Last year I wrote a grab-bag post titled, Don’t Forget To Brush Your Fur, because I’m terrible at SEO or making content easily discoverable.

In the same vein as that previous example, this is going to be in the style of Lightning Round talks at technology conferences.

Why are we doing this again?

I maintain a running list of things to write about, and cross ideas off whenever I cover a topic.

After a few months of doing this, I realize most of what remains is kinda interesting but not quite interesting enough to warrant a dedicated entry.

It always needs more isogenies.
(Art by Lynx vs Jackalope)

Contents

• Asymmetric Key Wear-Out
  
  • ECDSA Key Wear-Out
  • RSA Key Wear-Out

  
  

• HMAC Wear-Out?
• Asymmetric Commitments
• Against “Fluffies”
  
  • Divide and Conquer
  • Pre-Existing Terminology

  
  

• A Meditation on Furries and Cringe
• Furries and Blue State Privilege

Asymmetric Key Wear-Out

Last year, I wrote about cryptographic wear-out for symmetric encryption. That post has attracted quite a bit of feedback from folks requesting comparisons against other block cipher modes, etc. One topic that I didn’t see requested much, but is equally interesting, is how this reasoning can be applied to asymmetric cryptography (if at all).

Let’s get one thing clear: Cryptography keys don’t “wear out” in the same sense as a physical key might. What we’re talking about is an ever-increasing risk of a collision occurring in random nonces.

ECDSA Key Wear-Out

ECDSA signatures involve a one-time secret, k. The scalar multiplication of k and the base point for the curve is encoded as half of the signature (r), while its modular inverse is multiplied by the sum of the truncated message hash and the product of r and the secret key to produce the other half of the signature (s).

If your selection of k is biased, or k is ever reused for two different messages, you can leak the secret key.

Strictly speaking, for any given ECDSA curve, there is only one k value that corresponds to a given r for all users (n.b it’s not distinct per keypair).

This means that all users of e.g. ECDSA over NIST P-256 have to worry about a shared cryptographic wear-out: After 2^112 signatures, there is a 2^-32 chance of a single collision occurring.

Fortunately, the search space of possible k-values is enormous, and this will not impose a real-world operational risk in the near future. If you’re worried about multi-user attacks, P-384 gives you a wear-out threshold of 2^176 messages, which we’re probably never going to achieve.

RSA Key Wear-Out

In order to calculate the wear-out for an RSA message, you first have to begin with an attack model. Previously, we were looking at algorithms that would become brittle if a nonce was reused.

RSA doesn’t have nonces. You can’t attack RSA this way.

But let’s assume that such an attack did exist. What might the safety limit look like? There are two remaining possible considerations for RSA’s security against cryptographic wear-out: Key size and padding mode.

RSA private keys are two prime numbers (p, q). RSA public keys are the product of the two primes (n) and a public exponent (e) that must be coprime to (p-1)(q-1). (In practice, e is usually set to 3, 65537, or some other small prime.)

The security of RSA is subexponential to key size, based on the difficulty of integer factoring attacks and the requirement for p and q to be prime numbers.

This primeness restriction doesn’t apply to your message. The padding mode dictates your upper limit on message size; e.g., PKCS#1 v1.5 padding will take up at least 3 bytes:

• For encryption, x = 0x00 || 0x02 || r || 0x00 || m, where r is random padding bytes (minimum 8 bytes).
• For signatures, x = 0x00 || 0x01 || 0xFF..FF || 0x00 || m.
• In either case, the padding is always at least 11 bytes long.

So if you have 2048-bit RSA keys, you can encrypt or sign up to 245 bytes (1960 bits) with PKCS#1 v1.5 padding. This corresponds to a safety limit of 2^974 messages.

(Art by Lynx vs Jackalope)

HMAC Wear-Out?

To keep things simple, the security of HMAC can be reduced to the collision risk of the underlying hash function.

If you’re trying to estimate when to rotate symmetric keys used for HMAC, take the birthday bound of the underlying hash function as your starting point.

• For SHA-256, you have a 50% chance of a collision after 2^128 messages. For a 2^-32 chance, you can get 2^112 messages out of a single key.
• For SHA-384, this is 2^176 messages.
• For SHA-512, this is 2^240 messages.

