Tuesday, December 28, 2010

Man quits job, makes living suing e-mail spammers

Dec 26, 4:04 PM (ET)

By PAUL ELIAS

SAN FRANCISCO (AP) - Daniel Balsam hates spam. Most everybody does, of course. But he has acted on his hate as few have, going far beyond simply hitting the delete button. He sues them.

Eight years ago, Balsam was working as a marketer when he received one too many e-mail pitches to enlarge his breasts.

Enraged, he launched a Web site called Danhatesspam.com, quit a career in marketing to go to law school and is making a decent living suing companies who flood his e-mail inboxes with offers of cheap drugs, free sex and unbelievable vacations.

"I feel like I'm doing a little bit of good cleaning up the Internet,"
Balsam said.

From San Francisco Superior Court small claims court to the 9th U.S. Circuit Court of Appeals, Balsam, based in San Francisco, has filed many lawsuits, including dozens before he graduated law school in 2008, against e-mail marketers he says violate anti-spamming laws.

His many victories are mere rain drops in the ocean considering that Cisco Systems Inc. estimates that there are 200 billion spam messages circulating a day, accounting for 90 percent of all e-mail.

Still, Balsam settles enough lawsuits and collects enough from judgments to make a living. He has racked up well in excess of $1 million in court judgments and lawsuit settlements with companies accused of sending illegal spam.

His courtroom foes contend that Balsam is one of many sole practitioners unfairly exploiting anti-spam sentiments and laws. They accuse him of filing lawsuits against out-of-state companies that would rather pay a small settlement than expend the resources to fight the legal claims.

"He really seems to be trying to twist things for a buck," said Bennet Kelley, a defense lawyer who has become Balsam's arch nemesis over the years in the rough-and-tumble litigation niche that has sprung up around spam.

Kelley created a website with a similar name, Danhatespam.com, that was critical of Balsam's tactics. Kelley let it expire.

"There is nothing wrong per se with being an anti-spam crusader," said Kelley, who has sued Balsam twice for allegedly violating confidentiality terms in settlement agreements. "But Dan abuses the processes by using small claims court.

"A lot of people will settle with him to avoid the hassle," Kelley said.

Balsam started small in 2002 in small claims court. By 2008, some of his cases were appearing before the 9th U.S. Circuit Court of Appeal and he was graduating from the University of California Hastings College of the Law.

"What started just as kicks turned into a hobby, which turned into a career," Balsam said. "It's what triggered me to go to law school."

Balsam mostly sues companies he accuses of violating California's anti-spam law.

Among other restrictions, the law prohibits companies from sending spam with headers that misleads the recipient into believing the e-mail is noncommercial or comes with offers of "free" products that aren't true.

The law also requires a way for Internet consumers to "opt out" of receiving any more spam from a sender.

Balsam said he has more than 40 small claims victories and several more in higher courts, mostly alleging the receipt of misleading advertising.

In November, he won a $4,000 judgment against Various Inc., an "adult-oriented" social media company that controls AdultFriendFinder.com.

A judge sided with Balsam, who sued after he received four identical e-mails sent to four different accounts with the identical subject line "Hello my name is Rebecca, I love you." It's the fourth time he's beat Various in court.

The company is appealing the latest ruling and a hearing is scheduled for Jan. 5 in San Francisco Superior Court.

Balsam certainly isn't the average Internet consumer.

When San Mateo Superior Court Judge Marie Weiner in March ordered Trancos Inc. to pay Balsam $7,000 for sending spam that recipients couldn't stop, she noted that he has more than 100 e-mail addresses.

Balsam has filed lawsuits and got settlements and judgments from companies small and large.

He has sued the Stockton Asparagus Festival and embroiled himself in contentious litigation with Tagged.com, the country's third largest social networking site. Balsam noted in his lawsuit that Time magazine dubbed it "the world's most annoying Web site."

Tagged.com shot back with a lawsuit of its own, accusing Balsam of threatening to violate terms of an earlier settlement by telling the company he was planning to post terms of the agreement on his website.

Balsam is fighting the lawsuit and a lawyer for Tagged.com didn't return a phone call seeking comment.

Balsam has also been sued by Valueclick Inc. for allegedly breaching settlement agreements by exposing confidential terms, which he denies.

"Balsam, who in his anti-spam zeal frequently views matters in absolutes such that anyone who disagrees with him must be villainous," lawyers for Valueclick Inc. stated in a 2007 lawsuit accusing Balsam of disclosing terms of a settlement.

The lawsuit was later dismissed in San Francisco Superior Court and Balsam declined to discuss the case other than to say it was "resolved."

He said, generally speaking, those who sue him are "retaliating" for lawsuits he filed against them.

"I feel comfortable doing what I'm doing," Balsam said of the lawsuits against him. "And I'm not going away."

http://apnews.myway.com/article/20101226/D9KBQRMG0.html

Ceiling lights in Minn. send coded Internet data

By CHRIS WILLIAMS, Associated Press Chris Williams, Associated Press - Mon Dec 27, 9:56 am ET

ST. CLOUD, Minn. - Flickering ceiling lights are usually a nuisance, but in city offices in St. Cloud, they will actually be a pathway to the Internet.

The lights will transmit data to specially equipped computers on desks below by flickering faster than the eye can see. Ultimately, the technique could ease wireless congestion by opening up new expressways for short-range communications.

