Blog - GovAffairs

Computing Research Policy Blog

White House Responds to UCS Complaint About US Science Policy

April 9, 2004/In: Policy /by Peter Harsha

The White House last Friday released its response to a report by the Union of Concerned Scientists that claims

the administration is distorting and censoring scientific findings that contradict its policies; manipulating the underlying science to align results with predetermined political decisions; and undermining the independence of science advisory panels by subjecting panel nominees to political litmus tests that have little or no bearing on their expertise; nominating non-experts or underqualified individuals from outside the scientific mainstream or with industry ties; as well as disbanding science advisory committees altogether.

The administration response, authored by the Director of the White House Office of Science and Technology Policy, John Marburger, is a 20 page, point-by-point rebuttal. The gist:

In this Administration, science strongly informs policy. It is important to remember, however, that even when the science is clear and often it is not it is but one input into the policy process.

IEEE Gets Favorable OFAC Ruling, Publications Activities No Longer Restricted

April 5, 2004/In: Policy /by Peter Harsha

Ed Felten’s Freedom to Tinker has a bit on the recent Treasury Department ruling in favor of IEEE regarding U.S. restrictions in place against copy-editing and publishing scientific papers whose authors come from countries under US trade embargoes. IEEE had been working the issue with the Treasury Department’s Office of Foreign Assets Control for about a year before receiving the favorable ruling. IEEE had stopped providing some services to its members in embargoed countries while it sought exemption from the trade rules. The Treasury Department’s decision means IEEE can resume peer-reviewing, editing, and publishing scholarly works from its members in embargoed countries such as Iran and Cuba.
Here’s the press release (pdf, 56kb) from IEEE.

CRA, USACM Urge Support for NIST Labs

April 5, 2004/In: Funding /by Peter Harsha

In response to the dire funding situation for the National Institute of Standards and Technology (NIST) Labs program in FY 2004 and beyond, CRA and US ACM’s Public Policy Committee have joined in a letter to leaders in Congress calling for increased support in the FY 2005 appropriations process.
Among the labs most likely impacted by the cuts — cuts enacted as part of the FY 2004 Omnibus Appropriations bill passed in January — is NIST’s Computer Security Division, which has played a historic role in computer security by conducting security research on emerging technologies, promoting security assessment techniques, providing security management and guidance, and facilitating a greater awareness of the need for security.
The extended entry below has the full letter, or you can download a PDF version here (335k).

GrepLaw Interview With Spaf

April 5, 2004/In: People /by Peter Harsha

GrepLaw, run by the Berkman Center for Internet and Society at Harvard, has an interview with CRA board member Gene Spafford (“Spaf”), on what it’s like to testify before Congress, the current spate of virus and worm attacks, his favorite operating systems, and his suggested reading list for “geeky legal types who want to become involved in the prevention, investigation, or prosecution of computer-related crimes.”

CRA Analysis of Computing Research in the FY 2005 Budget Request

March 31, 2004/In: Funding /by Peter Harsha

As part of the American Association for the Advancement of Science (AAAS) annual review of R&D in the President’s Budget Request, CRA provides an analysis of computing research in the request. This is essentially a look at the current status of the Networking and Information Technology Research and Development initiative — the government-wide program that encompasses all federal IT R&D activities. In short, the President’s request would keep things pretty steady-state. A slight decline in overall funding — made up of slight increases at some agencies, and slight declines in other. But the overall funding requested still falls well short of the amount recommended by the President’s Information Technology Advisory Committee (PITAC) when they did their last comprehensive review of federal IT R&D funding back in 1999.
Here are the highlights from the report:

Highlights

Networking and Information Technology Research and Development (NITRD) funding would fall 0.7 percent in FY 2005 to $2.00 billion across eleven federal agencies, under the Presidents budget request.

The President’s request would increase funding for computing research at the National Science Foundation (NSF), the lead agency in the NITRD initiative, to $761 million in FY 2005, an increase of 0.9 percent.

Concerns about interagency coordination of large-scale “cyberinfrastructure” investments in FY 2005 will likely lead to greater congressional oversight of NITRD programs in 2004.

Read on to get the full scoop…

Another Data Point in the P2P Debate

March 30, 2004/In: Research /by Peter Harsha

Researchers from Harvard Business School and the University of North Carolina released a study today that suggests that illegal downloading of songs via P2P networks is not having a significant effect on legitimate music sales and in many cases may help album sales. The Washington Post has the story.
A few choice paragraphs:

Songs that were heavily downloaded showed no measurable drop in sales, the researchers found after tracking sales of 680 albums over the course of 17 weeks in the second half of 2002. Matching that data with activity on the OpenNap file-sharing network, they concluded that file sharing actually increases CD sales for hot albums that sell more than 600,000 copies. For every 150 downloads of a song from those albums, sales increase by a copy, the researchers found.
“Consumption of music increases dramatically with the introduction of file sharing, but not everybody who likes to listen to music was a music customer before, so it’s very important to separate the two,” said Felix Oberholzer-Gee, an associate professor at Harvard Business School and one of the authors of the study.
Oberholzer-Gee and his colleague, University of North Carolina’s Koleman Strumpf, also said that their “most pessimistic” statistical model showed that illegal file sharing would have accounted for only 2 million fewer compact discs sales in 2002, whereas CD sales declined by 139 million units between 2000 and 2002.
“From a statistical point of view, what this means is that there is no effect between downloading and sales,” said Oberholzer-Gee.

