distinction between the two controlling parties anymore.
The important point you raised (inadverntantly and unwittingly, by unintended satire) is that this mindset is no longer "Right Wing", but is becoming mainstream. That is to say, fearmongering has served its practitioners well. Markey's action is thoughtless, selfish, imprudent, and irresponsible. But his throwing literally years' worth of legal trouble at some well-inended student is nothing compared to the fearmongering, which is in turn nothing compared to the actual damage it has caused. The lazy and impressionable public is frightened because they are told they should be. If a charismatic public figure had espoused cool-headedness and restraint, emphasized thoroughness and dedication to law enforcement and the preservation of freedom, they'd have lapped that up too. It just doesn't matter to them! Politicians have everything (read: power) to gain from fearmongering.
"There doesn't seem to be any new data or weight of evidence that will make them change their mind."
That statement applies to (almost all) politicians. They're partisans; not scientists. They care about forcing their opinions and values on others; not about fact, truth, or knowledge. In fact, those things often impede politicians' endeavors.
You missed Title 18, Section 2: Principals.
and Title 18, Section 371: Conspiracy to commit offense or to defraud United States.
I'm not familiar with the legal definitions, but I'd hope that at the very least someone would have to actually use his generator to commit a crime for him to be punished under section 2, or that he'd have to communicate with some specific person about commiting a crime for him to be punished under section 371.
Posts like this make me laugh. Although you might not be completely against this idea that you put forth, you definitely aren't for it. You probably just post this shit to piss people off.
yes, but. Politicians have no brains, so they are not eligible for thought crime prosecution. Somehow, citizens are.
FairTax baby!
I'd sure like him to scan the affidavit of the FBI agent which was made in support of establishing probable cause for the search warrant. He should have it.
Stupid people make stupid things profitable.
No, Mr Soghoian's little PHP script saves would-be terrorists (who have no doubt known about this stupid flaw, just as the government has for years) maybe at most 20 minutes in front of photoshop or 20 seconds with notepad:
The point, I feel, was that people did not yet understand exactly how worthless watch-lists were just from a few paragraphs from an expert's report on how a terrorist "could" do something. With the example the PHP script provided, even idiots can appreciate how dim-witted the situation was.
Just like it is not illegal to disclose a software security flaw, but it is illegal to write a worm that exploits it.
Sometimes, mere "reports" of "theoretical" attacks are just too boring to the OS vendors. I liken it more to the "proof-of-concept" hacks which are written to prove security vulnerabilities exist and to bring the threat out of theory and into reality. This prompts a response from the OS vendor because only NOW do they have to take it seriously...
Since 2003, the problem has been outlined by several experts through official, public, and private channels to the relevant authorities and government officials. However it's remained the way it is without any apparent effort to remedy it.
Either they want to improve security (apparently not), or they can choose to leave watch-lists as they are, completely worthless. Chris is right: it's just theatre.
It seems whoever has the power and authority to fix this problem is either lazy, or incompetent, or both. There would have been no hope for improvement. What Chris has done is forced them to either fix the problem or continue to bury their heads in the sand, and divert attention from themselves by persecuting Chris for bringing shame to them by pointing out their incomptetent management of airport procedures.
It seems they aren't interested in security, just public opinion.
If anyone has been helping the terrorists, it's the idiots who have known about but haven't fixed such a gaping flaw in their security procedures for nearly three years now.
No jury on the planet would ever convict him, hopefully he won't be charged with anything. He's a whistle blower. But the Oval Office and Congress don't like to be exposed as what they are... corrupt & incompetent. So they send their dogs to scare him, as a message to the rest of us "Citizens", "Shut your fucking mouth, don't critisize your Goverment or we will fuck your life up!" And if you have any doubt about whether this was a blatant scare tactic and a complete abuse of Federal Goverment Power, here's a simply question, "Why do this in the middle of the fucking night to a Phd Student? An Academic!" In "America" Citizenship no longer entitles you to a trial by a jury of your peers(hey that citizen is an enemy combatant) or limits you being held without a charge. And now, The president can declare martial law ,nullifying some of the most important protections in the constitution againts using the fucking Army against Americans!
Why?
Because the Republicans are pussies that are scared of terrorists ... and are willing to give up the whole point of America, freedom. The purpose of starting America was NOT to be safe it was to be fucking "FREE".
The Republicans failed at protecting the borders (incredibly simple) and failed in airport security.. (all the luggage isn't scanned) .. and they want to punish anyone who points that failure out.. like him. He's making the President and Congress look really stupid and incompetent, that's why the FBI is storming into his house in the middle of the night.