The first few light fixtures built by LVX System, a local startup, will be installed Wednesday in six municipal buildings in this city of 66,000 in the snowy farm fields of central Minnesota.

The LVX system puts clusters of its light-emitting diodes, or LEDs, in a standard-sized light fixture. The LEDs transmit coded messages - as a series of 1s and 0s in computer speak - to special modems attached to computers.

A light on the modem talks back to the fixture overhead, where there is sensor to receive the return signal and transmit the data over the Internet.
Those computers on the desks aren't connected to the Internet, except through these light signals, much as Wi-Fi allows people to connect wirelessly.

LVX takes its name from the Latin word for light, but the underlying concept is older than Rome; the ancient Greeks signaled each other over long distances using flashes of sunlight off mirrors and polished shields. The Navy uses a Morse-coded version with lamps.

The first generation of the LVX system will transmit data at speeds of about
3 megabits per second, roughly as fast as a residential DSL line.

Mohsen Kavehrad, a Penn State electrical engineering professor who has been working with optical network technology for about 10 years, said the approach could be a vital complement to the existing wireless system.

He said the radio spectrum usually used for short-range transmissions, such as Wi-Fi, is getting increasingly crowded, which can lead to slower connections.

"Light can be the way out of this mess," said Kavehrad, who is not involved in the LVX project.

But there are significant hurdles. For one, smart phones and computers already work on Wi-Fi networks that are much faster than the LVX system.

Technology analyst Craig Mathias of the Farpoint Group said the problems with wireless congestion will ease as Wi-Fi evolves, leaving LVX's light system to niche applications such as indoor advertising displays and energy management.

LVX Chief Executive Officer John Pederson said a second-generation system that will roll out in about a year will permit speeds on par with commercial Wi-Fi networks. It will also permit lights that can be programmed to change intensity and color.

For the city, the data networking capability is secondary. The main reason it paid a $10,000 installation fee for LVX is to save money on electricity down the line, thanks to the energy-efficient LEDs. Pederson said one of his LED fixtures uses about 36 watts of power to provide the same illumination that 100 watts provides with a standard fluorescent fixture.

Besides installation costs, customers such as St. Cloud will pay LVX a monthly fee that's less than their current lighting expenses. LVX plans to make money because the LED fixtures are more durable and efficient than standard lighting. At least initially, the data transmission system is essentially a bonus for customers.

Pederson said the next generation of the system should get even more efficient as fixtures become "smart" so the lights would dim when bright sunlight is coming through a window or when a conference room or hallway is empty.

Because the lights can also change color, Pederson said they could be combined with personal locators or tiny video cameras to help guide people through large buildings. The lights could show a trail of green lights to an emergency exit, for instance.

While Kavehrad and Mathias credited LVX for being the first company in the United States to bring the technology to market, Kavehrad said it trails researchers and consumer electronics companies in Japan and Korea in developing products for visible-light networks.

Pederson's previous company, 911 EP, built high-powered LED roof lights for squad cars and other emergency vehicles. He said he sold the company in 2002. He said the visible-light network grew out his interest in LEDs that goes to the mid-1990s.

The Minneapolis-St. Paul International Airport, which pays for 24-hour lighting and replacing fluorescent bulbs on high ceilings, is considering an LVX system, said Jeffrey W. Hamiel, executive director of the Metropolitan Airports Commission.

The system might include mounting cameras on the light fixtures to bolster the airport security system, but the real attraction is the savings on electricity and maintenance.

"Anything we can do to save costs is worth consideration," he said.

Michael Williams, the city administrator in St. Cloud, said the city had been considering LVX for some time.

"It's pretty wild stuff," he said. "They have been talking about it with us for couple of years, and frankly it took a while for it to sink in."

http://news.yahoo.com/s/ap/20101227/ap_on_hi_te/us_tec_internet_via_lighting

Friday, December 24, 2010

IBM Expects to See Holographic Phone Calls, Air-Powered Batteries by 2015

By Ryan Flinn - Dec 23, 2010 8:03 AM PT

By 2015, your mobile phone will project a 3-D image of anyone who calls and your laptop will be powered by kinetic energy. At least that's what International Business Machines Corp. sees in its crystal ball.

The predictions are part of an annual tradition for the Armonk, New York-based company, which surveys its 3,000 researchers to find five ideas expected to take root in the next five years. IBM, the world's largest provider of computer services, looks to Silicon Valley for input, gleaning many ideas from its Almaden research center in San Jose, California.

Holographic conversations, projected from mobile phones, lead this year's list. The predictions also include air-breathing batteries, computer programs that can tell when and where traffic jams will take place, environmental information generated by sensors in cars and phones, and cities powered by the heat thrown off by computer servers.

"These are all stretch goals, and that's good," said Paul Saffo, managing director of foresight at the investment-advisory firm Discern in San Francisco. "In an era when pessimism is the new black, a little dose of technological optimism is not a bad thing"

For IBM, it's not just idle speculation. The company is one of the few big corporations investing in long-range research projects, and it counts on innovation to fuel growth, Saffo said. Not all of its predictions pan out, though. IBM was overly optimistic about the spread of speech technology, for instance. When the ideas do lead to products, they can have broad implications for society, as well as IBM's bottom line, he said.

