<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: fellow]]></title>
    <link>http://securityratty.com/tag/fellow</link>
    <description></description>
    <pubDate>Tue, 07 Oct 2008 01:48:53 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Hacking Airport Wi-Fi]]></title>
      <link>http://securityratty.com/article/ef7747fa4c5dfd5fdd287d72998fac6e</link>
      <guid>http://securityratty.com/article/ef7747fa4c5dfd5fdd287d72998fac6e</guid>
      <description><![CDATA[Richard Farina booted up his computer on an American Airlines flight in October from New York to San Francisco. It was one of the first commercial flights to offer wireless Internet service. Within a...]]></description>
      <content:encoded><![CDATA[Richard Farina booted up his computer on an American Airlines flight in October from New York to San Francisco. It was one of the first commercial flights to offer wireless Internet service. Within a couple minutes of reaching 10,000 feet, Farina was snooping the airwaves with the ability to see what his fellow pass<img src="http://feedproxy.google.com/~r/digg/topic/security/popular/~4/6OtgSil3ppQ" height="1" width="1"/>]]></content:encoded>
      <pubDate>Mon, 24 Nov 2008 17:10:02 +0000</pubDate>
      <category domain="http://securityratty.com/tag/american airlines flight">american airlines flight</category>
      <category domain="http://securityratty.com/tag/farina">farina</category>
      <category domain="http://securityratty.com/tag/richard farina">richard farina</category>
      <category domain="http://securityratty.com/tag/couple minutes">couple minutes</category>
      <category domain="http://securityratty.com/tag/san francisco">san francisco</category>
      <category domain="http://securityratty.com/tag/commercial flights">commercial flights</category>
      <category domain="http://securityratty.com/tag/fellow pass">fellow pass</category>
      <category domain="http://securityratty.com/tag/feet">feet</category>
      <category domain="http://securityratty.com/tag/october">october</category>
      <source url="http://feeds.digg.com/~r/digg/topic/security/popular/~3/6OtgSil3ppQ/Hacking_Airport_Wi-Fi">Hacking Airport Wi-Fi</source>
    </item>
    <item>
      <title><![CDATA[Censorship in Dubai]]></title>
      <link>http://securityratty.com/article/a5108490e981eb2b167f02a911f54a44</link>
      <guid>http://securityratty.com/article/a5108490e981eb2b167f02a911f54a44</guid>
      <description><![CDATA[I was in Dubai last weekend for the World Economic Forum Summit on the Global Agenda. (I was on the &quot;Future of the Internet&quot; council; fellow council members Ethan Zuckerman and Jeff Jarvis have...]]></description>
      <content:encoded><![CDATA[<p>I was in Dubai last weekend for the World Economic Forum Summit on the Global Agenda.  (I was on the "Future of the Internet" council; fellow council members <a href="http://www.ethanzuckerman.com/blog/2008/11/10/the-weekend-in-dubai/">Ethan Zuckerman</a> and <a href="http://www.buzzmachine.com/2008/11/09/a-fundamental-reboot/">Jeff</a> <a href="http://www.buzzmachine.com/2008/11/10/where-is-dubai/">Jarvis</a> have written about the event.)</p>

<p>As part of the United Arab Emirates, Dubai <a href="http://opennet.net/research/profiles/uae">censors</a> the Internet:</p>

<blockquote>The government of the United Arab Emirates (UAE) pervasively filters Web sites that contain pornography or relate to alcohol and drug use, gay and lesbian issues, or online dating or gambling. Web-based applications and religious and political sites are also filtered, though less extensively. Additionally, legal controls limit free expression and behavior, restricting political discourse and dissent online.</blockquote>