In either case, however, these numbers might as well be infinity.

With apologies to Filippo Valsorda.

Asymmetric Commitments

Did you know that fast MACs such as GHASH and Poly1305 aren’t random-key robust? This property can matter in surprising ways.

Did you know that ECDSA and RSA don’t qualify for this property either? This is related to the topics of malleability and exclusive ownership. You can learn more about this in the CryptoGotchas page.

Essentially, if a signature scheme is malleable or fails to provide exclusive ownership, it’s possible to construct two arbitrary (m, pk) pairs that produce the same signature.

Any nonmalleable signature scheme with exclusive ownership (i.e. Ed25519 with low-order point rejection and canonical signature checks, as provided by the latest version of libsodium) provides sufficient commitment–mostly due to how it uses a collision-resistant cryptographic hash function. (It’s also worth noting: HashEdDSA doesn’t. Isn’t cryptography fun?)

Generally, if you need random-key robustness, you want to explicitly make it part of your design.

Against “Fluffies”

In my blog post about the neverending wheel of Furry Twitter discourse, I mentioned the controversy around SFW spaces for underage furries.

Everything I said in that post is still accurate (go read it if you haven’t), but I want to emphasize something that maybe some people overlooked.

https://twitter.com/SoatokDhole/status/1426638694786682884

Underage furries calling themselves “fluffies” is a bad idea, for two reasons.

Divide and Conquer

The first reason is tactical, and not specific to what they’re calling themselves: If you label yourselves separately from the larger furry community, you make it much easier to be targeted–especially by propaganda. There’s a severely disturbed alt-right fringe to the furry fandom (dubbed alt-furry, the Furry Raiders, and so many other names) that would love nothing more than to sink their claws into younger furs.

It’ll start innocently enough (“Yay, you have your own space!”), but it will quickly accelerate (“Congrats on kicking those degenerates to the curb!”) to horrible places (“All LGBTQIA+ people are degenerates”), gliding on the wings of edgy humor.

This descent into madness is also known as the PewDiePipeline and all parents of furries should be made aware of it, lest it happen to their child:

https://www.youtube.com/watch?v=pnmRYRRDbuw

It bears emphasizing: This existence of a PewDiePipeline within the “fluffy” space is not predicated on the intentions of the proponents. They can have all the best intentions in the world and it will still happen to their microcosm.

https://twitter.com/ARCADEGUTS/status/1425687280983937027

Preventing this from happening will require an almost inhuman degree of vigilance and dedication to correcting discourse from going sour. None of us are omniscient, so I wouldn’t take that bet.

Pre-Existing Terminology

The second reason the “fluffies” label is a bad idea is more specific to the word “fluffies” in particular: It already refers to a very disturbing meme on 4chan from not-very-many years ago: Fluffy Abuse Threads.

I’m intentionally not including any videos or images of this topic. There just aren’t enough content warnings for how gross this content is.

By calling yourselves “fluffies”, the most deranged 4chan-dwellers and/or Kiwi Farms lurkers on the Internet will begin associate you with the “fluffy abuse” memes, and may even act accordingly. In their twisted minds, they may even rationalize their conduct as if somehow you’re consenting to the abuse, by virtue of what you call yourselves.

Look, I get it: When you’re young, the over-sexualization of the media can be very uncomfortable, and it’s natural to want to avoid it. Additionally, it’s only human to want your own special club with a special name to hang out with your exclusive (n.b. same-age) community.

But please think carefully about what you’re doing, how you’re doing it, and which adults you decide to trust.

Also: maybe talk to older queers and/or furries about the history of the Furry Fandom, Pride, and kink before you make dangerous moves that make you more vulnerable to the worst humanity has to offer? Even if you don’t agree with us, we don’t want to see you get hurt.

There definitely is room in the furry fandom for people who are not comfortable with sexual content, or simply don’t want to be inundated with it all the damn time. It doesn’t need to be an exclusive thing or concept; instead, it should be normalized.

Ultimately, there’s probably a lot of work to be done to ensure kids and families have a safe and enjoyable furry con experience during daylight hours without repressing the queer and sexual identities of consenting adults at night. The best way to get from here to there is to talk, not to isolate.

