Apparently someone thinks it is a good idea to require you to have your cellphone with you in order to start your car. When that is found to be easily broken (i.e. with a replay or DoS attack) I can only guess what else will be used as a key. Perhaps a special stuffed animal that will rest on the dashboard? Or maybe one of those cap tassles from graduation ceremonies? Might as well put the stuff to use.

Anyhow, I just thought I should mention that multiples of the same form of authentication do not necessarily reduce vulnerabilities. For example, “something you have” plus “something else you have” plus “something else you have” still just adds up to one-factor authentication — something you have.

Telematics Journal describes the system in question:

A new car security system that identifies car owners through the Bluetooth element of their mobile phones is set to revolutionize the fight against car thieves. Auto-txt immediately identifies a car as stolen if the car is started with the keys but the mobile phone is not present. This unique feature allows a Bluetooth enabled device, such as a phone or PDA, to authenticate the vehicle owner, providing an enhanced level of security.

I can barely get my bluetooth headset to reliably connect to my phone, so I can’t imagine what happens when I need to start my car and bluetooth connections are spotty, or the battery dies. And when will manufacturers stop hard-coding four-digit PIN authentication as 0000? Bluetooth security has been so poorly implemented, I have a hard time understanding why anyone would want to lower their auto security to the dismal level of cell-phones.

The other part of the system seems to be some sort of sales spiel by Ford’s luxury division to provide assurance to prospective owners:

Auto-txt is the first stolen vehicle protection and tracking system to be awarded Thatcham’s Category 5 accreditation, the new insurance industry standard that is supported by the police. […] Auto-txt has been selected by Jaguar Cars and Land Rover to supply car tracking and security systems for all their vehicles from 2006. The systems, called Jaguar Watch and Land Rover Watch, will be available in the UK and across Europe. It is the first time the prestige car manufacturers will be offering a stolen vehicle tracking system in their own name.

Might be interesting to look into the formula for the Thatcham accreditation claim. In other words, is the plan for sales to go up x% due to an Auto-txt marketing blurb, or do they really believe that auto recovery (in a useable state) will be more effective?

In a case called Garcetti v. Ceballos, the US Supreme Court ruled that whistleblowers do not have a Constitutional right to free speech.

I’m no lawyer, but it seems to me that the Court has basically said that employers should be able to discipline employees for speech on the job without any regard to whether it touches on serious matters of “public concern”. So if anyone was wondering what’s ahead for America, with Alito on the bench, the answer should be clear. Alito cast the deciding vote.

Hopefully clarification will be in the news soon. Perhaps more reasonable minds will raise awareness and some sensible thinking might prevail over Alito. Jack Balkan has aleady posted an excellent critique called Ceballos — The Court Creates Bad Information Policy. Meanwhile Alito’s decision means employee’s speech in any “official capacity” explicity has no constitutional protection. SCOTUSblog has a nice summary of the case background:

Los Angeles County deputy district attorney Richard Ceballos may be in trouble for one simple reason: he performed his job exactly as he was supposed to. Informed by a defense attorney in a case being prosecuted by the district attorney’s office that one of the arresting police officers may have lied in a search warrant affidavit, Ceballos vigorously investigated the charge and found evidence of wrongdoing. Respecting the chain of command, Ceballos drafted a memo raising his concerns and recommended dismissal of the case. Since Ceballos could not dismiss the case without supervisor approval, he discussed his concerns with one of his supervisors and provided him with the memo. Ceballos and his supervisors met with the Sheriff’s office to discuss their concerns, but the meeting convinced Ceballos’s superiors to pursue the case despite flaws in the affidavit. Knowing that Ceballos had legitimate concerns about the affidavit, defense counsel in the case subpoenaed Ceballos to testify at the hearing. Ceballos agreed to testify and—pursuant to what he believed were his prosecutorial obligations—provided the memo to defense counsel. When Ceballos was allegedly punished for speaking out, he responded by filing a Section 1983 action contending that he was retaliated against for engaging in speech protected by the First Amendment. Legally, however, Ceballos has one critical problem: he did exactly what his job required.

And here is Jack’s conclusion regarding today’s decision, clearly explaining why it is bad policy:

After Ceballos, employees who do know what they are talking about will retain First Amendment protection only if they make their complaints publicly without going through internal grievance procedures. Although the Court suggests that its decision will encourage the creation and use of such internal procedures, it will probably not have that effect. Note that if employees have obligations to settle disputes and make complaints within internal grievance procedures, then they are doing something that is within their job description when they make complaints and so they have no First Amendment protections in what they say. Hence employees will have incentives not to use such procedures but to speak only in public if they want First Amendment protections (note that if they speak both privately and publicly, they can be fired for their private speech). However, if they speak only publicly, they essentially forfeit their ability to stay in their jobs, first because they become pariahs, and second, because they have refused to use the employer’s internal mechanisms for complaint (mechanisms which, if they used them, would eliminate their First Amendment rights). In short, whatever they do, they are pretty much screwed. So the effect of the Court’s decision is to create very strong incentives against whistleblowing of any kind. (Another possible result of the case is that employees will have incentives to speak anonymously or leak information to reporters and hope that the reporters don’t have to reveal their sources).