RISKS-LIST: Risks-Forum Digest Tuesday 18 January 2021 Volume 32 : Issue 45
ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks) Peter G. Neumann, founder and still moderator ***** See last item for further information, disclaimers, caveats, etc. ***** This issue is archived at <http://www.risks.org> as <http://catless.ncl.ac.uk/Risks/32.45> The current issue can also be found at <http://www.csl.sri.com/users/risko/risks.txt> Contents: Abridged info on RISKS (comp.risks) ---------------------------------------------------------------------- Date: Sat, 9 Jan 2021 18:00:44 -0500 From: Gabe Goldberg <g...@gabegold.com> Subject: Bursts of acceleration in Tesla vehicles caused by drivers mistaking accelerators for brakes, feds conclude (Ian Duncan) Ian Duncan, *The Washington Post*, 8 Jan 2021 Dozens of incidents involving Teslas unexpectedly accelerating and crashing were the fault of drivers, not a defect with the electric vehicles, the federal car safety agency concluded Friday. https://www.washingtonpost.com/transportation/2021/01/08/tesla-brakes/ [Doesn't speak well of Tesla owners' driving skills...] ------------------------------ Date: Tue, 12 Jan 2021 11:19:09 PST From: Peter Neumann <neum...@csl.sri.com> Subject: Riot in the Capitol is a nightmare scenario for cybersecurity professionals (Tonya Riley) Tonya Riley, *The Washington Post, 7 Jan 2021 Riot in the Capitol is a nightmare scenario for cybersecurity professionals Lawmakers and congressional staff were ushered into secure locations as a mob backing President Trump violently stormed the U.S. Capitol in hopes of overturning the election he lost. The assault -- which only temporarily delayed the certification of president-elect Joe Biden's win -- left many unanswered questions about security at the Capitol, including its cybersecurity. The quick evacuation left computers and other device unattended as the mob ransacked offices. ------------------------------ Date: Sun, 10 Jan 2021 00:23:17 -0500 From: Gabe Goldberg <g...@gabegold.com> Subject: Post-Riot, the Capitol Hill IT Staff Faces a Security Mess (WiReD) Wednesday's insurrection could have exposed congressional data and devices in ways that have yet to be appreciated. [...] Given the scope of the intrusion, Coleman and others say that it's important to assume that any device could have been compromised and remediate the breach with that scale and scope in mind. But he and others emphasize that rather than replacing every device and cable in the entire congressional orbit, constant vigilance and an “assume breach” mentality will be the best defense going forward. The Economic Development Administration took an ill-advised maximalist approach after a 2011 compromise, launching a massive campaign <https://arstechnica.com/information-technology/2013/07/us-agency-baffled-by-modern-technology-destroys-mice-to-get-rid-of-viruses/> to physically destroy all of its digital equipment, including desktop computers, printers, cameras, mice, and keyboards -- most of which were uninfected. The effort concluded only when the agency ran out of money for the project. Congress needn't take an action so dramatic as that. But it also must acknowledge how exposed Wednesday's incident has left it. https://www.wired.com/story/capitol-riot-security-congress-trump-mob-clean-up/ Every cable? And if they ran out of money to destroy things, what was left to *buy* things? ------------------------------ Date: Tue, 12 Jan 2021 09:35:30 -0700 From: "Bob Gezelter" <gezel...@rlgsc.com> Subject: The Parler API was open without authentication. One or more third parties have done full downloads () It is important to design APIs so that they are reasonably secure. It is reported that the Parler API was open (e.g. did not require authentication). Further more, the geo-tagging inherent in JPEG was provided on public images. Reportedly, the entire contents of Parler's database have been accessed by at least one third party. I guess that the individuals who implemented Parler were not well-read on web security issues, and were not familiar with the OWASP guidance on the subject. The full articles can be found at: https://arstechnica.com/information-technology/2021/01/parlers-amateur-coding-could-come-back-to-haunt-capitol-hill-rioters/ ------------------------------ Date: Tue, 12 Jan 2021 18:08:42 PST From: Peter Neumann <neum...@csl.sri.com> Subject: ESS voting machine company sends threats (Andrew Appel) Andrew Appel <ap...@princeton.edu> has another RISKS-relevant article on freedom-to-tinker: https://freedom-to-tinker.com/2021/01/11/ess-voting-machine-company-sends-threats/ ESS voting machine company sends threats, 11 Jan 2021 For over 15 years, election security experts and election integrity advocates have been communicating to their state and local election officials the dangers of touch-screen voting machines. The danger is simple: if fraudulent software is installed in the voting machine, it can steal votes in a way that a recount wouldn't be able to detect or correct. That was true of the paperless touchscreens of the 2000s, and it's still true of the ballot-marking devices (BMDs) and *all-in-one* machines such as the ES&S ExpressVote XL voting machine ( [ https://www.cs.princeton.edu/~appel/papers/bmd-insecure.pdf | see section 8 of this paper ] *). This analysis is based on the characteristics of the technology itself, and doesn't require any conspiracy theories about who owns the voting-machine company. In contrast, if an optical-scan voting machine was suspected to be hacked, the recount can assure an election outcome reflects the will of the voters, because the recount examines the very sheets of paper that the voters marked with a pen. In late 2020, many states were glad they used optical-scan voting machines with paper ballots: the recounts