From traditional hackers to PacCERT

I thought that I would post this piece that formed part of my half-day workshop on information security at PacINET 2008 in the Cook Islands. My slides were almost the same set that I used last year in Honiara.

Historically speaking, information security is not new. There is evidence of people protecting and of course attacking information in all cultures as far back as there is a historical record. If we take early missionary accounts in Fiji, for example, as containing at least a kernel of truth, we find that access to spiritual information was a closely protected monopoly of a priestly class. The confidentiality, integrity, and availability of information from the world beyond – which was extremely valuable information about the weather, the future, the correct course of action, and many other things – was strictly limited to established priests who seem to have been kept under close control by the chiefs.

However, even pre-European contact Fiji had its hackers. Living at the fringes of Vitian society were (and still are in remote areas) medicine men and witches who could also tap into spiritual information. Their status as relative social outsiders made them either an enemy or a counter-balance to the priestly information monopoly. Some witches and medicine men could even hack (I mean, influence) the spiritual world and alter the confidentiality, integrity, or availability of information to priests.

Even the technology focused information security that jumps to mind when we hear terms like infosec, has very old and mostly military roots going back in Europe to before the time of Christ. One perspective that is used in military, governmental, and business circles today is that information security forms the defensive aspect of information warfare – that is the part of information warfare that is concerned with protecting information assets. For example, information security was something that the USA knew that Iraq was lacking in the first Gulf War in 1991 when they disabled Iraqi air defense computers with a virus smuggled in on dot matrix printers (see Dorothy Denning, Information Warfare and Security, 1991).

Of course, with the rise of the personal computer and the Internet in recent history, information security has become much more than a military concern. With the growth of the so-called information economy has come an equal and predicable growth of information crime, leading to some staggering statistics including a 2005 estimate that the cost of computer crime in the USA exceeded the size of the combined economies of all the nations in the South Pacific.

I have been quoted in the past as saying that despite all of the fascinating mathematics and technology that underly modern infosec, information security is fundamentally a very human discipline. Certainly, no one likes to have money stolen from them, but increasingly information security is focusing on our privacy, our public personae, our collective identity, our fundamental rights, and even our legal identity.

Fiji's anti-government bloggers, who are only able to voice their (all too often slanderous) opinions due to technology which assures their anonymity, are playing a role in shaping the future of Fiji and the region. Only time will tell how significant that role is. However, anonymous political activists everywhere should be wary of the behavior of America's Internet giants in repressive regimes, as they are not always on your side. The most striking example is the case of the activist Shi Tao who was essentially handed over to Chinese authorities by US-based Yahoo. Yahoo, and other international firms, have agreed to work with Chinese authorities in order to gain access to the immense Chinese market.

Information security even has a role in protecting the function of entire nations. Take the case of Estonia, a small former Soviet republic on the coast of the Baltic Sea with a population of around 1.3 million people. In May this year, Estonia moved a certain Russian war memorial to a location more desirable to Estonians but less desirable to Russian nationals living both in and out of Estonia. Soon, various blogs were posting instructions on how to wage a denial of service attack against Estonian institutions, and a little while later, this attack was in full swing bringing down government and financial sector systems across the tiny maritime nation. Should this story concern other, perhaps more tropical, small maritime nations who are rushing to get their institutions online? The answer is a resounding, "Yes".

Still, one of the largest challenges facing information security today is the heady combination of social engineering and user ignorance. Many computer criminals have discovered that hacking just does not pay off as well as simply fooling people into giving up either their money (to help move funds out of Nigeria to help a poor window, for example) or enough information to get to their money. To give a somewhat trivial example, I have never received so many chain emails from people I know since I came to Fiji – and I was part of the first wave of Internet users in Canada. It goes without saying that nations with large populations of new Internet users are more at risk.

Technology policy makers in the South Pacific should indeed be worried by all of this. By joining the global information economy, the region is embarking on an enterprise that is as fraught with danger and as ripe with rewards as the great Melanesian and Polynesian migrations of days past. Fortunately, it is not necessary to sail the seas blind – technology policy navigators need only to look across the ocean to the experiences of other nations to see what problems to expect and which solutions are effective.

Microwave ray gun controls crowds with noise

A US company claims it is ready to build a microwave ray gun able to beam sounds directly into people's heads.The device – dubbed MEDUSA (Mob Excess Deterrent Using Silent Audio) – exploits the microwave audio effect, in which short microwave pulses rapidly heat tissue, causing a shockwave inside the skull that can be detected by the ears. A series of pulses can be transmitted to produce recognisable sounds.The device is aimed for military or crowd-control applications, but may have other uses.
[Microwave ray gun controls crowds with noise New Scientist Tech, July 3, 2008]

Two thoughts on this story: 1.) I'm no physicist, but I think my foil hat might actually protect against this one - seriously; and 2.) Could this be put to good use in Fiji? "Oi! Jone, Ise, Prakash! Put down the bilo and go home to your wives so that I can go to sleep!" "Did you hear that?" "Hear what?"