When the Democrats have the Oval office and Congress .. hopefully we'll return to some semblance of Freedom again.
Next time you hear some PUSSY on TV say that its necessary to sacrifice a little freedom for safety, remember this my friends... http://libertyonline.hypermall.com/henry-liberty.h tml
Security is a joke in airports.
I was a airplane re-fueler at Edmonton International Airport post 9/11 (Shell Aerocenter 2002-2003) . I can tell you this. EVERY refueler and most baggage handlers carry knives or a multi-tool (ie. leatherman) of some sort. So do many pilots. Why is this? We use them to lever open hatches, latches, open your bags for the video cameras ect. (I shit you not. I know several guys who carry those little keys that fit the little locks on your bags so they can poke around in your bags) It would be a snap for some one on the inside to plant a knife. Or even a small gun.
But how do you get past security you ask. I'll tell you. We don't. We have our own entrances and exits and these don't use metal detectors or our steel-toed boots would set them off every time. The only thing that is our security check is our id tags. Sure we go through an extensive process before we are issued one but there's lots of criminals working at your airports. That and they aren't that tough to forge. If you have a "friend" at your local DMV you could probably do it.
So security is tight at the terminal? You can charter a small to large plane at your local FBO. We never check you or your bags. Why would we? We think you are some rich guy who jaunts around on his private jet. Perfect for loading with explosives and plowing into buildings on you jihadic quest.
But what about the regular people who go through security? Did you know that you are allowed 10 packs of matches but no lighters? I can do a shit load of damage with ten packs of matches and I'm sure you could too! Oh yeah the metal detectors that you walk through aren't sensitive enough to pick up a bic lighter. If you get caught with one. Just say oops, my bad I forgot about it and make sure they see your pack of smokes. They'll take the lighter away and thats it!
If you are worried when they swab your laptop and you've been chopping some of columbia's finest ontop of it don't worry. They are searching for bomb residue. But here's a secret. They don't swab your MP3 players, video cameras, and cell phones. They just scan them with the machines. I'm not sure how many ounces of high explosive you fit in a video camera but i'm guessing it's a fair amount.
What about sniffing dogs? I fly all over the place to meet up or disembark from ships. I can't remember the last time I saw one. Why? They are a bitch to train. (pun semi-intended) Something like one out of every 20 makes the grade. And THEN they are split up for K-9 tracking, bomb sniffing, narcotics, sniffing, blind leading ect. The odds of running into a dog is pretty slim unless ou are at one of the well funded big airports. (LAX, Heathrow ect.) Most of the guys who I work with on multi-national ships regularily bring some drugs home. Not alot, but a few grams to help make the welcome home party a bit more welcoming.
These flaws are just a few I could think of off the top of my head. So whats the point? If you are creative enough (and hackers prove this regularily) and determined enough you can get past and security thats in place. Especially when it's so shoddy like it is at our airports.
So to be honest some one forging a boarding pass should be the least of their worries. Happy flying!
Hee Hee The drinking bird does all the work!
This looks more like a political issue then a concern over securty. Becose if it was a concern over securty the congresman who called for the arrest of the phd student would have called for a fix into this securty flaw insted. It is quite obvius that he didn't do the second option, but that only exposes the political nature of this matter. Arresting the pepole who find the securty hole never solves anything, that is a fact.
It is also a fact that this congresman should not be in office, behaving like a idiot and whatnot.
I could be wrong, but an FBI raid seems absolutely disgusting - because they knew perfectly well he created the software, since he had gone public with it. I don't know, but I imagine the source code was available? So what possible need was there to break into his house, semi-ransack it and take his computers and other possessions? you all know or can imagine how he feels now - it seems to me like the State, through the FBI, is *oppressing* people; the message in their actions is "break the law and we'll fuck you over."
There's a big difference between explaining how to circumvent security procedures and actually materially assisting in the process by providing forged documents.
Hmm. So he is charged with conspiracy?
Does Senator Charles Schumer qualify as a co-conspirator?
do you mean he planned to lie to the government about the pass being insecure? Say "Nah, I was making that up, it really is safe to use. Honest".
If you mean lie by create a false document and use that to get in the airport, that isn't the case for at least two reasons:
1) He'd be lying to the private airport security or airline.
2) It's hard to lie to someone when you've said in public "it's easy to lie to the airport security if you do ". People take notice and security will look out for this guy. Obviating any lying possible
if it is because an unknown third party could lie, then you'd have to *prove* that there was a third pary and that there was collusion between this person and this guy. If that is going to be needed, the fella is fairly safe and secure.