<p>More detail <a href="http://opennet.net/studies/uae">here</a>.</p>

<p>What was interesting to me about how reasonable the execution of the policy was.  Unlike some countries -- China for example -- that simply block objectionable content, the UAE displays a <a href="http://www.flickr.com/photos/alarch/319965943/">screen</a> indicating that the URL has been blocked and offers information about its appeals process.</p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=JypUN"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=JypUN" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=RbSTN"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=RbSTN" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Wed, 12 Nov 2008 09:56:09 +0000</pubDate>
      <category domain="http://securityratty.com/tag/dubai">dubai</category>
      <category domain="http://securityratty.com/tag/fellow council">fellow council</category>
      <category domain="http://securityratty.com/tag/uae displays">uae displays</category>
      <category domain="http://securityratty.com/tag/dissent online">dissent online</category>
      <category domain="http://securityratty.com/tag/council">council</category>
      <category domain="http://securityratty.com/tag/dubai censors">dubai censors</category>
      <category domain="http://securityratty.com/tag/online">online</category>
      <category domain="http://securityratty.com/tag/uae">uae</category>
      <category domain="http://securityratty.com/tag/political sites">political sites</category>
      <source url="http://www.schneier.com/blog/archives/2008/11/censorship_in_d.html">Censorship in Dubai</source>
    </item>
    <item>
      <title><![CDATA[Most data security risks internal, Cisco study finds ]]></title>
      <link>http://securityratty.com/article/3b47a1c849425710faba7fe67bac35fe</link>
      <guid>http://securityratty.com/article/3b47a1c849425710faba7fe67bac35fe</guid>
      <description><![CDATA[One in 10 employees admits stealing data or corporate devices, selling them for a profit, or knowing fellow employees who did, according to Cisco's data-leakage study. Abstract: One in 10 employees...]]></description>
      <content:encoded><![CDATA[One in 10 employees admits stealing data or corporate devices, selling them for a profit, or knowing fellow employees who did, according to Cisco's data-leakage study. 
Abstract: One in 10 employees admits stealing data or corporate devices, selling them for a profit, or knowing fellow employees who did, according to Cisco’s data leakage study.
By Jim Duffy<p><A href="http://ad.doubleclick.net/jump/idg.us.nwf.rss/security;sz=468x60;ord=66057?">
<IMG src="http://ad.doubleclick.net/ad/idg.us.nwf.rss/security;sz=468x60;ord=66057?" border="0" width="468" height="60"></A>
</p>]]></content:encoded>
      <pubDate>Tue, 11 Nov 2008 21:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/data">data</category>
      <category domain="http://securityratty.com/tag/employees">employees</category>
      <category domain="http://securityratty.com/tag/fellow employees">fellow employees</category>
      <category domain="http://securityratty.com/tag/data-leakage study">data-leakage study</category>
      <category domain="http://securityratty.com/tag/profit">profit</category>
      <category domain="http://securityratty.com/tag/jim duffy">jim duffy</category>
      <category domain="http://securityratty.com/tag/devices">devices</category>
      <category domain="http://securityratty.com/tag/cisco">cisco</category>
      <category domain="http://securityratty.com/tag/abstract">abstract</category>
      <source url="http://www.networkworld.com/news/2008/111208-cisco-study-internal-security.html?fsrc=rss-security">Most data security risks internal, Cisco study finds </source>
    </item>
    <item>
      <title><![CDATA[Inmate hacked prison network, broke into employee database]]></title>
      <link>http://securityratty.com/article/1a2128f7f1c03146120ae4fcfb7cb449</link>
      <guid>http://securityratty.com/article/1a2128f7f1c03146120ae4fcfb7cb449</guid>
      <description><![CDATA[A former prison inmate has been arrested and charged with hacking the facility's computer network, stealing personal details of more than 1,100 prison employees and making them available to fellow...]]></description>
      <content:encoded><![CDATA[A former prison inmate has been arrested and charged with hacking the facility's computer network, stealing personal details of more than 1,100 prison employees and making them available to fellow inmates. Francis G. Janosko, 42, gained access to the names, addresses, dates of birth, social security numbers and telephone numbers of employees worki<img src="http://feedproxy.google.com/~r/digg/topic/security/popular/~4/Zqx25o4Zz6o" height="1" width="1"/>]]></content:encoded>
      <pubDate>Sun, 09 Nov 2008 22:50:02 +0000</pubDate>
      <category domain="http://securityratty.com/tag/prison">prison</category>
      <category domain="http://securityratty.com/tag/prison employees">prison employees</category>
      <category domain="http://securityratty.com/tag/employees worki">employees worki</category>
      <category domain="http://securityratty.com/tag/personal details">personal details</category>
      <category domain="http://securityratty.com/tag/social security">social security</category>
      <category domain="http://securityratty.com/tag/computer network">computer network</category>
      <category domain="http://securityratty.com/tag/birth">birth</category>
      <category domain="http://securityratty.com/tag/janosko">janosko</category>
      <category domain="http://securityratty.com/tag/telephone">telephone</category>
      <source url="http://feeds.digg.com/~r/digg/topic/security/popular/~3/Zqx25o4Zz6o/Inmate_hacked_prison_network_broke_into_employee_database">Inmate hacked prison network, broke into employee database</source>
    </item>
    <item>
      <title><![CDATA[Links List 11.7.08]]></title>
      <link>http://securityratty.com/article/005aeccf95461397bcc44aae9976e6f2</link>
      <guid>http://securityratty.com/article/005aeccf95461397bcc44aae9976e6f2</guid>