Otherwise, we’ll keep seeing occurrences like this:

https://twitter.com/PrincelyKaden/status/1426192114694692866

The onus here is going to be largely on furry convention staff and chatroom moderators to actually listen to people reporting abusive behavior. They haven’t always been good about that, and it’s time for change.

https://twitter.com/MegaplexCon/status/1425966589241970693

A Meditation on Furries and Cringe

Every once in a while, I get a comment or email like this one:

https://twitter.com/SoatokDhole/status/1360835077899436033

The biggest magnet for poorly-reasoned hate comments is, surprisingly, my tear-down of the “sigma male” meme.

You’d think the exposure of TheDonald’s non-CloudFlare IP address would draw more ire than having correct opinions on masculinity, but here we are.

Art by Sophie

Let’s talk about masculinity for a moment, guys.

There is nothing manlier than being your authentic self. Even if that means liking some “girly” things. Even if that means being soft and vulnerable at times. Even if that means actually conforming to some stereotypes perpetuated by toxic masculinity when it coincides with your likes and interests. You do you.

But this isn’t just true of the male gender. Authenticity is the epitome of humanity. There’s nothing that stops women and enbies from being ruthlessly themselves.

You can’t be authentic when you’re participating in Cringe Culture, which blindly tears large swaths of people down to stoke the feelings of superiority in the people who evade its blast.

People are weird. I’m weird. I don’t expect everyone to like me, nor do I want them to. (Parasocial relationships suck!)

It’s okay to be a little obsessed about something other people look down on just because you happen to like it. Just make sure you’re not eschewing your adult responsibilities. (We all have bills to pay and promises to keep to the people that matter to us.)

If people don’t like you because you suddenly revealed your fondness for classic video games, rock-tumbling, or linear algebra? Fuck ’em. May the bridges you burn light the way to people who will appreciate you for who you truly are.

I’ve been told my blog is “weapons grade cringe” before, because I dared talk about encryption while having what, to most adults, comes across as little more than a cartoon brand or company mascot.

(Art by Lynx vs Jackalope)

Furries and Blue State Privilege

I sympathize with most queer people and/or furries for not wanting to subject themselves to the bigotry that runs rampant in Red States, but the ones who are jerks to other members of their community for living in those states, I can do without.

https://twitter.com/SarahcatFursuit/status/1413566747148435456

Being an asshole to someone because they live in, or are moving to, a state whose politics you dislike is equal parts stupid, selfish, and self-defeating:

• It’s stupid because there’s no reason for expressing prejudice or painting with broad brushes. For example: “Florida Furs are bad people” is an attack on the author of this blog.
• It’s selfish because not everyone who wants to leave these states has the resources or opportunity to do so, so all you’re doing is shining a spotlight on your own privilege. Way to show your entire ass to the community.
• It’s self-defeating because of the way the U.S. political system is architected:
  If you wished for a genie to move every LGBTQIA+ person to the west coast of the United States, within a few years you’d essentially reduce support for LGBTQIA+ rights to approximately 6 out of 100 votes in the US Senate and 68 out of 435 in the House of Representatives.

  When you factor in who owns the land in the big tech cities (San Francisco, Seattle, etc.) and how much political and economic power they wield, it becomes very clear that your shaming of others for not boarding the bandwagon serves the interests of the worst of humanity: Landlords and venture capitalists.

  Not a good move for people who claim to be progressive, and want to achieve progressive political outcomes nationwide.

The fact that some states have horrendous laws on the books, even worse bastards enforcing these laws, and somehow even more terrible politicians gatekeeping any meaningful progress from changing the system isn’t ever going to be improved from the outside.

I say all this, and I acknowledge Florida does suck in a lot of obvious ways: Our governor (Ron DeSantis) has a disposition that would actually be improved if he wore clown make-up to press appearances. We also have far too many furries that are anti-maskers, anti-vaxxers, or both.

https://twitter.com/SoatokDhole/status/1300911840000708608

But when furries go out of their way to shame someone, simply for living here? You’re not helping. Seriously stop and think about your priorities.