I mean the bills being passed aren't being read by the senators and who has the time to read ALL the laws?
If sneators can be excused incompetence in their job reading and affirming bills because there are too many, too complicated and too long, then we as citizens can be excused not knowing laws for the same reason.
When was the last time that you got a leaflet saying "the laws passed this year are:..."?
And with cash (it is merely a promissory note) it has severe repercussions on the value of all notes if it is known that there are fakes out there.
If there are similarly severe repercussions from this loophole, then whoever should have fixed the hole over the last 3 years it has been known about needs to be done for terrorism. The ones exercising authority to persue this one person rather than fixing this hole needs to be jailed and the senator asking should be jailed for incompetence and wasting resources that should be used in fixing this problem.
Every time I read /. I end up reading through these type of articles and every time I wonder...
:(
My mother, normal central European woman of 60 something years in age, knows nothing really about technology, yet she realizes how making a weak spot known to the public would result in any central European government to fix it, because someone would find a way to get some financial profit out of the hole in the government organizations. It's kind of a hobby for all central Europeans, try to get some money back out of the government. We do have much higher tax percentages here, so we deserve it. The point I'm trying to make here is that we seems to have a different attitude here then in the USA, and I'm very glad we do. It really sounds like you're all dropping deeper and deeper into the totalitarian, Orwellian even, hole there. Has anyone ever thought of either re-educating the old, spiderweb covered brains of most of the senators and politicians there? On internationally published news here in Europe I never seem to see any US politician who isn't at least in his 60's or 70's. Lately here in Europe, the political streams have seriously renewed themselves and added loads of young, or at least younger, political names to their voting lists. Maybe that's something that might start changing the attitudes there? To put people whom actually know what they're talking about in the security/government places?
Just watching the "American theater" of degrading personal freedoms... It's entertaining, in the same way that seeing images of a war is entertaining. But you still realize that war might get to your front door at some point...
It strikes me that if this situation was indeed allowed to developed unchecked (i.e. people NOT flagging rigged elections, companies doing as they please, finance companies rampage over the population, politicians starting wars abroad to deflect attention from a defective health/social system) it would pretty soon come to a grinding halt by the sheer weight of competing interests and a total destruction of any productivity.
:(.
The problem is that millions of innocent people get dragged down with it, and so they rightfully object, thus delaying the inevitable.
I agree with you that (a) the cancer might spread and (b) younger politicians may change matters. I just can't help feeling that it's all a bit beyond salvage by now, it seems they're more in need of a revolution then an election
After thinking about this awhile, I think the best approach to actually get the TSA to do something that would actually work, instead of just mask the problem and "make it go away", is for 10,000 or more of us to do the same thing. If anything, the DHS should be thanking the guy, not hassling him. What a backwards system! Thomas Jefferson was right, this Federalist approach will only seek to divide the country when Liberty is thrown out the window. Time for another revolution, and a much smaller, weaker, federal government. One that respects our rights as citizens, and restores liberty. Bryan
Great Slashdot, now because I actually read the original article the FBI is going to be looking into all of us...
From http://www.schneier.com/blog/archives/2006/10/crea te_your_own.html
/ osama-boarding-pass.jpg
1 7B
/* Output the image */
Image of a doctored boarding pass:
http://photos1.blogger.com/blogger/6601/1598/1600
Here is a very quick PHP hack to edit a boarding pass template. Edit the boarding pass above to white out the areas to change and save it as nwa_pass.png. This code can be called with:
bp.php?name=Tom%20Tuttle&date=29OCT2006&flight=US
There should be enough fields here that even non-PHP programmers get the idea.
A web server with PHP and GD are required. Wrap this in standard php opening and closing brackets.
ATTN: FBI Agents -- this took about 15 minutes. Anyone with any amount of PHP experience can do this.
$pass = "nwa_pass.png";
$name_loc = array( 202, 138 );
$date_loc = array( 55, 230 );
$flight_loc = array( 55, 250 );
$name = $_GET['name'];
$date = $_GET['date'];
$flight = $_GET['flight'];
header("Content-type: image/png");
$im = imagecreatefrompng("./" . $pass);
$black = imagecolorallocate( $im, 0, 0, 0 );
imagestring( $im, 4, $name_loc[0], $name_loc[1], $name, $black );
imagestring( $im, 4, $date_loc[0], $date_loc[1], $date, $black );
imagestring( $im, 4, $flight_loc[0], $flight_loc[1], $flight, $black );
imagepng($im);
imagedestroy($im);
I have not looked a a print your own boarding pass in some time. But I seem to remember they have logos, Tradmarked words, and would be a copyright docment. So if all they Terror and the like charges do not stick. Could they infringment charges (some civil some criminal) be brought to bear.
