Category Archives: Security

Bozeman Privacy

Note the survey results at the top of the story about Bozeman City job requirements. I’m surprised that 1% actually voted in favor of the policy. 98% have voted against:

Applying for a job with the City of Bozeman? You may be asked to provide more personal information than you expected.

That was the case for one person who applied for employment with the City. The anonymous viewer emailed the news station recently to express concern with a component of the city’s background check policy, which states that to be considered for a job applicants must provide log-in information and passwords for social network sites in which they participate.

European regulators regularly point to the US as a primitive and lax country in terms of the right to privacy. Stories like this just drive the nail in. The employer actually asked for the applicant to surrender their password? That is more than a violation of privacy, it actually begs the question of integrity and authenticity. How many people were allowed access to the passwords? Beyond that, one has to wonder how passwords were stored securely and when they allowed users to change the password. The value of this test is questionable as well since it is based on a record that the user can actively manipulate before and after, unlike a driving record. Clearly Bozeman is in serious need of some security consulting.

Iran and Deep Packet Inspection

News broke yesterday that Nokia and Siemens had enabled Iran to do deep packet inspection. The sale of this capability has been defended as an integral part of technology required for network access. In other words, when Iran invests in core communications infrastructure it will inevitably get the ability to look inside and reshape the traffic that it now carries.

Whether or not you agree with the politics of this situation, very interesting analysis is possible as demonstrated by Arbor. They have posted a map of recent Iranian Traffic Engineering and also noted why Iran is unlikely to completely block off communication:

Iran has significant commercial and technological relationships with the rest of the world. In other words, the government cannot turn off the Internet without impacting business and perhaps generating further social unrest.

That means Iranian traffic is highly likely to be manipulated and monitored instead of blocked. This is a much higher level of sophistication in security terms, as I explained before with regard to cell phones in prisons. I would therefore expect to see counterintelligence used for things like Twitter misinformation, as I explained before with regard to protests in Egypt and the militias in Somalia.

Somalia Begs for Invasion

The New York Times reports that Somalia’s Parliament has asked its neighbors for military intervention.

Somali lawmakers pleaded Saturday for international military intervention within 24 hours to help fight Islamic insurgents in the lawless African nation, where fierce fighting has resumed in the capital.

The Parliament is clearly losing its grip to violent opposition, but the question is whether their call for intervention makes any sense in terms of security.

US policy there, as I have mentioned before, seems to have been about unfettered aim at anti-American groups and targets. Air and missile strikes in Somalia, as well as clandestine operations, might be seen by Washington to be a great way to illuminate the shadowy pockets of Al Qaeda, but it motivates local populations to be even more anti-American (like Al Shabab) and fuels lawless profiteering (piracy). The Ethiopian incursion, which was supposedly requested by the parliament at that time, not only failed to stabilize the situation but led to a failure of government. Ethiopia’s occupation and then withdrawal (arguably more about U.S. anti-terror operations than nation-building) ended with another vacuum of power and the loss of government, not preservation…which brings us back to today’s question.

The U.S. military strategy in the Horn has failed, Ethiopia’s invasion failed, Kenya is unlikely to want to take on unilateral action and an even greater refugee situation, and I can not see Djibouti officially involved in anything (although it is quietly involved in everything related to French policy in Africa). The African Union (AU) mission in Somalia, however, seems to have been successful enough for the United Nations to call it sufficient. This is something the Somali government should not dismiss lightly. A call for greater AU involvement would make the most sense for defending the country’s government. Perhaps the reason for calling upon neighbors for invasion instead of increased AU presence is related to regional politics. A test of the AU is whether it can navigate through Eritrea’s influence on the Horn. Nonetheless, given U.S. and Ethiopian examples, the AU seems like the best option at this point to help stabilize the city and state.

BaaCode for Icebreaker Clothing

Icebreaker is a company that makes wool clothing. They provide a page where you can enter a code from your clothing to find out all kinds of information about its “source”:

Your unique Baacode will let you see the living conditions of the high country sheep that produced the merino fibre in your Icebreaker garment, meet the farmers who are custodians of this astonishing landscape, and follow every step of the supply chain. We’re sure you’ll find the experience as inspiring as we do. Enjoy your journey back to the source.

“Traceability” seems like a really good way to get a handle on the information that has to be displayed on packaging like sulfur, or nuts, or types of sweeteners. The use in garments is nice too, but seems more like a novelty than a necessity.

I wonder if anyone has invented a device that could scan a barcode, identify the product and then immediately advise whether the contents and/or source is suitable for purchase. That could save shoppers significant time/effort and help drive change in the market.

On the flip side, I wonder if Icebreaker monitors who checks their BaaCode and from where.

The demo code they offer for testing is 213C3F390 and the URL seems to support automated/scripted testing, like this:

https://www.icebreaker.com/site/baacode/trace.html?language=en&baacode=213C3F390

How long before someone runs every alphanumeric and downloads their database? Maybe there’s no threat. I mean what could anyone do with a database of wool fiber supply chain information? Could suppliers use it to reveal competitive info and set prices?