<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: outrageous]]></title>
    <link>http://securityratty.com/tag/outrageous</link>
    <description></description>
    <pubDate>Mon, 21 Jan 2008 18:10:00 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[On Elephants and Analytics]]></title>
      <link>http://securityratty.com/article/1442c3136b28a9d1abcf4dffefbd1935</link>
      <guid>http://securityratty.com/article/1442c3136b28a9d1abcf4dffefbd1935</guid>
      <description><![CDATA[In On EP and Analytics , good friend and respected colleague Opher Etzionapplies the well known metaphor of the big elephantto describe how, if you areobserving certain specific domains of a subject,...]]></description>
      <content:encoded><![CDATA[<div class='snap_preview'><br /><p>In <a href="http://epthinking.blogspot.com/2008/06/on-ep-and-analytics.html" target="_self">On EP and Analytics</a>, good friend and respected colleague Opher Etzion applies the well known metaphor of the big elephant to describe how, if you are observing certain specific domains of a subject, like fraud detection, then your view of the whole elephant is biased by your lack of perspective of entire big elephant.</p>
<p>I am pleased that dear Opher continues to use this metaphor in counterpoint because the same metaphor can be used to describe the carefully selected group of vendors that have banded together to called themselves CEP Vendors.  This group, many founding members of the EPTS, have formed a merry band of well-intended event processing &#8220;specialists&#8221; and the same lovely elephant causes this group of bonded colleagues to make elephant-blinded statements, as Opher has made in his <a href="http://epthinking.blogspot.com/2008/06/on-ep-and-analytics.html" target="_self">quoted post</a>:</p>
<p><em>&#8220;Currently most CEP applications do not require analytics.&#8221;</em> </p>
<p>The reason, I believe, that Opher makes the statement above is because the group of software vendors calling themselves &#8220;CEP vendors&#8221; represent a very small part of the overall event processing elephant;  and hence, since these self-described CEP applications appear to require very little or no analytics, then, by the same logic, CEP requires no analytics. </p>
<p>(I should outline the boolean logic in a future post!)</p>
<p>For example, one friend and colleague in Thailand is the CTO of True Internet, a leading telecommunications, voice, Video and Internet service provider in Thailand.   True processes myriad events on their network using a dynamic, self-learning neural networking technology.    The US company providing this very clever and highly recommended event processing application do not call themselves a &#8220;CEP vendor&#8221;; however, they process complex events better and more interesting than the band of merry self-described &#8220;CEP players&#8221;.</p>
<p>Again,  visualize the gentle giant elephant metaphor that Opher likes to use as a basis for his comments in CEP counterpoint.</p>
<p>When folks define the term &#8220;complex event processing&#8221; to match a technology marketing campaign that is primarily driven by software running rules against time-series data streaming in a sliding-time windows, and then go on to take the same software capabilities and apply these capabilities to problems that are suitable for that domain, then you match Opher&#8217;s elegant description of &#8220;a small view of the overall elephant&#8221;.</p>
<p>The fact of the matter is that the overall domain of event processing is at least three orders of magnitude larger than the combined annual revenue of the self-described companies marketing what they call &#8220;CEP engines.&#8221;  The very large &#8220;rest of the big elephant&#8221; is doing what is also &#8220;complex event processing&#8221; in everyday operations that are somehow overlooked in &#8221;other&#8221; analysis and counterplay.</p>
<p>Therefore,  I kindly remain unmoved of my view  that the self-described CEP community, as currently organized, is not immune to counterpoint using the same gentle giant elephant metaphor.  I like this metaphor and hope well-respected colleagues will continue to use this metaphor; because we can easily apply this elegant manner of discussion to explain why the current group of self-described CEP vendors are, in a manner of speaking, selling <a href="http://eventprocessing.wordpress.com/wp-admin/post.php?action=edit&amp;post=255" target="_self">Capital Market Snake Oil </a>because they are making outrageous claims about the capabilities of their products, as if they can solve the entire &#8221;elephant&#8221; of event processing problems.   Recently, <a href="http://reddevnews.com/news/article.aspx?editorialsid=9988" target="_self">in this article</a>, CEP was positioned as a technology to mitigate against corporate megadisasters like the subprime meltdown.</p>
