2013 PET Award for Outstanding Research in Privacy Enhancing Technologies

You are invited to submit nominations to the 2013 PET Award.

The PET Award is presented annually to researchers who have made an outstanding contribution to the theory, design, implementation, or deployment of privacy enhancing technology. It is awarded at the annual Privacy Enhancing Technologies Symposium (PETS).

The PET Award carries a prize of 3000 USD thanks to the generous support of Microsoft. The crystal prize itself is offered by the Office of the Information and Privacy Commissioner of Ontario, Canada.

Any paper by any author written in the area of privacy enhancing technologies is eligible for nomination. However, the paper must have appeared in a refereed journal, conference, or workshop with proceedings published in the period from April 16, 2011 until March 31, 2013.

The complete Award rules including eligibility requirements can be found at http://petsymposium.org/award/rules.php.

Anyone can nominate a paper by sending an email message containing the following to award-chairs13@petsymposium.org:

  • Paper title
  • Author(s)
  • Author(s) contact information
  • Publication venue and full reference
  • Link to an available online version of the paper
  • A nomination statement of no more than 500 words.

Thoughts on the Tragedies of December 14th

I started this post on December 14th, and couldn’t finish it. I’m going to leave the opening as I wrote it then: By now, everyone has heard of the tragic school shooting in Connecticut. My heart goes out to everyone touched by the events. But this isn’t the first school shooting on a December 14th. I went to a tiny school, Simon’s Rock, and on December 14, 1992, Wayne Lo murdered my friend Galen Gibson and Professor Ñacuñán Sáez. He also shot my friend Tom McElderry. I can still remember the phone call from my friend Chi, telling me that Tommy had been shot and was in the hospital. I remember being up all night, spreading what little information we had by phone, and wondering what the hell was going on. I remember that weeks later, I’d get emails from co-workers whose local papers in places like Japan finally carried the story. For years after, I took December 14th as a day off, because it was hard to handle life with that weighing on you.

It’s a sad reality that we now have enough school shootings that one of them was going to fall on an anniversary of another. (Statisticians call this the birthday problem.) It’s also a sad reality that we have enough of them that schools, police and emergency responders have plans for them.

What a fucking world.

Some people like to say things like “time heals all wounds,” but you know? Greg Gibson isn’t going to get his son back. Ñacuñán’s family isn’t going to get him back. And twenty or more families in Sandy Hook will never again be the same. I’m having trouble editing this more than a month later because of how the memories flood back.

All that to say that I have some understanding of these events, and I think I can talk about them differently than a random observer.

A lot of people are using this tragedy to say we need gun control. I understand where they’re coming from, and I disagree. We’ve had a lifetime of marijuana control, and it didn’t work. We suffered under crypto controls, and they didn’t work. Assholes who want a gun will likely to be able to get a gun whatever regime we put in place. There’s some truth to the claim that if guns are outlawed, only outlaws will have guns. Maybe we’d gain some ability to catch these nuts early, but maybe not. Those who say that easy availability of guns drives murder rates must do better than simply cherry picking data. What makes the US worse than Switzerland or Israel?

Yesterday, the President outlined a set of proposals including expanded background checks, and signed executive actions including one to “encourage federal agencies and state governments to share more information.” And now I find it hard to speak, and hard to remain silent.

Infringing privacy would not have stopped the events at Sandy Hook, and I worry that reducing privacy around mental health care is going to deter people who need health care from getting it. That may mean that more people will end up hurt or dead. I’m confident that no one wants that, and we need to rationally consider the tradeoff.

I also see a lot of people who are worried about gun control being so strident that they’re undercutting their own case. I agree that gun control is a poor response, and I think the NRA are coming off like a bunch of idiots. I’m trying not to be strident, just add a voice to say that even from a position of grief, it’s possible to see that what’s proposed probably will not meet the goals.

I don’t know what we should do. I do think that taking the entire TSA budget and moving it to mental health care would be a fine start.

Another fine way to proceed would be to threat model and try to judge the efficacy of the mitigation techniques. (For those who don’t know me, I spent a few years designing threat modeling tools and techniques which you can read about here.) Perhaps that starts from data on how people who use guns to hurt themselves or others get them. There’s an easy trope of “buys a gun and shoots someone.” Is that because it’s common, or because the stories are highly “available” and spring to mind? I don’t know, and in that vein, more studies of gun ownership and gun violence are probably going to help. Whatever approach to threat modeling we take should also include the hundreds of millions of guns owned by hundreds of millions of people and not misused.

We can and should do better than bringing back ideas that didn’t pass muster in calmer times. We should be cautious about trading a little liberty for a little safety. And whatever we do, we should do so respectful of the victims.

Comments are closed.

Test post

Over the summer, Adam and I were talking and I said that I’d like a place to do some personal blogging as opposed to things I normally do, which are targeted at one place or another.

I’d like to be able to blither about security, but also about whatever. Photography, cooking, you know, things that most people who blog blog about.

We set this up and I have finally gotten around to making a test post.

So thank you, Adam and the rest of the jazz combo. I’m Jon Callas, and I’m on bari sax and english horn.