could demonstrate conclusively that the election results were legitimate, regardless of what software might have been installed in the voting machines or who owned the voting-machine companies. In fact, the vast majority of the states use optical-scan voting machines with hand-marked paper ballots, and in 2020 we saw clearly why that's a good thing. In November and December 2020, certain conspiracy theorists made unsupportable claims about the ownership of Dominion Voting Systems, which manufactured the voting machines used in Georgia. [ https://www.cnn.com/2021/01/08/politics/dominion-voting-defamation-lawsuit/index.html Dominion has sued for defamation [For example, PGN suggests looking at this WashPost item: https://www.washingtonpost.com/politics/dominion-sues-pro-trump-lawyer-sidney-powell-seeking-more-than-13-billion/2021/01/08/ebe5dbe0-5106-11eb-b96e-0e54447b23a1_story.html ] Dominion is the manufacturer of voting machines used in many states. Its rival, Election Systems and Software (ES&S), has an even bigger share of the market. Apparently, ES&S must think that amongst all that confusion, the time is right to send threatening Cease & Desist letters to the legitimate critics of their ExpressVote XL voting machine. Their lawyers sent [ https://freedom-to-tinker.com/2021-01-04-cease-and-desist-letter-to-smart-elections-0029787725-1/ | this letter ] to the leaders of [ https://smartelections.us/ | SMART Elections ] , a journalism+advocacy organization in New York State who have been communicating to the New York State Board of Elections, explaining to the Board why it's a bad idea to use the ExpressVote XL in New York (or in any state). ES&S's lawyers claim that certain facts (which they call *accusations*) are *false, defamatory, and disparaging*, namely: that the ``ExpressVote XL can add, delete, or change the votes on individual ballots'', that the ExpressVote XL will ``deteriorate our security and our ability to have confidence in our elections,'' and that it is a ``bad voting machine.'' Well, let me explain it for you. The ExpressVote XL, if hacked, can add, delete, or change votes on individual ballots -- and no voting machine is immune from hacking. That's why optical-scan voting machines are the way to go, because they can't change what's printed on the ballot. And let me explain some more: The ExpressVote XL, if adopted, will deteriorate our security and our ability to have confidence in our elections, and indeed it is a bad voting machine. And expensive, too! It's been clearly explained in the peer-reviewed literature how touch-screen voting machines -- even the ones like the XL that print out paper ballots -- can (if hacked) alter votes; and how most voters won't notice; and how even if some voters do notice, there's no way to correct the election result. And it's been explained why machines like the ExpressVote XL are particularly insecure -- as I said, [ https://www.cs.princeton.edu/~appel/papers/bmd-insecure.pdf | see section 8 of this paper ] *. And it's pretty clear that the folks at SMART Elections are aware of these scientific studies, and are basing their journalism and advocacy on good science. I'll summarize here what's explained in the paper: how the ExpressVote XL, if hacked, can change votes. If the machine is hacked, the software can do whatever the hacker has programmed, but the hacker can't change the hardware. The hardware includes a thermal printer that can make black marks (i.e., print text or barcodes or whatever) on the paper, but the hardware can't erase marks. Therefore you might think the ExpressVote XL, even if hacked, couldn't alter votes. But consider this: suppose there are 15 contests on the ballot; suppose the voter makes choices for all 13 contests and chooses not to vote for State Senator. Then what the legitimate software does is, in the line for State Senator, print NO SELECTION MADE. But the hacked software could simply leave that line blank -- then, when the voter has reviewed the ballot (or not bothered to), the ballot card is pulled past the printhead into the ballot box, and the printhead (under control of hacked software) can print in a vote for Candidate Smith. Few voters will be worried that the line is blank rather than filled in with NO SELECTION MADE. You might think, ``OK, the ExpressVote XL can fill in undervotes, that's bad, but it can't change votes.'' But it can! Here is the mechanism: Suppose the voter makes choices in all 15 contests, and chooses Jones for State Senator. The hacked software can print a ballot card with only 14 contests, and leave blank spaces for State Senator. Then, after the voter reviews the ballot card behind glass, the card moves past the printhead into the ballot box. At this time the hacked software can print the hacker's choice (Smith) for State Senator. If most humans were really good at checking their printout line-by-line with what they marked on the touchscreen, this wouldn't succeed because the voter would notice the missing line, but voters are only human. More details and explanation are in https://www.cs.princeton.edu/~appel/papers/bmd-insecure.pdf ------------------------------ Date: Sun, 10 Jan 2021 10:04:05 +0800 From: Richard Stein <rmst...@ieee.org> Subject: IPhone12 will stop your implantable defibrillator (Medicalxpress.com) https://medicalxpress.com/news/2021-01-iphone12-implantable-defibrillator.html "In a recent paper in the journal Heart Rhythm, doctors describe how they turned off the potentially life-saving cardiac defibrillator function of an implanted Medtronic device simply by holding an iPhone 12 near it. The authors had nothing personal against Medtronic, or for that matter, against the new iPhone. The main reason they singled the phone out here was because it is compatible with some of the most advanced new technologies available for various magnetic-based communications and charging." [Monty Solomon noted another take: Medical study suggests iPhone 12 with MagSafe can deactivate pacemakers https://9to5mac.com/2021/01/11/iphone-12-magsafe-deactivates-pacemakers/ PGN] ------------------------------ Date: Sat, 9 Jan 2021 18:02:51 -0500 From: Gabe Goldberg <g...