Photo by: nicmcphee

Blogged with the Flock Browser

A consumer view of residential Internet service in Fiji

Intro
Let's be honest, Fiji's ISPs have room for improvement. The problem with residential broadband in Fiji is value for money. Value in this case means a combination of 1.) actual, as opposed to promised, speed, 2.) reliability of service, and 3.) monthly data volume. Why is this value lacking?

Wholesale
Last week there was a session on the Southern Cross Cables Network (SCCN) presented by George Samisoni of FINTEL (video of the session is available, thanks to Franck from PICISOC). The three most noteworthy points of the presentation for me were:

1. FINTEL splits the revenue roughly 50/50 with local ISPs for data transfered. Some undisclosed portion of FINTEL's share then goes to SCCN.
   
2. The SCCN is nowhere near its capacity - only money/pricing and the infrastructure between FINTEL and your door is preventing users in Fiji from having faster access to the Internet.
   
3. In the new deregulated environment, FINTEL will remain the sole agent for access to the SCCN. This means that FINTEL maintains a practical monopoly on wholesale Internet access until a competitive sea-floor cable is run to Fiji or satellite connections become more reliable and affordable.

What does this mean for Fiji's residential Internet users? It means that competition will only benefit residential consumers through any economic efficiencies that can be made and reliability that can be gained through infrastructure between FINTEL and your doorstep. In other words, there will be no changes in the near future on the wholesale side.

Retail
The following table lays out the current options for residential Internet consumers.

Residential ISP pricing as of May 9, 2008
based on ISP websites supplemented by phone calls to sales reps.

ISP	Advertised speed	Price (rounded off)	Usage cap	Setup costs (rounded off)	Notes
Connect	256/128 down/up kbps	$40	3 Gb/mo.	$100	need a land line
	512/256 down/up kbps	$90	3 Gb/mo.	$100	need a land line
Kidanet	128 kbps	$50	4 Gb/mo.	$300	install visit required
	256 kbps	$100	5 Gb/mo.	$400	install visit required
Unwired	256/128 down/up kbps	$50	none	$100 24 mo. $200 no contract	burglar bars may cause interference
	512/256 down/up kbps	$100	none	$100 24 mo. $200 no contract	burglar bars may cause interference

There are a number of points of interest on this table:

• Internet companies lacking commitment to their own website: Kidanet's website is woefully out of date. They are certainly turning potential customers away due to the high startup pricing quoted on their website ($599 for the modem and $99 installation). If you call or go in person, they will quote you the lower pricing that I have provided in the table above and tell you that there is now a data cap. Connect and Unwired both have some minor inconsistencies on their sites as well.
  
  
  
  Kidanet's broadband pricing on their website as of May 9, 2008 - no cap and a very expensive modem
  
  
• All you can eat?: Kidanet's nationwide launch was based on no monthly download limits. Now, only a few months later, they have quietly clamped on limits starting at 4 Gb per month. In response to Kidanet's launch last year, Unwired dropped the monthly download cap that had been in place since at least mid 2006 (when I signed up). Now Unwired's website claims that they have always had no cap. Other than Connect's special After Dark plan, which allows access only on evenings and weekends, Unwired is the only ISP currently offering no download limits. Can they keep it up? The reluctance of ISPs to offer residential customers no limit Internet access is an indication of significant pricing pressure on data volume procured through FINTEL.
  
  
  Unwired's dubious claim of "always have been" from their website on May 9, 2008
  
  
  
• Student plans: All three ISPs offer reduced rates for student users. If you are a student, consider signing up for a rate reduction of up to 20%.
  
• Lock in: Both Connect and Unwired have service packages requiring no long term commitment other than the purchase of necessary hardware - although packages with special pricing do require contracts with a term of one year or longer. In contrast, Kidanet requires all users make a two year commitment (the website says three) and the penalty for early cancellation is a painful six months of fees. Increasing customers' switching costs is not an uncommon practice for many service vendors, but it is not a method for forging strong customer relationships.
  
• Misleading advertising: All three ISPs advertise attractive data communication speeds, but my informal survey of residential customers of all three vendors reveals that no one sees the advertised speeds for any significant period of time, and others claim that they do not see the advertised speeds at all. In fact all customers that I spoke to claim to have experienced significant episodes of down time. None of the ISPs offer a meaningful service level agreement to residential customers and terms of service small print always reveals that the advertised speeds are nothing more than maximums. It would be invaluable to have a third party carry out customer satisfaction and actual throughput surveys across all major vendors. Based on my informal research, I assume that Kidanet does not offer less for $50 per month as it might appear on paper; rather they are merely more honest than the competition in advertising their residential transfer rates.