An Argument Against Jargon

Lately I’ve been savoring Kahneman’s “Thinking, Fast and Slow”. Kahneman is one of the originators of behavioral economics and a Nobel prize winner. The book is tremendously thought provoking, insanely well written, jargon-minimizing, and just comes together beautifully. It’s a book where you struggle with the ideas and their implications, rather than struggle through the prose to get to the ideas.

One of the little things that made me squee with delight was where he said:

Why call them System 1 and System 2 rather than the more descriptive “automatic system” and “effortful system”? The reason is simple: “Automatic system” takes longer to say than “System 1” and therefore takes more space in your working memory. This matters, because anything that occupies your working memory reduces your ability to think.

I am totally dropping that on the next person who uses “novel” where they mean “new”. (And yes, you can make the argument that novel means “not really new but not publishied in some peer-reviewed place, and you can take that argument, fold it until it’s all nice and sharp, and then store it as appropriate.)

Edited Twitter Weekly Updates for 2012-06-10

  • RT @hellNbak_ @adamshostack @derekcslater anything with Scott Blake has to be worth reading. #
  • RT @Beaker Updated BYOD security profile/policy pushed to my iPhone this morning. String passwords on phone unlock (really?) = PiTA. #
  • Bad password policies give no benefit while absorbing your people's willingness to help with security. #Fail (cc @beaker) #
  • RT @moxie If LinkedIn hasn't confirmed the breach, they havent fixed it either. You can change your PW, but attackers can just get it again #
  • RT @aloria Another password breach, another round of "how to create strong passwords" lectures. THEY'LL TOTALLY LISTEN THIS TIME! #adorable #
  • MT @jeremiahg Instincts telling me these incidents are connected. Wondering if all 3 using the same DEV framework. << or same PR checklist? #
  • I'll bet we see 10-20 announcements of password breaches hoping to be in the LinkedIn PR shadow. Reminds me a bit of Heartland/inauguration #
  • RT @451wendy @securityninja That would be fantastic. We need more security card games besides Elevation of Privilege. #
  • RT @MSFTnews To track or not to track? Not just a question, a choice for consumers and industry http://t.co/906dY7D4 #
  • RT @philvenables More new school thinking from the Feynman archives. Listen to this while thinking of InfoSec. http://t.co/SiFpDkxT #

Powered by Twitter Tools

Edited Twitter Weekly Updates for 2012-06-03

Powered by Twitter Tools

Twitter Weekly Updates for 2012-05-20

  • RT @votescannell Mother of 3 Arrested for Taking Pictures of Tourist Attraction at Airport http://t.co/Id8TKH9r // I feel safer already. #
  • Freedom gropes for all @seatac! /cc @tsastatus. #
  • RT @ashk4n WiFi Pineapple lets anyone with $90 to "compromise the sh*t out of anyone using WiFi in the area" http://t.co/TnR3n56k #armsrace #
  • Great question for @beaker: why has innovation in sanitation exceeded innovation in security? #
  • RT @DanaEpp In DC @ the security dev conference. Missing you both. Adam, I taught some people EoP at the reception tonight ;-) << cool! #
  • RT @jeremiahg it really is stunning how silly infosec's historical list of "best-practices" look when contrasted with data. #
  • RT @JohnLaTwC Nice job @adamshostack for your work on the Autorun update. Dropping infections by 60+% #
  • RT @jeremiahg RT @adamshostack: @jeremiahg Is that clueless, or cynical that the assessments are assessing the right things? < C) Both #
  • For those at AusCERT, quick pointer to additional Star Wars & Information security content: http://t.co/yfY6F9nl #