@gabegold.com> Subject: IRS rushes to fix error that sent millions of stimulus payments to wrong bank accounts (Michelle Singletary) Michelle Singletary, *The Washington Post*, 8 Jan 2021 https://www.washingtonpost.com/business/2021/01/08/irs-tax-preparer-stimulus-error/ ------------------------------ Date: Thu, 14 Jan 2021 12:27:52 -0500 From: Gabe Goldberg <g...@gabegold.com> Subject: Lack of Tiny Parts Disrupts Auto Factories Worldwide (NYTimes) Carmakers can't buy the semiconductors they need because home electronics are taking all the supply. https://www.nytimes.com/2021/01/13/business/auto-factories-semiconductor-chips.html [The Internet of Things is becoming the Internet of Ca-chings? PGN] ------------------------------ Date: Wed, 13 Jan 2021 00:12:55 -0500 From: Gabe Goldberg <g...@gabegold.com> Subject: Lost Passwords Lock Millionaires Out of Their Bitcoin Fortunes (NYTimes) https://www.nytimes.com/2021/01/12/technology/bitcoin-passwords-wallets-fortunes.html The risk? History repeating itself. ------------------------------ Date: Sun, 17 Jan 2021 03:20:47 -0800 From: Tom Van Vleck <t...@multicians.org> Subject: Bug wipes UK arrest records Software bug wipes out over 150,000 UK arrest records including fingerprints and DNA data. ------------------------------ Date: Sat, 16 Jan 2021 08:59:40 -0800 From: Lauren Weinstein <lau...@vortex.com> Subject: Risks of DNS encryption: NSA warns enterprises to beware of third-party DNS resolvers (Ars Technica) https://arstechnica.com/information-technology/2021/01/the-nsa-warns-enterprises-to-beware-of-third-party-dns-resolvers/ ------------------------------ Date: Sun, 17 Jan 2021 03:16:20 -0800 From: Tom Van Vleck <t...@multicians.org> Subject: Company name could lead to security xss attack Someone named his company " " > [or perhaps even `" " >'] https://www.ibtimes.sg/british-company-forced-change-name-it-could-be-used-cross-site-scripting-hack-53148 ------------------------------ Date: Wed, 13 Jan 2021 23:44:43 -0500 From: Gabe Goldberg <g...@gabegold.com> Subject: How Amazon Sidewalk Works -- and Why You May Want to Turn It Off (WiReD) The white paper points out the steps that Amazon has taken to make this as private and secure as possible, including a variety of cryptographic algorithms and those three levels of encryption: It shouldn't be possible for other people to spy on your network or suddenly gain access to your smart thermostat. Everything should happen seamlessly behind the scenes, in theory. All that said, it really comes down to how much you trust Amazon -- the company that seems keen to collect as much data as possible about you, shares Ring camera information with law enforcement agencies, and which hasn't always protected sensitive user data quite as robustly as it might have done. The company has also said it might share Sidewalk data with third-party developers further down the line, and you know where that kind of data sharing tends to lead. If you end up deciding that Amazon Sidewalk isn't for you, you need to take action: It's on by default, once the software update has hit your devices (it's also on by default for users setting up an Amazon-powered smart home for the first time.) If you want to turn it off, you need to open up the Alexa app on your phone, and go to More, Settings, Account Settings, and Amazon Sidewalk. https://www.wired.com/story/how-amazon-sidewalk-works/ ------------------------------ Date: Sun, 10 Jan 2021 02:13:55 -0500 From: Gabe Goldberg <g...@gabegold.com> Subject: What to expect for the 2021 workplace (WashPost) Video chats will get smarter -- and, potentially, creepier -- thanks to artificial intelligence. If 2020 was the year video conferencing truly went mainstream, 2021 could be the year it gets smarter. Some of the largest platforms will begin using artificial intelligence to recognize and track certain gestures participants make, automate to-do items and help manage the challenges of workers split between work and home. Zoom Video Communications, for instance, announced a *smart gallery* feature it plans to roll out in June 2021 that will use cameras to make multiple people in the same on-site conference room appear as separate, equal-sized windows on their live-stream video. Those working from home will see the individual faces of each colleague rather than just a view of the whole conference room, an effort to visually shrink the differences between remote and in-person workers. ``We want to maintain the democratization of Zoom, and have everyone on the same level when people come back to the office,'' said Oded Gal, Zoom's chief product officer. Cisco Systems, meanwhile, will launch *gesture recognition* early next year using artificial intelligence to recognize specific movements -- clapping, raised hands, a thumbs up, or thumbs down. For large virtual meetings with hundreds of attendees, it could help gauge reactions to an idea without requiring attendees to answer a survey or click on-screen emoji. Asked if recognizing facial expressions like smiles, frowns or eye rolls in a video call might be next, Cisco Senior Vice President Jeetu Patel said addressing privacy concerns has to come first. Even collecting anonymous data might make people uneasy, he said. ``This is much more of a privacy and comfort issue than it is a technology issue. It's just a matter of what is going to be acceptable.'' Microsoft Teams, meanwhile, added a new feature late this year that uses AI to recognize what