Conclusion
I am not confident that deregulation will substantially improve the lot of Internet consumers in Fiji in terms of data transfer rate or cost per packet. Without competition at the upstream or wholesale stage, the opportunity to drive consumer pricing down is severely limited. And, at least for the short term, competition in Fiji is a facade. The ATH Group owns controlling stakes - directly or indirectly - in all of FINTEL, Connect, Kidanet, and Vodafone Fiji. Unwired is the only meaningful competition to the ATH juggernaut. However, increased competitiveness in the future, should it come, is likely to drive an increase in quality of service to residential consumers as vendors will seek non-price related means of differentiation. I look forward to a day when Fijian ISPs' primary method of maintaining customers is through creating an outstanding customer experience rather than relying on switching costs.



Photo by: publicenergy
Diagram by: activeside

Human rights report critiques blog censorship

There has been much said this week about the recent American report on human rights in Fiji. From the perspective of a Fiji blogger, it is interesting to see that blogs are explicitly mentioned several times in the report. Here are the relevant sections:

Internet Freedom
There were no government restrictions on general public access to the Internet. However, the military attempted to censor or shut down a number of antigovernment blogs that appeared after the coup, and the Public Service Commission warned civil servants against accessing or taking part in antigovernment Web sites. The military extensively monitored Internet chat rooms on these Web sites. In May the RFMF announced that it was following three individuals alleged to be involved with antigovernment blogs. Also in May, a businessman accused by the military of involvement with such a blog was detained by RFMF personnel at an army camp, where he was verbally and physically abused. Several other individuals suspected of maintaining blogs or posting on blogs were threatened or intimidated. Two senior civil servants accused of contributing to a blog were suspended from duty and subjected to disciplinary action. At least two persons were arrested for allegedly authoring or forwarding e-mail messages critical of the interim government.The Internet was widely available and used in and around urban centers, and the majority of the population lived in areas with
Internet coverage. However, low-income persons generally could not afford individual service, and other public access was very limited. Access outside urban areas was minimal or nonexistent.

Academic Freedom and Cultural Events
Academic freedom was generally respected; however, government work‑permit stipulations prohibit foreigners from participating in domestic politics. University of the South Pacific contract regulations effectively restrict most university employees from running for or holding public office or holding an official position with any political party. RFMF agents reportedly infiltrated the university campus to monitor any political activity. The RFMF also threatened to terminate scholarships from the Fijian Affairs Board, a government-funded statutory body, for university students who contributed to antigovernment blogs.
[Fiji. Country reports on human rights practices. US Department of State. March 11, 2007]

Most of this seems to refer to well known events from the first half of 2007. Readers, what do you think?

• Is this report acurate?
• Is it still unsafe to blog in Fiji?
• Does the US really have the right to criticize the human rights practices of other countries?
• Would anyone from the interim government like to comment on this section of the report?
  

Photo by: riacale

Blogged with Flock

Franck Martin and myself interviewed on email security

Fijilive has run a story on email security based on interviews with Franck Martin of PICISOC and myself. Here is an excerpt.

While email is an extremely useful technology, it is not very secure, warns Chris Hammond-Thrasher, the author of the Digital Fiji Blog, dfiji.blogspot.com . And he suggested that the best advice to follow is "to always assume that all of your emails are being read by others".
[Emails are not so secure: experts, Fijilive, March 9, 2008]

That's right, email is not secure - it never has been. You do not need to dream up elaborate hacking plots to explain Hunter's emails getting out into the wild.

Why would they [hackers] take weeks to plan a sophisticated attack if they can just trick you into giving them your password or key, or if they can take advantage of a well known software flaw on a server that has not been updated for a couple of months? ... He cites the dangers of the common practice of "writing your password on a sticky note on your PC, leaving your PC unattended while you are logged into email and other services, and allowing others to watch over your shoulder while you type in your password".

The mystery of how Hunter's email was stolen is the biggest non-story in Fiji ICT news.

Photo by: juiceboxgasoline

Blogged with Flock

ICT, information warfare, and the RFMF

Note to RFMF readers: I would be very interested in hearing your comments on this post.

The Royal Fiji Military Force (RFMF) recently posted a document entitled Commander's Intent 2008 on the their website. This statement of intent forms sort of a strategic plan for the RFMF for 2008 and beyond. It is broken up into three main sections:

• One section dealing with "Good Governance in the RFMF", including issues such as policy and legal compliance, formal planning, and budgetary restraint;
  
• One section that is a kind of environmental scan of the current internal and external situation in Fiji, including social and economic pressures, race relations, regional security, and a survey of the RFMF's "competition" within Fiji, "there had been a move to replace the RFMF with a reinvigorated and robust police force," and in the region including Commonwealth forces recruiting soldiers away from the RFMF; and
• A large section outlining the Commander's strategic ideas for the coming year.

I was curious to see what this document would say, if anything, about ICT in general and information warfare in particular. In the environmental scan section the document makes the following optimistic statement about Fiji's ICT potential, "Technologically, Fiji can be the Singapore of the region." Only to burst that bubble in the very next sentence, "Unfortunately we continue to lag behind badly and this has affected our ability to grow like Singapore." No additional information is provided about who we are lagging behind, what is the cause of the lag, nor how said lag can be overcome.