<p>Advice:  Tone down the hype.</p>
<p>Furthermore, the noise in the counter arguments marginalize most of the real event processing challenges faced by customers.</p>
<p>In consistant and well respected rebuttal, Opher likes to use the &#8220;glass half-full, half-empty&#8221; metaphor.   Opher&#8217;s point is a valid attempt to paint my operational realism as &#8220;half empty&#8221; negativism; while at the same time positioning the promotion of the (narrow) event processing capabilities of the self-described CEP rules community as &#8220;half-full&#8221; thinking. </p>
<p>For the record, I do see my worldview as &#8220;half full&#8221; or &#8220;half empty&#8221;; but an unbiased pragmatic view based on day-to-day interaction with customers with what they would call &#8220;complex event processing&#8221; problems. </p>
<p>These same customers would fall over laughing if we tried to bolt one of these rule-based, time-series streaming data processing engines on their network and told them they can detect anything other than trival business events, business opportunities and threats, in near real-time. </p>
<p>Is it &#8220;half empty&#8221; thinking to caution people that a &#8220;glass&#8221; of software that is being touted as the answer to a wide range of complex (even going so far in a recent news article to imply CEP would have magically stopped the subprime crisis!) tangible business problems is not really as that it is hyped to be?  </p>
<p>If so, then I plead guilty to honesty and realism, with the added offense of a sense of fiscal responsibility to customers and end users.</p>
<img alt="" border="0" src="http://feeds.wordpress.com/1.0/categories/eventprocessing.wordpress.com/259/" /> <img alt="" border="0" src="http://feeds.wordpress.com/1.0/tags/eventprocessing.wordpress.com/259/" /> <a rel="nofollow" href="http://feeds.wordpress.com/1.0/gocomments/eventprocessing.wordpress.com/259/"><img alt="" border="0" src="http://feeds.wordpress.com/1.0/comments/eventprocessing.wordpress.com/259/" /></a> <a rel="nofollow" href="http://feeds.wordpress.com/1.0/godelicious/eventprocessing.wordpress.com/259/"><img alt="" border="0" src="http://feeds.wordpress.com/1.0/delicious/eventprocessing.wordpress.com/259/" /></a> <a rel="nofollow" href="http://feeds.wordpress.com/1.0/gostumble/eventprocessing.wordpress.com/259/"><img alt="" border="0" src="http://feeds.wordpress.com/1.0/stumble/eventprocessing.wordpress.com/259/" /></a> <a rel="nofollow" href="http://feeds.wordpress.com/1.0/godigg/eventprocessing.wordpress.com/259/"><img alt="" border="0" src="http://feeds.wordpress.com/1.0/digg/eventprocessing.wordpress.com/259/" /></a> <a rel="nofollow" href="http://feeds.wordpress.com/1.0/goreddit/eventprocessing.wordpress.com/259/"><img alt="" border="0" src="http://feeds.wordpress.com/1.0/reddit/eventprocessing.wordpress.com/259/" /></a> <img alt="" border="0" src="http://stats.wordpress.com/b.gif?host=thecepblog.com&blog=1100533&post=259&subd=eventprocessing&ref=&feed=1" /></div>]]></content:encoded>
      <pubDate>Thu, 26 Jun 2008 08:11:30 +0000</pubDate>
      <category domain="http://securityratty.com/tag/call">call</category>
      <category domain="http://securityratty.com/tag/call cep engines">call cep engines</category>
      <category domain="http://securityratty.com/tag/cep">cep</category>
      <category domain="http://securityratty.com/tag/cep community">cep community</category>
      <category domain="http://securityratty.com/tag/cep counterpoint">cep counterpoint</category>
      <category domain="http://securityratty.com/tag/cep players">cep players</category>
      <category domain="http://securityratty.com/tag/imply cep">imply cep</category>
      <category domain="http://securityratty.com/tag/cep rulescommunity">cep rulescommunity</category>
      <category domain="http://securityratty.com/tag/cep vendors">cep vendors</category>
      <source url="http://thecepblog.com/2008/06/26/on-elephants-and-analytics/">On Elephants and Analytics</source>
    </item>
    <item>
      <title><![CDATA[On Elephants and Analytics]]></title>
      <link>http://securityratty.com/article/d267d4bd8cc726a7efb346107f8889a3</link>
      <guid>http://securityratty.com/article/d267d4bd8cc726a7efb346107f8889a3</guid>
