LibertyVoice

After a successful joint Judiciary Committee vote this week, the Marriage Equality bill (LD 1020) goes to the Senate floor for a vote TODAY. The Senate consists of 20 Democrats and 15 Republicans, with a simple majority needed to pass…so the magic number is 18.
Once we get through the Senate, it is on to [...]

How competitive are security research conferences? Several people have been tracking this information. Mihai Christodorescu has a nice chart of acceptance and submission rates over time. The most recent data point we have is the 2009 Usenix Security Symposium, which accepted 26 of 176 submissions (a 14.8% acceptance ratio, consistent with recent years). Acceptance rates like that, at top security conferences, are now pretty much the norm.

With its deadline one week ago, ACM CCS 2009 got 317 submissions this year (up from 274 last year, and approx. 300 the year before) and ESORICS 2009, with a submission deadline last Friday night, got 222 submissions (up from about 170 last year).

Think about that: right now there are over 500 research manuscripts in the field of computer security fighting it out, and maybe 15-20% of those will get accepted. (And that’s not counting research in cryptography, or the security-relevant papers that regularly appear in the literature on operating systems, programming languages, networking, and other fields.) Ten years ago, when I first began as an assistant professor, there would be half as many papers submitted. At the time, I grumbled that we had too many security conferences and that the quality of the proceedings suffered. Well, that problem seems mostly resolved, except rather than having half as many conferences, we now have a research community that’s apparently twice as large. I suppose that’s a good thing, although there are several structural problems that we, the academic security community, really need to address.

• What are we supposed to do with the papers that are rejected, resubmitted, rejected again, and so on? Clearly, some of this work has value and never gets seen. Should we make greater use of the arXiv.org pre-print service? There’s a crypto and computer security section, but it’s not heavily used. Alternatively, we could join on on the IACR Cryptology ePrint Archive or create our own.
• Should we try to make the conference reviewing systems more integrated across conferences, such that PC comments from one conference show up in a subsequent conference, and the subsequent PC can see both drafts of the paper? This would make conference reviewing somewhat more like journal reviewing, providing a measure of consistency from one conference to the next.
• Low acceptance ratios don’t necessarily achieve higher quality proceedings. There’s a distinctive problem that occurs when a conference has a huge PC and only three of them review any given paper. Great papers still get in and garbage papers are still rejected, but the outcomes for papers “on the bubble” becomes more volatile, depending on whether those papers get the right reviewers. Asking PC members to do more reviews is just going to lower the quality of the reviews or discourage people from accepting positions on PCs. Adding additional PC members could help, but it also can be unwieldy to manage a large PC, and there will be even more volatility.
• Do we need another major annual computer security conference? Should more workshops be willing to take conference-length submissions? Or should our conferences raise their acceptance rates up to something like 25%, even if that means compressed presentations and the end of printed proceedings? How much “good” work is out there, if only there was a venue in which to print it?

About the only one of these ideas I don’t like is adding another top-level security conference. Otherwise, we could well do all-of-the-above, and that would be a good thing. I’m particularly curious if arbitrarily increasing the acceptance rates would resolve some of the volatility issues on the bubble. I think I’d rather that our conferences err on the side of taking the occasional bad/broken/flawed paper rather than rejecting the occasional good-but-misunderstood paper.

Maybe we just need to harness the power of our graduate students. When you give a grad student a paper to review, they treat it like a treasure and write a detailed review, even if they may not be the greatest expert in the field. Conversely, when you give an overworked professor a paper to review, they blast through it, because they don’t have the time to spend a full day on any given paper. Well, it’s not like our grad students have anything better to be doing. But does the additional time they can spend per paper make up for the relative lack of experience and perspective? Can they make good accept-or-reject judgements for papers on the bubble?

For additional thoughts on this topic, check out Matt Welsh’s thoughts on scaling systems conferences. He argues that there’s a real disparity between the top programs / labs and everybody else and that it’s worthwhile to take steps to fix this. (I’ll argue that security conferences don’t seem to have this particular problem.) He also points out what I think is the deeper problem, which is that hotshot grad students must get themselves a long list of publications to have a crack at a decent faculty job. This was emphatically not the case ten years ago.

