From a legal perspective, the DRM could significantly influence the distribution and control of information from country to country. This article in particular provides a clear overview of what the DRM system actually is and the policies it entails. Additionally, the role of copyright protection is also included in this overview of the DRM, establishing the bases for the regulatory approaches undertaken by the US and the EU. In reference to background information, DRM systems use a variety of technological protection measures to prevent digital content from being distributed without the right holders' consent. To provide secure distribution for digital content, DRM systems not only have to protect content against copying, but they must also offer a means to identify and manage content. The DRM thus strives to provide tamper-resistant hardware and software. This method of protection disables hackers and network insiders from being able to crack multiple levels of security, strengthening the protection of individual property rights'. In reference to the U.S., the U.S. congress enacted complex anticircumvention regulations as part of the Digital Millenium Copyright Act of 1998. The DMCA arranges these provisions on a biplanar scheme, which includes distinguishing between technological protection measures and the protection rights of the copyright owner.

This example seems to showcase the progressive changes in protection measures taken against copyright infringement. Though dense in its offerings, this article provides a decent anthology of acts and agreements enacted in order to protect individual property rights. This anthology further demonstrates the morphing of protective technology against copyright infringement. In the context of the ACTA, the DRM seems to be desired block against piracy and the illicit transfer of information.

generates encoded signatures to add to update.rdf and install.rdf in secure firefox 3 toolbars

Mozilla's main page for this sort of thing

mozilla's how-to documentation for mccoy

June 05, 2008

The War on Photography

What is it with photographers these days? Are they really all terrorists, or does everyone just think they are? Since 9/11, there has been an increasing war on photography. Photographers have been harrassed, questioned, detained, arrested or worse, and declared to be unwelcome. We've been repeatedly told to watch out for photographers, especially suspicious ones. Clearly any terrorist is going to first photograph his target, so vigilance is required.

Except that it's nonsense. The 9/11 terrorists didn't photograph anything. Nor did the London transport bombers, the Madrid subway bombers, or the liquid bombers arrested in 2006. Timothy McVeigh didn't photograph the Oklahoma City Federal Building. The Unabomber didn't photograph anything; neither did shoe-bomber Richard Reid. Photographs aren't being found amongst the papers of Palestinian suicide bombers. The IRA wasn't known for its photography. Even those manufactured terrorist plots that the US government likes to talk about -- the Ft. Dix terrorists, the JFK airport bombers, the Miami 7, the Lackawanna 6 -- no photography.

Given that real terrorists, and even wannabe terrorists, don't seem to photograph anything, why is it such pervasive conventional wisdom that terrorists photograph their targets? Why are our fears so great that we have no choice but to be suspicious of any photographer?

Because it's a movie-plot threat.

A movie-plot threat is a specific threat, vivid in our minds like the plot of a movie. You remember them from the months after the 9/11 attacks: anthrax spread from crop dusters, a contaminated milk supply, terrorist scuba divers armed with almanacs. Our imaginations run wild with detailed and specific threats, from the news, and from actual movies and television shows. These movie plots resonate in our minds and in the minds of others we talk to. And many of us get scared.

...

China's All-Seeing Eye China's All-Seeing Eye

With the help of U.S. defense contractors, China is building the prototype for a high-tech police state. It is ready for export.

NAOMI KLEIN

Posted May 29, 2008 3:24 PM

February 2, 2008
New Operation to Put Heavily Armed Officers in Subways
By AL BAKER

In the first counterterrorism strategy of its kind in the nation, roving teams of New York City police officers armed with automatic rifles and accompanied by bomb-sniffing dogs will patrol the city's subway system daily, beginning next month, officials said on Friday.

Under a tactical plan called Operation Torch, the officers will board trains and patrol platforms, focusing on sites like Pennsylvania Station, Herald Square, Columbus Circle, Rockefeller Center and Times Square in Manhattan, and Atlantic Avenue in Brooklyn.

Officials said the operation would begin in March.