      <description><![CDATA[In On EP and Analytics , good friend and respected colleague Opher Etzionapplies the well known metaphor of the big elephantto describe how, if you areobserving certain specific domains of a subject,...]]></description>
      <content:encoded><![CDATA[<p>In <a href="http://epthinking.blogspot.com/2008/06/on-ep-and-analytics.html" target="_self">On EP and Analytics</a>, good friend and respected colleague Opher Etzion applies the well known metaphor of the big elephant to describe how, if you are observing certain specific domains of a subject, like fraud detection, then your view of the whole elephant is biased by your lack of perspective of the entire big elephant.</p>
<p>I am pleased that dear Opher continues to use this metaphor in counterpoint because the same metaphor can be used to describe the carefully selected group of vendors that have banded together to called themselves CEP Vendors.  This group, many founding members of the EPTS, have formed a merry band of well-intended event processing &#8220;specialists&#8221; and the same lovely elephant causes this group of bonded colleagues to make elephant-blinded statements, as Opher has made in his <a href="http://epthinking.blogspot.com/2008/06/on-ep-and-analytics.html" target="_self">quoted post</a>:</p>
<p><em>&#8220;Currently most CEP applications do not require analytics.&#8221;</em> </p>
<p>The reason, I believe, that Opher makes the statement above is because the group of software vendors calling themselves &#8220;CEP vendors&#8221; represent a very small part of the overall event processing elephant;  and hence, since these self-described CEP applications appear to require very little or no analytics, then, by the same logic, CEP requires no analytics. </p>
<p>(I should outline the boolean logic in a future post!)</p>
<p>For example, one friend and colleague in Thailand is the CTO of True Internet, a leading telecommunications, voice, Video and Internet service provider in Thailand.   True processes myriad events on their network using a dynamic, self-learning neural networking technology.    The US company providing this very clever and highly recommended event processing application does not call themselves a &#8220;CEP vendor&#8221;; however, they process complex events better and more interesting than the band of merry self-described &#8220;CEP players&#8221;.</p>
<p>Again,  visualize the gentle giant elephant metaphor that Opher likes to use as a basis for his comments in CEP counterpoint.</p>
<p>When folks define the term &#8220;complex event processing&#8221; to match a technology marketing campaign that is primarily driven by software running rules against time-series data streaming in a sliding-time windows, and then go on to take the same software capabilities and apply these capabilities to problems that are suitable for that domain, then you match Opher&#8217;s elegant description of &#8220;a small view of the overall elephant&#8221;.</p>
<p>The fact of the matter is that the overall domain of event processing is at least two orders of magnitude larger (maybe more) than the combined annual revenue of the self-described companies marketing what they call &#8220;CEP engines.&#8221;  The very large &#8220;rest of the big elephant&#8221; is doing what is also &#8220;complex event processing&#8221; in everyday operations that are somehow overlooked in &#8221;other&#8221; analysis and counterplay.</p>
<p>Therefore,  I kindly remain unmoved from my view  that the self-described CEP community, as currently organized, is not immune to counterpoint using the same gentle giant elephant metaphor.  I like this metaphor and hope well-respected colleagues will continue to use this metaphor; because we can easily apply this elegant manner of discussion to explain why the current group of self-described CEP vendors are, in a manner of speaking, selling <a href="http://eventprocessing.wordpress.com/wp-admin/post.php?action=edit&amp;post=255" target="_self">Capital Market Snake Oil </a>because they are making outrageous claims about the capabilities of their products, as if they can solve the entire &#8221;elephant&#8221; of event processing problems.   Recently, <a href="http://reddevnews.com/news/article.aspx?editorialsid=9988" target="_self">in this article</a>, CEP was positioned as a technology to mitigate against corporate megadisasters like the subprime meltdown.</p>
<p>Advice:  Tone down the hype.</p>
<p>Furthermore, the noise in the counter arguments marginalize most of the real event processing challenges faced by customers.</p>