      <description><![CDATA[Government contractors spill their thoughts about how Obamas historic win will affect the industry. A majority of those questioned agreed to the fact that nothing will change overnight and everything...]]></description>
      <content:encoded><![CDATA[<p>Government <a href="http://www.bisnow.com/washington_dc_tech_news_story.php?p=1744">contractors spill their thoughts</a> about how Obama’s historic win will affect the industry. A majority of those questioned agreed to the fact that nothing will change overnight and everything will occur within 2-3 years. Others expressed thoughts on who will lead procurement and acquisition policy at GSA and OMB, as well as a possible hiring freeze for the government workforce. We’re also waiting to see what will happen to <a href="http://blog.sciencelogic.com/government-sent-home-with-a-c-on-fisma-report-card/08/2008">FISMA</a> and<a href="http://blog.sciencelogic.com/times-up-ipv6-omb-mandate/06/2008"> IPv6</a> compliance going forward as a new administration and new OMB management sets their own agendas and mandates.<strong></strong></p>
<p>Due to the slow economy, most tech companies are being cautious and ratcheting back sales forecasts for software and hardware. <a href="http://blogs.wsj.com/biztech/2008/10/31/how-to-survive-the-downturn-sell-tech-to-bankruptcy-lawyers/?mod=djemTECH">The exception: Infra-Strategy</a>, a company that operates a group of Web sites that help people find a lawyer and info to deal with bankruptcies, divorces and DUI cases. Visits to the sites are booming – with visits to <a href="http://www.totaldivorce.com/">totaldivorce.com</a>, for example, up 112% in October 2008 (I found the picture on the website particularly compelling). Apparently, in bad times, divorce rates go up. Who knew?</p>
<p>Is it always a recession when it comes to IT Operations? <a href="http://blogs.forrester.com/it_infrastructure/2008/10/how-is-the-econ.html">Companies are constantly trying to find ways to do more with less in IT – reducing costs but keeping the same or even adding functionality</a> – deploying technologies that drive IT consolidation such as mobile and remote access, unified communications and virtualization. Chris Silva of The Forrester Blog for IT Infrastructure &amp; Operations Professionals is looking for a research panel to find out what fellow IT companies are doing to keep their IT budgets in check. To join the research panel visit: <a href="http://itpanel.forrester.com/">http://itpanel.forrester.com/</a>.</p>
<p>The Cloud Computing Monopoly debate continues. O’Reilly Media founder Tim O’Reilly and technology writer Nicholas Carr (of <a href="http://www.computerworld.com/managementtopics/roi/story/0,10801,81045,00.html">“IT Doesn’t Matter”</a> fame/infamy) have been <a href="http://www.informationweek.com/blog/main/archives/2008/11/the_cloud_compu.html?cid=RSSfeed_IWK_ALL">discussing the ‘potential for a single company to achieve monopoly control of the world of cloud computing</a>.’ But what’s even more interesting is the “who will make a lot of money” in cloud computing question.</p>
]]></content:encoded>
      <pubDate>Fri, 07 Nov 2008 19:49:59 +0000</pubDate>
      <category domain="http://securityratty.com/tag/research panel visit">research panel visit</category>
      <category domain="http://securityratty.com/tag/research panel">research panel</category>
      <category domain="http://securityratty.com/tag/monopoly">monopoly</category>
      <category domain="http://securityratty.com/tag/achieve monopoly control">achieve monopoly control</category>
      <category domain="http://securityratty.com/tag/tech companies">tech companies</category>
      <category domain="http://securityratty.com/tag/omb management sets">omb management sets</category>
      <category domain="http://securityratty.com/tag/companies">companies</category>
      <category domain="http://securityratty.com/tag/omb">omb</category>
      <category domain="http://securityratty.com/tag/forrester">forrester</category>
      <source url="http://blog.sciencelogic.com/links-list-11708/11/2008">Links List 11.7.08</source>
    </item>
    <item>
      <title><![CDATA[The process and culture of security]]></title>
      <link>http://securityratty.com/article/2561c9f57c6128d87dbb0afde45d0610</link>
      <guid>http://securityratty.com/article/2561c9f57c6128d87dbb0afde45d0610</guid>
      <description><![CDATA[I'm always amazed at the tenacity and inventiveness of my fellow Greeks. They actually manage to get things done in a system that makes it look impossible to achieve much at...]]></description>
      <content:encoded><![CDATA[I'm always amazed at the tenacity and inventiveness of my fellow Greeks. They actually manage to get things done in a system that makes it look impossible to achieve much at all.]]></content:encoded>
      <pubDate>Tue, 14 Oct 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/fellow greeks">fellow greeks</category>
      <category domain="http://securityratty.com/tag/inventiveness">inventiveness</category>
      <category domain="http://securityratty.com/tag/impossible">impossible</category>
      <category domain="http://securityratty.com/tag/system">system</category>
      <category domain="http://securityratty.com/tag/tenacity">tenacity</category>
      <category domain="http://securityratty.com/tag/achieve">achieve</category>
      <category domain="http://securityratty.com/tag/manage">manage</category>
      <source url="http://www.networkworld.com/columnists/2008/101508antonopoulos.html?fsrc=rss-security">The process and culture of security</source>
    </item>
    <item>
      <title><![CDATA[Clever Counterterrorism Tactic]]></title>
      <link>http://securityratty.com/article/9b0993eb71be732aed5e6c621525d339</link>
      <guid>http://securityratty.com/article/9b0993eb71be732aed5e6c621525d339</guid>
      <description><![CDATA[Used against the IRA : One of the most interesting operations was the laundry mat [sic]. Having lost many troops and civilians to bombings, the Brits decided they needed to determine who was making...]]></description>
      <content:encoded><![CDATA[<p>Used <a href="http://www.washingtonpost.com/wp-dyn/content/article/2008/10/03/AR2008100301978.html?hpid=opinionsbox1">against the IRA</a>:</p>

