The roar of the reporters had been deafening and Barbara had gotten the first question in. “Mr. Governor, with all due respect: we have incontrovertible video evidence that Marcus Yallow, a citizen of this state, native-born, was subjected to a simulated execution by DHS officers, apparently acting on orders from the White House. Is the State really willing to abandon any pretense of justice for its citizens in the face of illegal, barbaric torture?” Her voice trembled, but didn’t crack.
The Governor spread his hands. “The military tribunals will accomplish justice. If Mr. Yallow—or any other person who has cause to fault the Department of Homeland Security—wants further justice, he is, of course, entitled to sue for such damages as may be owing to him from the federal government.”
That’s what I was doing. Over twenty thousand civil lawsuits were filed against the DHS in the week after the Governor’s announcement. Mine was being handled by the ACLU, and they’d filed motions to get at the results of the closed military tribunals. So far, the courts were pretty sympathetic to this.
But I hadn’t expected this.
“She got off totally scot-free?”
“The press release doesn’t say much. ‘After a thorough examination of the events in San Francisco and in the special antiterror detention center on Treasure Island, it is the finding of this tribunal that Ms. Johnstone’s actions do not warrant further discipline.’ There’s that word, ‘further’—like they’ve already punished her.”
I snorted. I’d dreamed of Carrie Johnstone nearly every night since I was released from Gitmo-by-the-Bay. I’d seen her face looming over mine, that little snarly smile as she told the man to give me a “drink.”
“Marcus—” Barbara said, but I cut her off.
“It’s fine. It’s fine. I’m going to do a video about this. Get it out over the weekend. Mondays are big days for viral video. Everyone’ll be coming back from the holiday weekend, looking for something funny to forward around school or the office.”
I saw a shrink twice a week as part of my deal at the halfway house. Once I’d gotten over seeing that as some kind of punishment, it had been good. He’d helped me focus on doing constructive things when I was upset, instead of letting it eat me up. The videos helped.
“I have to go,” I said, swallowing hard to keep the emotion out of my voice.
“Take care of yourself, Marcus,” Barbara said.
Ange hugged me from behind as I hung up the phone. “I just read about it online,” she said. She read a million newsfeeds, pulling them with a headline reader that sucked up stories as fast as they ended up on the wire. She was our official blogger, and she was good at it, snipping out the interesting stories and throwing them online like a short-order cook turning around breakfast orders.
I turned around in her arms so that I was hugging her from in front. Truth be told, we hadn’t gotten a lot of work done that day. I wasn’t allowed to be out of the halfway house after dinner time, and she couldn’t visit me there. We saw each other around the office, but there were usually a lot of other people around, which kind of put a crimp in our cuddling. Being alone in the office for a day was too much temptation. It was hot and sultry, too, which meant we were both in tank tops and shorts, a lot of skin-to-skin contact as we worked next to each other.
“I’m going to make a video,” I said. “I want to release it today.”
“Good,” she said. “Let’s do it.”
Ange read the press release. I did a little monologue, synched over that famous footage of me on the waterboard, eyes wild in the harsh light of the camera, tears streaming down my face, hair matted and flecked with barf.
“This is me. I am on a waterboard. I am being tortured in a simulated execution. The torture is supervised by a woman called Carrie Johnstone. She works for the government. You might remember her from this video.”
I cut in the video of Johnstone and Kurt Rooney. “That’s Johnstone and Secretary of State Kurt Rooney, the President’s chief strategist.”
“The nation does not love that city. As far as they’re concerned, it is a Sodom and Gomorrah of fags and atheists who deserve to rot in hell. The only reason the country cares what they think in San Francisco is that they had the good fortune to have been blown to hell by some Islamic terrorists.”
“He’s talking about the city where I live. At last count, four thousand two hundred fifteen of my neighbors were killed on the day he’s talking about. But some of them may not have been killed. Some of them disappeared into the same prison where I was tortured. Some mothers and fathers, children and lovers, brothers and sisters will never see their loved ones again—because they were secretly imprisoned in an illegal jail right here in the San Francisco Bay. They were shipped overseas. The records were meticulous, but Carrie Johnstone has the encryption keys.” I cut back to Carrie Johnstone, the footage of her sitting at the board table with Rooney, laughing.
I cut in the footage of Johnstone being arrested. “When they arrested her, I thought we’d get justice. All the people she broke and disappeared. But the President”—I cut to a still of him laughing and playing golf on one of his many holidays—“and chief strategist”—now a still of Rooney shaking hands with an infamous terrorist leader who used to be on “our side”—“intervened. They sent her to a secret military tribunal and now that tribunal has cleared her. Somehow, they saw nothing wrong with all of this.”
I cut in a photomontage of the hundreds of shots of prisoners in their cells that Barbara had published on the Bay Guardian’s site the day we were released. “We elected these people. We pay their salaries. They’re supposed to be on our side. They’re supposed to defend our freedoms. But these people”—a series of shots of Johnstone and the others who’d been sent to the tribunal—“betrayed our trust. The election is four months away. That’s a lot of time. Enough for you to go out and find five of your neighbors—five people who’ve given up on voting because their choice is ‘none of the above.’