Research Spending

"They have continued to do research when all the other grand research organizations are gone," said Saffo, who is also a consulting associate professor at Stanford University.

IBM invested $5.8 billion in research and development last year, 6.1 percent of revenue. While that's down from about 10 percent in the early 1990s, the company spends a bigger share on research than its computing rivals. Hewlett-Packard Co., the top maker of personal computers, spent 2.4 percent last year.

At Almaden, scientists work on projects that don't always fit in with IBM's computer business. The lab's research includes efforts to develop an electric car battery that runs 500 miles on one charge, a filtration system for desalination and a program that shows changes in geographic data.

IBM rose 9 cents to $146.04 at 11:02 a.m. in New York Stock Exchange composite trading. The stock had gained 11 percent this year before today.

Citizen Science

The list is meant to give a window into the company's innovation engine, said Josephine Cheng, a vice president at IBM's Almaden lab.

"All this demonstrates a real culture of innovation at IBM and willingness to devote itself to solving some of the world's biggest problems," she said.

Many of the predictions are based on projects that IBM has in the works. One of this year's ideas -- that sensors in cars, wallets and personal devices will give scientists better data about the environment -- is an expansion of the company's citizen-science initiative.

Earlier this year, IBM teamed up with the California State Water Resources Control Board and the City of San Jose Environmental Services to help gather information about waterways. Researchers from Almaden created an application that lets smartphone users snap photos of streams and creeks, and report back on conditions. The hope is that these casual observations will help local and state officials who don't have the resources to do the work themselves.

Traffic Predictors

IBM also sees data helping shorten commutes in the next five years. Computer programs will use algorithms and real-time traffic information to predict which roads will have backups, and how to avoid getting stuck.

Batteries may last 10 times longer in 2015 than today, IBM says. Rather than using the current lithium-ion technology, new models could rely on energy-dense metals that only need to interact with the air to recharge. Some electronic devices might ditch batteries altogether and use something similar to kinetic wristwatches, which only need to be shaken to generate a charge.

The final prediction involves recycling the heat generated by computers and data centers. Almost half of the power used by data centers is currently spent keeping the computers cool. IBM scientists say it would be better to harness that heat to warm houses and offices.

In IBM's first list of predictions, compiled at the end of 2006, researchers said instantaneous speech translation would become the norm. That hasn't happened yet. While some programs can quickly translate electronic documents and instant messages, and other apps can perform limited speech translation, there's nothing widely available that acts like the universal translator in "Star Trek."

Second Life

The company also predicted that online immersive environments, such as Second Life, would become more widespread. While immersive video games are as popular as ever, Second Life's growth has slowed. Internet users are flocking instead to the more 2-D environments of Facebook Inc. and Twitter Inc.

Meanwhile, a 2007 prediction that mobile phones will act as a wallet, ticket broker, concierge, bank and shopping assistant is coming true -- thanks to the explosion of smartphone applications. Consumers can pay bills through their banking apps, buy movie tickets and get instant feedback on potential purchases, all with a few taps on their phones.

"The nice thing about the list is that it provokes thought," Saffo said. "If everything came true, they wouldn't be doing their job."

To contact the reporter on this story: Ryan Flinn in San Francisco at rflinn@bloomberg.net

To contact the editor responsible for this story: Tom Giles at tgiles5@bloomberg.net

http://www.bloomberg.com/news/2010-12-23/ibm-predicts-holographic-calls-air-breathing-batteries-by-2015.html

Tuesday, December 21, 2010

FCC Gives Government Power to Regulate Web Traffic

By AMY SCHATZ

WASHINGTON-Federal telecommunications regulators approved new rules Tuesday that would for the first time give the federal government formal authority to regulate Internet traffic, although how much or for how long remained unclear.

A divided Federal Communications Commission approved a proposal by Chairman Julius Genachowski to give the FCC power to prevent broadband providers from selectively blocking web traffic.

The rules will go into effect early next year, but legal challenges or action by Congress could block the FCC's action. Senate Minority Leader Mitch McConnell (R., Ky.) on Tuesday called the FCC's action "flawed" and said lawmakers would "have an opportunity in the new Congress to push back against new rules and regulations."

The new FCC rules, for example, would prevent a broadband provider, such as Comcast Corp., AT&T, Inc. or Verizon Communications Inc., from hobbling access to an online video service, such as Netflix, that competes with its own video services.

The rules would also require Internet providers to give subscribers more information on Internet speeds and service. Broadly, the rules would prohibit Internet providers from "unreasonably discriminating" against rivals' Internet traffic or services on wired or wireless networks.

The rules would allow phone and cable companies to offer faster, priority delivery services to Internet companies willing to pay extra. But the FCC proposal contains language suggesting the agency would try to discourage creation of such high-speed toll lanes.

Companies that operate mobile wireless networks would have fewer rules to contend with. Phone companies wouldn't be able to block legal websites from consumers. They also can't block mobile voice or video-conferencing applications. Wireless providers would be allowed to block other applications, however, that they say could take up too much bandwidth on wireless networks.

The five-member Federal Communications Commission board approved the new rules on a 3-2 vote, with the agency's two Republican members rejecting the measure.