<blockquote>One of the most interesting operations was the laundry mat [sic]. Having lost many troops and civilians to bombings, the Brits decided they needed to determine who was making the bombs and where they were being manufactured. One bright fellow recommended they operate a laundry and when asked "what the hell he was talking about," he explained the plan and it was incorporated -- to much success.

<p>The plan was simple: Build a laundry and staff it with locals and a few of their own. The laundry would then send out "color coded" special discount tickets, to the effect of "get two loads for the price of one," etc. The color coding was matched to specific streets and thus when someone brought in their laundry, it was easy to determine the general location from which a city map was coded.</p>

<p>While the laundry was indeed being washed, pressed and dry cleaned, it had one additional cycle -- every garment, sheet, glove, pair of pants, was first sent through an analyzer, located in the basement, that checked for bomb-making residue. The analyzer was disguised as just another piece of the laundry equipment; good OPSEC [operational security]. Within a few weeks, multiple positives had shown up, indicating the ingredients of bomb residue, and intelligence had determined which areas of the city were involved. To narrow their target list, [the laundry] simply sent out more specific coupons [numbered] to all houses in the area, and before long they had good addresses. After confirming addresses, authorities with the SAS teams swooped down on the multiple homes and arrested multiple personnel and confiscated numerous assembled bombs, weapons and ingredients. During the entire operation, no one was injured or killed.</blockquote></p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=1VsTM"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=1VsTM" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=omBpM"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=omBpM" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Mon, 13 Oct 2008 09:22:24 +0000</pubDate>
      <category domain="http://securityratty.com/tag/laundry">laundry</category>
      <category domain="http://securityratty.com/tag/laundry simply">laundry simply</category>
      <category domain="http://securityratty.com/tag/laundry equipment">laundry equipment</category>
      <category domain="http://securityratty.com/tag/laundry mat sic">laundry mat sic</category>
      <category domain="http://securityratty.com/tag/color coded">color coded</category>
      <category domain="http://securityratty.com/tag/coded">coded</category>
      <category domain="http://securityratty.com/tag/bomb residue">bomb residue</category>
      <category domain="http://securityratty.com/tag/opsec operational security">opsec operational security</category>
      <category domain="http://securityratty.com/tag/city">city</category>
      <source url="http://www.schneier.com/blog/archives/2008/10/clever_countert.html">Clever Counterterrorism Tactic</source>
    </item>
    <item>
      <title><![CDATA[Sarah Palin and Security Questions]]></title>
      <link>http://securityratty.com/article/1eba1cf0b2be12e62853ecfc357cf52d</link>
      <guid>http://securityratty.com/article/1eba1cf0b2be12e62853ecfc357cf52d</guid>
      <description><![CDATA[I've always looked at security questions used to automate user password recovery with quite a bit of skepticism . What's the point of requiring strong passwords if you allow anyone to reset the...]]></description>
      <content:encoded><![CDATA[<p>I&#39;ve always looked at <a href="http://goodsecurityquestions.com" target="_blank">security questions</a> used to automate user password recovery with <a href="http://www.pluralsight.com/community/blogs/keith/archive/2006/05/24/24964.aspx" target="_blank">quite a bit of skepticism</a>. What&#39;s the point of requiring strong passwords if you allow anyone to reset the password on an account by answering a (potentially inane) question? And just how many good security questions are there, and how many web sites will ask similar questions, allowing the owner of one web site to reset a user&#39;s password at another site that uses the same question? I&#39;m pretty sure that the typical user will tend to select the same security question if it&#39;s available at multiple sites. In many web sites I&#39;ve seen, the security question is clearly the weak link in the chain.</p> <p>Apparently <a href="http://voices.washingtonpost.com/securityfix/2008/10/son_of_tenn_lawmaker_indicted.html?hpid=news-col-blogs" target="_blank">a fellow recently was indicted</a> on charges of <a href="http://blog.wired.com/27bstroke6/2008/09/palin-e-mail-ha.html" target="_blank">hacking</a> into the Republican vice presidential nominee&#39;s Yahoo <a href="http://wikileaks.org/wiki/VP_contender_Sarah_Palin_hacked" target="_blank">email account</a>, by simply doing some research on the Internet to find her birthday, zip code, and the answer to her security question, &quot;Where did you meet your spouse?&quot; All told the attack reportedly took under an hour to complete.</p> <p>Given the level of interest in Palin and other public figures, and the large amount of information about them available to the public, it makes sense that they will be some of the easiest targets for attacks like this.</p><div style="clear:both;"></div><img src="http://www.pluralsight.com/community/aggbug.aspx?PostID=53812" width="1" height="1">]]></content:encoded>