Note that ANYONE can pay a nominal fee (~$25 IIRC) if they really want to get past the screener's boarding-pass-check legally to meet someone on an incoming flight or escort someone on the way out. Ask any airline reservation agent. It happens all the time when small children travel alone on a flight: The parents want to go all the way to the gate.
The whole reason that boarding passes are checked for a matching name is not for security, it was a move to protect airline revenues.
This stops someone from buying up tickets for cheap and reselling them to others.
This is an issue which has been pointed out for years on the various frequent flyer forums out there.
Bring back the old version of slashdot.
That if this guy didn't post a tool that automated the process enough that an FBI grunt could use it, the issue probably never wouldve gotten the respect it deserved? The fact that any joe can do this is what finally gave the problem the attention it needed.
"Those who would give up Essential Liberty to purchase a little Temporary Safety, deserve neither Liberty nor Safety."
-Benjamin Franklin
an enemy combatant and make the whole mess just go away. And while he's at it, he should shut down the NWA site too, since that's where we can get the means to create the false boarding passes. NWA is obviously conspiring to help terrorists and should be shut down too. Furthermore, whoever created the NWA website should be thrown in the slammer too.
"I don't know why I bothered to type this in."
Why public release of security holes before they are fixed is bad:
Everybody knows already (a) that people who are doing this are not hooligans, they just want to create public awareness and public pressure so the hole is fixed (b) that the public release of the security hole increases the chance of using this hole.
The question is whether the benefit of (a) outweighs the dangers of (b).
I present an important aspect of addressing this question.
In plenty of cases security hole is already known to the people who are responsible for fixing it. Like in this case. Why they are not fixing it then? Simple answer is lack of resources. If you have a castle with a particularly weak door, that can be fixed only in a month, the information of where is this door, and which door is weak will only help the enemy, it will surely create a public awareness in the castle, but it won't help an inch to fix the door sooner.
In this case public awareness probably increases the chance that this security hole can be fixed sooner, because, well, the publicity pressure mounts. But wouldn't it be simpler in such case to provide the access to a particular breaching tool only to relevant people? That certainly require some self-sacrifice of depriving yourself of some fame and consequent benefits...
I do not believe in karma. "Funny"=-6. Do good and forbid evil. Yours, Oft-Offtopic Flamebaiting Troll.
Nobody seems to get that the reason for ID/Boarding Pass checks at airports is to limit the number of people that go through the scanners, to make it more manageable. So keeping friends and family out helps them save money by having fewer scanning devices and hiring fewer agents. It is all about money, and that is why the Government does not want people to know that it the inconvenience is not for security purposes.
Rep. Markey put out a press release today urging that the kid not get arrested, but hired by the TSA ?!? :
...
"On Friday I urged the Bush Administration to 'apprehend' and shut down whoever had created a new website that enabled person without a plane ticket to easily fake a boarding pass and use it to clear security, gain access to the boarding area and potentially to the cabin of a passenger plane. Subsequently I learned that the person responsible was a student at Indiana University, Christopher Soghoian, who intended no harm but, rather, intended to provide a public service by warning that this long-standing loophole could be easily exploited. The website has now apparently been shut down."
"He picked a lousy way of doing it, but he should not go to jail for his bad judgment. Better yet, the Department of Homeland Security should put him to work showing public officials how easily our security can be compromised."
If you want another example, read this: http://www.swiss.ai.mit.edu/6805/student-papers/sp ring02-papers/caps.htmf
p ring02-papers/caps.htm
the link should actually be http://www.swiss.ai.mit.edu/6805/student-papers/s
The issue is the law is not logical. Certainly the application of the law is not logical. There is a HUGE component of hysteria involved... and self interest as well.
In another 20 years these problems will be somewhat behind us. The issue is the present generation of legal begals do not have the systems-technical knowledge base and neither do most of their collegues. So the judge, the prosecutors, and indeed, the jury have no landmarks from which to judge what he did and why. Now, if the jury were composed of his "peers" then there is no way they could make anything stick. Alas, they don't want people like me for instance on the jury.
Most people get by with the idea that if you can make something happen, then you have succeeded. This is the opposite notion of what is required for security and making working systems. I learned this very early on and I'm a seasoned programmer with more than 25 years experiance.