And maybe–just maybe–be surgically precise when you decide insults are warranted.

Now that I’ve flushed the blog post topic buffer, I’m fresh out of ideas. Let me know some topics that interest you in my Telegram group so I don’t get bored and eventually write Buzzfeed-quality crap like this:

In hindsight, ideas like this are 90% of the reason Cringe Culture refuses to die.

https://soatok.blog/2021/08/16/lightning-round/

#asymmetricCryptography #ECDSA #Florida #furries #FurryFandom #HMAC #Politics #RSA #Society #wearOut

Dhole Moments

2020-07-07 14:05:09

There are a lot of random topics I’ve wanted to write about since I started Dhole Moments, and for one reason or another, haven’t actually written about. I know from past experience with other projects that if you don’t occasionally do some housekeeping, your backlog eventually collapses under its own gravity and you can never escape from it.

So, to prevent that, I’d like to periodically take some time to clean up some of those loose ends that collect over time.

Random-Access AEAD

AEAD stands for Authenticated Encryption with Associated Data. Typically, AEAD constructions involve a stream cipher (which may also be a block cipher in counter mode) and a message authentication code (which may also be an almost-universal hash function).

AEAD modes are designed for one-shot APIs: Encrypt (then authenticate) all at once; (verify then) decrypt all at once. AES-GCM, ChaPoly, etc.

AEADs are less great at providing random access to the underlying plaintext. For example: If you’re encrypting a 240 GB file with AES-GCM, but you only need a 512 KB chunk at some arbitrary point in the file, you’re forced to choose between either:

1. Authenticating the rest of the AES-GCM ciphertext, then decrypting only the relevant chunk. (Performance sucks.)
2. Sacrificing integrity and decrypting the desired chunk with AES-CTR.

Being forced to choose between speed and security will almost certainly result in a loss of security. The incentives of software developers (especially with fly-by-night startup engineers) all-but-guarantee this outcome.

Consequently, there have been several implementations of streaming-friendly AEAD. The most famous of which is Phil Rogaway’s STREAM construction.

Source: Rogaway’s paper

The downside to STREAM is that it requires an additional T bytes (e.g. 16 for an 128-bit authentication tag) for each chunk of the plaintext.

A similar solution, as implemented in the AWS Encryption SDK, is to carefully separate plaintexts into equal-sized frames and have special rules governing IV/nonce selection. This lets you facilitate random access while still making the security of the whole system easy to reason about.

Can we do better than STREAM and message framing?

The most straightforward idea is to use a Merkle tree on the ciphertext with a stream cipher for extracting a distinct key for each leaf node. This can be applied to existing AEAD ciphertexts, out of band, to create a sort of deep authentication tag that can be used to authenticate any random subset of the message (provided you have the correct nonce/key).

However, I haven’t found the time to develop this idea into something that can be toyed with by myself and other researchers.

More Introductory Articles

Let’s face it:

Art by Riley

I’ve previously suggested an alternative strategy for programmers to learn cryptography. I’d like to do more posts covering introductory material for the topics I’m familiar with, so anyone who wants to actually employ my proposed strategy can carry themselves across the finish line.

Dissecting Dog-Whistles

Random fact: My fursona is a dhole–also known as a whistling dog.

Soatok is a dhole, not a fox. Art by Khia.

Coincidentally, I’m deeply fascinated by language, and planned to start a series analyzing dog-whistle language (especially the kind commonly used against queer subcultures).

However, the very nature of dog-whistle language provides a veneer of plausible deniability for the whistler’s intent, which makes it very difficult to address them in a meaningful way that doesn’t undermine your own credibility.

So, for the time being, this is on the back-burner.

Reader Questions

I’ve received quite a few questions via email and social media since I started this blog in April. The most obvious thing to do with these questions would be to periodically collate a bunch of them into a Questions and Answer style post.

However! I have an open source projected called FAQ Off that is way more efficient at the Q&A format than a long-form blog post. If you’d like to see it in action, start here.

Art by Kyume

General Punditry

I make a lot of dumb jokes, typically involving puns and other wordplay. Most of these live in private Telegram conversations with other furries, but a few have leaked out onto Twitter over the years.