Powered by Twitter Tools

Twitter Weekly Updates for 2012-05-13

  • RT @Ellen_CK It appears that putting a contest in one's internal newsletter leads to people actually reading it #SEingmycoworkers #
  • RT @bfist I like my risk like I like my steak << with blue cheese sauce? #
  • RT @451wendy "Q: How many of the Fortune 500 are hacked right now? A: 500." http://t.co/I090fJmp <- Lovely example of FUD << "lovely"? #
  • .@451wendy @dakami @attritionorg agree with Dan, we need data; Wendy this is testable Can I have a side helping of confirmation bias? :) #
  • RT @Privacymatters Just updated iOS. More T&Cs include Apple WILL make public a basic profile which I can switch off afterwards #privacyfail #
  • RT @shawnmoyer Defenders: I'm the track chair for the defensive track (yes, there is one) for @BlackHatHQ. We need submissions! #
  • Why does @wsdot not have any "special events" here http://t.co/f1gC6bNq when there's a Mariner's game tonight? #
  • Spending time prepping my AusCERT talk. All that energy watching Star Wars for good examples, it's rough. #
  • New blog: "What Kip Hawley of the TSA Doesn't Understand about Terrorism" http://t.co/IR9yQqvc #
  • RT @AlecMuffett "#Cybersecurity: Demand An Evidence-Based Approach" ( http://t.co/FdyjBU6Q at Computerworld ) http://t.co/8kaIACsl #
  • MT @resnikoff Eagerly awaiting president's evolution on drone strikes, surveillance, drug war, mass imprisonment, secrecy, deportation, etc #
  • RT @aionescu Seriously? Flashing firmware with crap was a "revelation" & "life changing experience" for Dell & HP CEO? http://t.co/vVnEyVDE #
  • .@aionescu The trouble with classified briefings is they exclude skeptics & prevent discussion. #
  • We seem to be made to suffer. It's our lot in life. #
  • Look sir! Droids! #
  • What I really need is a droid that understands the binary language of power converters. #
  • He suggests that if you remove the restraining bolt, he might be able to play back the entire message. #
  • RT @normative U.S. Military Taught Officers: Use ‘Hiroshima’ Tactics for ‘Total War’ on Islam http://t.co/RtjOejEZ << Holy fuck #
  • RT @geekwire Ready Indian food fans? A Vij’s offshoot is coming to ‘Amazonland’ with help from Paul Allen http://t.co/m831HujI << woot! #
  • Just cast my ballot for an open-access set of candidates for the ACM. Thanks to Brighten Godfrey for data: http://t.co/6fNq9qsD #
  • RT @BlackHatHQ Reminder: #BlackHat USA 2012 Call for Papers closes in 4 days on May 15. Time to deliver submissions http://t.co/2GAOdrTg #
  • RT @ericlaw: @jeremiahg: So if I see ".secure" in the URL, I'm good to go right? :-P << Nah, you also have to look for the lock. #
  • RT @jeremiahg a "lock," how quaint. .secure needs an ominous icon. Like a bigass vault door w/ electric razor …<< TSA's blogger bob? #
  • We should start by understanding mental models, testing what people can learn, then decide how to secure it. #
  • If we spend a dollar educating everyone online about a new security measure, that's $2B. Seems worth a lot of up-front design. #
  • Quick blog on "Why Sharing Raw Data is Important" http://t.co/fFjpWD0Z cc @hrbrmstr #
  • Where do I find the Youtube-nocookie link? Wasn't it under embed, options? #

Powered by Twitter Tools

Twitter Weekly Updates for 2012-05-06

  • RT @netik You program in Rails? Check out Brakeman from our security team & make your code safer. http://t.co/nFPQ3cxx (go @presidentbeef!) #
  • RT @KimZetter Equipment Maker Caught Installing Backdoor Vows to Fix After Public Pressure – http://t.co/EZfe7s27 #
  • Pro tip: "Blackhat talks get lots of publicity" is not a reason *your* submission will make a great BH talk" #
  • RT @mattblaze "It is a rare foray by Facebook into social engineering…" http://t.co/cIEdwHMk << Not rare at all; eg privacy, timeline. #
  • . @mattblaze maybe they meant it was rare for Facebook's social engineering to be for the public good? #
  • RT @jeremiahg #sansappsec panelist from ADP says the Elevation of Priviledge card game has proved remarkably engaging w/ DEVs & found bugs #
  • RT @Wh1t3Rabbit Just recorded another episode of Down the Rabbithole, this one with @adamshostack on "New School Security" – what a blast. #
  • RT @bccla: Cuts 2 CSIS watchdog actually close the office completely; no more oversight 4 Canada's spy agency: http://t.co/4sXu7bwA #cdnpoli #
  • RT @jatiki Anyone got source for a printed version of EOP card game http://t.co/2uFyX1Jp? My printer will not do less than 108 sets #
  • Added some rough costs to "Please Kickstarter Elevation of Privilege" http://t.co/2ByDWe59 #
  • RT @BlackHatHQ First round of #BlackHat speaker selections has been released! http://t.co/sjs6ZFhg #
  • RT @tqbf We are in year ~32 of "security managed by folks who think strategically, don't break things". How's that going for us? #
  • Call me when he's done something dastardly, like painted the space needle orange, or stolen a bridge. http://t.co/VaaUgLKK (h/t @normative) #
  • RT @jayjacobs We've started a new blog series called "Ask the Data", first post is on Log Analysis: http://t.co/wxQaFsYX << yay, data! #
  • RT @rsingel The story behind the feds seizing a hip-hop site at RIAA behest for a year http://t.co/so3Xz0lM << Very sad abuse of power #
  • New blog: "More than 90% of Americans Take Action on Privacy" http://t.co/WpM8yuiD #
  • May the fourth be with you! I'm spending Star Wars Day on my AusCert talk, "This Technological Terror: Security Lessons from Lord Vader" #
  • New blog: More than 90% of Americans take action on privacy http://t.co/WpM8yuiD #
  • We have a hard enough time writing secure code without needing to code in back doors. http://t.co/8tXoVs73 #
  • Listening to Rhythms Del Mundo cover Bohemian Rhapsody in Spanish and wondering why language classes don't use more music. #
  • RT @dakami http://t.co/lhZWimT9 Everyone's been hacked. Now what? << Now we talk about it, learn from each others mistakes (cc @KimZetter) #
  • RT @dakami there is evidence that we're not wired to trust evidence. << Yeah, but I don't trust it. (Sorry, couldn't resist. :) #
  • RT @csoghoian Facebook ad revenue by region. The company violates American users' privacy for just $9.51/ year. Sad https://t.co/0Xxj59ts #

Powered by Twitter Tools