<p>In consistant and well respected rebuttal, Opher likes to use the &#8220;glass half-full, half-empty&#8221; metaphor.   Opher&#8217;s point is a valid attempt to paint my operational realism as &#8220;half empty&#8221; negativism; while at the same time positioning the promotion of the (narrow) event processing capabilities of the self-described CEP rules community as &#8220;half-full&#8221; thinking. </p>
<p>For the record, I do see my worldview as &#8220;half full&#8221; or &#8220;half empty&#8221;; but an unbiased pragmatic view based on day-to-day interaction with customers with what they would call &#8220;complex event processing&#8221; problems. </p>
<p>These same customers would fall over laughing if we tried to bolt one of these rule-based, time-series streaming data processing engines on their network and told them they can detect anything other than trival business events, business opportunities and threats, in near real-time. </p>
<p>Is it &#8220;half empty&#8221; thinking to caution people that a &#8220;glass&#8221; of software that is being touted as the answer to a wide range of complex (even going so far in a recent news article to imply CEP would have magically stopped the subprime crisis!) tangible business problems is not really as that it is hyped to be?  </p>
<p>If so, then I plead guilty to honesty and realism, with the added offense of a sense of fiscal responsibility to customers and end users.</p>
]]></content:encoded>
      <pubDate>Thu, 26 Jun 2008 08:11:30 +0000</pubDate>
      <category domain="http://securityratty.com/tag/call">call</category>
      <category domain="http://securityratty.com/tag/call cep engines">call cep engines</category>
      <category domain="http://securityratty.com/tag/cep">cep</category>
      <category domain="http://securityratty.com/tag/cep community">cep community</category>
      <category domain="http://securityratty.com/tag/cep counterpoint">cep counterpoint</category>
      <category domain="http://securityratty.com/tag/cep players">cep players</category>
      <category domain="http://securityratty.com/tag/imply cep">imply cep</category>
      <category domain="http://securityratty.com/tag/cep rulescommunity">cep rulescommunity</category>
      <category domain="http://securityratty.com/tag/cep vendors">cep vendors</category>
      <source url="http://www.thecepblog.com/2008/06/26/on-elephants-and-analytics/">On Elephants and Analytics</source>
    </item>
    <item>
      <title><![CDATA[FAQ: The Obama breach: What exactly is a passport record]]></title>
      <link>http://securityratty.com/article/71a3ea387f8c5b9a81d5e1d8a270f1ee</link>
      <guid>http://securityratty.com/article/71a3ea387f8c5b9a81d5e1d8a270f1ee</guid>
      <description><![CDATA[An admission late Thursday that three contract workers in the U.S. Department of Stateillegally accessed the passport records of Sen. Barack Obama (D-Ill.), has sparked a firestorm of controversy....]]></description>
      <content:encoded><![CDATA[An admission late Thursday that three contract workers in the U.S. Department of Stateillegally accessed the passport records of Sen. Barack Obama (D-Ill.), has sparked a firestorm of controversy. While State Department officials characterized the incident as the result of "imprudent curiosity," Obama's campaign spokesman called the breach an "outrageous breach of security and privacy." The breaches occurred Jan. 9, Feb. 12 and March 14, but were apparently not reported to higher-level State Department employees, who said they learned of the incidents just this week.]]></content:encoded>
      <pubDate>Thu, 20 Mar 2008 21:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/obama">obama</category>
      <category domain="http://securityratty.com/tag/breach">breach</category>
      <category domain="http://securityratty.com/tag/department">department</category>
      <category domain="http://securityratty.com/tag/department officials">department officials</category>
      <category domain="http://securityratty.com/tag/department employees">department employees</category>
      <category domain="http://securityratty.com/tag/outrageous breach">outrageous breach</category>
      <category domain="http://securityratty.com/tag/barack obama">barack obama</category>
      <category domain="http://securityratty.com/tag/imprudent curiosity">imprudent curiosity</category>
      <category domain="http://securityratty.com/tag/passport records">passport records</category>
      <source url="http://www.networkworld.com/news/2008/032108-faq-the-obama-breach-what.html?fsrc=rss-security">FAQ: The Obama breach: What exactly is a passport record</source>