"For the first time, we'll have enforceable rules of the road to preserve Internet freedom and openness," FCC Chairman Julius Genachowski said Tuesday morning. He said the rules offered "a strong and sensible framework-one that protects Internet freedom and openness and promotes robust innovation and investment."

Republicans at the FCC and on Capitol Hill blasted the FCC's new rules, saying that they could stifle new investments in broadband networks and are unnecessary since there have been few complaints about Internet providers blocking or slowing web traffic.

The FCC's action "is not motivated by a tangible competitive harm or market failure," said Commissioner Meredith Attwell Baker, a Republican, who said she couldn't support the rule because the agency was intervening to regulate the Internet "because it wants to, not because it needs to."

At the same time, advocates of strong net-neutrality rules complained that Mr. Genachowski's proposal didn't go far enough, a sentiment echoed Tuesday by the agency's other two Democrats.

Specifically, the two Democratic FCC commissioners wanted the same rules to apply to both wireless and wireline broadband networks. However, they agreed to approve the rules anyway, saying that passing Mr. Genachowski's proposal was better than nothing.

"In my book, today's action could, and should, have gone further," said Democratic Commissioner Michael Copps.

Big phone and cable companies have expressed qualified support for the compromise, but they have said there was no real need for government regulation of web traffic.

Although this is the first time the FCC has passed formal rules on "net neutrality," or the idea that Internet providers can't deliberately block or slow web traffic, it is not the first time the agency has tried to act as an Internet traffic cop.

In 2007 the agency sanctioned Comcast for deliberately slowing the web traffic of some subscribers who were downloading large files over peer-to-peer networks. Comcast sued and in April, a federal appeals court sided with the cable giant, saying that the FCC didn't have clear authority to enforce net neutrality.

The rules passed Tuesday are also likely to be legally challenged, and it isn't clear if they will be upheld. Congress has never given the FCC explicit authority to regulate Internet lines, so the agency is using older rules to justify its authority.

Write to Amy Schatz at Amy.Schatz@wsj.com

http://online.wsj.com/article/SB10001424052748703581204576033513990668654.html?mod=WSJ_hp_LEFTTopStories

Music Web Sites Dispute Legality of Their Closing

By BEN SISARIO
Published: December 19, 2010


When federal authorities shut down five Web sites last month on suspicion of copyright infringement, they gave no warning and offered no details of their investigation, and they have not filed any criminal charges since.

But after the seizure warrant used in the operation was released last week, the operators of several of the sites said in interviews that they were innocent of infringement, and criticized the investigation for misrepresenting how their sites worked.

In a 69-page affidavit seeking the warrant, an agent of Immigration and Customs Enforcement, the unit of the Department of Homeland Security that did the investigation, said the five sites - rapgodfathers.com, torrent-finder.com, rmx4u.com, dajaz1.com and onsmash.com - were used "to commit or facilitate criminal copyright infringement."

The agent also said the Motion Picture Association of America and the Recording Industry Association of America, the trade groups for the major film studios and record labels, had confirmed that the music and movies on the sites had not been released with the authorization of their copyright holders.

Yet after being shown the affidavit, the operator of dajaz1.com - a widely read hip-hop blog that posts new songs and videos - disputed many of the warrant's examples of what it called copyright infringement. He said that, like much of the material on his site, the songs had been sent to him for promotional purposes by record labels and the artists.

As proof, the operator, a Queens man who declined to give his real name but is known online as Splash, showed The New York Times several e-mails from record label employees and third-party marketers offering songs mentioned in the affidavit.

"It's not my fault if someone at a record label is sending me the song," Splash said.

In describing what it contends are the infringing aspects of onsmash.com, the affidavit mentions a post with a link to new music by the rapper Kid Cudi, with a line telling readers, "You can pre-order the album on iTunes tomorrow and receive a bonus track on the day of release."

Waleed A. GadElKareem, an Egyptian who operated torrent-finder.com, said his site was essentially a search engine for BitTorrent - a decentralized file-sharing system that can be used for any data - with results that are easily found elsewhere on the Internet.

"Google and Yahoo still link to them," he said. "Why can't I?"

(Torrent-finder.com, like several of the seized domains, has relocated; it is now fully operational at torrent-finder.info.)

The sites were shut over the Thanksgiving weekend as part of "Operation In Our Sites," a crackdown on 82 domains, or Web addresses, suspected of copyright infringement and selling counterfeit handbags, sunglasses and other consumer goods. The investigation is continuing. Unlike most previous similar government crackdowns, the domains were seized with no warning.

The move has drawn criticism among many bloggers and Web advocates who see it as a preview of a controversial bill in Congress, the Combating Online Infringements and Counterfeits Act, which would extend the attorney general's power in pursuing Web sites believed to be "dedicated to infringing activities."

"There is tremendous concern about the climate of fear and uncertainty this is going to create," said Peter Eckersley of the Electronic Frontier Foundation, a civil liberties group. "It's a troubling situation where basically any Web site that the Department of Homeland Security doesn't like and is convinced has too much infringing material on it can just disappear overnight."

A version of this article appeared in print on December 20, 2010, on page B6 of the New York edition.

http://www.nytimes.com/2010/12/20/business/media/20music.html

Monday, December 20, 2010

Microsoft yanks Outlook 2007 update

Cites multiple problems, including connection and performance issues
By Gregg Keizer, Computerworld
December 19, 2010 04:31 PM ET

Microsoft last week pulled an update for Outlook 2007 issued just two days earlier, citing connection and performance problems for the unusual move.

