What ciphers will be broken 30 years from now?

About 10 years ago, as a very green and ignorant student, I wrote a paper on security in which I imagined that with sufficiently strong encryption there'd be, in theory, no need to secure an encrypted document. Millions of copies would be merely redundant backups.

I think the encryption standard in use then was 40 bit DES or the equivalent (I may have the names wrong). That would be trivially cracked today.

I thought of that when I read this story on cracking old German ciphers:

BBC News: Online amateurs crack Nazi codes

Three German ciphers unsolved since World War II are finally being cracked, helped by thousands of home computers.

The codes resisted the best efforts of the celebrated Allied cryptographers based at Bletchley Park during the war.

Now one has been solved by running code-breaking software on a "grid" of internet-linked home computers.

The complex ciphers were encoded in 1942 by a new version of the German Enigma machine, and led to regular hits on Allied vessels by German U-boats.

Allied experts initially failed to deal with the German adoption in 1942 of a complex new cipher system, brought in at the same time as a newly upgraded Enigma machine.

The advancement in German encryption techniques led to significant Allied losses in the North Atlantic throughout 1942....

[Krah] ... wrote a code-breaking program and publicised his project on internet newsgroups, attracting the interest of about 45 users, who all allowed their machines to be used for the project.

There are now some 2,500 separate terminals contributing to the project, Mr Krah said.

... in little over a month an apparently random combination of letters had been decoded into a real wartime communication.

... Stefan Krah's computerised codebreaking software uses a combination of "brute force" and algorithmic attempts to get at the truth.

Today's best ciphers will likely meet the same fate as Enignma, sometime in the next 10-30 years. Presumably there are people now collecting as much encrypted network traffic as possible, with the intent of storing it until the codes can be cracked ...

Obsidian Wings on Scientology

Obsidian Wings has a nice set of links to several recent Scientology articles. This has long been an interest of mine. Salon also did a great series last year.

Scientology seems to be moderating, they don't seem to go after journalists with their old savagery. Maybe they're afraid of qualifying for a watch list, but more likely they're following an ancient trail most recently blazed by Mormonism and newer systems migrating from cult to faith.

All worth reading for students of theology and humanity.

Update 3/2/06: Since my initial post I read through the key Rolling Stone article. Superb journalism. LRH's death sounds fairly grim, I suspect his lifelong psychiatric disorder (?schizophrenia) had gotten the better of him. The will that transferred all his assets to the church sounds rather suspicious.

Most sad of all, and reminescent of Jon Krakauer's history of the Mormon Fundamentalism, are the stories of how the church uses family relationships to silence its critics. A cruel and not terribly effective strategy. That cruelty may explain why membership appears to be dwindling.

Now don't panic ...

The Washington Post reports that the Fed's watch list has over 325,000 names:

The National Counterterrorism Center maintains a central repository of 325,000 names of international terrorism suspects or people who allegedly aid them, a number that has more than quadrupled since the fall of 2003, according to counterterrorism officials.

The list kept by the National Counterterrorism Center (NCTC) -- created in 2004 to be the primary U.S. terrorism intelligence agency -- contains a far greater number of international terrorism suspects and associated names in a single government database than has previously been disclosed. Because the same person may appear under different spellings or aliases, the true number of people is estimated to be more than 200,000, according to NCTC officials.

... The TSC consolidates NCTC data on individuals associated with foreign terrorism with the FBI's purely domestic terrorism data to create a unified, unclassified terrorist watch list. The TSC, in turn, provides, for official use only, a version giving each person's name, country, date of birth, photos and other data to the Transportation Security Agency for its no-fly list, the State Department for its visa program, the Department of Homeland Security for border crossings, and the National Crime Information Center for distribution to police.

Ok, so that's a lot of names. If only 10% are US residents that's over 30,000 names of US citizens on the no-fly list alone. I'd wager at least 98% of those are likely "false positives", people who have been 'tried and convicted' without benefit of trial.

I thought there used to be rules about that sort of thing.

But not to worry, there's a home awaiting those folks (link and emphasis mine)...

