Bruce Schneier | |||||||||||
Schneier on SecurityA blog covering security and security technology. « NSA Helps Microsoft with Windows Vista | Main | Surveillance Cameras Catch a Cold-Blooded Killer » January 10, 2007MI5 Terror Alerts by E-mailSounds like security theater to me: But he added that one of the difficult questions was what people should do about the information when they receive it: "There's not necessarily that much information on the website about how you should act and how you should respond other than being vigilant and calling a hotline if you see anything suspicious." I've written about terror threat alerts in the UK before. EDITED TO ADD (1/15): System is in shambles and being overhauled: Digital detective work by campaigners revealed that the alerting system did little to protect the identities of anyone signing up. Posted on January 10, 2007 at 6:31 AM • 28 Comments To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter. Ben Smyth • January 10, 2007 6:54 AM I wonder how long it will be before someone sends a spoofed email claiming that the country is at the highest level of alert... Panic buying would commence. I wonder if a leading supermarket chain would create such an email to clear their shelves. Rich • January 10, 2007 7:25 AM Spoofing? I did a trial subscription usnig pookmail. Want to see what happens first. The subscription confirmation came from yoho-common.wc09.net which is owned by: because they're using www.whatcounts.com to manage their mailing list. Just how many ways is this a bad idea? Rich So when all the terrorists will be subscribing to these terrorist alert emails ... will they strike then the terrorist threat is at high or at low? Somehow I think there will be the green ever "go out and enjoy your life". Chris • January 10, 2007 7:36 AM "including speeches made by the director general and links to relevant websites." That's a brilliant idea, seeing as how we can all see how accurate the DG's speeches are!! Chris R • January 10, 2007 7:47 AM Take a look at SpyBlog's analysis of how they manage the mailing list: bac • January 10, 2007 8:04 AM Off topic but hopefully helpful. Just for those who have not discovered a good way to post long urls in post here is TinyUrl I do not work for TinyUrl, just think it helps post look neater and organized. vwm • January 10, 2007 8:57 AM @ben: The current level is "Severe" meaning "an attack is highly likely". The next (and also the highest) level is "Critical" meaning "an attack is expected imminently". If it gets that far, you might want to avoid crowded places like supermarkets. So if you want to fill up your stock in a panic, the right moment would be now... Fin • January 10, 2007 9:06 AM Bac, tinyurl is not for the paranoid. It is not readily apparent where you'll end up when clicking the link and the target may not be 'work safe'. That said I use it quite a bit and they have a preview feature on thier site. regards, Fin Carlo Graziani • January 10, 2007 9:12 AM Best terror alert system ever: http://www.geekandproud.net/terror/ Today we are at Ernie for all commercial flights, and at Bert for everything else. @Fin so use http://preview.tinyurl.com/ , or add the 'preview.' before any tinyurls you come across. At the least, you can preview the actual link. Your NSFW comment applies to *any* link - do you trust the word of someone random on a public message board about whether their long link is SFW? Steve • January 10, 2007 9:33 AM Anyone who actually believes in the MI5 threat level probably deserves whatever they get in terms of spoof email alerts. The Home Secretary, John Reid, stated in December that an attempted terrorist attack in the UK over Christmas was "highly likely": http://www.google.com/search?... Since there wasn't one, I think Bayes' Theorem tells us that it is "highly likely" that Reid, and hence also MI5, either don't know what they're talking about, or else were lying. Rainer Ots • January 10, 2007 11:14 AM All those terror alert levels etc. remind me of a mother trying to get her child to bed/school/etc. Paul • January 10, 2007 11:34 AM Do they increase the terror alert level before the director makes a speech? I can see how that might be useful. Everything else, bleh. another_bruce • January 10, 2007 11:42 AM surely a vista machine running nsa code can stop an mi5-spoof email. coming soon to your box: spy versus spy! gfujimori • January 10, 2007 12:28 PM There's got to be some sort of math formula here... It would have to include something about stupidity approaching infinity and multiplied by FUD equals waste times hysteria, so that hysteria becomes infinite given a limit on waste. I need to spend some time working this out - the proof alone could be great. Many office workers in NYC were hysterical about the stink the other day. People are no longer just afraid of being blown up - they're now afraid of being "stunk to death." This is how far it's come: a sad state of affairs indeed. Roy • January 10, 2007 1:36 PM Presumably, when the 'Terrist' color code went to red, the system would flood the internet with identical messages bound for all IP address in the UK. Hopefully, antispam software would intercept all of these and scram the spam. Still, it would cause a general DoS, would it not? Tim • January 10, 2007 2:00 PM Why on earth *email*? What's wrong with RSS, apart from the fact it's already been done by someone else? Davi Ottenheimer • January 10, 2007 6:20 PM "...not necessarily that much information on the website about how you should act and how you should respond..." Therein lies the real issue. MI5 should be trying to answer the "difficult question" of what to do with information about threats, and resist the easy path of spreading FUD. Dave Walker • January 11, 2007 4:45 AM While this may well be security theatre from the perspective of "being seen to be doing something", it does give MI5 a database of the email addresses of the folk who are most paranoid about terror alerts. I have no idea how useful such a thing might be, but.. Felix Dzerzhinsky • January 11, 2007 8:54 AM MI5 e-mail alert signup shambles - all email subscription web forms sent to the USA, without encryption See Spyblog: http://p10.hostingprod.com/@spyblog.org.uk/blog/...
derf • January 11, 2007 9:40 AM Considering the overwhelmingly humongous number of terrorist attacks we've had in the US since 9/11/01, this one seems to work: SARAH • May 21, 2007 5:04 PM MY NAME IS SARAH , I EXPORT TRUCKS ALL OVER THE WORLD,, i do get alot of those check from nigeria you all now that scam, i just throw them away
Post a comment
Powered by Movable Type. Photo at top by Geoffrey Stone.
Schneier.com is a personal website. Opinions expressed are not necessarily those of BT. |
|
Comments