ICT is referred to explicitly three additional times in the list of actions that the RFMF is considering in 2008.

• "Improve logistic support system,"
• "Develop a modern reliable and secure communications system," and
• "Develop a computerization and IT system for the RFMF."

While these seem valuable strategic activities, it should be understood that these three are nearly lost in a lengthy list of 50 actions that are under consideration for the 2008 budget. Clearly, ICT is not high on the military priority list. Let's examine each of these in turn.

LSS
While I do know a thing or two about electronic procurement, I am the first to admit that I know nothing about logistics support systems (LSS); and I am not familiar with what the RFMF currently has deployed. Certainly they will need to equip their logistics personnel with computers, wireless equipment, and assorted electronic inventory management apparatus - not to mention training - in order to take full advantage of a modern LSS.

Secure Communications
My informal survey of civilians who have had email contact with RFMF officers revealed two facts. First, RFMF officers use free email accounts from US vendors (i.e. Hotmail, Yahoo, etc.), at least to communicate with civvies. Using these American services makes spying on RFMF communication quite simple for US intelligence services, not to mention the risk due to the notorious insecurity of these services. Still, these are not a problems as long as these free accounts are limited to use for unclassified communications only. There is a mail exchanger (MX) registered for RFMF email addresses pointing to a server operated by Connect. Could this be the military's current/future secure mail server?

Second, my survey revealed that RFMF officers do not have Internet access in RFMF facilities and that officers must leave their bases in order to access the net. However, this cannot be entirely true. For one thing, there is a webmaster's Unwired email address posted at the bottom of the RFMF home page. This indicates that there is at least one wireless modem in RFMF facilities around the country. For another, according to an issue of the RFMF newsletter, there is an Internet Cafe located at QEB.

Our soldiers are so fortunate to be given this opportunity especially the Other Ranks and they will no longer go to town because we now have our own, and I would urge them to make good use of it," said the Commander Land Forces.
[Internet cafe to boost troops' interoperability, Mataivalu News, Feb. 2007, p13]

The newsletter states that soldiers can purchase Internet access cards in $5, $10, and $15 denominations.

Of course, there is a lot more to digital military communications than email, but one must walk before one can run.

IT
In terms of establishing a state of the art military ICT infrastructure, the RFMF clearly has some challenges to overcome and room to grow. It will be difficult to establish such an infrastructure when the organization seems much more focused on the purely physical side of soldering. While the Commander's intent does mention the "changing nature of warfare", a phrase that evokes the increasing importance of information warfare and asymmetric conflict, the bulk of the 50 potential action items listed in this document involve enhancing the RFMF's physical operational capabilities. Of course, military forces often conceal their information warfare capabilities in terms of signals intelligence, cryptology, and system and network attack and defense - could there be more beneath the surface?

Absent?
In terms of ICT, what is missing from the Commanders statement of intent? There is no mention of plans to develop the RFMF's capacity to wage offensive or defensive information warfare. There is no mention of how the RFMF plans to compensate for the high-tech support and training that they used to receive from the Australian and New Zealand forces. There is no mention of plans to use private contractors to shore up RFMF's high-tech expertise, such as the Indian hackers rumored to have been employed last year or the consultations with FINTEL experts over anti-government bloggers. There is no mention of investing in media and public affairs training for officers.

As I have written about before, Fiji's current crisis is not a traditional military conflict, but rather a battle for the supremacy of ideas - the new ideas of the interim regime vs. the old ideas of the Qarase government. Fiji's current crisis is a 4th generation warfare (4GWF) conflict, where the focus is not on physically outmaneuvering one's opponent, but rather on winning the battle for public opinion. To quote Kim Taipale,

4GWF is political war -- superior political will, when properly employed, can defeat greater economic and military power... In 4GWF conflicts, nonmilitary instruments of power (information) trump military solutions (warfare, technology, and firepower). Information constrains the exercise of kinetic power but kinetic power cannot constrain information power.
[Seeking Symmetry in Fourth Generation Warfare: Information Operations in the War of Ideas. March 2006]

The possibility that political will could overcome the RFMF's monopoly on military power in Fiji should be a concern. Yet most of the activities under consideration, other than winning "the hearts and minds of the local population through professionalism," are purely 3GWF considerations - that is focused on informed, flexible, and rapid physical deployment of military force.

To be successful with its cleanup campaign, the RFMF needs to win a conflict where the battlespace is bounded by communications technologies (including Fiji's ineffable but very effective coconut wireless) and the content of the stories that these technologies communicate. To be successful, it is in this battlespace, the informationspace, that the RFMF needs to increase its operational capacity. [Note: This morning's Fiji Times reports that the interim government is reviving the National Security Council and the Fiji Intelligence Services. Does this signal a change in focus or are these purely civilian initiatives?]