Is automated vulnerability scanning a nessusity?

— Mastodon: soatok@furry.engineer, Cohost: soatok (@SoatokDhole) November 23, 2017

Nurse: "I suspect this patient attempted to shove a foreign object into their urethra for pleasure"

Doctor: "I believe your theory is sound"

— Mastodon: soatok@furry.engineer, Cohost: soatok (@SoatokDhole) June 25, 2018

A lot of them involve queer lingo.

People say it's lonely at the top.

No wonder there's so many bottoms in this fandom 😛

— Mastodon: soatok@furry.engineer, Cohost: soatok (@SoatokDhole) December 30, 2019

BitTorrent users are thirsty bottoms. Always complaining about wanting more seed.

— Mastodon: soatok@furry.engineer, Cohost: soatok (@SoatokDhole) August 4, 2019

My RAID controller has big disk synergy

— Mastodon: soatok@furry.engineer, Cohost: soatok (@SoatokDhole) August 1, 2018

Some of them involve furry in-jokes.

Q) Why are foxes so prevalent in the furry fandom?

A) We're a sub-culture not a dom-culture.

— Mastodon: soatok@furry.engineer, Cohost: soatok (@SoatokDhole) May 24, 2018

Intrusion detection systems are old hat. What we need is a protrusion detection system.

Introducing OwO

— Mastodon: soatok@furry.engineer, Cohost: soatok (@SoatokDhole) February 1, 2018

Some are just silly.

Using mined bitcoins to buy a pumpkin spice latte makes you an ASIC bitch, right?

— Mastodon: soatok@furry.engineer, Cohost: soatok (@SoatokDhole) February 6, 2018

So in gay male furry culture if you give into a booty call from your ex-boyfriend… does that mean you were craving the XD?

— Mastodon: soatok@furry.engineer, Cohost: soatok (@SoatokDhole) August 25, 2018

If SQL is pronounced "sequel" then PHP must be pronounced "fap".

— Mastodon: soatok@furry.engineer, Cohost: soatok (@SoatokDhole) July 23, 2019

What do you call a submissive dragon with a mathematics background who's already lubed up for you?

A sliding scale.

— Mastodon: soatok@furry.engineer, Cohost: soatok (@SoatokDhole) December 26, 2018

Did you hear about the clairvoyant babyfur that broke RSA?

Turns out, all you needed was a padding oracle.

— Mastodon: soatok@furry.engineer, Cohost: soatok (@SoatokDhole) October 1, 2017

I should look for my next partner in a nuclear chemistry lab.

I hear they're good at dating.

— Mastodon: soatok@furry.engineer, Cohost: soatok (@SoatokDhole) December 8, 2016

In my humble opinion, there haven’t been nearly enough puns on this blog (unless the embedded tweets above count).

Normally, this is where I’d proclaim, “I shall rectify this mistake” and proceed to make an ass out of myself, but I don’t like forced and obvious puns.

A lot of furries get this wrong: “Pawesome” is not clever, unless you’re talking to someone with a marsupial fursona. Then maybe.

The best puns come in two forms: They’re either so clever that you never saw it coming, or they’re just clever enough that the punchline lands at the same time you realized a bad pun was even possible.

Only Soatok brand puns are 100% whole groan

— Mastodon: soatok@furry.engineer, Cohost: soatok (@SoatokDhole) January 26, 2018

Miscellaneous / Meta

The past few blog posts touched a little on political subjects (especially How and Why America Was Hit So Hard By COVID-19, but this short-term trend actually started with my Pride Month post).

At some point in the future, I may write a post dedicated to politics, but for the time being, it’s not really a subject I care enough about in and of itself to emphasize all the time.

Let me be clear: Being gay in America is inherently political. Developing technology is inherently political (although you don’t always realize it). Being a gay technologist, saying something politically significant is an inevitability.

But I’m not interested in the traditional roles and narratives that infect politics and political discourse. Labels are stupid and I’m not interested in being a Useful Idiot for anyone’s propaganda.

---

The most difficult thing about writing blog posts for me is coming up with a meaningful title. I’ve lost many hours due to the writer’s block that ensues.