    </item>
    <item>
      <title><![CDATA[The Checklist]]></title>
      <link>http://securityratty.com/article/fe4f934e33d82e7c6399c659a93681bb</link>
      <guid>http://securityratty.com/article/fe4f934e33d82e7c6399c659a93681bb</guid>
      <description><![CDATA[Brian Chess wrote about a great article in the New Yorker - &quot; The Checklist .&quot; The article is a fantastic read and I highly recommend it, even if you're not interested in medicine. It is well written...]]></description>
      <content:encoded><![CDATA[Brian Chess <a href="http://extra.fortifysoftware.com/blog/2008/01/the_checklist.html">wrote</a> about a great article in the New Yorker - "<a href="http://www.newyorker.com/reporting/2007/12/10/071210fa_fact_gawande">The Checklist</a>."   The article is a fantastic read and I highly recommend it, even if you're not interested in medicine.  It is well written and quite engaging about how doctors handle a ridiculously complex topic - intensive care.<br /><br />Like Brian, I was struck by how closely the article can parallel some of the problems we face in trying to develop secure software.  I agree with the basic premise of Brian's statement, that a checklist can help in the software development world just like it can in the ICU.  I've had great success providing checklists to developers of common areas of concern, areas they need to make sure the document, etc.<br /><ul><li>Document how you handle authentication.  if different from standard X, get a security reviews.</li><li>Document how you're handing input filtering. If not the standard library with declarative syntax, document and get a security review.....</li></ul>You get the picture.  You can do similar things with static analyzers for example, and even by tweaking compilers or compile environment to prevent the usage of certain easy to mess-up functions such as strcpy, messed up buffer sizes, etc.<br /><br />I want to focus on two other items from the article that are worth noting.<br /><ol><li>Metrics</li><li>Processe<span style="font-weight: bold;">s</span></li></ol><span style="font-weight: bold;">Metrics</span><br /><br />In the paper the author talks about following the checklist and how it reduced deaths.  One thing he never mentions is the cost of following the checklist.  I thought it interesting, but I can only assume based on the number of lives saved, and the cost of even a single infection, that the costs of following the checklist are far outweighed by the cost savings.  Still, it would have been nice to see a cost comparison between the two.<br /><br />What is also interesting though is that in the hospital setting its generally quite clear what an adverse event is.  We generally know when someone has an infection, we certainly know when someone dies.  We do root cause analysis in many cases (though not all) to understand the general cause of death, though when there is an infection for example we don't always get to root cause.<br /><br />One result of this sort of tracking, is that it occurs within a regulatory framework where hospitals must report their incident rates publicly, and there are agencies within government charged with collecting, monitoring, and even in some cases improving on these measurements and results.<br /><br />As a result of this public tracking, the key doctor from the paper, Pronovost, was able pretty clearly to tell whether his process changes were having a positive or negative effect.  He had lots of public data to draw from, and the incidence rate at any given hospital is large enough that we can start to make valid statistical judgments about the impact of our changes.<br /><br />Contrast this with software and the differences in both area, and maturity, are quite telling.  We don't have any standard measures of success/failure, we don't perform lots of root cause on adverse events, and we don't have public reporting of success and failure.  So, we don't have a general body of knowledge that allows us  to get better or at least measure how we're doing.<br /><br />Maybe we ought to have something like that? I <a href="http://securityretentive.blogspot.com/2007/05/analyzing-software-failures.html">wrote</a> about this last year when saying that we ought to have some sort of NTSB for security, or at least for security breaches.  Maybe its time we start taking that more seriously?<br /><br /><span style="font-weight: bold;">Processes</span><br /><br />I was also struck by one of Pronovost's comments about medicine that I think especially relevant to software security.  