Senate Bill Would Allow DOJ to Target Filesharers

March 26, 2004/In: Policy /by Peter Harsha

Tech Daily (sub. req’d) reports on a Senate bill introduced yesterday by Sen. Patrick Leahy (D-VT) that would allow the Justice Department to file civil lawsuits and bring criminal charges against song-swappers using peer-to-peer networks. Complaints from content providers about the relatively few numbers of criminal prosecutions for file trading apparently led Leahy to introduce the bill (S. 2237 — should be available online shortly). Currently, the government has to prove that song traders demonstrate “willful conduct” to bring criminal charges. Leahy’s bill apparently lowers that threshold. Judiciary Chairman Orrin Hatch is a co-sponsor. RIAA and MPAA are on board:

“This legislation provides federal prosecutors with the flexibility and discretion to bring copyright-infringement cases that best correspond to the nature of the crime,” said Mitch Bainwol, CEO of the Recording Industry Association of America.
“I commend Senators Patrick Leahy and Orrin Hatch for their vision and leadership in combating the theft of America’s creative works,” said Jack Valenti, CEO of the Motion Picture Association of America.

More info as it becomes available….

Bush Announces Broadband Policy

March 26, 2004/In: Policy /by Peter Harsha

Speaking in New Mexico today, President Bush announced his support for rolling out universal broadband service within three years. From Reuters:

“We ought to have universal, affordable access to broadband technology by the year 2007,” Bush said. “And then we ought to make sure as soon as possible thereafter consumers have plenty of choices.”
“It’s important that we stay on the cutting edge of technological change, and one way to do so is to have a bold plan for broadband,” he said. Bush did not elaborate on how he would accomplish the 2007 goal.

In addition, Bush urged that broadband access be tax free. It looks like the issue, long dormant for this White House in particular, may become a campaign issue:

Minutes after the president spoke, Democratic presidential contender John Kerry mentioned broadband as a key growth area during a campaign speech laying out his economic policy.

The scorecard for IT campaign issues so far then: IT offshoring (to protect or not to protect); Universal Broadband (how to roll it out, who should pay); maybe soon IT R&D? 🙂

The Spread of the Witty Worm

March 26, 2004/In: Research /by Peter Harsha

The folks at UCSD Computer Science and Engineering and the Cooperative Association for Internet Data Analysis (CAIDA) put their “Network Telescope” to good work in analyzing the spread of the Witty Worm. From their analysis:

Witty was the first widely propagated Internet worm to carry a destructive payload.
Witty was started in an organized manner with an order of magnitude more ground-zero hosts than any previous worm.
Witty represents the shortest known interval between vulnerability disclosure and worm release — it began to spread the day after the ISS vulnerability was publicized.
Witty spread through a host population in which every compromised host was doing something proactive to secure their computers and networks.
Witty spread through a population almost an order of magnitude smaller than that of previous worms, demonstrating the viability of worms as an automated mechanism to rapidly compromise machines on the Internet, even in niches without a software monopoly.

The conclusion is ominous:

Witty demonstrated that any minimally deployed piece of software with a remotely exploitable bug can be a vector for wide-scale compromise of host machines without any action on the part of a victim. The practical implications of this are staggering; with minimal skill, a malevolent individual could break into thousands of machines and use them for almost any purpose with little evidence of the perpetrator left on most of the compromised hosts.

And finally:

The patch model for Internet security has failed spectacularly. To remedy this, there have been a number of suggestions for ways to try to shoehorn end users into becoming security experts, including making them financially liable for the consequences of their computers being hijacked by malware or miscreants. Notwithstanding the fundamental inequities involved in encouraging people sign on to the Internet with a single click, and then requiring them to fix flaws in software marketed to them as secure with technical skills they do not possess, many users do choose to protect themselves at their own expense by purchasing antivirus and firewall software. Making this choice is the gold-standard for end user behavior — they recognize both that security is important and that they do not possess the skills necessary to effect it themselves. When users participating in the best security practice that can be reasonably expected get infected with a virulent and damaging worm, we need to reconsider the notion that end user behavior can solve or even effectively mitigate the malicious software problem and turn our attention toward both preventing software vulnerabilities in the first place and developing large-scale, robust and reliable infrastructure that can mitigate current security problems without relying on end user intervention.

Interesting stuff…