The little cartoon movie from “Hands Off the Internet” (an organization funded by member organizations that include major telcos and equipment vendors) has led to a response from “Save the Internet” (advocates of net neutrality funded by MoveOn.org and others). “Save the Internet” claims that the cartoon is “a clever piece of industry propaganda that is riddled with half-truths and outright lies.” It then quotes a few passages from the cartoon and offers responses. Unfortunately, it is “Save the Internet”’s response that contains misinformation, and it fails to point out any alleged lies. In what follows, I’ll quote directly from the “Save the Internet” response (including the quotes from the “Hands Off” cartoon they are responding to) and then respond to each point. The big telecom companies say: “Is the Internet in Danger? Does the Internet need saving? It keeps getting faster. We keep getting more choices." The truth: Right now AT&T and others want to take away your choices and control what you can do and watch online. They’re on their best behavior while trying to convince Congress to hand over the Internet. But if their high-priced lobbyists get their way in Washington, the Internet as we know it will be gone. Network Neutrality has always curbed the control of the network owners, invited competition and encouraged innovators. It’s what made it possible for entrepreneurs and creative thinkers to prosper online. None of the big ideas that made the Internet the innovative engine it is today came from the cable or telephone companies. ...

The Baltimore Sun has reported on a shelved 1990s NSA program to collect and analyze phone records which had the following features: Used more sophisticated methods of sorting through massive phone and e-mail data to identify suspect communications. Identified U.S. phone numbers and other communications data and encrypted them to ensure caller privacy. * Employed an automated auditing system to monitor how analysts handled the information, in order to prevent misuse and improve efficiency. ...

Radley Balko at The Agitator is on top of it: If you’ve read anything at all about this case, I’d urge you to take a look at the brief. I realize that a brief’s legal effectiveness is a very different thing than its general pursuasiveness, particularly briefs filed in almost perfunctory post-trial motions like this one. Since I’m not really qualified to comment on its legal merits, I’ll keep my comments limited to its general pursuasiveness. To that end, it’s devastating. The difference between the top-notch legal representation Cory Maye has now and the minimal representation he had at trial is striking (and frightening, given the stakes). I can’t see anyone reading this thing through and still believing that Maye is the slightest bit guilty, much less that he should be executed. At worst, you could perhaps make the case that Maye acted recklessly, and might have been tried for manslaughter. I wouldn’t agree. But I probably wouln’t be making trips to Mississippi to investigate, or blathering endlessly on my blog, either. Of course, I still think the guy should not only be released from prison, but compensated.The brief, from Bob Evans, Orin Kerr, and attorneys at D.C. firm Covington and Burling, is here (PDF). There’s also a forensics review here (Word doc), and a review of the autopsy report of Officer Jones here (PDF). I’ve had the pleasure of meeting and briefly working with some Covington and Burling attorneys in the past (though none of the ones who worked on this brief), and found them to be incredibly bright and professional people. They also won a multimillion-dollar lawsuit against Fax.com, which makes them good guys in my book.

Some advocates of net neutrality have advocated nationalization of “the Internet backbone” (see, for example, the comments of Paul and Frank at Richard Bennett’s Original Blog). The idea that there is such a thing as “the Internet backbone” is itself a confusion about what telcos contribute to the Internet, but what was the pace of innovation when telephony was a highly regulated government monopoly in the United States? Touch-Tone was developed in the late 1950’s. It was promoted at the Bell System Pavilion at the 1962 Seattle World’s Fair, as can be seen in this fascinating short film, “21st Century Calling” (a bonus feature on the DVD of the Mystery Science Theatre 3000 episode, “The Killer Shrews”). Other features promoted in the film include call forwarding and three-way calling. Bell Labs officially announced Touch-Tone as a feature (PDF) in 1964. Touch-Tone was rolled out to consumers in the 1980s as a feature which consumers had to pay extra for, even though it cost nothing more to provide. The SS7 electronic switching infrastructure costs were covered by consumer fees such as the monthly fee for Touch-Tone service, and then used to roll out new services to businesses, subsidized by consumers. Time from innovation to deployment: over two decades.

Mark Vuletic at the Secular Outpost reports on the Freedom From Religion Foundation’s lawsuit against the Department of Veteran’s Affairs for conducting “basic spiritual assessments” as part of admissions procedures. The “spiritual assessments” are used to determine whether patients require treatment for “spiritual injury or sickness.”

Today’s Washington Post reports (via Donna Woodka’s blog): New federal guidelines ask all females capable of conceiving a baby to treat themselves – and to be treated by the health care system – as pre-pregnant, regardless of whether they plan to get pregnant anytime soon. Among other things, this means all women between first menstrual period and menopause should take folic acid supplements, refrain from smoking, maintain a healthy weight and keep chronic conditions such as asthma and diabetes under control. ...