The second most difficult thing for me is writing closing statements that aren’t totally redundant.

https://www.youtube.com/embed/l44OV2jlN7A?start=665&feature=oembed
George Carlin – “Count the Superfluous Redundant Pleonastic Tautologies” – Skip to 11:05 if WordPress breaks something
Some bloggers like to sign off like they’re writing an email. “Happy hacking!” and whatnot. To me, this feels forced and inauthentic, like a bad pun.

So instead, here’s a totally sick piece of art I got from @MrJimmyDaFloof.
Furry artists are, like the rest of the fandom, amazing.
https://soatok.blog/2020/07/07/dont-forget-to-brush-your-fur/

Last week, Floridians were startled by an emergency alert sent to all of our cell phones. Typically when this sort of alert happens, it’s an Amber Alert, which means a child was abducted. In Florida, we sometimes also receive Silver Alerts, which indicates that an Alzheimer’s or dementia patient has gone missing. (Florida has a lot of old and retired people.)

To my surprise, it was neither of those things. Instead, it was a Blue Alert–a type of alert I had never seen before. Apparently nobody else had seen it either, because a local news site published a story explaining what Blue Alerts even are for their confused readers.

What’s a Blue Alert?

A Blue Alert is an involuntary message, communicated over the emergency alert infrastructure, to perform the equivalent of a Twitter call-out thread on a suspected cop-killer or cop-abductor.

Blue Alerts are opt-out, not opt-in, and you cannot turn them off without also disabling other types of emergency alerts. Even on newer phones which offer greater granularity with the types of emergency alerts to receive, there is no specific flag to disable Blue Alerts and leave all the other types turned on.

Blue Alerts Are Security Theater

Blue Alerts do not provide any meaningful benefit towards public safety, and actually make us less safe.

If someone just killed a cop, do you really expect random untrained citizens to get involved? We already know how that worked out for the armed and trained professionals.

https://twitter.com/cel_decicco/status/1408127188671647748

If law enforcement wants an uncritical platform to broadcast their lies and omissions with no questions (or only softball questions that presuppose the frame that they’re telling the truth), they already have every major media outlet in their locale. They don’t need the Blue Alerts to get the word out, or to advertise a cash reward for information leading to an arrest. They already have channels for that.

Why are Blue Alerts a thing? The best reason I’ve been able to discern is: Because the surviving families of deceased law enforcement officers want to feel like their loss is taken seriously. The need to “do something”–even when that something is meaningless, or even harmful, but still looks like a solution–is the essence of Security Theater.

But Blue Alerts aren’t as harmless as a mere expression of sheer self-entitlement over the rest of us unimportant proles.

Blue Alerts actually serve to make our society less safe by increasing Alarm Fatigue, which negatively impacts public safety by making people less focused when an alert comes in.

Alternatively, some people will actively disable Blue Alerts to prevent alarm fatigue. But, as stated above, there’s no way to disable them in isolation without also disabling other emergency alerts, which puts them at risk of being uninformed of an actual severe or extreme emergency.

Making the public less safe goes against the very predicate for why police forces exist in most states.

Just say NO to Security Theater!
(Art by Khia.)

Blue Alerts Are Copaganda (in Practice)

This one needs a bit of explaining. I’m going to focus on Florida, because it’s familiar to me.

Blue Alerts were created in Florida in 2011 via an executive order by then-governor Rick Scott. According to Spectrum News 9, only three alerts have been issued since the system was created.

(Anecdote: I’ve had my own mobile phone since 2008 and never once received one until last week.)

The Florida Department of Law Enforcement identifies four criteria for a Blue Alert to be issued:

1. A law enforcement officer must have been: seriously injured; killed by a subject(s); or become missing while in the line of duty under circumstances causing concern for the law enforcement officer’s safety.
2. The investigating agency must determine that the offender(s) poses a serious risk to the public or to other law enforcement officers, and the alert may help avert further harm or assist in the apprehension of the suspect.
3. A detailed description of the offender’s vehicle or other means of escape (vehicle tag or partial tag) must be available for broadcast to the public.
4. The local law enforcement agency of jurisdiction must recommend issuing the Blue Alert.