“Talk to your neighbors. Make them promise to vote. Make them promise to take the country back from the torturers and thugs. The people who laughed at my friends as they lay fresh in their graves at the bottom of the harbor. Make them promise to talk to their neighbors.
“Most of us choose none of the above. It’s not working. You have to choose—choose freedom.
“My name is Marcus Yallow. I was tortured by my country, but I still love it here. I’m seventeen years old. I want to grow up in a free country. I want to live in a free country.”
I faded out to the logo of the website. Ange had built it, with help from Jolu, who got us all the free hosting we could ever need on Pigspleen.
The office was an interesting place. Technically we were called Coalition of Voters for a Free America, but everyone called us the Xnetters. The organization—a charitable nonprofit—had been cofounded by Barbara and some of her lawyer friends right after the liberation of Treasure Island. The funding was kicked off by some tech millionaires who couldn’t believe that a bunch of hacker kids had kicked the DHS’s ass. Sometimes, they’d ask us to go down the peninsula to Sand Hill Road, where all the venture capitalists were, and give a little presentation on Xnet technology. There were about a zillion start-ups who were trying to make a buck on the Xnet.
Whatever—I didn’t have to have anything to do with it, and I got a desk and an office with a storefront, right there on Valencia Street, where we gave away ParanoidXbox CDs and held workshops on building better WiFi antennas. A surprising number of average people dropped in to make personal donations, both of hardware (you can run ParanoidLinux on just about anything, not just Xbox Universals) and cash money. They loved us.
The big plan was to launch our own ARG in September, just in time for the election, and to really tie it in with signing up voters and getting them to the polls. Only 42 percent of Americans showed up at the polls for the last election—nonvoters had a huge majority. I kept trying to get Darryl and Van to one of our planning sessions, but the
y kept on declining. They were spending a lot of time together, and Van insisted that it was totally nonromantic. Darryl wouldn’t talk to me much at all, though he sent me long emails about just about everything that wasn’t about Van or terrorism or prison.
Ange squeezed my hand. “God, I hate that woman,” she said.
I nodded. “Just one more rotten thing this country’s done to Iraq,” I said. “If they sent her to my town, I’d probably become a terrorist.”
“You did become a terrorist when they sent her to your town.”
“So I did,” I said.
“Are you going to Ms. Galvez’s hearing on Monday?”
“Totally.” I’d introduced Ange to Ms. Galvez a couple weeks before, when my old teacher invited me over for dinner. The teacher’s union had gotten a hearing for her before the board of the Unified School District to argue for getting her old job back. They said that Fred Benson was coming out of (early) retirement to testify against her. I was looking forward to seeing her again.
“Do you want to go get a burrito?”
“Totally.”
“Let me get my hot sauce,” she said.
I checked my email one more time—my PirateParty email, which still got a dribble of messages from old Xnetters who hadn’t found my Coalition of Voters address yet.
The latest message was from a throwaway email address from one of the new Brazilian anonymizers.
> Found her, thanks. You didn’t tell me she was so h4wt.
“Who’s that from?”
I laughed. “Zeb,” I said. “Remember Zeb? I gave him Masha’s email address. I figured, if they’re both underground, might as well introduce them to one another.”
“He thinks Masha is cute?”
“Give the guy a break, he’s clearly had his mind warped by circumstances.”
“And you?”
“Me?”
“Yeah—was your mind warped by circumstances?”
I held Ange out at arm’s length and looked her up and down and up and down. I held her cheeks and stared through her thick-framed glasses into her big, mischievous tilted eyes. I ran my fingers through her hair.
“Ange, I’ve never thought more clearly in my whole life.”
She kissed me then, and I kissed her back, and it was some time before we went out for that burrito.
Afterword
by Bruce Schneier
I’m a security technologist. My job is making people secure.
I think about security systems and how to break them. Then, how to make them more secure. Computer security systems. Surveillance systems. Airplane security systems and voting machines and RFID chips and everything else.
Cory invited me into the last few pages of his book because he wanted me to tell you that security is fun. It’s incredibly fun. It’s cat and mouse, who can outsmart whom, hunter versus hunted fun. I think it’s the most fun job you can possibly have. If you thought it was fun to read about Marcus outsmarting the gait-recognition cameras with rocks in his shoes, think of how much more fun it would be if you were the first person in the world to think of that.
Working in security means knowing a lot about technology. It might mean knowing about computers and networks, or cameras and how they work, or the chemistry of bomb detection. But really, security is a mindset. It’s a way of thinking. Marcus is a great example of that way of thinking. He’s always looking for ways a security system fails. I’ll bet he couldn’t walk into a store without figuring out a way to shoplift. Not that he’d do it—there’s a difference between knowing how to defeat a security system and actually defeating it—but he’d know he could.
It’s how security people think. We’re constantly looking at security systems and how to get around them; we can’t help it.
