:: extra ::

I watched Hacking Democracy on HBO tonight. The show is about the potential pitfalls and perils of electronic voting. I'm left wondering if every topic must undergo Geraldo-ization in order to be make it in to the mainstream. The activists come off looking like vigilantes, and the corporate suits look so slick that you're left thinking they must be criminals. I'm not buying it. I blogged on voting last week, but watching this show got me thinking about the right way to boil down the problem. This might not make for good TV, but here goes:

For democracy to work, we have to count votes in a transparent way.

That's no mean feat from a technical perspective, but I think the biggest problem is that people mistake the relative tranquility of their lives as a signal that our election system really is functioning properly. If there's a way to game the system, sooner or later the system will be gamed. We don't need to look beyond our own history to see that.

There was a good article on ChoicePoint in this Sunday's NYT: link.

The best part is a timeline that depicts large data loss reports beginning with ChoicePoint. It includes the number of people notified and the cause of the loss (lost or stolen equipment, hacking, or "other"). Link

Here's what I took away: companies are losing a lot of data for a lot of reasons. The ChoicePoint episode was not at all unusual: sloppy controls on granting access to data. Lots of other incidents are equally mundane: backup tapes fall off the truck, the FedEx envelope never arrives. The good news is that these are the kinds of operational problems that have relatively straightforward solutions. The bad news is that the biggest single cause of data loss appears to be the hackers.

I'm this week's victim on the Silver Bullet Security Podcast. Woo hoo! Gary McGraw and I talk about the nature of software security and the origin of the Silver Bullet. Big fun.

I'm a JavaOne Rock Star! It looks like I'm on a roll this week. Maybe this means I'll be on a t-shirt someday? Speculation aside, it means my 2006 JavaOne talk, "Twelve Java Security Traps and How to Avoid Them" is online. Link