The update was issued mid-day on Dec. 14 as part of the monthly Patch Tuesday. Within hours, users reported trouble with retrieving e-mail and major delays when switching folders.

"This latest update results in Outlook 2007 being very slow in changing folders and the archiving functionality appears to have been removed," said someone identified as "alspar" on a Microsoft support forum early Wednesday morning. "Is this an error or by design?"

Others said they couldn't send or receive e-mail, including Gmail messages, through Outlook after installing the update.

Ironically, Microsoft had billed the update, which didn't patch any security vulnerabilities, as one that contained "stability and performance improvements."

By Thursday, support forum moderators were telling users to uninstall the update. Microsoft made that official late Friday in a post on the Outlook team's blog. "We have discovered several issues with the update and ... as of December 16, this Outlook 2007 update has been removed from Microsoft Update."

According to Microsoft, the Tuesday update contained three flaws related to Secure Password Authentication (SPA), a Microsoft protocol used to authenticate mail clients like Outlook to a mail server; sluggish folder switching when Outlook wasn't configured to grab mail from an Exchange server; and a broken AutoArchive feature.

Microsoft urged users who had installed update during its three days of availability to remove it, and spelled out the necessary steps. The company also issued a mea culpa.

"We apologize to our customers for not discovering these issues before releasing the update and for any inconvenience we have caused," the Outlook team wrote on its blog. "We failed to meet our own and our customers' expectation for quality with this update release. We are working to fix these issues and will post a release date for those fixes, and link to download them, as soon as that information is available."

Microsoft has yanked updates before. In April, it pulled a patch for Windows 2000 -- which at the time was still being supported -- over what it called "quality issues."

In early 2008, Microsoft retracted an update designed to prep Windows Vista for Service Pack 1 (SP1) after users flooded support forums with tales of endless reboots.

Microsoft has not set a timetable for releasing a re-patch for Outlook 2007.

Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer or subscribe to Gregg's RSS feed. His e-mail address is gkeizer@computerworld.com.

http://www.networkworld.com/news/2010/121910-microsoft-yanks-outlook-2007.html?source=NWWNLE_nlt_daily_am_2010-12-20

For Windows 7 and Windows Vista
1. Click Start and select Control Panel.
2. Select the option for Large icons or Small icons in the View by section in the upper-right corner of your screen.
3. Select Programs and Features.
4. In the left navigation pane, select the View installed updates option.
5. In the list of updates, look for update KB2412171. If you locate this update click to select it, and then click the Uninstall option. Restart your computer if you are prompted.

For Windows XP
1. Click Start and Run.
2. Type appwiz.cpl and then click OK.
3. Click to select the Show updates check box.
4. In the list of updates, look for update KB2412171. If you locate this update click to select it, and then click the Remove option. Restart your computer if you are prompted.

The FCC's Threat to Internet Freedom

'Net neutrality' sounds nice, but the Web is working fine now. The new rules will inhibit investment, deter innovation and create a billable-hours bonanza for lawyers.

By ROBERT M. MCDOWELL

Tomorrow morning the Federal Communications Commission (FCC) will mark the winter solstice by taking an unprecedented step to expand government's reach into the Internet by attempting to regulate its inner workings. In doing so, the agency will circumvent Congress and disregard a recent court ruling.

How did the FCC get here?

For years, proponents of so-called "net neutrality" have been calling for strong regulation of broadband "on-ramps" to the Internet, like those provided by your local cable or phone companies. Rules are needed, the argument goes, to ensure that the Internet remains open and free, and to discourage broadband providers from thwarting consumer demand. That sounds good if you say it fast.

Nothing is broken and needs fixing, however. The Internet has been open and freedom-enhancing since it was spun off from a government research project in the early 1990s. Its nature as a diffuse and dynamic global network of networks defies top-down authority. Ample laws to protect consumers already exist. Furthermore, the Obama Justice Department and the European Commission both decided this year that net-neutrality regulation was unnecessary and might deter investment in next-generation Internet technology and infrastructure.

Analysts and broadband companies of all sizes have told the FCC that new rules are likely to have the perverse effect of inhibiting capital investment, deterring innovation, raising operating costs, and ultimately increasing consumer prices. Others maintain that the new rules will kill jobs. By moving forward with Internet rules anyway, the FCC is not living up to its promise of being "data driven" in its pursuit of mandates-i.e., listening to the needs of the market.

It wasn't long ago that bipartisan and international consensus centered on insulating the Internet from regulation. This policy was a bright hallmark of the Clinton administration, which oversaw the Internet's privatization.
Over time, however, the call for more Internet regulation became imbedded into a 2008 presidential campaign promise by then-Sen. Barack Obama. So here we are.

Last year, FCC Chairman Julius Genachowski started to fulfill this promise by proposing rules using a legal theory from an earlier commission decision (from which I had dissented in 2008) that was under court review. So confident were they in their case, FCC lawyers told the federal court of appeals in Washington, D.C., that their theory gave the agency the authority to regulate broadband rates, even though Congress has never given the FCC the power to regulate the Internet. FCC leaders seemed caught off guard by the extent of the court's April 6 rebuke of the commission's regulatory overreach.

