Ever-Falling Cost of Surveillance Talk

US v Jones is one of the more important recent SCOTUS cases on the 4th Amendment. Kevin Bankston and Ashkan Soltani wrote a great paper analyzing the case, Tiny Constables, on how the rise of software and small sensors is bringing about a sea change in tracking technologies available to law enforcement. Their talk at New America in 2014, The Cost of Surveillance was a great overview of the economics, and how that should affect the legal analysis. I attended, and found the graphs of the cost outlays with and without technology really interesting, and it helped show how economic analysis can be helpful in thinking about how the law should respond to changes in technological capabilities.

Zero Days

Zero day hacks are software bugs the software vendor is not aware of, and which therefore have no patch available. The "valuable" (for a particular definition of valuable...) ones are bugs that can be leveraged to give the exploiter privileged access on a computer, which can be used to install keyloggers, etc. Zero day exploits the exploits are often sold and there is debate about whether the government does or can use them in counterterrorism surveillance. If we ignore the "does the government use them?" question and focus on the "can they?" aspect, one statute that might offer the answer is the Computer Fraud and Abuse Act, 18 USC §1030(f). This section offers the government immunity from hacking when used to go after criminals. It states, "This section does not prohibit any lawfully authorized investigative, protective, or intelligence activity of a law enforcement agency of the United States, a State, or a political subdivision of a State, or of an intelligence agency of the United States." That's pretty wide ranging- "any lawfully authorized" covers a lot of ground. Is exploiting zero days lawfully authorized? I think that no matter what steps the actual exploit takes, the government might argue that it should be covered under "lawfully authorized activity" if it's part of an ongoing investigation. Is keeping knowledge of a zero day from the software vendor, so that a government agency can continue exploiting it, allowed? Is there a duty to disclose the issue so that others don't also exploit it? And is the purchase of zero day exploits covered under "lawfully authorized activity"? There's a law review article, 50 A.F. L. Rev. 135, Defensive Information Operations and Domestic Law: Limitations on Government Investigative Techniques, from 2001, which addresses 1030(f) in the context of government operations.

Creative Commons Goodness

My Instagram feed has for a long time featured occasional shots of coffee cups and my kindle. My favorite way to spend a weekend morning, after all, is so get a good cup of coffee and read, and in the vein of "shoot what you know" I've shot quite a few coffee cups + kindle still lifes. My friends have kidded me about it a few times over the years, but apparently some of them associated "coffee cup" and "kindle" with my photos enough that I was notified by a few folks when this article was published a few months ago:

THE BOOK THAT MADE ME QUIT MY JOB

- yup, that's my photo illustrating it! The awesomeness of tagging your pictures with a creative commons license on flickr and releasing them into the wild is that once in a blue moon one gets used. So cool. Looking at the last post I put up here, with the coffee cup & kindle reminded me that I wanted to save a link up here so I could find it again! So here are a few more coffee cups with Kindles. As you might guess from the name of my blog, my drink of choice is an americano, with pourovers being my fallback drink.

famous last words

April 2008, on my blog:

"I don't think that there has ever been a foray into legal territory on my blog, if I think about it. Which is a bit odd, because I'm not a lawyer, but my dad is, and I love talking about trials and legal things with him."

-- on Contracts

March 2014: dear blog, time for the once-every-few-years sorry-I've-neglected-you post (see exhibit 1, the most recent iteration and exhibit 2, the oldest iteration). What's my excuse this time? I'm in law school, so no free time. Also, maybe in a few years that post linked above is going to be factually incorrect. Who knows, I'm currently a clueless 1L so anything could happen. However, I went hunting through my blog today for some substantive writing from my past lives, having had some weird idea that I must have written a few posts that were more than a paragraph long. I was 98% incorrect, but I did dig up a few examples where I managed to ramble on at length.

Why am I in school again? According to my law school application essay, it's because of a conversation about open source software at OSCON 2012. I've thought a fair amount about programming vs legal issues over the last few months, and how diametrically opposed they are in so many ways. Tech industry: we are suspicious of you if you wear a suit to an interview or if you stay at a company for too long. Law: we are suspicious of you if you don't wear a suit to an interview or if you job hop. Software: I'm not sure what this program does, let's compile it and put in a break point to see exactly what's happening. Law: "'Chicken' may mean one thing or it may mean something else entirely. Who knows?" Software: you prove an algorithm is n log n by these steps that every one agrees on. Law: You might be able to prove a prima facie case of negligence with these facts, but maybe not.

In any event, I've had a few pushes from different parties to take up blogging again, so hopefully I will find time to write here more. I also hope I might find time to write about music again- the first few years of this blog were almost entirely music blogging, and it's something I miss.