tasks participants agreed to complete during a meeting and send them reminders afterward, as well as create searchable meeting transcripts. ``It will follow up with me with *action items* that I agreed to,'' Jared Spataro, corporate vice president for Microsoft 365, said in an interview. ``A lot of things that people are thinking `Yeah, someday that will be reality' are actually already in the product.'' Microsoft has also filed a patent for a system that could use sensors, cameras and software to examine body language, expressions and participant contributions to come up with an *overall quality score* for how the meeting went. But Spataro said, ``Neither research nor patents is a good predictor of product pipeline. We're always looking at all those types of things.'' https://www.washingtonpost.com/road-to-recovery/2021/01/03/rtr-officetrends/ Potentially? ------------------------------ Date: Thu, 14 Jan 2021 23:54:05 -0500 From: Gabe Goldberg <g...@gabegold.com> Subject: In-Garage Delivery: Amazon Key (Amazon.com) What is Key by Amazon In-Garage Delivery? Key by Amazon In-Garage Delivery is a secure, convenient way to receive Amazon packages inside your garage. It helps prevent package theft and provides protection from potentially damaging weather like heat and rain. Key by Amazon is also contactless, because there�s no interaction between you and the delivery associate, or contact between the associate and the garage door. Key In-Garage Delivery requires a compatible Smart Garage Hub or Wifi Garage Door Opener to enable authorized delivery associates to leave Amazon packages inside your garage. https://www.amazon.com/b?node=21222091011&ref=kfg_surl_key ------------------------------ Date: Fri, 15 Jan 2021 10:53:57 +0800 From: Richard Stein <rmst...@ieee.org> Subject: AI algorithm over 70% accurate at guessing a person's political orientation (techxplore.com) https://techxplore.com/news/2021-01-ai-algorithm-accurate-person-political.html "A team of researchers at Stanford University has developed an AI algorithm that proved to be slightly over 70% accurate at guessing a person's political affiliation after studying a single photograph. In their paper published in the journal Scientific Reports, the group describes building and testing their algorithm and how well it worked." See "Facial recognition technology can expose political orientation from naturalistic facial images," for a detailed discussion of image classification and algorithm operation. https://www.nature.com/articles/s41598-020-79310-1 "The researchers were not able to pin down exactly what sorts of facial characteristics their system correlated with political affiliation, but they did find some trends -- head orientation and emotional expression, for example, appeared to provide some clues." Political profiling based on facial recognition can guide campaign advertising, appeals for donations, personnel recruiting, etc. Given a polarized electorate, the algorithm might assist identification of persuadable voters to tip a close election. Correlate this algorithm's predictive capabilities with an interpretation of the brain's amygdala, as explored by political neuroscientists [1] using fMRI to estimate political inclinations, to yield artificially intelligent phrenology. [1] "A Neurology of the Conservative-Liberal Dimension of Political Ideology, Part 4: Neuroimaging Studies" from https://neuro.psychiatryonline.org/doi/full/10.1176/appi.neuropsych.16030051 ------------------------------ Date: Thu, 14 Jan 2021 13:57:46 -0500 From: Gabe Goldberg <g...@gabegold.com> Subject: Detection of Hardware Trojans Using Controlled Short-Term Aging (NYU Tandon School of Engineering) The project builds upon on-going research, funded by a $1.3 million grant from the Office of Naval Research, to create algorithms for detecting Trojans -- deliberate flaws inserted into chips during fabrication -- based on the short term aging phenomena in transistors. It will focus on this physical phenomenon of short-term aging as a route to detecting hardware Trojans. The efficacy of short-term aging-based hardware Trojan detection has been demonstrated through simulations on integrated circuits (ICs) with several types of hardware Trojans through stochastic perturbations injected into the simulation studies. This DURIP project seeks to demonstrate hardware Trojan detection in actual physical ICs. https://engineering.nyu.edu/news/detection-hardware-trojans-using-controlled-short-term-aging ------------------------------ Date: Thu, 14 Jan 2021 11:15:50 +0800 From: Richard Stein <rmst...@ieee.org> Subject: Unique study incorporates fluid dynamics and more to evaluate, enhance future implants (PHYS.ORG) https://phys.org/news/2021-01-unique-incorporates-fluid-dynamics-future.html "Rice University engineers hope to make life better for those with replacement joints by modeling how artificial hips are likely to rub them the wrong way." Knee, hip, and shoulder replacements are performed routinely, especially for an aging population. Arthroplasty is the medical procedure orthopedic surgeons apply for joint replacement. "Rates of Total Joint Replacement in the United States: Future Projections to 2020--2040 Using the National Inpatient Sample" https://www.jrheum.org/content/early/2019/04/09/jrheum.170990 estimates 498K total hip arthroplasty and 1.06M total knee arthroplasty procedures in 2020 within the US. The essay projects a 2-3X multiplier for each by 2040. The FDA's product classification website (type in 'knee' or 'hip' to see an extended list) (https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfPCD/PCDSimpleSearch.cfm, A culled list (filtered for implants -- partial and total -- and inspected to possess non-null TPLC medical device report records) reveals 24 separate product codes for hip