See also, Birman and Schneider’s CACM article (behind a paywall, unless your university has a site license). They argue that the focus on short, incremental results is harming our field’s ability to have impact. They suggest improving the standing of journals in the tenure game and they suggest disincentivizing people from submitting junk / preliminary papers by creating something of a short-cut reject that gets little or no feedback and also, by virtue of the conferences not being blind-review, creates the possibility that a rejected paper could harm the submitter’s reputation.

A European Union court has reduced market-fixing fines levied on games console maker Nintendo and its distributors in 2002. It ruled that most of the fines should be reduced because of the co-operation the companies gave to the investigation.

During last year’s Presidential campaign, the Obama team earned accolades for its embrace of new technology to get its message out. During the transition, it extended tools developed during the campaign to allow citizen input on policy.  So, 100 days in, how is the new President doing on fostering technological innovation?
Not too well, according to [...]

The IIPA, the lead U.S. lobbyist on international IP matters, has issued a press release on the USTR Special 301 report, welcoming the inclusion of Canada on the Priority Watch List.  Yet the release inadvertently demonstrates why the designation is so absurd.  Included at the end are the estimated software piracy percentages for each country on the list.  While the BSA claims are themselves subject to challenge, compare Canada to the remainder of the list.  Canada comes in at 32%.  The remaining countries (no rates are listed for Algeria, Israel, or Venezuela):

Not only is Canada not even remotely close to any other country on the list, it has the lowest software piracy rate of any of the 46 countries in the entire Special 301 Report.  Moreover, it is compliant with its international IP obligations, participates in ACTA, has prosecuted illegal camcording, has the RCMP prioritizing IP matters, has statutory damages provisions, features far more copyright collectives than the U.S., and has a more restrictive fair dealing/fair use provision.

The U.S. Trade Representative released its Special 301 report today, in which it casts judgement on the intellectual property laws of dozens of countries around the world. To the surprise of no one, Canada finds itself playing the role of Bill Murray in Groundhog Day as it once again is target.  In fact, this year the U.S. aims to increase the pressure by elevating Canada to the Priority Watch List (a more sinister designation than the previous Watch List), implausibly claiming that Canada sits alongside countries like Russia and China with its intellectual property laws. 

The move is not unexpected, given recent comments from Vice President Joe Biden and U.S. Congressional panels as well as the demands from U.S. lobby groups.  Those same groups will now dust off their press releases that lament the "embarrassment" of being included on the list (never mind that countries that represent more than 70 percent of the world's population are on the list) and the failure to introduce U.S.-style reforms (never mind that Canada enacted anti-camcording laws in 2007, introduced C-61 last year, is an original negotiating partner in the ACTA negotiations, joined the U.S. as a third party in the WTO copyright complaint against China, etc.).

Hopefully, the Canadian officials will similarly dust off their advice to the Minister, which for the past few years has stated (as obtained under Access to Information):

The Government is disappointed with the United States' decision to include Canada in its [year here] Special 301 "Watch List."  Canada does not recognize the Special 301 process due to its lacking of reliable and objective analysis, and we have raised this issue regularly with the U.S. in our bilateral discussions."

Those same sentiments were expressed by an official at the Department of Foreign Affairs to a House of Commons committee in 2007:

In regard to the watch list, Canada does not recognize the 301 watch list process. It basically lacks reliable and objective analysis. It's driven entirely by U.S. industry. We have repeatedly raised this issue of the lack of objective analysis in the 301 watch list process with our U.S. counterparts.