So on that note, my latest favorite song is by Air Review, and you should check it out in this fabulous video of a border collie enjoying life while his owner does some mountain biking. This made me miss the Northwest so much; I need to find a weekend to get out there again soon!

Amazon Christmas

I came across these wild photos of Amazon's warehouses, packed with books recently, and it reminded me of my first Amazon Christmas. So far this one has been interesting (best moment so far, walking to Mike's Pastry in Boston at 7 AM after working from 2 AM to 7 AM on some Black Friday prep... nothing like awesome lobster tail pastries to replace sleep). Nothing so far like my first Christmas, though. Here's something I wrote up about that 1999 Christmas.

The smell of coffee brewing makes me up before my alarm goes off as the timer on my coffeemaker ticks over to 4 AM. A velvety black is draped across my apartment as I stumble out of bed to get a cup. This morning- mid December 1999, probably rainy, definitely cold and dank- is just like all the others in a string of a few weeks since we paused working on updates to amazon.com’s website software and went all hands on deck in the company’s warehouses. We have been successful beyond anything we thought would happen and people are ordering books and CDs faster than we can get them out the door. My team of developers has drawn the morning to mid-afternoon shift and we assemble in South Seattle at an anonymous warehouse to start work as elves.

I pull on an extra pair of wool socks and put my work boots back on, then slide my walkman into my vest pocket. We all listen to mixtapes during our shifts, swapping them back and forth to ease the monotony of hour after hour after hour of moving books from the loading docks into the shelves. We’ve picked up a new foreign tongue. To “receive” is to grab pallets of shrink wrapped books out of the backs of tracker trailers. To “pick” is to grab books off the shelves that we’ve deposited them on to be assembled into customer orders. I’ve been told that we run our warehouse differently than any other warehouse. I joke that sure, few warehouses around here have software engineers wrestling 60 pound boxes of books off the loading docks, given that this is the pinnacle of the dotcom boom.

One slice of that different way we run our warehouse is in the very area I’m working. One of the backend software engineers had noticed that because we use computers to generate our pick lists it didn’t matter where on the shelves we stuck the books we’d unloaded, just so long as we told the computer where they were. There was no need to put all the textbooks in the same spot- they could go in any shelf that had space for them. Gingerly, I slash open a pallet of book boxes and scoop up an armful, as many as I think I can hold. Grateful that I’ve yet again avoided the sharp razor of the box cutter I turn and set off down the aisles to store the books for the pickers. An open spot down by the floor catches my eye and I stuggle to kneel down without spilling the armful of books. I grab the scanner clipped to my belt and scan the barcode under the shelf spot- the bin- where I’m about to put the book. Then I scan the book, tuck it into that spot, and walk on. I love the delicious simplicity of this hack. I’ve turned into a walking hash function, the computer algorithm by which items can be stored at arbitrary locations but still be retrieved by a pointer. My scanning that bin and then book made a pointer in our warehouse’s memory to be traced in reverse by the picker.

Scanning, kneeling, walking, walking, walking and scanning more. I peek at the giftwrap station sometimes, assuring myself that the endless stream of books that I’m pulling out of trucks really are going out to customers. We sit on breaks sucking down stale coffee. We marvel at seeing all the code we wrote the past few months turning into real packages to people all over the world. The sky outside, when I peek it between the trucks and the loading dock has weathered from the inky black to a flat gray, the same gray that will slide into black again before we are done here.

These really early mornings ended eventually once we got too close to Christmas to ship anything to customers anymore with any hope of it reaching them on time. The next few Christmases I mostly helped out on the customer service email queues, so I rarely went back to that warehouse after that first year. Eventually we closed it, because as an older un-automated one it couldn't keep up with the volume of the newer distribution centers.

pictures

hello blog! i've been twittering and flickring and neglecting my poor blog. So some photo quotes, courtesy lens rentals blog and pictures.




There are always two people in every picture: the photographer and the viewer. – Ansel Adams



In black and white you suggest; in color you state. Much can be implied by suggestion, but statement demands certainty… absolute certainty. - Paul Outerbridge

penguins!

That's my sailor, back when we first started dating, with a real, live penguin. In antarctica. We're getting married soon, so just think... I have years more of crazy penguin photos from emergency deployments to the South Pole to look forward to the rest of my life. ;)

Happy Veteran's Day!

fuzzbusters

I've been a blogging slacker over here, and haven't updated in about a month. How about some fuzzy shelties to make it up?






On one of my favorite topics, Target printed out a coupon for me the other night for $1 off a "Fur Fighter Kit". I got a huge kick out of it- I've never bought dog food there, so how do they know that I'm surrounded by sheltie fuzz? I do occasionally buy stuffed dog toys for Christmas or the sheltie birthdays, so that must be it. I really wish it had a "click here to see why we recommeded this" on the coupon, do 3 dog toys a year add up enough to recommend a fuzz fighter kit? Maybe I'm buying too many de-lint rollers??

cabbage

cabbage
Originally uploaded by wck

Soon. Very very soon.