      <pubDate>Thu, 09 Oct 2008 04:09:10 +0000</pubDate>
      <category domain="http://securityratty.com/tag/security question">security question</category>
      <category domain="http://securityratty.com/tag/user">user</category>
      <category domain="http://securityratty.com/tag/security questions">security questions</category>
      <category domain="http://securityratty.com/tag/question">question</category>
      <category domain="http://securityratty.com/tag/typical user">typical user</category>
      <category domain="http://securityratty.com/tag/user password recovery">user password recovery</category>
      <category domain="http://securityratty.com/tag/password">password</category>
      <category domain="http://securityratty.com/tag/yahoo email account">yahoo email account</category>
      <category domain="http://securityratty.com/tag/account">account</category>
      <source url="http://www.pluralsight.com/community/blogs/keith/archive/2008/10/09/sarah-palin-and-security-questions.aspx">Sarah Palin and Security Questions</source>
    </item>
    <item>
      <title><![CDATA[Palin Hacker Allegedly Involved in Another Computer Intrusion]]></title>
      <link>http://securityratty.com/article/b0e235cee9a2d5c7f3d32327ba039f4d</link>
      <guid>http://securityratty.com/article/b0e235cee9a2d5c7f3d32327ba039f4d</guid>
      <description><![CDATA[A 20-year-old Tennessee student who was indicted this week for gaining unauthorized access to Alaska Gov. Sarah Palin's Yahoo account, was involved in another computer intrusion years ago while in...]]></description>
      <content:encoded><![CDATA[A 20-year-old Tennessee student who was indicted this week for gaining unauthorized access to Alaska Gov. Sarah Palin's Yahoo account, was involved in another computer intrusion years ago while in high school, a former teacher says. David Kernell and a fellow classmate guessed the password to a system storing lesson plans and got detention for it, the teacher says.<br style="clear: both;"/>
  <img alt="" style="border: 0; height:1px; width:1px;" border="0" src="http://www.pheedo.com/img.phdo?i=85be033c030c3ca62c0f90c544831a6f" height="1" width="1"/>
<img src="http://www.pheedo.com/feeds/tracker.php?i=85be033c030c3ca62c0f90c544831a6f" style="display: none;" border="0" height="1" width="1" alt=""/><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=g9jaM"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=g9jaM" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=zlQFm"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=zlQFm" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=gga2m"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=gga2m" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=9gFwM"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=9gFwM" border="0"></img></a>
 <a href="http://feeds.wired.com/~f/wired/politics/security?a=NLfwM"><img src="http://feeds.wired.com/~f/wired/politics/security?i=NLfwM" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=4MYSm"><img src="http://feeds.wired.com/~f/wired/politics/security?i=4MYSm" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=2mTlm"><img src="http://feeds.wired.com/~f/wired/politics/security?i=2mTlm" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=7s4MM"><img src="http://feeds.wired.com/~f/wired/politics/security?i=7s4MM" border="0"></img></a> </div><img src="http://feeds.feedburner.com/~r/wired/politics/privacy/~4/416036147" height="1" width="1"/><img src="http://feeds.wired.com/~r/wired/politics/security/~4/416036150" height="1" width="1"/>]]></content:encoded>
      <pubDate>Thu, 09 Oct 2008 00:28:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/computer intrusion">computer intrusion</category>
      <category domain="http://securityratty.com/tag/20-year-old tennessee student">20-year-old tennessee student</category>
      <category domain="http://securityratty.com/tag/lesson plans">lesson plans</category>
      <category domain="http://securityratty.com/tag/yahoo account">yahoo account</category>
      <category domain="http://securityratty.com/tag/alaska gov">alaska gov</category>
      <category domain="http://securityratty.com/tag/teacher">teacher</category>
      <category domain="http://securityratty.com/tag/david kernell">david kernell</category>
      <category domain="http://securityratty.com/tag/sarah palin">sarah palin</category>
      <category domain="http://securityratty.com/tag/system">system</category>
      <source url="http://feeds.wired.com/~r/wired/politics/security/~3/416036150/tennessee-stu-1.html">Palin Hacker Allegedly Involved in Another Computer Intrusion</source>
    </item>
    <item>
      <title><![CDATA[The Seven Habits of Highly Ineffective Terrorists]]></title>
      <link>http://securityratty.com/article/9ded3dd1627a4f9a60f16de4625687eb</link>
      <guid>http://securityratty.com/article/9ded3dd1627a4f9a60f16de4625687eb</guid>
      <description><![CDATA[Most counterterrorism policies fail, not because of tactical problems, but because of a fundamental misunderstanding of what motivates terrorists in the first place. If we're ever going to defeat...]]></description>
      <content:encoded><![CDATA[<p>Most counterterrorism policies fail, not because of tactical problems, but because of a fundamental misunderstanding of what motivates terrorists in the first place. If we're ever going to defeat terrorism, we need to understand what drives people to become terrorists in the first place. </p>