Harri Hursti of Black Box Voting has released a report (PDF) on yet more flaws (on top of others reported back in December) in Diebold TSx and TS6 Direct-Recording Electronic (or DRE) voting machines. Having a few minutes of physical access to a machine makes it possible to install software, using simple, easily available tools, which will completely compromise the machine in such a way that it will be impossible to tell whether future software updates are successful or not. Ed Felten and Avi Rubin give more detail at Felten’s blog, Freedom to Tinker, and question whether it makes sense to build voting machines based on commodity hardware and operating systems due to these risks. This certainly seems like an application where you’d want hardware-enforced verification of a stripped-down trusted computing platform. Hursti’s report says that there are three layers of software in the Diebold machines: a boot loader, an operating system (customized Windows CE), and an application program (the voting software). Each of the three layers has backdoors which allow bypassing security controls. The report states that “Different files on the system carry various subsets of the following features: Signature check, mode check, and integrity check. None of these can be considered security features against tampering. For example, the integrity check is [redacted]. This check can be equated to a very crude spell-checker. It is effective against accidental typing errors but not deliberate attacks." The redacted portion, based on the description, is apparently a weak checksum such as CRC (cyclic redundancy check), rather than a cryptographically stronger checksum like MD5 or SHA1 (both of which have weaknesses of their own). The Hursti report describes how an attacker could exploit the weaknesses at multiple levels to prevent the removal of malicious code. One such flaw (the details of which are redacted from the report) is that inserting a standard PCMCIA memory card into the machine containing a file with the appropriate name will cause the boot loader to reflash itself, installing the code in that file as the new boot loader on the system. As Hursti points out, “Due to the fact that the boot loader is the primary mechanism for its own reprogramming, if the boot loader is compromised with a deep attack, using the boot loader itself to install a known clean version of a boot loader is no longer a viable option as a recovery path to clean the system." The report goes on to show similar flaws in replacing the operating system image, and points out a voter-accessible hidden button (labeled “battery test”) that could be exploited by malicious code as a trigger for an attack. The recommended defense against attacks is to physically protect the machines–as a machine can be compromised with less than five minutes of physical access, chain of custody evidence must be maintained from the machines’ origin to final use, with no unsupervised access.

Two New Jersey attorneys, Bruce Afran and Carl Mayer, have filed a lawsuit in federal court in New York City against Verizon regarding its sharing of call-detail records with the NSA without a subpoena. The lawsuit charges that Verizon has violated a number of federal laws, including the 1986 Stored Communications Act (28 USC 2701), which provides for $1,000 in statutory damages for each violation. Some reports have quoted a $50 billion figure based the potential of one violation regarding the information of each of 50 million people, but the suit as filed asks for $1,000 per violation, or $5 billion if certified as a class action. The Stored Communications Act is a confusingly-written piece of the Electronic Communications Privacy Act that covers both content records (such as email) as well as non-content records (such as log information and subscriber information). One of the exceptions in the law for when a provider can supply non-content information to a governmental entity without a subpoena is if (quoting from a commentary by law professor Orin Kerr) “the provider reasonably believes that an emergency involving immediate danger of death or serious physical injury to any person justifies disclosure of the information.” This seems like a defense that Verizon will be likely to use to justify a program that’s supposed to be used to identify and stop terrorists. Verizon claims that it “does not, and will not, provide any government agency unfettered access to our customer records or provide information to the government under circumstances that would allow a fishing expedition." RCN, a telecom and Internet provider (its assets include the former Erols Internet) based in Herndon, VA, has issued a press release stating that it, like Qwest, has not disclosed customer information except when required by legal process.

USA Today has reported that the NSA has been collecting a database of call detail records from data provided by AT&T, Verizon, and BellSouth (no word on whether SBC or other ILECs and CLECs have participated). Qwest is noteworthy for having refused to participate in the program. The collected CDRs include records of calls which both originate and terminate within the United States (i.e., completely domestic calls). The NSA’s goal was allegedly “’to create a database of every call ever made’ within U.S. borders,” which is out of scope for the NSA’s mission. Arlen Specter of the Senate Judiciary Committee says that the telcos will be questioned about their participation. In other news today, the NSA managed to kill an investigation by the Justice Department’s Office of Professional Responsibility into whether Justice Department attorneys violated ethical rules with regard to the NSA’s domestic spying. They did this by denying requested security clearances to OPR investigators.

Judicial Watch obtained records of Jack Abramoff’s visits to the White House from the U.S. Secret Service, but they are demonstrably incomplete. At least three other visits known to have occurred were not included, as presaged by Scott McClellan’s statement that the records were incomplete. The released documents record two visits, one on January 20, 2004 (from 10:42:20 to 11:29:34) and another on March 6, 2001 (from 16:23:35 to 16:49:50), in a format that differs from the format of White House visit records Judicial Watch previously obtained from the Clinton administration, which gave more information such as the name of the individual being visited. These records appear to be reports pulled directly from a badge access control system. (Via TPM Muckraker.) The documents can be found here (PDF). UPDATE (May 17, 2006): These logs are the only ones the U.S. Secret Service has–the logs that are needed for a complete record are in the possession of the White House.