WorkingForChange-The cost of incompetence (Molly Ivins)

... And now comes a curious new contract for KBR, the Halliburton subsidiary. The contract provides for establishing temporary detention and processing capabilities to augment existing Immigration and Custom enforcement. It's a contingency contract -- the contingency they have in mind apparently being 'in the event of an emergency influx of immigrants into the United States.' Canadians drowning from global warming? Mexicans feeling the return of PRI? Ah, but the contract also specifies the detention centers are to 'support the rapid development of new programs.' New programs? Far be it from me to speculate.

The alarmmeisters in the blogosphere, whose imaginations know no bounds, are already positing any number of horrors. (I cannot imagine where they get some of these far-out ideas. From reading the right-wing blogosphere?) What surprises me is that the administration has planned for ... whatever it is it's planning for. How forethoughtful of them to have something in place in case ... a lot of citizens need to be rounded up or something.

Now Molly does make mistakes, but her record is pretty good. I'm sure there's an innocent explanation for these detention ... centers. Of course if you click the link I provided you can find all sorts of explanations...

Update 3/7/06: I didn't use to link to this sort of thing. GWB made me do it.

Katrina: the disappeared

The NYT has surprisingly lyrical writing in a story of the living lost of Katrina:

Storm's Missing: Lives Not Lost but Disconnected - New York Times

.... They include every permutation in the grand mosaic of human relationships, an intricate design of unpaid child support, paranoia, grudges, helplessness and anguish, the lonely cul-de-sacs of estrangement and old age.

The story is very well done.

Not all who are scattered wish to be found, and some don't know how to start looking ...

Where has the money gone? To the very American oligarchy.

DeLong liberates Krugman from the NYT pay-prison (emphases mine):

Brad DeLong's Semi-Daily Journal

From Krugman, NYT:

So who are the winners from rising inequality? It's not the top 20 percent, or even the top 10 percent. The big gains have gone to a much smaller, much richer group than that. A new research paper by Ian Dew-Becker and Robert Gordon of Northwestern University, "Where Did the Productivity Growth Go?," gives the details. Between 1972 and 2001 the wage and salary income of Americans at the 90th percentile of the income distribution rose only 34 percent, or about 1 percent per year. So being in the top 10 percent of the income distribution, like being a college graduate, wasn't a ticket to big income gains. But income at the 99th percentile rose 87 percent; income at the 99.9th percentile rose 181 percent; and income at the 99.99th percentile rose 497 percent. No, that's not a misprint.

Just to give you a sense of who we're talking about: the nonpartisan Tax Policy Center estimates that this year the 99th percentile will correspond to an income of $402,306, and the 99.9th percentile to an income of $1,672,726. The center doesn't give a number for the 99.99th percentile, but it's probably well over $6 million a year....

The idea that we have a rising oligarchy is much more disturbing. It suggests that the growth of inequality may have as much to do with power relations as it does with market forces. Unfortunately, that's the real story. Should we be worried about the increasingly oligarchic nature of American society? Yes, and not just because a rising economic tide has failed to lift most boats. Both history and modern experience tell us that highly unequal societies also tend to be highly corrupt. There's an arrow of causation that runs from diverging income trends to Jack Abramoff and the K Street project....

So when does the revolt occur? Will we see a reinvented Al Gore return at the vanguard of a populist rebellion?

Tonight, on NPR, I heard a naive young woman describing a book she'd written about the financial hurdles faced now by her Gen Xrs. Specifically, she and her husband couldn't really afford to live in New York City, but that thought didn't seem to have occurred to them -- so they ran out of cash. What she's really experiencing, of course, is life when the returns on productivity are increasingly concentrated in an Argentinian-style oligarchy. The fact that she wasn't advocating a populist government tells me things will need to get quite a bit worse before most folks catch on.

Psychoanalysis as alternative medicine: Tommyrot in the NYT OpEd page

I was thinking of Freud the other day. A great thinker, a great writer, and a flawed human being to be sure, but he started out as a scientist. I wonder if some of his very early work as, I think, a neurologist, may still hold up. Most of his time, however, was dedicated to psychoanalysis.