<p>Conventional wisdom holds that terrorism is inherently political, and that people become terrorists for political reasons. This is the "strategic" model of terrorism, and it's basically an economic model. It posits that people resort to terrorism when they believe -- rightly or wrongly -- that terrorism is worth it; that is, when they believe the political gains of terrorism minus the political costs are greater than if they engaged in some other, more peaceful form of protest. It's assumed, for example, that people join Hamas to achieve a Palestinian state; that people join the PKK to attain a Kurdish national homeland; and that people join al-Qaida to, among other things, get the United States out of the Persian Gulf. </p>

<p>If you believe this model, the way to fight terrorism is to change that equation, and that's what most experts advocate. Governments tend to minimize the political gains of terrorism through a no-concessions policy; the international community tends to recommend reducing the political grievances of terrorists via appeasement, in hopes of getting them to renounce violence. Both advocate policies to provide effective nonviolent alternatives, like free elections. </p>

<p>Historically, none of these solutions has worked with any regularity. Max Abrahms, a predoctoral fellow at Stanford University's Center for International Security and Cooperation, has studied dozens of terrorist groups from all over the world. He argues that the model is wrong. In a <a href="http://maxabrahms.com/pdfs/DC_250-1846.pdf">paper</a> published this year in International Security that -- sadly -- doesn't have the title "Seven Habits of Highly Ineffective Terrorists," he discusses, well, seven habits of highly ineffective terrorists. These seven tendencies are seen in terrorist organizations all over the world, and they directly contradict the theory that terrorists are political maximizers: </p>