replacements and 20 for knee replacements. Each product code represents manufactured devices consisting of various plastics, metals, or a combination of these materials. Given the product code count above, and the Patient Problem counts given below, an estimate of diminished quality of life from hip arthroplasty can be calculated assuming there's at least 1 manufactured product per product code. 1085 * 24 = 47740 patient problems/5 years = 9548 patient problems per year or 9,548/498,000 = ~2% of all arthroplasty procedures in 2020 are estimated to experience post-operative negative quality of life impact: infection, pain, dislocations, etc. A similar method can be applied to estimate knee replacement quality of life impacts. Given the implantation growth rate projection, this number is likely to double or triple by 2040 without significant improvements in prosthetic device and patient arthroplasty treatment life cycles. For product code JDH (Device: prosthesis, hip, hemi-, trunnion-bearing, femoral, metal/polyacetal, Regulation Description: Hip joint femoral (hemi-hip) trunnion-bearing metal/polyacetal cemented prosthesis), the FDA's Total Product Life Cycle tool (https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfTPLC/tplc.cfm?id=4638) aggregates the following Top-10 Device Problems and Patient Problems (linked to medical device reports) between 01JAN2016 and 31DEC2020 (in CSV format): Device Problems,MDRs with this Device Problem,Events in those MDRs Insufficient Information,387,387 Adverse Event Without Identified Device or Use Problem,177,177 Device Dislodged or Dislocated,121,121 Break,71,71 Fracture,65,65 Loose or Intermittent Connection,36,36 Appropriate Term/Code Not Available,31,31 Unintended Movement,22,22 Unstable,14,14 Loosening of Implant Not Related to Bone-Ingrowth,12,12 Migration or Expulsion of Device,10,10 The Top-10 Patient Problems attributed to this product code in CSV format are: Patient Problems,MDRs with this Patient Problem,Events in those MDRs Injury,532,532 Unspecified Infection,125,125 Pain,88,88 Joint Dislocation,78,78 No Code Available,60,60 No Information,50,50 Bone Fracture(s),50,50 No Known Impact Or Consequence To Patient,40,40 No Consequences Or Impact To Patient,32,32 Failure of Implant,30,30 ------------------------------ Date: Tue, 12 Jan 2021 12:15:56 -0800 From: Rob Slade <rmsl...@shaw.ca> Subject: Risk Management and Two-Dose Vaccines Now that vaccines have started to roll out, we have a new risk management lesson from them. Most of the vaccines that have been approved so far are two-dose vaccines. With the rush to get vaccines into people in the most expeditious manner, there is now a new controversy. Do you give as many people as possible one dose of the vaccine, or do you hold back doses so that there will be a guaranteed supply for those who need a second shot? First, let's look at the mechanics of what is going on with the two-dose vaccines. (There are some one dose vaccines coming, but they seem to be at least a month away from approval, so we've got some time to discuss this.) The first shot, in a two-dose series, is often referred to as a primer shot. It is delivering some material to the body to alert the immune system to something it should be paying attention to. Most often this is some kind of protein that is foreign to the human body. The Pfizer and Moderna vaccines are kind of interesting in that they contain messenger RNA (mRNA) that makes our bodies produce the protein spikes that are on the coronavirus. Having produced these proteins (without ever having encountered the actual virus), our bodies then produce antibodies that identify and attack these proteins. The idea is that, by the time we actually encounter some coronavirus, our bodies are primed and ready to attack the actual virus. (Given the trials that have gone on, and the data collected, the idea seems to be correct.) With many two-dose vaccines, the second dose, sometimes known as a booster shot, as opposed to the initial primer shot, is often just more of the same. (Both the Pfizer and Moderna vaccines are of this type.) In past studies of vaccines, it seems to be that, in the case of many vaccines, a second shot of the same material does two things. The first is that it increases the protective effectiveness of the vaccine, by boosting the immune response that we produce. The second is that it increases the duration over time that the body is able to produce this response, thus conferring protection over a longer period. For example, after a single shot the body may produce an effective immune response for a period of four months. After a second shot, that might be increased to two years. (At this point we don't have good data about duration in regard to the Pfizer and Moderna vaccines, since they haven't existed for more than a few months, but we assume they will follow a similar pattern.) The increase in duration is, of course, a benefit. But, in the midst of a pandemic, and particularly in the midst of huge second and third wave surges, it is the increase in effectiveness that sets up the possible controversy. Do you leave some people only partly protected, so that you can partly protect others? Since this is risk management, we again have to note probabilities and uncertainties and the fact that none of this is quantum. Protection isn't absolute, and it doesn't turn on and off. In particular, protection doesn't turn on instantly, and takes time to develop. And it also takes time to go away again. In a two-dose vaccine regime, you receive an initial primer shot. That does not mean you can now safely go to bars and insurrection mobs without being at risk of getting CoVID-19. It will take some time for your body to develop any kind of immune response. After three weeks or so, you may have about 80% protection. Note