It was of that work that I wondered -- was there anything in there of value? Was it anything but a massive diversion and distraction from a deeper understanding of the human mind? I wondered if any modern scientist had dug through Freud's writings looking for any testable hypotheses that could hold water today. Then I came across this awful OpEd by Adam Phillips in the NYT:

A Mind Is a Terrible Thing to Measure - New York Times

PSYCHOTHERAPY is having yet another identity crisis. It has manifested itself in two recent trends in the profession in America: the first involves trying to make therapy into more of a "hard science" by putting a new emphasis on measurable factors; the other is a growing belief among therapists that the standard practice of using talk therapy to discover traumas in a patient's past is not only unnecessary but can be injurious.

.... One of the good things psychotherapy can do, like the arts, is show us the limits of what science can do for our welfare. The scientific method alone is never going to be enough, especially when we are working out how to live and who we can be.

... the attempt to present psychotherapy as a hard science is merely an attempt to make it a convincing competitor in the marketplace. It is a sign, in other words, of a misguided wish to make psychotherapy both respectable and servile to the very consumerism it is supposed to help people deal with.

... its practitioners should not be committed either to making money or to trivializing the past or to finding a science of the soul.

... No amount of training and research, of statistics-gathering and empathy, can offset that unique uncertainty of the encounter.

... Psychotherapists are people whose experience tells them that certain risks are often worth taking, but more than this they cannot rightly say. There are always going to be casualties of therapy.

Psychotherapy makes use of a traditional wisdom ...

Let me get this straight. Recent studies suggest some of the key therapies of psychotherapy are potentially harmful. Rather than investigate this further, Philips makes an appeal to "art", "traditional wisdom" and the fight against "consumerism" (which apparently includes the hard cold light of reason).

Wow. What pretty, pathetic, balderdash. Philips is using arguments that even the alternative medicine cult world has largely abandoned. He's basically arguing against reason and measurement. Those psychoanalysts working hard to figure out how to maximize benefit and minimize harm have my deep sympathies -- having someone like Philips on the NYT Op Ed page is a real slap in the face.

The tragicomic security failures of the financial services industry: Acxiom's story

The security situation in the financial services industry has passed beyond shocking into darkly comical. For about four years the personal data, effectively the digital identities, of millions of Americans were sold for less than a dollar apiece to criminal organizations. The source was Acxiom, a little-known financial services company that provides transactional services for the credit card industry. This very poorly written story also has some interesting details on how extraordinary the financial data mining industry has become: (I've edited it as much as I can to help make it a bit more coherent):

Data Thief Exposes Flimsy Security, Nets 8 Years

Posted on 02/24/2006 @ 16:55:34 in Security.

The former owner of an email marketing company in Boca Raton, Florida [Scott Levine] will be spending eight years on a forced sabbatical for filching one billion data records from Acxiom, one of the world's largest managers of personal, financial, and corporate data.

According to the Cincinnati Post, Acxiom handles "14 of the 15 top credit cards companies, five of the six biggest retail banks and seven of the top 10 car makers. All share the credit card and other information of their customers with Acxiom."Other customers include TransUnion and the City of Chicago. In addition, Acxiom maintains nearly 850 terabytes of storage across five football fields worth of data centers worldwide, including the US Europe, China and Australia. Among other things, they process over a billion US postal records a day.

Acxiom claims it "continually gathers data from thousands of public and private sources," enabling it to offer the "widest and latest selection of data possible" with "the most informative, accurate and recent demographic, socio-economic and lifestyle data available-at the individual or household level."

And all that data's not being collected for posterity. Acxiom offers it to direct marketers, among others, to identify the best prospects. For example, its CPI score, which is updated monthly, tracks an individual's economic life and "quantifies the size of a specific consumer's economic footprint, indicating the historical consumer purchasing and relative amount of marketing activity surrounding that individual."

... Daniel Baas... was the systems administrator for a small shop that did business with Acxiom. He was tasked with downloading his company's files from Acxiom's FTP server.

Gregory Lockhart, the US Attorney in Charge said, "Baas committed a crime when he exceeded his authorized access, looked for and downloaded an encrypted password file, and ran a password cracking program against the file."

... Baas illegally obtained about 300 passwords, including one that acted like a "master key" and allowed him to download files that belonged to other Acxiom customers. The downloaded files contained personal identification information.