By way of conclusion I offer two quotations - one from a Russian Major-General and one from the most wanted man in the world - both of whom understand 4GWF better than anyone in the Pacific.

We are approaching a stage of development when no one is a soldier anymore but everyone is a participant in combat action. The task now is not to inflict losses in men and material but to thwart an enemy's plans, demoralize it, undermine its worldview, and destroy its intrinsic values."
[Maj. Gen. G.A. Berezkin, Deputy Head of the Russian Federation Defense Ministry Center of Military-Technical Information Studies, in Lessons from the war in Iraq, Military Thought (May 1, 2003). Quoted in Taipale.]

It is obvious that the media war in this century is one of the strongest methods; in fact, its ratio may reach 90% of the total preparation for the battles.
[Osama bin Laden, 2002. Quoted in Taipale.

Photos by: soldiersmediacenter

On top of everything else, lan problems!

2007 and now 2008 have not been easy years for the small Pacific nation of Fiji. Between a coup and ensuing political turmoil, an economic down turn driven by a drop in tourism visits, a couple of cyclones, occasional flooding, corrupt officials, home invasions, drownings, road deaths, typhoid, and water and power cuts; things have been challenging. And now, I sit down in front of my computer, open up the Fiji Times web site to read that, on top of everything else, we now have "lan problems"!

[Fiji Times, February 25, 2008]

One can only hope that the "meaningful dialogue" succeeds so that we can all get back to WoW and SL in order to escape reality.

Blogged with Flock

Fiji political blogs: truth or slander?

Since the 2006 coup, I have tried to chronicle the rapidly changing world of blogs in Fiji as they start up, shut down, climb to great heights, and then fall out of the spotlight. My comments even garnered some unwanted attention from the Human Rights Commission Director who, paradoxically for a human rights officer, seemed to be arguing against freedom of speech. While the interim government ended its public affairs assault on blogs some months ago, there are still intrigues to explore in Fiji's blogosphere.

In recent weeks, one of the top news stories in the Fiji press has been the mystery of the interim government minister who has been accused of tax evasion. The interim government and the police claim that this individual has been cleared of all wrong-doing and refuses to reveal his or her identity. At least one of Fiji's political blogs, however, has openly published the identity of the accused minister. Of course there is no proof. If there was concrete proof, the international press would certainly be publishing this name, even if the Fijian press practices self-censorship.

As I wrote over nine months ago,

Clearly, some of the remarks in Fiji's anonymous political blogs regarding members of the interim government are libelous. Fiji's Defamation Act and supporting Common Law allows for an injured party to ask the court to instruct an Internet Service Provider to turn over records relating to a customer who has published defamatory remarks.
[Blocking anti-military blogs may harm military, Digital Fiji, May 14, 2007]

We will have to wait an see if anyone is willing to put their name and some evidence behind this accusation, otherwise it remains simply the unfounded finger-pointing of anonymous individuals with a clear anti-government political agenda.

Photo by: TW Collins

Blogged with Flock

Koha hits Apia, Samoa

UNESCO has formally announced the installation of the Koha open source library management system in the Nelson Memorial Library in Apia, Samoa. I was honoured to be involved in this project.

Dear Pacific Library colleagues,

The Communication & Information (CI) Sector of UNESCO, the University of the South Pacific (USP) Library, and the Samoa Nelson Memorial Library are very proud to announce the launch of the online Koha Library Management System (LMS) for the Samoa Nelson Memorial Library.

The Samoa Nelson Memorial Library is the first Pacific National Library to launch an online Library Management System allowing members and visitors to view their entire catalogue including their extensive Samoa and Pacific collection.

UNESCO is committed to developing dynamic, viable websites for Pacific National Libraries and National Archives to increase access to information. By publishing their catalogue, the Samoa Nelson Memorial Library promotes Samoa and Pacific literature and knowledge. It protects Samoa’s literary and intellectual heritage.

The Library now also provides a 24/7 service to Samoan members and visitors worldwide.

UNESCO promotes the use of open-source software and supports the Koha LMS. The Samoa project follows on from a successful 2006 deployment for the Cook Islands National Library. UNESCO fully funded the project including the supply of server hardware, bar-code readers, extensive training and documentation, internet connectivity, and linking Nelson staff to Koha technical support groups.

USP Library is the only recognised Koha implementation partner in the Pacific. We received excellent ICT support from CSL Ltd.

Please visit the Nelson site at: www.nelsonlibrary.ws

We look forward to comments on the Nelson site especially improvements. We would like to hear from Pacific National Libraries expressing interest in developing websites of their collections.

Regards,

Abel Caine

Adviser for Communication & Information

UNESCO Office for the Pacific States

Apia, SAMOA

Photo by: The Depratment

Blogged with Flock

Are Fiji's ISPs delivering what they promise?