When asked whether we'd get to the point that checklists are as common as a stethoscope for a Dr, he replied:<br /><br /><blockquote>"At the current rate, it will never happen,” he said, as monitors beeped in the background. “The fundamental problem with the quality of American medicine is that we’ve failed to view delivery of health care as a science. The tasks of medical science fall into three buckets. One is understanding disease biology. One is finding effective therapies. And one is insuring those therapies are delivered effectively. That third bucket has been almost totally ignored by research funders, government, and academia. It’s viewed as the art of medicine. That’s a mistake, a huge mistake. And from a taxpayer’s perspective it’s outrageous.” We have a thirty-billion-dollar-a-year National Institutes of Health, he pointed out, which has been a remarkable powerhouse of discovery. But we have no billion-dollar National Institute of Health Care Delivery studying how best to incorporate those discoveries into daily practice.</blockquote>I was reminded of Gunnar's <a href="http://1raindrop.typepad.com/1_raindrop/2007/10/sacred-cow-gore.html">response</a> to the Spaf piece - "<a href="http://www.cerias.purdue.edu/weblogs/spaf/kudos-opinions-rants/post-124/solving-some-of-the-wrong-problems/">Solving the Wrong Problems</a>."   I think Gunnar hit it on the head with his criticism of Spaf's piece, and I think the situation is quite similar to the one Pronovost finds in medicine. <br /><br />For the most part we fail to treat the delivery/creation of software as a science.  We do lots of research on languages, we do lots of work on theories of security, and then it all breaks down because we have people implementing the processes, and we don't spend any time on that.  Well, at least not in measure to how much we spend on all sorts of other efforts that we don't measure, we aren't sure achieve results, etc.<br /><br />We know lots about how to theoretically secure things, but we don't know a whole lot about how to get large software development organizations to produce consistently high quality/"secure" software.  Heck, we don't even know how to do it if we aren't budget constrained, much less if we are.<br /><br />To be sure, medicine hasn't solved this problem either, and they aren't dealing with a huge installed base :)  They are better at measuring effectiveness, but again they are in a life/death world plus they have the added joy of strict liability.  Operating under those conditions they do manage to settle on newer/better techniques pretty quickly, because they are tracking how they are doing, lives are on the line, and they are pretty strongly incented to get it right.<img src="http://feeds.feedburner.com/~r/SecurityRetentive/~4/231381189" height="1" width="1"/>]]></content:encoded>
      <pubDate>Thu, 07 Feb 2008 17:14:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/secure">secure</category>
      <category domain="http://securityratty.com/tag/develop secure software">develop secure software</category>
      <category domain="http://securityratty.com/tag/software">software</category>
      <category domain="http://securityratty.com/tag/software development organizations">software development organizations</category>
      <category domain="http://securityratty.com/tag/health">health</category>
      <category domain="http://securityratty.com/tag/health care delivery">health care delivery</category>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/checklist">checklist</category>
      <category domain="http://securityratty.com/tag/software development world">software development world</category>
      <source url="http://feeds.feedburner.com/~r/SecurityRetentive/~3/231381189/checklist.html">The Checklist</source>
    </item>
    <item>
      <title><![CDATA[Financial Ombudsman losing it?]]></title>
      <link>http://securityratty.com/article/74e08152850c21aa924133108ad1f3fd</link>
      <guid>http://securityratty.com/article/74e08152850c21aa924133108ad1f3fd</guid>
      <description><![CDATA[I appeared on You and Yours (Radio 4) today at 12.35 with an official from the Financial Ombudsman Service, after I coauthored a FIPR submission to a review of the service which is currently being...]]></description>
      <content:encoded><![CDATA[<p>I appeared on &#8220;You and Yours&#8221; (Radio 4) today at 12.35 with an official from the Financial Ombudsman Service, after I coauthored a <a href="http://www.fipr.org/080116huntreview.pdf">FIPR submission</a> to a review of the service which is currently being conducted by <a href="http://www.thehuntreview.org.uk/">Lord Hunt</a>.</p>