That fourth requirement gives law enforcement a lot of discretion in deciding whether or not to issue a Blue Alert.

That power to arbitrarily decide whether or not to send one might explain why, despite having 2 cops killed in 2020 and 4 cops killed in 2018 due to shooting incidents (both in Florida alone, and I do not have access to data earlier than 2018), a Blue Alert wasn’t emitted for any of those incidents.

Gee, I wonder if something else could have happened last week to prompt law enforcement to exercise a rarely-used tool in their toolbelt?

What Happened Before June 2021’s Blue Alert

I’m not particularly clued into the specific events of the shooting that issued the Blue Alert, but there was a particularly embarrassing incident for law enforcement in Florida the day before that was starting to gain a lot of attention.

Florida Highway Patrol tased a teenage boy in his girlfriend’s yard. And it was starting to get national media coverage.

Content Warning: Do not watch this video if violence–especially police violence–might cause you severe discomfort or trigger an involuntary psychological response to past trauma:

https://www.youtube.com/watch?v=n4wSkqQlA9o

I do not have, nor will I claim to have, any specific evidence that proves that the cops used the shooting in Volusia County, Florida as an excuse to trigger the surprising Blue Alert to confuse and distract the populace.

However, all cops are bastards, so I certainly suspect them of doing such a thing to cover for their buddies.

And since their mere suspicion is generally sufficient justification for cops to violate the Fourth Amendment with wild abandon, it’s only fair that my suspicion be sufficient to launch an investigation into their motives.

Just kidding!

We know the system is stilted in cops’ favor, which is why there’s a Blue Alert when a cop gets killed, but not a Stasi Alert when cops decide to murder an American citizen.

(Art by Khia.)

In Conclusion

Blue Alerts are not actionable for their recipients, and make the public less safe. Additionally, they provide the police yet another propaganda tool that I suspect they already used once to distract the public from an embarrassing news story.

Here’s what needs to happen:

1. Mobile Operating System developers need to create a dedicated toggle to disable Blue Alerts without disabling other emergency alerts.
2. These toggles need to be easier to find and configure.

These aren’t political solutions, merely technological ones, but as a security engineer, that’s all I can offer.

https://soatok.blog/2021/07/02/blue-alerts-security-theater-and-copaganda/

#ACAB #BlueAlerts #Florida #police #policeState #Politics #publicSafety #SecurityTheater #Society #Technology

Dhole Moments

2021-07-02 06:32:20

Last week, Floridians were startled by an emergency alert sent to all of our cell phones. Typically when this sort of alert happens, it’s an Amber Alert, which means a child was abducted. In Florida, we sometimes also receive Silver Alerts, which indicates that an Alzheimer’s or dementia patient has gone missing. (Florida has a lot of old and retired people.)

To my surprise, it was neither of those things. Instead, it was a Blue Alert–a type of alert I had never seen before. Apparently nobody else had seen it either, because a local news site published a story explaining what Blue Alerts even are for their confused readers.

What’s a Blue Alert?

A Blue Alert is an involuntary message, communicated over the emergency alert infrastructure, to perform the equivalent of a Twitter call-out thread on a suspected cop-killer or cop-abductor.

Blue Alerts are opt-out, not opt-in, and you cannot turn them off without also disabling other types of emergency alerts. Even on newer phones which offer greater granularity with the types of emergency alerts to receive, there is no specific flag to disable Blue Alerts and leave all the other types turned on.

Blue Alerts Are Security Theater

Blue Alerts do not provide any meaningful benefit towards public safety, and actually make us less safe.

If someone just killed a cop, do you really expect random untrained citizens to get involved? We already know how that worked out for the armed and trained professionals.

https://twitter.com/cel_decicco/status/1408127188671647748

If law enforcement wants an uncritical platform to broadcast their lies and omissions with no questions (or only softball questions that presuppose the frame that they’re telling the truth), they already have every major media outlet in their locale. They don’t need the Blue Alerts to get the word out, or to advertise a cash reward for information leading to an arrest. They already have channels for that.