Complaining about your ISP is one of the most popular topics in ICT circles in Fiji. So I wanted to put the question publicly, does your ISP deliver what they promise?

• How often do you achieve the maximum throughput that you pay for?
• How often are one or more of your ISP's services offline?
• What is your experience calling customer support?
  
• Have you used more than one ISP? If so, was one better than the other and how?
• If you work for one of the ISPs, would you like to address you customers? I will publish your statement.

Leave a comment --> here <-- and let your voice be heard!

Note: Digital Fiji is not responsible for the opinions of its readers.

Photo by: Matt Watts

NORAD tracks Santa over Fiji

That's right, NORAD tracked Father Christmas by RADAR leaving the North Pole, then servicing Eastern Siberia, followed by the Marshal Islands, and then over our island home at around 9:30 pm Fiji Time. This year, NORAD is providing two interfaces to their Santa tracking. The one depicted below using Google Maps and...


This one using a Google Earth KMZ file constructed by NORAD (get their KMZ here).


Maybe next year we will be able to go on a ridealong with Santa using Google VR? Happy holidays!

Blogged with Flock

Secret messages - thinking about cryptology

The history of secrecy is as old as the history of ideas. Whether for reasons of war, religion, power, jealousy, or, of course, love, people of every culture have always found reasons to keep secrets. Of course, keeping a secret is not difficult until you try to communicate it to someone else. What if someone overhears you whispering the secret? Or worse, what if the secret message is intercepted by an assailant and does not even reach the intended recipient?

Simple model for secure communication between Alice and Bob with adversary Eve attempting to view the romantic missive

Historical attempts to foil Eve's efforts have fallen into three categories:

• Physically secure the message from access to all except its intended recipients. This could include hand delivering a love note to your sweetie at school, hiring a bonded courier to transport contract drafts burned on CDs to your business partner, or hiring an armored car to take a bank vault combination to the main branch for safe keeping. In other words, do not let Eve get her hands on it.
  
• Use steganography - Conceal the message in some other innocuous message. This includes communicating messages in innocent looking classified adds in the newspaper, hiding digital signals in what sounds like background noise on telephone calls, or embed messages in otherwise normal JPEGs, MP3, or other files using steghide. [try it!] In other words, do not let Eve know that a secret is being transmitted.
  
• Mathematically encrypt the message in such a way that it is difficult for an adversary to recover the original message even if she gains access to the entire encrypted message. In other words, even if Eve gets the message, make it difficult for her to decode it. An early example is a method used by Julius Caesar to protect military orders. Now, message encryption has become a sophisticated military practice and is the cornerstone of the modern banking and e-commerce industries. It is the greatest asset of political activists in oppressive regimes and the scourge of law enforcement and national security forces when fighting online threats.

It is this final approach - the mathematical approach to protecting information, the field of cryptology - that I would like to investigate in the next few blog posts. How does it work? What if criminals or enemies of the state use it?

Icons by: Mark James
Photo by: dirtyfeet

Google wants you to inform on evil websites

The Google Online Security Blog posted an update to the monsterous corporation's ongoing battle against malware and made the following plea to well-meaning web surfers:

Currently, we know of hundreds of thousands of websites that attempt to infect people's computers with malware. Unfortunately, we also know that there are more malware sites out there. This is where we need your help in filling in the gaps. If you come across a site that is hosting malware, we now have an easy way for you to let us know about it. If you come across a site that is hosting malware, please fill out this short form. Help us keep the internet safe, and report sites that distribute malware.
[Help us fill in the gaps!, Google Online Security Blog, November 29, 2007]

I have confession to make. The first thing that occurred to me when I read this was: this sounds like a great opportunity for online revenge! Fiji's interim government could report the Solivakasama blog, elusive freedom blogger Captain Intelligentsiya could inform on the RFMF site, Fiji's literacy-challenged community could report Paradise Not Found. And it would not have to stop there! The Unwired mavericks could report the ATH duo Kidanet and Connect's sites, Monopoly-buster Inkk could inform on the Vodafone site, the Oceanic hot-heads could report Webmasters, and Channel 2 (if Channel 2 even still exists?) could hit Fiji TV.

Let's hear it for Google's continuing ability to stick to their "do no evil" corporate motto by encouraging us to be informers! The truth is the average Internet user cannot accurately identify a malware site any better than Shiasta Shameem can play ice hockey.

Photo by: Zeet Jones

Blogged with Flock

USP art exhibit - UPDATE: new date

UPDATE: The opening with the refreshments has moved to December 6th at 5:30pm.

Art exhibit that is open to all - and note the free refreshments. I'll be there and would love to meet some more of the Fiji blogging community.

Blogged with Flock

Online freedom baby, yeah!

I was surprised to see Everyone's guide to by-passing Internet censorship for citizens worldwide as the first item under Information Management on UNESCO's Open Training Platform - an online repository of open license training materials.

To quote from the source:

This guide is meant to introduce non-technical users to Internet censorship circumvention technologies, and help them choose which of them best suits their circumstances and needs.