In May, the FCC leadership floated the idea of deeming complex and dynamic Internet services equivalent to old-fashioned monopoly phone services, thereby triggering price-and-terms regulations that originated in the 1880s.
The announcement produced what has become a rare event in Washington: A large, bipartisan majority of Congress agreeing on something. More than 300 members of Congress, including 86 Democrats, contacted the FCC to implore it to stop pursuing Internet regulation and to defer to Capitol Hill.

Facing a powerful congressional backlash, the FCC temporarily changed tack and convened negotiations over the summer with a select group of industry representatives and proponents of Internet regulation. Curiously, the commission abruptly dissolved the talks after Google and Verizon, former Internet-policy rivals, announced their own side agreement for a legislative blueprint. Yes, the effort to reach consensus was derailed by . . .
consensus.

After a long August silence, it appeared that the FCC would defer to Congress after all. Agency officials began working with House Energy and Commerce Committee Chairman Henry Waxman on a draft bill codifying network management rules. No Republican members endorsed the measure. Later, proponents abandoned the congressional effort to regulate the Net.

Still feeling quixotic pressure to fight an imaginary problem, the FCC leadership this fall pushed a small group of hand-picked industry players toward a "choice" between a bad option (broad regulation already struck down in April by the D.C. federal appeals court) or a worse option (phone monopoly-style regulation). Experiencing more coercion than consensus or compromise, a smaller industry group on Dec. 1 gave qualified support for the bad option. The FCC's action will spark a billable-hours bonanza as lawyers litigate the meaning of "reasonable" network management for years to come. How's that for regulatory certainty?

To date, the FCC hasn't ruled out increasing its power further by using the phone monopoly laws, directly or indirectly regulating rates someday, or expanding its reach deeper into mobile broadband services. The most expansive regulatory regimes frequently started out modest and innocuous before incrementally growing into heavy-handed behemoths.

On this winter solstice, we will witness jaw-dropping interventionist chutzpah as the FCC bypasses branches of our government in the dogged pursuit of needless and harmful regulation. The darkest day of the year may end up marking the beginning of a long winter's night for Internet freedom.

Mr. McDowell is a Republican commissioner of the Federal Communications Commission.

http://online.wsj.com/article/SB10001424052748703395204576023452250748540.html

Saturday, December 18, 2010

The clock is ticking on encryption

Today's secure cipher-text may be tomorrow's open book

Lamont Wood
December 17, 2010 (Computerworld)

In the indictment that led to the expulsion of ten Russian spies from the U.S. in the summer of 2010, the FBI said that it gained access to their communications after surreptitiously entering one of the spies' homes, during which agents found a piece of paper with a 27-character password.

In other words, the FBI found it more productive to burglarize a house than to crack a 216-bit code, despite having the computational resources of the U.S. government behind it.

That's because modern cryptography, when used correctly, is rock solid. Cracking an encrypted message can require time frames that dwarf the age of the universe. That's the case today. But within the foreseeable future, cracking those same codes could become trivial, thanks to quantum computing.

The encryption landscape
"The entire commercial world runs off the assumption that encryption is rock solid and is not breakable" says Joe Moorcones, vice president at SafeNet Inc., an information security firm in Belcamp, Md.

There are two kinds of encryption algorithms used in enterprise-level communications security -- symmetric and asymmetric (also called public-key encryption), he explains. Symmetric algorithms are typically used to send the actual information, where asymmetric algorithms are used to send both the information and the keys.

Symmetric encryption requires that the sender and receiver both employ the same algorithm and the same encryption key. Decryption is simply the reverse of the encryption process -- hence the "symmetric" name.

The scale of the problem
Today's encryption algorithms can be broken. Their security derives from the wildly impractical lengths of time it can take to do so.

Let's say you're using a 128-bit AES cipher. The number of possible keys with 128 bits is 2 raised to the power of 128, or 3.4x10^38, or 340 undecillion. Assuming no information on the nature of the key (such as that the owner likes to use his or her children's birthdays) a code-breaking attempt would require the testing of each possible key until one is found that works.

Assuming that enough computing power was amassed to test 1 trillion keys per second, testing all possible keys would take 10.79 quintillion years. This is about 785 million times the age of the visible universe (13.75 billion years.) On the other hand, you might get lucky in the first 10 minutes.

Using quantum technology with the same throughput, exhausting the possibilities of a 128-bit AES key would take about six months. However, moving to 256 bits would give the system a level of security equivalent to 128 bits with a conventional computer.

Cracking an RSA or EC cipher with a quantum machine would be essentially immediate.
There are numerous symmetric algorithms available, but Moorcones says that, at the enterprise level, nearly everyone uses the Advanced Encryption Standard (AES), published in 2001 by the National Institute of Standards and Technology after five years of testing. It replaced the Data Encryption Standard (DES), which debuted in 1976 and uses a 56-bit key.

Typically using keys that are either 128 or 256 bits long, AES has never been broken, while DES can now be broken in a matter of hours, Moorcones says. AES is approved for sensitive U.S. government information that is not classified, he adds.

As for classified information, the algorithms used to protect it are, of course, themselves classified. "They're more of the same -- they put in more bells and whistles to make them harder to crack," says Charles Kolodgy, analyst at IDC, a market research firm in Framingham, Mass. And they use multiple algorithms, he says.