Millions of records worth US$1.9 million.

... Baas burned CDs full of Acxiom's data from 10 December 2002 through New Years [year?], Acxiom said it had no idea its security had been breached till the sheriff called nearly eight months later.

During the course of the Baas investigation, technicians stumbled over another illicit data miner... Scott Levine, owner of Snipermail... yet another Acxiom customer with a password.

The feds claimed that Levine cracked Acxiom's password system so he could filch other peoples' data. From January through July 2003, he abused this authority, ultimately downloading a billion records with a purported street value of US$7 million. ..

... Despite all this, you might say Scott Levine is lucky. His original indictment in July 2004 carried 144 counts. But by the time his jury was finished a year later, the US prison system's latest inductee was found guilty of just 120 counts of unauthorized access of a protected computer, two counts of access device fraud, and one count of obstruction of justice.

So there were two separate identified break-ins of which one led to one conviction on two counts. There were no consequences for Acxiom's crummy security -- after all, they were the "injured" party. The inability of the jury to convict more broadly is typical of these crimes; they are too complex for most trials. Given the history it is reasonable to assume there were other unidentified break-ins.

Bruce Schneier has written for years that nothing will happen until the financial services companies are held directly liable for their security.

There's a lot of enthusiasm in many quarters for electronic health care standards and transactions. Often the security of financial industry transactions is upheld as an indicator that privacy and security issues will be managed well. Pardon my skepticism.

Discarding receipts: IRS accepts scanned images

It's a bit quirky, but my Brother MFC 7820N device is now working as a networked scanner to my Mac and XP machines. I can put something on the flatbed or sheet feeder, press a button and walk away. In under a minute the document is scanned to a reasonably sized black and white 300 dpi 8.5x11 PDF stored on my OS X box. [1]

So now I wonder if I can toss the paper receipts -- at least for tax purposes. The IRS says yes (more on NeatReceipts below):

Welcome to NeatReceipts

Does the IRS accept digital receipts?

Yes. According to ruling Rev. Proc. 97-22, the IRS allows one to prepare, record, transfer, index, store, preserve, retrieve, and reproduce books and records by either electronically imaging hard copy documents to an electronic storage media, or transferring computerized books and records to an electronic storage media that allows them to be viewed or reproduced without using the original program.

Can I throw away my receipts once I have captured an acceptable image?

Yes. According to ruling Rev. Proc. 97-22, the IRS permits the destruction of the original hard copy books and records and the deletion of original computerized records after a taxpayer completes testing of the storage system.

NeatReceipts, incidentally, is a wonderful business idea. They provide custom software and a portable scanner for automated scanning and processing of receipts. I don't know how it works in practice; it has at least two big drawbacks from my perspective. For one it's XP only, and I'm trying to minimize the use of XP at home. For another I don't want yet another scanner. I have a multi-function device with a document scanner, a flat bed scanner, and a Nikon negative scanner. I just can't handle the hassle of another device to fuss with.

[1] I have to be logged in to the account that receives the transfer and I have the firewall disabled, I am trying to figure out what ports are in use so I can reenable the firewall -- but this machine is fairly protected anyway. I can't get things working as well with the XP box, it seems to ignore my configuration settings. I don't have confidence in the software I'm using -- there's no business model to make it robust and reliable. I do have confidence in PDF as an image format so I'll probably switch to something else some day.

The National Parks: Reason 143 to despise Bush

Even if I didn't have 142 other reasons to intensely dislike the GOP and GWB, their attack on the national parks would do all by itself:

Crossroads in the National Parks - New York Times

The Interior Department has extended the period in which the public may comment on the National Park Service's controversial plan to rewrite the management policies for the national parks.

.. The main problem with the proposed revisions is that, taken together, they shift the management focus from the park service's central, historic mission — preserving natural resources for the enjoyment of future generations — to commercial and recreational use of the park for today's generation. As many members of the House and Senate have pointed out in letters to Interior Secretary Gale Norton, air quality and wilderness are especially at risk since the policy appears to invite greater use of snowmobiles and other off-road vehicles.