Everyone's guide to by-passing Internet censorship for citizens worldwide is a great guide for those who want to use the Internet anonymously, or circumvent filtering on their LAN or WAN, or help others to circumvent filtering in their country or organization, or all three. It contains clearly worded advice and has URLs for numerous free and commercial solutions including, to name but a few:

• Proxify
• CGIProxy
• UltraReach
• Anonymizer
• Guardster/SSH
• tor
• JAP ANON

Internet users who desire freedom of expression and intellectual freedom should read this guide. Similarly, law enforcement organizations should read this guide as the same tools and tactics are used by online criminals.

Photo by: Norma Desmond

RIP HnC: another renegade blog bites the dust

Another notorious anti-interim government blog goes offline. Hyde and Seek, which went live in May of 2007, seems to have taken itself offline within the last several hours after around 400 posts and thousands of comments.
As with the death of WFC, rumors abound about whether or not the bloggers took the site down willingly or unwillingly. If you want to see how the site looked in June and July of 2007, there are three pages captured by the Internet Archive's Way Back Machine.

No doubt, a blog or two will take hnc's place.

Photo by: a shot in the dark

Blogged with Flock

USA and Fiji are "nations of lawbreakers"

Let's be honest, it is difficult to spend $5 to rent a DVD for a day when you can own it for $1. Every year, hundreds of thousands of Fijians chose the $1 option. A FAVIA press release (with no supporting evidence whatsoever) claims that, "Fiji's piracy rate is about 98%." These numbers were rolling around in my head as I read a recent article by Nate Anderson on ars technica about a country that has chosen a very different path from Fiji when it comes to copyright.

Tehranian's paper points out just how pervasive copyright has become in our lives. Simply checking one's e-mail and including the full text in response could be a violation of copyright. So could a tattoo on Tehranian's shoulder of Captain Caveman—and potential damages escalate when Tehranian takes off his shirt at the university pool and engages in public performance of an unauthorized copyrighted work.

Singing "Happy Birthday" [and Happy Long-Life -cht] at a restaurant (unauthorized public performance) and capturing the event on a video camera (unauthorized reproduction) could increase his liability, and that's to say nothing of the copyrighted artwork hanging on the wall behind the dinner table (also captured without authorization by the camera). Tehranian calculates his yearly liability at $4.5 billion...

What better way could there be to create a nation of constant lawbreakers than to instill in that nation a contempt for its own laws? And what better way to instill contempt than to hand out rights so broad that most Americans simply find them absurd?
[Overly-broad copyright law has made USA a "nation of infringers", ars technica, Novemebr 19, 2007]

The USA has created a nation of constant lawbreakers by handing out absurd rights to copyright holders combined with millions of dollars of public money spent on enforcement. Fiji has created a nation of lawbreakers through a complete failure to enforce almost any rights of copyright holders.

Having unenforced laws in place for the sake of meeting Fiji's WIPO commitments (is there another reason?) may be doing more harm than good. In a nation who's elite has consistently had difficulty with the rule of law for the past twenty years, breach of copyright has become every man and woman's opportunity to join in the tradition of trampling on one of the nation's fundamental institutions. Is this really what we want for our beloved Fiji? Is this really what we want to teach our children?

My advice to the country: Either repeal the 1999 Copyright Act or figure out a way to enforce it.

Photo by: Dr John2005

Blogged with Flock

Do you read your server logs?

Do you read your server logs? I admit that I only read them rarely. Let's face it, they are pretty dull and repetitive. Most sensible administrators - those who do not find reading syslogs eight times a day to be rewarding - will use some sort of log monitoring tool to let them know if anything interesting is going on. My favorite would be logwatch and I have also used swatch in the past. However, these and other fine tools, even after very careful and time consuming configuration, are prone to raising alarms when there is really nothing to see. And these false positives lead, over time, to the never cry wolf syndrome. You just stop listening to the alarms. Or you configure the monitoring tool to ignore potentially interesting information just to shut it up.

One of the systems that I am responsible for is an old Compaq/HP Tru64 Unix box. Tru64 has among its features an alarm that is tripped if too many log entries are made to the system binary log in a short period of time. Recently, we received this alarm stating that over 500 log entries had been made in a one minute period. I immediately thought that one of the drives was dying a most unwelcome death again. However, when I checked the log, it turned out that some IP at a Spanish university (names withheld to protect the guilty) had made over 1000 attempts to brute force the root password via ssh in a two minute period (try THC-Hydra). Of course, root logins via ssh were disabled (check your sshd.conf) and the root password is very strong anyway so no harm was done.

But an attack is an attack and even if revenge is not possible, at least some action should be taken to reduce the likelihood of reoccurence. How can you do that? Let the attacker and the attacker's ISP know that you detected the attack and are motivated enough to do something about it. Hackers, whether pimply-faced script kiddiez or hardened criminals, are lazy and risk-averse and prefer to go after easy prey. If you detected this attack, you might detect others in the future. If you write a complaint email, you might call the police or at least your lawyer next time. How do you find your assailant's ISP? Through the controversial whois database.