that this isn't 100% protection. You can still get infected if you encounter someone who is infectious. But you are less likely to become infected. (Actually, even though it might sound low, 80% is pretty good for a vaccine. The flu vaccines that we get every year are only about 50% effective. That, and the effects of herd immunity when almost everyone gets the vaccine, means far fewer cases of the flu, and fewer deaths, and less time lost to sickness, and less impact on the economy, and so even a 50% effective vaccine is a very good thing.) At this point, two things may be happening. Your body may (and probably is) still increasing it�s protection, even without any further intervention. Some of the Pfizer and Moderna data indicates that, over a longer period of time, even a single dose of the vaccine can confer protection over 90%. But you can, at this point, get the second, booster, dose of the vaccine. Following the booster dose, after some time (possibly a week, possibly six weeks), your protection level can rise to around 95%. A couple more points to note. I said �at this point.� Vaccine studies in the past have clearly shown that, if you give the booster shot too early, it is basically a waste of vaccine. There is a minimum time, after the primer shot, before a booster shot gives any booster effect. This minimum time seems to be three weeks, in the case of Pfizer, and four weeks, in the case of Moderna. Another factor to consider is that, while there is a definite minimum time period between shots in terms of maximum effect, the maximum time between shots is much more open ended. If the minimum time is three weeks, then there is no diminution of effect if you wait until four weeks to give the booster. In fact, many studies seem to indicate that, to a certain extent, the longer you wait for the second, booster, shot, the stronger the protection and the longer the duration of protection. (Again, the coronavirus vaccines simply haven't been in existence long enough for us to have really good data on the timing, but studies or existing vaccines show that this is very likely.) Yet another consideration goes back to those numbers. You will recall that I said 80% was pretty good protection. It is. 90% is better, and 95% is better still. But even 95% isn't that much better than 80%, and 80% is a whole lot better than nothing. So, back to the controversy. When we start giving vaccines, we can stick with the minimum time regime, and give everyone a second dose as soon as they hit the three week mark. That way we get more people up to 95% protection sooner. Or, we can delay the second dose out to five weeks. The downside is that those people spend an extra two weeks at 80% protection before they get the booster dose. But, during those two weeks, we can start bringing even more people to 80% protection (rather than leaving them with nothing). Which means we start building herd immunity faster. And the early lot are not, after all, being left with no protection. They are probably at 80%, and may be building, themselves, towards 90%. And they are still well within the time period during which they are going to get the booster effect. They may even get a better booster effect for the delay. The calculus involved here is complex. It involves the infectiousness of the virus, the effectiveness of the vaccine, the total numbers of cases, and a number of other considerations. However, in our situation, the answer seems to fall on the *delay* side of the equation. ------------------------------ Date: Fri, 15 Jan 2021 11:35:30 -0800 From: Rob Slade <rmsl...@shaw.ca> Subject: Different kinds of security For years, no, actually decades, I have read, with pleasure and reliance, a certain columnist's columns on politics in BC. He has been knowledgeable, analytical, and educational. Due to his taking on a field outside his expertise in 2020, that of the pandemic, I am rapidly losing any and all of the respect that I ever had for his journalistic abilities. https://vancouversun.com/opinion/columnists/vaughn-palmer-dix-ducks-and- covers-before-fessing-up-on-care-home-covid-outbreaks His latest column chides Health Minister Adrian Dix for being careful in his answer about a question involving the rise of infections in long term care homes. Yes, Dix might have answered earlier and more directly that staff is responsible for most outbreaks in long term care. But that is a loaded question right now. Staff are responsible for outbreaks because they are the ones moving between the community and the homes. What do you want to do about that? Ban the staff? Leave the homes unattended, and let the residents shift as best they can from their beds? But the columnist isn't content to raise that nonsensical issue. He then goes on to blame the "second wave" surge on the election. Anyone who takes the time to look at the case numbers can see that the election made almost no contribution to the surge, which clearly dates from Thanksgiving dinners and parties. The columnist then takes up the cudgel on behalf of the idea of "routine" testing for staff. As he has been told many times when he raises the (same) question on "The Dr. Bonnie Show (co-starring Adrian Dix and Nigel Howard)," there *is* routine testing of medical staff. It's just that the routine varies depending upon the level of medical and public health risk, and not at the call of some political columnist. Testing of every staff member twice a week would still leave at least a four day window every week during which people could become infected and infectious. In fact the window would be longer, since test results take about 24 to 48 hours to be processed. And who is it that would do these tests (by the way, how many LTC staff are there in the entire province of BC?), and what work would *not* be done