... President Bush's new budget calls for a $100 million cut in park appropriations. Viewed cynically, deliberately underfinancing the parks could create the necessary cover for opening the parks to more commercial activity — the last thing the parks need. It also makes a mockery of one of the few campaign promises George W. Bush ever made about the environment: his promise in 2000 to end the maintenance backlog in the national parks. The sharpest cuts — some $84.6 million — would come from money for construction and major maintenance, the very area Mr. Bush promised to address.

... Despite efforts to cram snowmobiles down the public's throat, snowmobile use in Yellowstone has dropped this year, falling well below the 720 machines that are allowed into the park each day. Visitors — including former snowmobilers — are increasingly choosing to use snow coaches, the specially equipped buses that are vastly cleaner than even the cleanest snowmobiles. And Yellowstone is seeing a greater variety of visitors in winter than it used to see when snowmobilers dominated the park.

This battle — as well as the larger battle over the parks' true purpose —isn't likely to end soon. Off-road vehicle groups are doing their best to pressure an already pliable park service leadership in Yellowstone and Washington into increasing access...

The tragedy of the motor brigade is that by winning they destroy what they love -- the wilderness. The Yellowstone story has impressed me though -- given better alternatives they choose the snow coaches to preserve quiet and clean air. That result was predicted by Clinton-era surveys, but of course Norton/Bush disregarded it.

Hacking the universe: counterfactual computing

You can measure something -- without actually doing the measurement.

You just threaten to do the measurement. The answer then appears.

It smells like a variant of 'spooky action at a distance'.

That's my summary of counterfactual computing. It will do for me until the Scientific American article comes out, which I will read and fail to comprehend.

This all feels as though we're hacking the infrastructure upon which our "program" runs.

If this stuff turns out to actually have real world implications the next forty years will be even less predictable than expected.

PS. Cosmic Variance has a serious attempt at an explanation.

Drug testing in sports: time to give up?

A few years ago JAMA featured a series of articles on drug testing for atheletes. I don't recall the details, but I do remember concluding that this was a doomed effort. The drug use was getting very sophisticated, and the tests couldn't keep up. Careful users could stay within the published bounds, and eventually every athelete's metrics would converge on the very limits of the test regimen. (This ought to be an amusing study by the way -- plot the narrowing of the distribution of lab values over time.)

Salon reports the end is now:

Salon.com | King Kaufman's Sports Daily

4. Officials administered a reported 1,200 drug tests, a 71 percent increase over the last Winter Games, in 2002. And there was one positive. One. In Salt Lake, seven athletes tested positive out of 700 tests.

So, thanks to the crackdown by world anti-doping forces, we've gone from 1 percent of the tests coming up positive to 0.0083 percent. Problem solved! Glad we cleared that up.

Drug tests performed on the Austrian cross-country skiers and biathletes following the raid on their quarters that reportedly turned up dozens of syringes and unlabeled drugs came up negative. The International Olympic Committee says the investigation is ongoing.

Positive tests are not required to punish athletes for drug use, the IOC says. It takes circumstantial evidence into account.

That's probably wise, because drug testing is obviously one of the most abject, spectacular law enforcement failures since Prohibition.
Either that or the Olympics are now suddenly a collection of the cleanest, most drug-free saints ever gathered in one place. On second thought, yeah, I'm sure that's it.

The drug tests still serve a purpose. They set an 'upper bound' on how performance enhancing drugs can be used -- users cannot exceed maximal physiologic outcomes.

In a sense the drugs now compensate for the fundamental inequities of genetic gifts ... So in the interests of fairness we should make the most sophisticated drug regimens and monitoring systems universally available to all atheletes. When they are are equallly tuned, including the use of cognitive modifiers, then the outcome of competition will be chance and training ...

Defining a disease: how often are atypical presentations due to multiple agents?

It's been a long time since I was a real doctor, but occasionally I play one when the kids are sick (my wife is still a real doctor). In the latest episode our six year old had a week of vomiting, persistent fevers, hand and foot complaints and rashes that, to tired and worried parents, looked a bit like Kawaski's Disease. Happily a set of bloodlettings cured him and he never made the diagnostic criteria.