Financing for the program will be funneled to the Police Department and will come from a pool of up to $30 million taken from $153.2 million in new federal transit grants to the state.

Michael Chertoff, the secretary of homeland security, and Gov. Eliot Spitzer announced the grants at a news conference on Friday at Grand Central Terminal, where Police Commissioner Raymond W. Kelly outlined his plans to add a layer of security to the city's 24-hour transit system.

NYC's Subway Spycam Network Stuck in the Station
By Noah Shachtman EmailJanuary 24, 2008 | 8:59:00 AM

New York City's plan to secure its subways with a next-generation  surveillance network is getting more expensive by the second, and slipping further and further behind schedule.

A new report by the New York State Comptroller's office reveals that "the cost of the electronic security program has grown from $265 million to $450 million, an increase of $185 million or 70 percent." An August 2008 deadline has been pushed back to December 2009, and further delays may be just ahead.

Shortly after a series of bombings in the London Tube, The Metropolitan Transit Authority, which oversees New York's mass transit systems, signed a contract in 2005 with defense contractor Lockheed Martin to put in thousands of security cameras, electronic tripwires, and digitally-controlled gates into New York's sprawling network of subways. The deal was inked just a few months after MTA chairman Peter Kalikow argued against "wasting money on unproven technology."

At the heart of the program was a network of surveillance cameras, passing what they saw through a set of intelligent video algorithms, designed to spot suspicious behavior: a bag left on the subway platform, a person jumping down to the tracks, a mob running up a down escalator.
...

A cookbook for how to do incedent handling and policies and practices necessary.  Suggested that this is a good place to start.

Get a copy for eval...

From the website:

OCTAVE is self-directed. A small team of people from the operational (or business) units and the IT department work together to address the security needs of the organization. The team draws on the knowledge of many employees to define the current state of security, identify risks to critical assets, and set a security strategy. 

Tracking and Video: Coming Soon to a Taxi Near You

by Sol Hess
June, 2007

In a matter of months, New Yorkers riding in taxicabs will have more to look at than the view. The constant media buzz of modern life - television programs, sports scores, advertisements - will invade the back of cabs starting in October, the result of a new city regulation requiring that all yellow cabs be equipped with global positioning systems and video screens.

The city Taxi and Limousine Commission says it simply wants to make cab rides safer and more enjoyable for passengers. But the drivers of the city's 13,000 yellow cabs have protested, arguing that the new technology will cost them money and impinge on their privacy.

WHAT THE SYSTEM WILL DO

Through the GPS system, taxi passengers will be able to know where they are at any moment. For New Yorkers who never want to be out of touch, the monitors and tracking system will make a cab ride -- 13 minutes on average -- more enjoyable. Passengers will be able to follow sports scores, get up-to-the-minute news, weather and more. (Those who want some peace and quiet will be able to turn off the monitors.) The driver will also notified of traffic congestion in the area and of large parties or concerts that are ending – and could be fertile ground for finding fare-paying customers. With the new system, passengers can pay their fares using credit or debit cards.

Taxi and limousine commissioner Matthew Daus has called the tracking and the monitors “nothing short of revolutionary and evolutionary for the taxi industry" and has written that the technology “will benefit both drivers and customers.” The commission believes it will make it easier for tourists, who may not want to carry much cash, to use cabs. And the system believes such high-tech taxis will enhance New York’s image as the "city of the world.”

But cab drivers are not convinced. They worry that the tracking system will enable the police department and traffic agents to follow the cabs and prosecute drivers for violating traffic laws. “For myself, I am not against it, but I can see my fellow drivers being angry for being dictated to sacrifice for other people's extra entertainment," said one driver, Ibrahim Jane.

Consider attending this conference

Alan Cox states in the Felten case many of the speculated impacts of the DMCA and its enforcement. Cox is a Red Hat Linux (an open source operating system) developer residing in the United Kingdom. His statement includes a resignation letter to Usenix (a group that encourages foreign researchers to speak in the United States). In this letter, he tells all foreign software developers to avoid visiting and speaking at the United States until the “DMCA mess is resolved.”