<p>Our <a href="http://www.fipr.org/080116huntreview.pdf">submission</a> looks at three cases in particular in which the ombudsman decided in favour of the banks and against bank customers over disputed ATM transactions. We found that the adjidicators employed by the ombudsman made numerous errors both of law and of technology, and concluded that their decisions were an affront to reason and to justice.</p>
<p>One of the cases has already <a href="http://www.lightbluetouchpaper.org/2007/02/08/financial-ombudsman-on-chip-pin-infallibility/">appeared here</a> on lightbluetouchpaper; the other two cardholders appeared on an investigation into card fraud on &#8220;Tonight with Trevor MacDonald&#8221;, and their case papers are included, with their permission, as <a href="http://www.fipr.org/080116huntreview.pdf">appendices to our submission</a>. These papers are damning, but the Hunt review&#8217;s staff declined to publish them on the somewhat surprising grounds that the information in them might be used to commit identity theft against the customers in question. Eventually they <a href="http://www.thehuntreview.org.uk/submissions/submissions.html">published</a> our submission minuss the two appendices of case papers. (If knowing someone&#8217;s residential address and the account number to a now-defunct bank account is enough for a criminal to steal money from you, then the regulatory failures afflicting the British banking system are even deeper than I thought.)</p>
<p>The Financial Ombudsman Service, and its predecessor the Banking Ombudsman, have for many years found against bank customers and in favour of the banks. In the early-to-mid 1990s, they upheld the banks&#8217; outrageous claim that mag-stripe ATM cards were invulnerable to cloning; this led to the court cases described <a href="http://www.cl.cam.ac.uk/~rja14/Papers/wcf.html">here</a> and <a href="http://www.cl.cam.ac.uk/~rja14/Papers/liability.pdf">here</a>. That position collapsed when ATM criminals started being sent to prison. Now we have another wave of ATM card cloning, which we&#8217;ve discussed several times: we&#8217;ve shown you a <a href="http://www.lightbluetouchpaper.org/2006/12/24/chip-pin-terminal-playing-tetris/">chip and PIN terminal playing Tetris</a> and described <a href="http://www.lightbluetouchpaper.org/2007/08/08/chip-and-pin-relay-attack-paper-wins-best-student-paper-at-usenix-security-2007/">relay attacks</a>. There&#8217;s much more to come.</p>
<p>The radio program is not yet available online; I&#8217;ll put in a link here when it appears. We clearly have them rattled; the ombudsman was patronising and abusive, and made a number of misleading statements. He also said that the &#8220;independent&#8221; Hunt review was commissioned by his board of directors. I hope it turns out to be a bit more independent than that. If it doesn&#8217;t, then consumer advocates should campaign for the FOS to be abolished and for customers to be empowered to take disputes to the courts, as we argue in section 31-32 of our <a href="http://www.fipr.org/080116huntreview.pdf">submission</a>.</p>
]]></content:encoded>
      <pubDate>Wed, 23 Jan 2008 12:14:58 +0000</pubDate>
      <category domain="http://securityratty.com/tag/ombudsman">ombudsman</category>
      <category domain="http://securityratty.com/tag/financial ombudsman service">financial ombudsman service</category>
      <category domain="http://securityratty.com/tag/service">service</category>
      <category domain="http://securityratty.com/tag/submission">submission</category>
      <category domain="http://securityratty.com/tag/submission minuss">submission minuss</category>
      <category domain="http://securityratty.com/tag/customers">customers</category>
      <category domain="http://securityratty.com/tag/bank customers">bank customers</category>
      <category domain="http://securityratty.com/tag/independent hunt review">independent hunt review</category>
      <category domain="http://securityratty.com/tag/fipr submission">fipr submission</category>
      <source url="http://www.lightbluetouchpaper.org/2008/01/23/financial-ombudsman-losing-it/">Financial Ombudsman losing it?</source>
    </item>
    <item>
      <title><![CDATA[Who says Politics doesn't pay and why can't I find clients with pockets this deep?]]></title>
      <link>http://securityratty.com/article/72ce20f130c78da874e849da0a3491a9</link>