Horked

Is "horked" really not a commonly used word? I just used it to describe a mess I'd created baking, and my mom had no idea what the word meant. What really amuses me is that her dad is an electrical engineer, and I'm fairly certain I've heard him use it a few times! Anyway, if you use the wrong type of baking chocolate in a flourless chocolate cake for a family Valentine's dinner, well, you just horked dessert and it's a runny mess. Not the elegant chocolate dessert that should have landed on the table! Anyone want fruit salad for dessert instead?

I've been surrounded by nerds for so long that I think that there are a lot of geeky words that I just use. "Horked", definitely. "Punted" which I picked up at MIT. There's the famous "foo" and "bar" and "baz" and then in security land "Alice" and "Bob." Munged. That's another favorite of mine, especially since perl is affectionally called "a data munging language."

Thomas

Making a toaster from scratch

On Boing Boing today, an article about making a toaster from scratch. Pretty funny. Also made me glad that I farm and I sew... I mean, those are easy ways to "reconnect" in comparison. ;) Really, people think I'm nuts for making bread and applesauce from scratch and growing a few tomatoes and eggplants? There's no microwave smelting involved at least. This guy really needs to start a blog to document this adventure...

seagull

seagull
Originally uploaded by wck

on the elizabeth river in virginia

braindump

* I wish I could write a shell script to schedule haircuts. What's with this having to pick a phone thing? ;-)
* Currently addicted to Rancid's Olympia WA song. Deeply, deeply addicted.
* I've had a partially written post on We'll Find a Way by the Ducky Boys floating around in my head for a few weeks, and I'm never going to finish it, so here it is in pieces

I never go up to midtown without a lot of grumbling, but I ended up spending the night in a hotel up on 50 something and 7th ave, just on the north edge of Times Square, on Dec 30. I was sitting at the desk, watching the sun go down and turn the skyscrapers a fantastic bright orange color, though the brown tinted hotel windows. It felt so 80s in some very weird way. I was listening to We'll Find a Way and a few other songs on a small playlist that kept looping and looping. Later in the evening I walked my way south down 7th, though the bitter cold, and after midnight back north up Broadway, still with the same mix. This song fit in with the crystal cold, with the blazing orangish lights so well that I now can't listen to it without the "hey nanana"s sounding like a setting sun and sharp cold air. And stumbling past crowds of tourists- walking Times Square a night early- some sense of dislocation, rooted by the chorus coming up and up all evening.

The "Harry Potter" problem in recommendations

Greg Linden covered the Harry Potter problem in a blog post on recommendation technologies a few years ago:

A very sharp and experienced developer named Eric wrote the first version of similarities that made it out to the Amazon website. It was great working with Eric. I learned much from him over the years.

The first version of similarities was quite popular. But it had a problem, the Harry Potter problem.

Oh, yes, Harry Potter. Harry Potter is a runaway bestseller. Kids buy it. Adults buy it. Everyone buys it.

So, take a book, any book. If you look at all the customers who bought that book, then look at what other books they bought, rest assured, most of them have bought Harry Potter.

-http://glinden.blogspot.com/2006/03/early-amazon-similarities.html


When I worked on the personalization team we were still struggling with the problem- there are definite ways to identify a Harry Potter problem, but you have to remember to apply them. Adding to that, within certain genres there are Harry Potter books/music albums that are only runaway successes within those genres. If you compared those books to the general list of books that amazon sells, they wouldn't look like books that everyone has bought. Taking it a step further, if then if you narrow the scope to only related books you'll find that they are crazy popular.

The biggest side effect of the Harry Potter problem is that it weakens recommendations. For instance, I've bought the O'Reilly regex pocket book and the O'Reilly Python Cookbook and Ruby Cookbook. From those three books, you can pretty easily peg me as a web nerd and safely recommend a Steve Souder's website performance book. Those are very strongly correlated purchases in a narrow band of interest. However, because I'm a geek, I've also bought Neal Stephenson's latest book, Anathem. As have a few hundred thousand OTHER geeks. We could say that Anathem is a nerd's Harry Potter.

So I received an email today from amazon with a list of recommended books, most of which were based off Anathem and Daniel Silva's latest book, Moscow Rules (great book but also a bit of a Harry Potter widely-bought book). As you might guess, the recommendations were really bad. I wish that email had a link that I could click that would say "never recommend any of these books to me again please" -I could go to each detail page and mark that, but it would take a massive amount of time.