So what did he "really" have? "Bad adenovirus" is the story our most excellent pediatrican gave, though he admits he really doesn't know. In reality, of course, there's no reason why he had to have just one virus. There's nothing about being infected with, say, an enterovirus, that makes one immune to infection with an adenovirus. Likewise a strep infection, for example, does not prevent coronavirus infection. They're all around us in Minnesota at this time of year.

We're used to thinking about multi-organism infections in the context of HIV and ICUs, but they must happen reasonably often in the ambulatory setting. How many unusual presentations, including some with persistent injury or even death, are really the result of coincidental simultaneous viral (or bacterial) infections that together produce far more disease than each would alone? How often does a pathogen cause a commensal to become pathogenic? Our models of disease are, like all models in science, only approximations. We haven't had the instruments to further refine these models, and thus to reconsider the nature and definition of infectious diseases. It will be interesting to see how these things change as we get cheaper and better rapid tests for viral and bacterial infections.

Of course I'm sure all of these speculations are old hat in the infectious disease and microbiology communities, but my background is in primary care. I think changing from a simplified model of disease to a multifactorial and 'emergent' model, will have some interesting consequences in many domains. (I've omitted mention of additional genetic and environmental interactions because that's kind of obvious ...)

PS. Incidentally, when reading about KD both my wife and I were struck yet again about how feeble the descriptions of disease are in the biomedical literature. Most of the descriptions are a list of uncorrelated and unsequenced complaints and findings, as though combinations and temporal evolution were irrelevant -- when in fact those are often the key 'signatures' of a disease. If I didn't know better I'd say our medical writers are encrypting their knowledge, but in fact this I know there's no conspiracy here. It's simply that the audience doesn't demand better.

By comparison layperson stories are often much richer; one parent's website featured a terrific slideshow and description of the evolution of their daughter's successful treatment that shamed every medical text we reviewed. Osler's descriptions of disease in the early 20th century are far better than what we read nowadays.

Some curmudgeon needs to write a paper about this!

PPS. And then there's the remarkable paucity of data in most reviews and articles on the prevalence of cardiac aneurysms in treated Kawasaki's Disease. Come on gang! Applied biomedicine could use a kick in the old pants ...

What's really going on with the "Port" story?

Google has about 2380 articles about the port story. That's a heck of a lot of noise. None of it makes much sense. There isn't enough there to justify all the fuss. Sure, US port security sucks. Sure this is an incredible sign of incompetence five years after 9/11. That's the fault of the GOP and the Bush administratiion, not the port management company. Dubai is as good an ally as the near-friendless US has these days. The friendless part is also the fault of the GOP and the Bush administration. Sure foreigners are buying up fundamental US assets, but that's because our governmental finances are a complete mess. That's also the fault of the GOP and the Bush administration.

No news here.

So what's really going on that so many Senators have their knickers in knot? It has to be something that no-one is ready to talk about. I have two suggestions:

1. Sure Dubai is an ally. So was Iran under the Shah. Dubai is not a democracy. Maybe security analysts suspect it's ripe for revolution. Maybe Senators know that. It's a rather impolitic thing to say. This is one way in which Duba is not the UK.

2. Follow the money. (This one comes via Emily.) No deal of any size is done in the US today without a kickback to the GOP. They got a percentage, somehow, womewhere. The deal was done pre-Abramoff, and now the GOP is afraid this one might get attention.

Or maybe the answer is #1 and #2 and something else. The one thing I'm betting on is that it isn't anything that's being talked about.

Google to PayPal: your days are numbered

Google's official blog features a remarkably bland post on payment systems that includes a remarkably coy phrase:

Official Google Blog: An update on payments:

... We expect to add payment functionality to Google services where our users need a way to buy online....

There's no mention of when this will be released. My bet would be that we'll see the announcement within 3 weeks.

[note: in the original version of this post I wrote 'eBay' instead of 'PayPal'. I meant the latter.]

Another update on America 1984

Hilzoy of obsidian wings has extensive commentary on a recent New Yorker Article on America's torture program. The torment of the "20th hijacker" is truly impressive. Stalin would have approved.

What I want now is an international panel of wise women and men, trustworthy group of outsider, to pronounce judgment on America. Is it "happening here"?