      <guid>http://securityratty.com/article/72ce20f130c78da874e849da0a3491a9</guid>
      <description><![CDATA[I have never drank the political coolaid. I have little faith in big party politics. Give me an independent politician who does not have to toe a party line and I'll show you a politician who has half...]]></description>
      <content:encoded><![CDATA[<a href="http://bp0.blogger.com/_1UFxC-OgSnA/R5UUuLmhiBI/AAAAAAAAADc/ODAIe-i9zzE/s1600-h/Fotolia_3032426_S.jpg"><img style="float:left; margin:0 10px 10px 0;cursor:pointer; cursor:hand;" src="http://bp0.blogger.com/_1UFxC-OgSnA/R5UUuLmhiBI/AAAAAAAAADc/ODAIe-i9zzE/s320/Fotolia_3032426_S.jpg" border="0" alt=""id="BLOGGER_PHOTO_ID_5158051731843680274" /></a><br />I have never drank the political coolaid.  I have little faith in big party politics.  Give me an independent politician who does not have to toe a party line and I'll show you a politician who has half a chance of being a decent advocate of the people.    <br /><span id="fullpost"><br />I think one of the greatest wrongs that politicans commit is in their thinking of voters as idiots.  I use the Washington Post article of 1/17/08 as a prime example.  Staff writer Carrie Johnson writes in the Business section that GAO investigators will look into "NO-BID Contracts" irregularities  involving the Justice Department.<br /><br />This all came about when a firm led by the former Attorney General, John D. Ashcroft, drew attention for receiving lucrative (more like outrageous) contracts to oversee companies accused of fraud and other wrong doings.  One firm in particular, Zimmer (famous for their "Zimmer Frames"), agreed to pay Mr. Ashcroft's firm between $28 and $52 million dollars to resolve kickback allegations.  <br /><br />Two questions spring to mind; 1) How much was the original "kickback" amount when they can now afford to pay out $28,000,000.00 to $52,000,000.00? and 2) Does the recieving of (as much as) $52 million dollars by a former high ranking politician from a company with it's back up against a wall not sound like a "kickback" in of itself?<br /><br />What does Mr. Ashcroft's firm deliver as a result of this outlandish payment?  Well, as a "monitor", they will make sure that Zimmer stops making illicit payment to doctors for using Zimmer products.  There's got to be more than that, surely?  Kind of.  Ashcroft said that he has already made several trips to Indiana to "understand Zimmer's troubles."  Several trips to Indiana for $52 million dollars?  Did they buy their own luxury jet just for those trips?<br /><br />Private investigation firms all across America conducts similar services on a daily basis, only for a mere fraction of what Zimmer has paid to this former Government official.  As a private security business owner I can attest to the fact that a typical investigation company would be delighted and thrilled to receive 2% - 3% of this amount and in so doing would employ highly skilled investigators with backgrounds and certifications such as Certified Fraud examiner in the FBI, United Nations and other Govt. and corporate investigative agencies.  <br /><br />You can be sure that Mr. Ashccroft is not the only former government offical riding the gravy train.  The article states that several other former government officials with ties to the Bush administration have been awarded similar contracts since 2001.<br />      <br /></span><div class="blogger-post-footer">Visit Sexton Executive Security at www.sextonsecurity.com</div>]]></content:encoded>
      <pubDate>Mon, 21 Jan 2008 18:10:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/zimmer">zimmer</category>
      <category domain="http://securityratty.com/tag/zimmer products">zimmer products</category>
      <category domain="http://securityratty.com/tag/zimmer frames">zimmer frames</category>
      <category domain="http://securityratty.com/tag/million dollars">million dollars</category>
      <category domain="http://securityratty.com/tag/firm">firm</category>
      <category domain="http://securityratty.com/tag/firm deliver">firm deliver</category>
      <category domain="http://securityratty.com/tag/zimmer stops">zimmer stops</category>
      <category domain="http://securityratty.com/tag/resolve kickback allegations">resolve kickback allegations</category>
      <category domain="http://securityratty.com/tag/contracts">contracts</category>
      <source url="http://www.thebulletproofblog.com/2008/01/who-says-politics-doesnt-pay-and-why.html">Who says Politics doesn't pay and why can't I find clients with pockets this deep?</source>
    </item>
  </channel>
</rss>