while they are doing them? Risk management is obviously not the columnist's field. It may just be CoVID fatigue and increased irritability on my part, but I am growing distressed with the poor quality of the Sun's coverage of the pandemic, and it's seeming pursuit of the scandalous over the informative. And so I fired off this rant to some of my friends in security. And got a response back: > Did you send this to the wrong mailing list? So, I definitely did not make the point I wanted to make properly. I suppose a bit more detail (and a bit less rant) is in order. Lemme start with a seminar I did some time back. Unusually, it was actually in Vancouver. I had two candidates, sitting next to each other, as it happened, who both worked for government, but came from radically divergent security situations, as became obvious when we discussed the good old CIA triad of Confidentiality, Integrity, and Availability. One worked for E-Comm. These are the people who, among other things, answer the phones when you call 911. The E-Comm people don't exactly broadcast their calls, but confidentiality is not their first concern. That's availability. When somebody in trouble calls 911, somebody *has* to answer the phone. (I had a tour through E-Comm one time, and their business continuity and resilience planning is *really* impressive.) Sitting beside him was a candidate from one of the business development banks of the federal government. These agencies provide loans to businesses that want to expand their business. Since the idea is expansion, most of the loans aren't exactly secured by traditional equity. In order to ensure that the money (mostly) goes to actually building business, the companies have to provide masses of information about themselves, their markets, and their plans. This data is *highly* confidential: if it ever got into the hands of their competitors, the companies could be in real trouble. So everything is kept strictly confidential, and almost all their security is directed that way. But availability? As he said himself, "Hey, we're the federal government. If we disappeared for a month, who would even notice?" I guess what the columnist doesn't see (and what I didn't really allow for), is that he has worked for decades in politics. Politics is definitely a long game. It doesn't really happen all that fast. It's important to have a really good memory, going back decades. You need to analyse. And you've got all the time in the world to analyse, because nothing is going to happen very quickly. You need to look, in minute detail, at what the government, and political figures, are doing, while they are doing it, to point out minor flaws so that, by the time an act *is* passed, it's perfect. (It never actually *is* perfect, but that's what you are aiming for.) But a pandemic isn't politics, even though a lot of political work is involved. A pandemic is emergency management. You have to do *something*, because, if you don't, people will die. And, often, anything you do is better than doing nothing, because if you do nothing, people will die. So, delaying things while you look for a perfect solution is wrong, because, in emergency management, "the best" is very definitely the enemy of the good. Pandemics are fluid, and you make the best choice you can, at the time, with limited information, and change plans when the information changes, and hope, rather desperately, that the first plans you made don't run completely counter to later information. But you make a choice, and do it, because, if you don't, people will die. In emergency management, you do try to get divergent opinions, to try and make sure that you don't make a drastic mistake. But the very last thing you need, in the middle of a pandemic or other disaster, is someone publicly second-guessing what you are doing. That can wait for the "after action" debriefings. During the crisis, having some political columnist (with no training in emergency management, or even risk management) saying that you are making a mistake is just messing with the messaging you are trying to get out to the public. And, if that happens, people might die. There are different types of security. They are useful in different types of situations. There is no "one size fits all." We need to apply the right security to the right situation. And we definitely don't want to apply the wrong security to the wrong situation. ------------------------------ Date: Mon, 11 Jan 2021 14:12:54 -0500 From: Larry Werring <lwerr...@nrtco.net> Subject: Hacker Locks Internet-Connected Chastity Cage The risks seem obvious...<br> https://www.vice.com/en/article/m7apnn/your-cock-is-mine-now-hacker-locks-internet-connected-chastity-cage-demands-ransom ------------------------------ Date: Sun, 10 Jan 2021 21:39:04 -0500 From: Larry Werring <lwerr...@nrtco.net> Subject: Re: Scope of Russian Hacking Far Exceeds Initial Fears (RISKS-32.44) I am getting very tired of reading stories like this. I worked IT security for many years in Government (now retired) expending much effort to stop this kind of activity. One of the reasons I retired early was the lack of will to really do anything about this type of activity. If the Russians or the Chinese or anyone else, for that matter, flew over and dropped troops into our major centers with orders to break into key Government and commercial buildings, sabotage critical infrastructure, and steal sensitive information and other valuables, we would immediately retaliate in an appropriate manner that would discourage future similar activities. Doing it electronically is the same as doing it the old fashioned way (analog). Why isn't anyone dealing with it as such? As far as I know, there has been no retaliation for the numerous intrusions that have occurred over the years. Why are we still letting them get away with it? Unless we treat this like an electronic war and appropriately defend ourselves with a good offence, they will keep doing it with impunity. If you are going to do nothing then you might as well throw open the doors and let them in (i.e. surrender). At the very least, take control of or destroy their access to the Internet so they can't access their targets.