While this demonstrates that Canadian officials recognize the Special 301 process for what it is (and isn't), it may well be time to take a more aggressive approach.  This year, twenty countries responded to the USTR process, challenging the claims of lobby groups like the IIPA and their possible inclusion on the list.  Some focused on their IP reform efforts, while others challenged the legality of reaching a conclusion of non-compliance.  The strongest came from Israel, which in discussing the view that the absence of anti-circumvention legislation could be the basis for inclusion on the list, stated:

given the industry objections to TPM, it lack of uniform implementation worldwide and its nascent obsolescence, non implementation of TPM can not be the basis for determining that a country, as in the words of the Trade Act of 1974 (19 USC 2242) "denies adequate and effective protection of intellectual property rights or deny fair and equitable market access to U.S. persons who rely on intellectual property protection.

I think Israel is on the right track here (though it too was elevated to the Priority Watch List).  It is not enough to say that the Special 301 process is unreliable and lacks objectivity.  Canadian officials must counter claims that Canada – which is compliant with its international obligations and has been a major partner for the U.S. on international IP matters – should be included at all.

Update: Here the come the lobbyist releases – the MPAA, Entertainment Software Association, and IIPA all celebrate Canada's inclusion on the list.

The Government has published its proposals for new equality legislation and one employment law expert has warned that a policy u-turn could leave companies exposed to a deluge of equal pay claims.

Organisations should not hand over employees’ personal details to private investigators except in very limited circumstances, the Information Commissioner’s Office (ICO) has warned.

A new Swedish political poll shows the Pirate Party with 5.1 percent support, enough to garner seats in the June European elections.  The party won 0.6 percent support in the 2006 elections. The party ranks second nationally among those aged 18 – 29 and fourth in the 30 – 44 age category.

Having reviewed the Electronic Commerce Protection Act provisions on anti-spam, enforcement, and do-not-call, the other major section in the bill are the provisions involving reforms to the Competition Act.  The ECPA makes several important amendments to the statute to better ensure that false or misleading representations in electronic messages are captured by the law.  This will mean that the Competition Bureau will have the power to investigate and take action against the use of false headers, false locator information, or the presence of false or misleading content in electronic messages.

The changes focus on parallel reforms to the false or misleading representation provisions and the deceptive marketing provisions.  The Competition Act will now include a lengthy new provision on false or misleading representations in an electronic message.  The three main offences, contained with Offences Related to Competition, are:

(1)     No person shall, for the purpose of promoting, directly or indirectly, any business interest or the supply or use of a product, knowingly or recklessly send or cause to be sent a false or misleading representation in the sender information or subject matter information of an electronic message.

(2)     No person shall, for the purpose of promoting, directly or indirectly, any business interest or the supply or use of a product, knowingly or recklessly send or cause to be sent in an electronic message a representation that is false or misleading in a material respect.

(3)      No person shall, for the purpose of promoting, directly or indirectly, any business interest or the supply or use of a product, knowingly or recklessly make or cause to be made a false or misleading representation in a locator.

The net effect of these three provisions is to render illegal false header information in electronic messages such as emails or text messages (including false sender or subject lines), false or misleading content in electronic messages, as well as false locator information.  Locator is defined in the Act as "a name or information used to identify a source of data on a computer system, and includes a URL." Sending a message covers both the actual sender and some who permits a representation to be made or sent. Electronic messages are considered sent once the transmission has been initiated and it does not matter if the message reaches the destination (or even if the recipient address is real).

With regard to penalties, the bill makes it clear that the recipient need not have been deceived or misled by the misleading representation for these provisions to apply.  The penalties for violating these provisions are severe – up to 14 years in jail (indictment) or $200,000 and a year in jail (summary conviction).  Moreover, the Act also grants courts the power to issue injunctions forbidding conduct that would result in a violation of these offences.

The Competition Act's provisions on Deceptive Marketing Practices are also expanded to deal with these same offences  (false or misleading sender information or subject matter information, false or misleading representations in a material respect, false or misleading locators).  This renders all of these actions "reviewable conduct" for the Competition Bureau, which brings the prospect of Administrative Monetary Penalties of up to $100,000 for a corporation on a first offence and $200,000 for subsequent orders.  Courts can also issue injunctions blocking further illegal conduct.  Note that the reforms specify that the Competition Bureau must choose either the false or misleading representation provisions or the deceptive marketing provisions when taking action against a specific incident or conduct.