Why are Blue Alerts a thing? The best reason I’ve been able to discern is: Because the surviving families of deceased law enforcement officers want to feel like their loss is taken seriously. The need to “do something”–even when that something is meaningless, or even harmful, but still looks like a solution–is the essence of Security Theater.

But Blue Alerts aren’t as harmless as a mere expression of sheer self-entitlement over the rest of us unimportant proles.

Blue Alerts actually serve to make our society less safe by increasing Alarm Fatigue, which negatively impacts public safety by making people less focused when an alert comes in.

Alternatively, some people will actively disable Blue Alerts to prevent alarm fatigue. But, as stated above, there’s no way to disable them in isolation without also disabling other emergency alerts, which puts them at risk of being uninformed of an actual severe or extreme emergency.

Making the public less safe goes against the very predicate for why police forces exist in most states.

Just say NO to Security Theater!
(Art by Khia.)

Blue Alerts Are Copaganda (in Practice)

This one needs a bit of explaining. I’m going to focus on Florida, because it’s familiar to me.

Blue Alerts were created in Florida in 2011 via an executive order by then-governor Rick Scott. According to Spectrum News 9, only three alerts have been issued since the system was created.

(Anecdote: I’ve had my own mobile phone since 2008 and never once received one until last week.)

The Florida Department of Law Enforcement identifies four criteria for a Blue Alert to be issued:

1. A law enforcement officer must have been: seriously injured; killed by a subject(s); or become missing while in the line of duty under circumstances causing concern for the law enforcement officer’s safety.
2. The investigating agency must determine that the offender(s) poses a serious risk to the public or to other law enforcement officers, and the alert may help avert further harm or assist in the apprehension of the suspect.
3. A detailed description of the offender’s vehicle or other means of escape (vehicle tag or partial tag) must be available for broadcast to the public.
4. The local law enforcement agency of jurisdiction must recommend issuing the Blue Alert.

That fourth requirement gives law enforcement a lot of discretion in deciding whether or not to issue a Blue Alert.

That power to arbitrarily decide whether or not to send one might explain why, despite having 2 cops killed in 2020 and 4 cops killed in 2018 due to shooting incidents (both in Florida alone, and I do not have access to data earlier than 2018), a Blue Alert wasn’t emitted for any of those incidents.

Gee, I wonder if something else could have happened last week to prompt law enforcement to exercise a rarely-used tool in their toolbelt?

What Happened Before June 2021’s Blue Alert

I’m not particularly clued into the specific events of the shooting that issued the Blue Alert, but there was a particularly embarrassing incident for law enforcement in Florida the day before that was starting to gain a lot of attention.

Florida Highway Patrol tased a teenage boy in his girlfriend’s yard. And it was starting to get national media coverage.

Content Warning: Do not watch this video if violence–especially police violence–might cause you severe discomfort or trigger an involuntary psychological response to past trauma:

https://www.youtube.com/watch?v=n4wSkqQlA9o

I do not have, nor will I claim to have, any specific evidence that proves that the cops used the shooting in Volusia County, Florida as an excuse to trigger the surprising Blue Alert to confuse and distract the populace.

However, all cops are bastards, so I certainly suspect them of doing such a thing to cover for their buddies.

And since their mere suspicion is generally sufficient justification for cops to violate the Fourth Amendment with wild abandon, it’s only fair that my suspicion be sufficient to launch an investigation into their motives.

Just kidding!

We know the system is stilted in cops’ favor, which is why there’s a Blue Alert when a cop gets killed, but not a Stasi Alert when cops decide to murder an American citizen.

(Art by Khia.)

In Conclusion

Blue Alerts are not actionable for their recipients, and make the public less safe. Additionally, they provide the police yet another propaganda tool that I suspect they already used once to distract the public from an embarrassing news story.

Here’s what needs to happen:

1. Mobile Operating System developers need to create a dedicated toggle to disable Blue Alerts without disabling other emergency alerts.
2. These toggles need to be easier to find and configure.

These aren’t political solutions, merely technological ones, but as a security engineer, that’s all I can offer.

https://soatok.blog/2021/07/02/blue-alerts-security-theater-and-copaganda/

#ACAB #BlueAlerts #Florida #police #policeState #Politics #publicSafety #SecurityTheater #Society #Technology