<br> <br> Maybe it's a good thing that I am retired. My frustration and bitterness at doing so much over the years with so little effect is beginning to show through. I can see from this and other similar posts that my peers are having very little success in dealing with the many crooks and enemies conducting these intrusions. Were I still working, I would be even more frustrated than I am reading about it. Continue to do nothing and they'll reap your reward. ------------------------------ Date: Sun, 10 Jan 2021 14:26:08 +1100 From: 3daygoaty <threedaygo...@gmail.com> Subject: Re: Voting Systems: The Cherry and the Cream (RISKS-32.44) > At anytime after I'd voted, I could check my vote online by entering my > registration number. I ran one of these pilots in 2007, the one in Swindon. It is illegal for the voting authority to issue any kind of binding proof of your vote that you could use to trade, sell or demonstrate your voting choices to a third party. The challenge is to show you something convincing that is not your vote, but which also can be independently verified. One of the best that has been achieved to date and not torn to shreds (so to speak) -- for which I was the project manager -- is vVote (2014) due to Teague, Schneider, Culnane, Hook and Ryan, and this is a supervised polling place system based on Pret a Voter. I am not aware of a remote votingscheme in the world used or proposed for high stakes public elections that has withstood even a fairly brief spotlight by the voting security community. ------------------------------ Date: Sun, 10 Jan 2021 07:31:33 -0600 From: Stephen Fierbaugh <step...@fierbaugh.org> Subject: Re: One Minute Left": Hockey, CoVID-19 ...vs hacking (Drewe, RISKS-32.43) We "wait" until total monthly deaths from all causes decrease to <= 1 standard deviation from normal. The benefit is this calculation is easy to make from readily available civil data collection processes which have been in place for a long time, doesn't require any special testing, and can't really be manipulated. For my Smith County, Texas, USA, mortality is currently at 7.351 standard deviations. ------------------------------ Date: Wed, 13 Jan 2021 22:24:07 +0000 From: "Chris D." <e767...@yahoo.co.uk> Subject: Re: One Minute Left": Hockey, CoVID-19 ...vs hacking (Fierbaugh, RISKS-32.45) Thanks, but I'm not sure if it's that simple. Reportedly, what panics politicians is people dying from Covid-19 in hospital corridors or parking lots, so much routine health treatment has virtually stopped to leave room for these people. "Total monthly deaths from all causes" will include those who may have died from delayed investigation and/or treatment but it's difficult to say how many there were, and people who die quietly at home aren't so conspicuous. We are deluged with figures on daily/weekly/monthly deaths, but often measured in different ways or time periods, and then there's the annual panic over 'winter'. There are constant demands over making lockdown restrictions stricter, or if this would make things better or worse... Hope that helped but it probably didn't. CD ------------------------------ Date: Wed, 13 Jan 2021 16:46:55 -0600 From: Stephen Fierbaugh <step...@fierbaugh.org> Subject: Re: One Minute Left": Hockey, CoVID-19 ...vs hacking (Drewe, RISKS-32.45) Clarification: I didn't mean that we stay locked down until then. Rather, the public health emergency will be over then. That the metric measures all deaths, not just explicitly COVID-19 is an intentional feature, not a bug. ------------------------------ Date: Mon, 1 Aug 2020 11:11:11 -0800 From: risks-requ...@csl.sri.com Subject: Abridged info on RISKS (comp.risks) The ACM RISKS Forum is a MODERATED digest. Its Usenet manifestation is comp.risks, the feed for which is donated by panix.com as of June 2011. => SUBSCRIPTIONS: The mailman Web interface can be used directly to subscribe and unsubscribe: http://mls.csl.sri.com/mailman/listinfo/risks => SUBMISSIONS: to risks@CSL.sri.com with meaningful SUBJECT: line that includes the string `notsp'. Otherwise your message may not be read. *** This attention-string has never changed, but might if spammers use it. => SPAM challenge-responses will not be honored. Instead, use an alternative address from which you never send mail where the address becomes public! => The complete INFO file (submissions, default disclaimers, archive sites, copyright policy, etc.) is online. <http://www.CSL.sri.com/risksinfo.html> *** Contributors are assumed to have read the full info file for guidelines! => OFFICIAL ARCHIVES: http://www.risks.org takes you to Lindsay Marshall's searchable html archive at newcastle: http://catless.ncl.ac.uk/Risks/VL.IS --> VoLume, ISsue. Also, ftp://ftp.sri.com/risks for the current volume/previous directories or ftp://ftp.sri.com/VL/risks-VL.IS for previous VoLume If none of those work for you, the most recent issue is always at http://www.csl.sri.com/users/risko/risks.txt, and index at /risks-32.00 ALTERNATIVE ARCHIVES: http://seclists.org/risks/ (only since mid-2001) *** NOTE: If a cited URL fails, we do not try to update them. Try browsing on the keywords in the subject line or cited article leads. Apologies for what Office365 and SafeLinks may have done to URLs. ==> Special Offer to Join ACM for readers of the ACM RISKS Forum: <http://www.acm.org/joinacm1> ------------------------------ End of RISKS-FORUM Digest 32.45 ************************