Though rumors have long swirled around the idea, well-respected sources universally reject the idea that AES has a "back door" that allows the government to read messages encrypted with it. "It's been too heavily scrutinized," says Paul Kocher, head of Cryptography Research Inc., in San Francisco. "They would have to put in a back door that no one else could see, and to be able to do that they would have to be years ahead of everyone else, and that is unlikely."

The beauty of public-key cryptography
The genuine weakness of AES -- and any symmetric system -- is that the sender has to get the key to the receiver. If that key is intercepted, transmissions become an open book. That's where asymmetric algorithms come in, as a method for disseminating symmetric keys.

Moorcones explains that asymmetric systems are also called public key cryptography because they use a public key for encryption and a different, private key for decryption. "You can post your public key in a directory with your name next to it, and I can use it to encrypt a message to you, but you are the only person with your private key so you are the only person who can decrypt it."

The most common asymmetric algorithm is RSA (for inventors Ron Rivest, Adi Shamir and Len Adleman). It is based on the difficulty of factoring large numbers, from which the two keys are derived.

But RSA messages with keys as long as 768 bits have been broken, notes Kocher. "I would guess that in five years even 1,024 bits will be broken." Moorcones adds: "You often see 2,048-bit RSA keys used to protect 256-bit AES keys."

Other kinds of algorithms
Besides responding with longer RSA keys, users are also turning to elliptic curve (EC) algorithms, based on the math used to describe curves, with security again increasing with the size of the key. EC can offer the same security with one-fourth the computational complexity of RSA, Moocones says. However, EC encryption up to 109 bits has been broken, Kocher explains.

Anna Chapman and nine other accused Russian spies were rooted out earlier this year when the FBI filched a 27-character password that revealed data that the spy ring had hidden. Photo courtesy of the U.S. Marshals Service.

RSA remains popular with developers because implementation requires only multiplication routines, leading to simpler programming and higher throughput, Kocher says. Also, all the applicable patents have expired. For its part, EC is better when there are bandwidth or memory constraints, he adds.

As for private individuals, IDC's Kolodgy says that many turn to freeware implementations of PGP (Pretty Good Privacy), published in 1991 by Phil Zimmermann. PGP traffic can be readily identified, inviting attempts to intercept key transfers.

For those who want to hide the fact that they are receiving messages, there's steganography, which involves hiding text, encrypted or not, typically within the pixels of photos posted on the Web. Anyone can download the picture and extract the message, assuming he has the right software. In fact, the previously cited 27-character code used by the Russian spies was for the password protection of a steganography software disk.

"The problem with steganography is that is not encryption, it's hiding, like putting drugs in a secret compartment of your suitcase," says Zimmermann, now a security consultant in Santa Cruz, Calif. "If your opponent knows about it they can intercept the message."

The quantum danger
This mostly tidy world of cryptography may be seriously disrupted by the expected arrival of quantum computers. "There has been tremendous progress in quantum computer technology during the last few years," says Michele Mosca, deputy director of the Institute for Quantum Computing at the University of Waterloo in Waterloo, Ontario, Canada. Mosca notes that in the past 15 years we have moved from playing with quantum bits to building quantum logic gates. At that rate he thinks it is likely we will have a quantum computer within 20 years.

"It's a game changer," Mosca says, explaining that the change comes not from a speed-up in the computer's clock speed, but from an astronomical reduction in the number of steps needed to perform certain computations.

Basically, Mosca explains, a quantum computer should be able to use the properties of quantum mechanics to probe for patterns within a huge number without having to examine every digit in that number. Cracking both RSA and EC ciphers depends on this very issue -- finding patterns in huge numbers.

Mosca explains that, with a conventional computer, finding a pattern for an EC cipher with N number of bits in the key would take a number of steps equal to 2 raised to one-half N. As an example, for 100 bits (a modest number), it would take 2^50 (1.125 quadrillion) steps.

Michele Mosca, deputy director of the Institute for Quantum Computing at the University of Waterloo, calls quantum computing a "game changer" for cryptography and says it could happen within 20 years.

With a quantum computer it should take about 50 steps, he says, and code-breaking would then be no more computationally demanding than the original encryption process.

With RSA, determining the number of steps needed for a solution through conventional computation is more complicated than with EC encryption, but the scale of the reduction with quantum computation should be similar, Mosca says.

The situation is less dire with symmetric encryption, Mosca explains. Breaking a symmetric code like AES is a matter of searching all possible key combinations for the one that works. With a 128-bit key there are 2^128 possible combinations. But thanks to a quantum computer's ability to probe large numbers, only the square root of the number of combinations needs to be examined -- in this case 2^64. This is still a huge number, and AES should remain secure with increased key sizes, he says.
Timing issues

When will all this happen?
"We don't know," says Mosca. To mere mortals, 20 years is a long way off, but in the world of cyber-security, it's right around the corner. "Is that an acceptable risk? I don't think so. So we need to start figuring out what alternatives to deploy since it takes many years to change the infrastructure."

Moorcones at SafeNet disagrees. "DES lasted for 30 years, and AES is good for another 20 or 30 years," he says. Increases in computing power can be countered by changing keys more often -- one per message if necessary -- he adds, as many enterprises currently change their key only once every 90 days. Every key, of course, requires a fresh cracking effort, as any success with one key is inapplicable with the next.