This kind of thinking is important no matter what side of security you’re on. If you’ve been hired to build a shoplift-proof store, you’d better know how to shoplift. If you’re designing a camera system that detects individual gaits, you’d better plan for people putting rocks in their shoes. Because if you don’t, you’re not going to design anything good.
So when you’re wandering through your day, take a moment to look at the security systems around you. Look at the cameras in the stores you shop at. (Do they prevent crime, or just move it next door?) See how a restaurant operates. (If you pay after you eat, why don’t more people just leave without paying?) Pay attention at airport security. (How could you get a weapon onto an airplane?) Watch what the teller does at a bank. (Bank security is designed to prevent tellers from stealing just as much as it is to prevent you from stealing.) Stare at an anthill. (Insects are all about security.) Read the Constitution, and notice all the ways it provides people with security against government. Look at traffic lights and door locks and all the security systems on television and in the movies. Figure out how they work, what threats they protect against and what threats they don’t, how they fail, and how they can be exploited.
Spend enough time doing this, and you’ll find yourself thinking differently about the world. You’ll start noticing that many of the security systems out there don’t actually do what they claim to, and that much of our national security is a waste of money. You’ll understand privacy as essential to security, not in opposition. You’ll stop worrying about things other people worry about, and start worrying about things other people don’t even think about.
Sometimes you’ll notice something about security that no one has ever thought about before. And maybe you’ll figure out a new way to break a security system.
It was only a few years ago that someone invented phishing.
I’m frequently amazed how easy it is to break some pretty big-name security systems. There are a lot of reasons for this, but the big one is that it’s impossible to prove that something is secure. All you can do is try to break it. If you fail, you know that it’s secure enough to keep you out, but what about someone who’s smarter than you? Anyone can design a security system so strong he himself can’t break it.
Think about that for a second, because it’s not obvious. No one is qualified to analyze their own security designs, because the designer and the analyzer will be the same person, with the same limits. Someone else has to analyze the security, because it has to be secure against things the designers didn’t think of.
This means that all of us have to analyze the security that other people design. And surprisingly often, one of us breaks it. Marcus’s exploits aren’t far-fetched; that kind of thing happens all the time. Go onto the net and look up “bump key” or “Bic pen Kryptonite lock” you’ll find a couple of really interesting stories about seemingly strong security defeated by pretty basic technology.
And when that happens, be sure to publish it on the Internet somewhere. Secrecy and security aren’t the same, even though it may seem that way. Only bad security relies on secrecy; good security works even if all the details of it are public.
And making vulnerabilities public forces security designers to design better security, and makes us all better consumers of security. If you buy a Kryptonite bike lock and it can be defeated with a Bic pen, you’re not getting very good security for your money. And, likewise, if a bunch of smart kids can defeat the DHS’s antiterrorist technologies, then it’s not going to do a very good job against real terrorists.
Trading privacy for security is stupid enough; not getting any actual security in the bargain is even more stupid.
So close the book and go. The world is full of security systems. Hack one of them.
Bruce Schneier
www.schneier.com
Afterword
by Andrew “bunnie” Huang, Xbox Hacker
Hackers are explorers, digital pioneers. It’s in a hacker’s nature to question conventions and be tempted by intricate problems. Any complex system is sport for a hacker; a side effect of this is the hacker’s natural affinity for problems involving security. Society is a large and complex system, and is certainly not off limits to
a little hacking. As a result, hackers are often stereotyped as iconoclasts and social misfits, people who defy social norms for the sake of defiance. When I hacked the Xbox in 2002 while at MIT, I wasn’t doing it to rebel or to cause harm; I was just following a natural impulse, the same impulse that leads to fixing a broken iPod or exploring the roofs and tunnels at MIT.
Unfortunately, the combination of not complying with social norms and knowing “threatening” things like how to read the arphid on your credit card or how to pick locks causes some people to fear hackers. However, the motivations of a hacker are typically as simple as “I’m an engineer because I like to design things.” People often ask me, “Why did you hack the Xbox security system?” And my answer is simple: First, I own the things that I buy. If someone can tell me what I can and can’t run on my hardware, then I don’t own it. Second, because it’s there. It’s a system of sufficient complexity to make good sport. It was a great diversion from the late nights working on my Ph.D.
I was lucky. The fact that I was a graduate student at MIT when I hacked the Xbox legitimized the activity in the eyes of the right people. However, the right to hack shouldn’t be extended to only academics. I got my start on hacking when I was just a boy in elementary school, taking apart every electronic appliance I could get my hands on, much to my parents’ chagrin. My reading collection included books on model rocketry, artillery, nuclear weaponry and explosives manufacture—books that I borrowed from my school library (I think the Cold War influenced the reading selection in public schools). I also played with my fair share of ad-hoc fireworks and roamed the open construction sites of houses being raised in my Midwestern neighborhood. While not the wisest of things to do, these were important experiences in my coming of age and I grew up to be a free thinker because of the social tolerance and trust of my community.