This comes as a direct result of the Dmitry Sklyarov case. He fears that foreign researchers can be jailed for research in security and cryptology they performed in their own countries if it is viewed to be a DMCA violation in the United States. The DMCA prevents security experts from pointing out bad protection algorithms and only increases the profitability of the “businesses of the incompetent.” Without the ability of experts to point out and discuss bad algorithms, copyrighted material protected by these algorithms are exposed to hacking.

He further notes that the DMCA will not prevent people from discussing ways to break algorithms for illegal uses. His experience is that the “bad guys share their knowledge and act without regards to laws.” It's only the people aiming to increase the strength of computer security that will be silenced. The DMCA only helps pirates win in the end. Cox also claims that what the DMCA would prevent him from saying regarding inspecting computer security systems in the United States would be considered negligent in the United Kingdom.

From Cox's statement, the DMCA hurts the United States software development community in two main ways. It prevents international researchers from speaking, for fear of prosecution of their research or activities in other countries. It also means that the block of the DMCA will hinder US researchers from discussing decryption methods and our own security will be weakened when compared to the advances made by other countries who are able to have these discussions.

Security Barriers of New York Are Removed
By CARA BUCKLEY
Published: October 7, 2006

They started appearing on Manhattan streets immediately after September 11: concrete and metal barriers in front of skyscrapers, offices and museums. Some were clunky planters; others were shaped artfully into globes. They were meant to be security barriers against possible car or truck bombers in a jittery city intent on safeguarding itself.

... 

Notes on how to secure Apache servers

Review of a survey to Campus IT leaders on trends facing Universities.  Interesting that security & identity mgmt is highest on the list.  Also reviews other surveys from other publications such as the Chronicle, Gartner, and CIO...

In the aftermath of the breakup of the Soviet Union, Europe's longstanding policies interweaving economics and security became obsolete and badly in need of reform.  This paper analyzes first the failures of these policies, and then possible policy changes that will bring the EU up to date.

"This online database is a compilation of speeches, interviews, statements, and publications of jihadist leaders, foot soldiers, and sympathizers. Nearly all content is in English translation, and has been collected from publicly-accessible websites. Original links are provided, along with excerpts and full-text content when available.... Content is indexed by date, author, affiliated group, online source, and keyword."  (criteria for inclusion listed on main page)

"Penn's Security SIG was established in October, 2005 to provide an opportunity and forum for security-conscious system administrators and support staff at Penn to meet and discuss information security issues and problems. The group is sponsored by ISC's Office of Information Security."

Lets you create a DBI connection with parameters stored in a .ini style file. The password is stored encrypted.

This module is similar to DBIx::Password. The differences are that DBI connection parameters aren't stored as part of the module source code (but in an external .ini style file), and that this module lets you only one virtual user (i.e. one connection) per .ini file.

Like , this is a subclass of DBI, so you may call DBI function objects using DBIx::PasswordIniFile objects.

Don't you hate keeping track of database passwords and such throughout your scripts? How about the problem of changing those passwords on a mass scale? This module is one possible solution. When you go to build this module it will ask you to create virtual users. For each user you need to specify the database module to use, the database connect string, the username and the password. You will be prompted to give a name to this virtual user. You can add as many as you like.

SANS has received permission to provide sanitized security policies from a large organization. These policies were developed by a group of experienced security professionals with more than 80 years of combined experience in government and commercial organizations, and each policy went through a vigorous approval process. They should form a good starting point if you need one of these policies.

Some tips about these policies. Anything that is in <angle brackets> should be replaced with the appropriate name from your organization. The term “InfoSec” is used through out these documents to refer the team of people responsible for network and information security. Replaced with the appropriate group name from your organization. Any policy name that is in italics is a reference to a policy that is also available on this site.

Review of common thinking in security.  takes the stand that security is planned.  prevention is only necessary on un-planned for security applications and hosts.  may be useful as we move thru security implementation.

Sans is a better site, but this points to some good password generators