In order to develop a system that can be relied upon you have to design so that it cannot fail. This is at least an order of magnitude greater level of achievment than getting something to work. An example if we are dealing with a plane for instance is that the Wright Brothers managed to get it into the air. Boeing is still not at the point where it cannot fail.
Computer systems and security are even more sensitive to failure than jet aircraft. One can assume that mother nature will throw stuff at a plane and we can design to survive what she throws at us. But mother nature is random. Mother nature does not intelligently seek out any weakness and then systematically exploit it. Hacker-crakers do. Terrorists will. Most terrorists lack the sophistication of the hacker-crackers. Most hacker-crackers are not terrorists. If we end up with a terrorist cell which developes the technical skills of the hacker-cracker community then we are all in deep shit.
You are correct this chap will probably not get a fair trial... that is unless people who do understand become very vocal and very public. Becomming very angry might help too. Dimitri Sklyarov would have been left to rot in prison had there not developed a rather large voice crying foul. We need to do it here.
In another 20 years... by then the lawyers and judges will have grown up with computers. Some may even have hacked a few for fun. They certainly will have friends who have. These people will know at the gut level that what this fellow did is necessary.
We need security systems that work. We don't want well meaning but systematically flawed systems that are trivial to exploit. All this fellow did is point out that for over 3 years now the TSA has been delusional. He was not the first. Tossing him in jail might make him the last and any terrorist will clearly love that outcome.
Most people want good things to happen. What most people need to understand is that by doing bad things and by deluding ourselves we don't get good things to happen. We get good things to happen when smart and alarmed people point out mistakes and demand they get corrected. The phrase comes to mind "Deal with reality or reality will deal with you".
Clearly this is a case of attempting to shoot the messenger.
Since you are a lawyer I'll suggest you volunteer some time pro-bono. Clearly you understand what is going on. He deserves and needs your help. I think the EFF should get involved as well. And it will not hurt if people start to call up the media and start demanding some quality journalizm. One way is by writing stories. Many reporters are either overworked or lazy. A well written story that tells the truth may be printed. This is all part of being "effective".
There is already enough written here in slashdot to form the basis of a number of good stories and good stories sell papers.
Considering he "materially and willfully" aided the enemies of the United States. Just saying.
Oh, and this is rich: "the best outcome of Mr. Soghoian's ill-considered demonstration would be for the Department of Homeland Security to close these loopholes immediately."
If that's the outcome, then it was an excellently considered demonstration.
sic transit gloria mundi
I don't know if it's been posted yet, but the apology is here:
t ask=view&id=2336&Itemid=125
http://markey.house.gov/index.php?option=content&
Seems he's had a change of heart, and now he's saying exactly what many of the people who left comments on Chris' blog wrote.
Legalize it.
From the district court judge: "Whether this is actually the government's policy is unclear, as the policy, if it exists,is unpublished". Also, "... the court, noting that the identification policy had been classified as SSI[Sensitive Security Information], did not review any official documentation of the identification policy."
From the government's motion to keep their pleadings secret, "In order to protect air travel security, a
federal statute and accompanying regulations prohibit defendants from disclosing any such directive in open court, to plaintiff, or to plaintiff's counsel."
All quotes are from PDFs of the court documents.
The reason this matters is that "due process" begins before you're arrested. Laws are supposed to be published so you or your counsel can read them and decide on conduct that follows them. Anything else is Kafka.
Now, ... wouldn't it have made the point about as well, but likely avoided a whole lot of trouble, if he'd set up the "fake" boarding pass generator to clearly print VOID all over the background of the "fake" boarding passes? ... and also didn't make the source code available, etc.?
I may be missing something, but I thought that the boarding-pass generator was targetted against the paperwork of [YetAnother] private company, an airline. Not against the United States as a country, or it's government or an agency or department thereof. Or has the US government privatised the airline industry overnight, and the rest of the world haven't cared?
I suppose it's possible that all boarding passes in the US are issued by some centralised authority, on pre-printed forms. A week in advance of the flight they refer to. Or maybe not.
Birds are not dinosaur descendants;birds are dinosaurs, for all useful meanings of "birds", "are" and "dinosaurs"
http://www.homeofheroes.com/wings/part1/6_survival .html
"Perfectly legal" was how it should have read; it was a typo.
I had originally written that sentence in the negative tense but changed it for clarity, and somehow missed changing that word. (Even made it through two preview cycles.) Oh, well.
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."