After a couple of whois queries (try Sam Spade if you don't want to use the command line), I was able to contact the abuse email of the assailant's institution. Within 24 hours, they acknowledged receipt of my email. Within 48 hours they sent me an email stating that they had contacted the owner of the offending IP and were closing the trouble ticket. While I would like to have seen the assailant suffer in front of my own eyes, this is probably the best resolution that I could hope for. After all, the break in was not successful and no damage was done other than wasting my time - not to mention the fact that Fiji has no cybercrime legislation nor has a computer crime (or attempted computer crime) ever gone before Fiji's courts.

Photo by: kenwood

Blogged with Flock

Wow! The Quick Links are great!

While I have not had time to write a great deal in recent weeks, I have tried to keep you on top of interesting ICT stories from Fiji and around the world with the dfiji Quick Links which you can see on the right hand side of this blog or via the RSS feed.

A few interesting recent Quick Links include:

• The Oceanic blog comments on gross financial mismanagement at USP in response to a lengthy article in Islands Business magazine. It is unfortunate that the hard working students and staff at USP are already experiencing the aftermath of recent disastrous financial decisions.
• The O'Reilly Radar blog draws a comparison between libraries and the Oink music site that was recently taken offline by law enforcement.
• The Fiji Times reports that new telecom licenses will be granted in Fiji some time on November. Creating genuine competition - not just competition between companies in the ATH family - would be a real boon for Fijian consumers.

How do I manage these great Quick Links? I use the free del.icio.us bookmark management and sharing site.

Photo by: splorp

A brief history of library technology in the South Pacific

Lately, I have been thinking about library technology in the South Pacific region. This is mainly due to the fact that I was supposed to have submitted a paper on the subject to the new CODE4LIB journal about a week ago (don't worry editors, I'm still writing!). I though it might help to think aloud and to give anyone out there a chance to correct my facts or put me onto new ones. Feedback is appreciated - please leave a comment below.

While the details are lost to history, libraries arrived to stay in the South Pacific along with the first missionaries. These early libraries in the region existed solely to support mission activities, especially education in mission schools. In 1909, the Carnegie Foundation built what is now the Suva City Library (no website, sigh), marking the first permanent presence of public libraries in the region. Towards the end of the colonial period larger libraries were established to support the work of large academic institutions such as the University of Papua New Guinea (found in 1965) and the University of the South Pacific (USP) (founded in 1968). More recently, international development funds have invested in the establishment of national libraries in the South Pacific such as the Cook Islands National Library (founded in 1993) and older national libraries in countries such as the Solomon Islands, Tuvalu, and Kiribati. It is worth noting that in some South Pacific countries, one large institution may serve as the de facto national library - for example, the Nelson Memorial Public Library in Samoa or the USP Library in Fiji.

But what of library technology? The few academic libraries in the region that predate the digital era certainly had the experience of card catalogues and all of the related trappings (In fact, many of the automated libraries in the region maintain these venerable artifacts after years of success with their system) and most small libraries in the region rely on the card or other manual instruments as the key tool for library operations. Computers came to the larger South Pacific libraries quite early - USP library went live with their first system in 1988. This was a VAX based Urika system similar to many employed throughout the developed world. Library automation eventually reached a substantial proportion of small and medium libraries in the region through UNESCO's promotion of the free CDS/ISIS library management system in the 1990s.

Around the turn of the millennium a very successful sales and marketing drive took advantage of the frustration with CDS/ISIS in the region - many countries lacked the required expertise to keep it operating - and replaced many CDS/ISIS installs with the commercial DB/TextWorks system running on Windows PCs. However, this approach also soon began to show weaknesses. While DB/TextWorks is reliable and easy to use, most South Pacific libraries lack the funding to purchase support and upgrades for the system. In addition, most libraries in the region purchased versions of DB/TextWorks that do not provide what are now seen as fundamental library system features such as the ability to import/export MARC, Z39.50/SRU support, and provision of web search (a.k.a. web OPAC). This has lead UNESCO to begin seeding the free open source Koha library system into major regional libraries in 2006. I have been fortunate to be involved in the two UNESCO funded Koha installations to date.

Of course, the world of library technology now extends far beyond the main systems that run our libraries, variously called library management systems (LMSs) or integrated library systems (ILSs). Library technology now gets into everything from remote database and Internet access, printing and photocopying, security technologies, self-checkout, online reference services (synchronous or asynchronous), meta-searching, link resolution, and too many more to name. It is safe to generalize that in the South Pacific, only the largest libraries utilize significant technologies beyond cards and an LMS; and even the largest libraries in the region are significantly behind comparable institutions in Australia and New Zealand when it comes to library technology beyond the core system.

Photo by: libraryman