<p>Terrorists, he writes, (1) attack civilians, a policy that has a lousy track record of convincing those civilians to give the terrorists what they want; (2) treat terrorism as a first resort, not a last resort, failing to embrace nonviolent alternatives like elections; (3) don't compromise with their target country, even when those compromises are in their best interest politically; (4) have protean political platforms, which regularly, and sometimes radically, change; (5) often engage in anonymous attacks, which precludes the target countries making political concessions to them; (6) regularly attack other terrorist groups with the same political platform; and (7) resist disbanding, even when they consistently fail to achieve their political objectives or when their stated political objectives have been achieved. </p>

<p>Abrahms has an alternative model to explain all this: People turn to terrorism for social solidarity. He theorizes that people join terrorist organizations worldwide in order to be part of a community, much like the reason inner-city youths join gangs in the United States. </p>

<p>The evidence supports this. Individual terrorists often have no prior involvement with a group's political agenda, and often join multiple terrorist groups with incompatible platforms. Individuals who join terrorist groups are frequently not oppressed in any way, and often can't describe the political goals of their organizations. People who join terrorist groups most often have friends or relatives who are members of the group, and the great majority of terrorist are socially isolated: unmarried young men or widowed women who weren't working prior to joining. These things are true for members of terrorist groups as diverse as the IRA and al-Qaida. </p>

<p>For example, several of the 9/11 hijackers planned to fight in Chechnya, but they didn't have the right paperwork so they attacked America instead. The mujahedeen had no idea whom they would attack after the Soviets withdrew from Afghanistan, so they sat around until they came up with a new enemy: America. Pakistani terrorists regularly defect to another terrorist group with a totally different political platform. Many new al-Qaida members say, unconvincingly, that they decided to become a jihadist after reading an extreme, anti-American blog, or after converting to Islam, sometimes just a few weeks before. These people know little about politics or Islam, and they frankly don't even seem to care much about learning more. The blogs they turn to don't have a lot of substance in these areas, even though more informative blogs do exist. </p>

<p>All of this explains the seven habits. It's not that they're ineffective; it's that they have a different goal. They might not be effective politically, but they are effective socially: They all help preserve the group's existence and cohesion. </p>

<p>This kind of analysis isn't just theoretical; it has practical implications for counterterrorism. Not only can we now better understand who is likely to become a terrorist, we can engage in strategies specifically designed to weaken the social bonds within terrorist organizations. Driving a wedge between group members -- commuting prison sentences in exchange for actionable intelligence, planting more double agents within terrorist groups -- will go a long way to weakening the social bonds within those groups. </p>

<p>We also need to pay more attention to the socially marginalized than to the politically downtrodden, like unassimilated communities in Western countries. We need to support vibrant, benign communities and organizations as alternative ways for potential terrorists to get the social cohesion they need. And finally, we need to minimize collateral damage in our counterterrorism operations, as well as clamping down on bigotry and hate crimes, which just creates more dislocation and social isolation, and the inevitable calls for revenge.</p>

<p>This essay <a href="http://www.wired.com/print/politics/security/commentary/securitymatters/2008/10/securitymatters_1002">previously appeared</a> on Wired.com.</p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=QW5fM"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=QW5fM" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=YCnjM"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=YCnjM" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Tue, 07 Oct 2008 01:48:53 +0000</pubDate>
      <category domain="http://securityratty.com/tag/ineffective">ineffective</category>
      <category domain="http://securityratty.com/tag/highly ineffective terrorists">highly ineffective terrorists</category>
      <category domain="http://securityratty.com/tag/terrorists">terrorists</category>
      <category domain="http://securityratty.com/tag/people join">people join</category>
      <category domain="http://securityratty.com/tag/people join hamas">people join hamas</category>
      <category domain="http://securityratty.com/tag/people join al-qaida">people join al-qaida</category>
      <category domain="http://securityratty.com/tag/terrorist organizations">terrorist organizations</category>
      <category domain="http://securityratty.com/tag/organizations">organizations</category>
      <category domain="http://securityratty.com/tag/al-qaida">al-qaida</category>
      <source url="http://www.schneier.com/blog/archives/2008/10/the_seven_habit.html">The Seven Habits of Highly Ineffective Terrorists</source>
    </item>
  </channel>
</rss>