The rule of thumb, when it comes to encryption, is that "you want your messages to provide 20 years or more of security, so you want any encryption that you use to remain strong 20 years from now," says Kolodgy.

The other quantum technology
If quantum technology calls into question the methods used to disseminate encryption keys, it also offers technology -- called quantum key distribution, or QKD -- by which such keys can be simultaneously generated and transmitted securely. This works in at least in some situations.

QKD has actually been on the market since 2004, with the fiber-based Cerberis system from ID Quantique SA in Geneva, Switzerland. Grégoire Ribordy, the firm's founder and CEO, explains that the system is based on the fact that measuring quantum properties changes them.

At one end of an optical fiber, an emitter sends individual photons to the other end. The phase of some the photons are measured as they are transmitted and thereby acquire a value, and the receiver is informed of the value through a separate channel. Normally the photons will arrive with the expected values and will be used to generate a new encryption key.

But if there is an eavesdropper on the line, that third party will have reassigned values to the photons through the act of measuring them. In that case, the receiver will see an error rate in the photon values and no key will be generated. In the absence of that error rate, the security of the channel is assured, Ribordy says. "It's like a fountain of random bits," he says of the system. "You can store the bits in a buffer and use them different ways, and with standard applications we use them to make 256-bit AES keys, and then replace the key every minute."

However, since security can only be assured after the fact -- when the error rate is measured, which happens immediately -- the channel should be used to send only the keys, and not actual messages, he notes.

The other limitation of the system is range, which currently doesn't exceed 100 kilometers (62 miles), although they have achieved 250 kilometers in the lab. However, due to the rate that photons get lost in the fiber, the theoretical maximum is 400 kilometers, Ribordy says. Going beyond that must await the development of a quantum repeater -- which would presumably use the same technology as a quantum computer, he adds.

QKD security, like all security, is not cheap, with an emitter-receiver pair costing about 100,000 Swiss francs (about $97,000), he says.

Safe, at least for now
For the time being, "code-breaking today is an end-run game -- it's all about snatching the user's machine," says Kolodgy at IDC."These days, if you pull something out of the air, you can't decrypt it."

But the biggest problem with encryption, typically, is the lack of any. "All business-critical data should be encrypted at rest, especially credit card data," says Richard Stiennon at IT-Harvest, a security analyst firm in Birmingham, Mich. "The Payment Card Industry Security Standards Council requires that merchants encrypt it -- or better yet not store it at all. And data breach notification laws don't require you to disclose your lost data if it was encrypted."

And of course, leaving your encryption keys lying around on slips of paper also turns out to be a bad idea.

Lamont Wood is a freelance writer in San Antonio.
http://www.computerworld.com/s/article/9201281/The_clock_is_ticking_on_encryption?source=CTWNLE_nlt_dailyam_2010-12-17

Thursday, December 2, 2010

US cable groups win ground on net neutrality rules

By Stephanie Kirchgaessner in Washington, Richard Waters in San Francisco and Andrew Edgecliffe-Johnson in New York

Published: December 1 2010 16:08 | Last updated: December 2 2010 00:54


The US cable and mobile communications industries have won important concessions from regulators over proposed "net neutrality" rules, as part of a broader retreat by Barack Obama's administration from the tougher rules it had argued were needed to protect the openness of the internet.

The plan, endorsed by Julius Genachowski, chairman of the Federal Communications Commission, would remove uncertainty about the ability of cable companies to charge internet users and content providers for the amount of network capacity they use, which some analysts call "broadband rationing".

It would also allow mobile operators more freedom than regulators had originally proposed to favour some types of traffic on their networks over others, although it would prevent them from blocking services outright.

The relaxation of the FCC's proposals follows political opposition to stricter regulation that some feared would result in price controls, as well as a protracted battle with network companies who claimed it would discourage investment.

Mr Genachowski said a -proposal he announced at midnight on Tuesday to institute new regulations that would -protect internet companies such as Google from being blocked had already received support from leading technology and internet companies, as well as broadband and consumer groups.

Although the exact details of the plan have yet to be unveiled, analysts said the FCC had made two big concessions to US cable companies; freeing them from the threat of being regulated more closely in the way that telecommunications concerns are, and approval for the tiering practices that are already in place.

While the cable companies would not be able to discriminate against certain types of traffic on their networks, such as video, they might be able to charge companies like Walt Disney or -Netflix extra in return for guaranteeing quality, said Rebecca Arbogast, an analyst at Stifel Nicolaus.

"This was a key concern for the cable industry," she said. "I think it is a good win for them."

The plans gained cautious backing from cable and communications companies. Verizon applauded Mr Genachowski's change in direction, while warning that his plan might be subject to legal challenge.

Mr Genachowski's proposals will be put to the FCC's board of commissioners at a meeting on December 21. He is expected to win the support of two other Democratic commissioners at the five-member FCC even though both supported the adoption of more onerous restrictions on cable companies and other high speed internet providers.

Copyright The Financial Times Limited 2010.

http://www.ft.com/cms/s/0/d14a0642-fd5d-11df-b83c-00144feab49a.html#axzz16vzV3Ne7