We're back again with another in our weekly reading list posts of books we think our community will find interesting and thought provoking. Once again, buying the book via the Amazon links in this story also helps support Techdirt.

In previous Techdirt Reading List posts, we've covered a bunch of different books about encryption and the crypto wars of the 1990s, arguing that it might be useful for more people to understand the past to avoid having to repeat the same old fight all over again (though, if we must, hopefully the eventual outcome is the same). However, a friend recently suggested another book on cryptography that is a bit different: Cryptonomicon by Neal Stephenson. Unlike all of the other books on crypto that we covered, this one is fictional. However, it may also be the most entertaining and readable.

If you haven't read it, I should warn you that it is a big book and also, like an unfortunate number of Stephenson's books, it tends to go off the rails as he struggles to figure out how to end it (Stephenson is one of the best writers around, but has always struggled with endings). However, a key plot point in the book is encryption (the title may be a hint) and it actually does a pretty damn good job of explaining encryption in a way that is really understandable, often by going back and discussing earlier versions of encryption, but also comparing them to more modern encryption as well. Definitely worth a read (or a re-read if you read it a while ago)...

This should hardly comes as a surprise but reports are surfacing saying that after hacking into Syed Farook's work iPhone, that was subject to so much attention, the FBI has found absolutely nothing of interest:

Law enforcement source tells @CBSNews so far nothing of real significance has been found on San Bernardino terrorist iPhone unlocked by FBI.

— Charlie Kaye (@CharlieKayeCBS) April 13, 2016

Remember, this was the same iPhone that the DOJ and the FBI said was critical in their investigation. This is the same iPhone that the San Bernardino District Attorney, Michael Ramos, insisted could be hiding evidence of a "dormant cyber pathogen" destined to destroy San Bernardino County's computer network.

And, in the end, it appears that (as everyone expected) there was nothing on it. At all.

This isn't surprising. As the FBI freely admitted all along, Farook and his wife had destroyed their own personal iPhones, and the only remaining one was this one, which was Farook's work phone. If there had been anything that sensitive on it, you'd have figured they would have destroyed it too. And, of course, others had noted that the FBI's choice of words after getting in pretty clearly suggested there was nothing useful on the phone.

But... in the meantime, the FBI has now made it clear that at least certain iPhone models have a massive vulnerability in them that potentially puts millions of iPhone users at risk. And the FBI has shown no interest in telling Apple where this vulnerability exists.

In short, the FBI, who is supposed to keep us safe from crime, broke into an iPhone which helped it solve no crime, but almost certainly has put millions of people at risk for potential criminal attacks in the future. Why does anyone think this is a good result?

Is it really that hard to expect officials representing law enforcement to understand basic concepts? Earlier this week, University of Michigan hosted a debate on the whole "going dark/encryption" fight with the EFF's Nate Cardozo (disclaimer: he has represented us on certain legal issues) and US Attorney for the Eastern District of Michigan Barbara McQuade. While the event was filmed and livestreamed, as I type this, they don't appear to have posted a recorded version. However, it appears that Cardozo (not surprisingly) raised a key point that has been raised many times before: a US law against allowing unbroken encryption would have little impact on bad people using encryption, since there are many open source and non-US encryption products worldwide. But McQuade had a response to that... and it was kind of insane:

McQuade: "I think it would be reasonable to ban the import of open-source encryption software" #UMichTalks

— David Adrian (@davidcadrian) April 12, 2016

If you can't read that, she said: "I think it would be reasonable to ban the import of open-source encryption software." This is idiotic on any number of levels, and that an actual representative of law enforcement would make such a claim is immensely troubling and raises serious questions about the competency of the US Attorney's Office in Eastern Michigan.

First off, the Open Technology Institute released a paper late last year showing that there was a ton of both open source and foreign encryption products that weren't subject to US regulations. Another paper, released earlier this year by the Berkman Center and written by Bruce Schneier (along with Kathleen Seidel and Saranya Vijayakumar), found that there were 865 encryption products from 55 different countries on the market when they wrote the paper (it could be more by now), with 546 of those from outside the US. In other words, there are a lot of these kinds of products. So, at the very least, they'd be used by people outside of the US.

But, more to the point, a ban on importing them? We already had that legal fight, though back then it was on the question of exporting encryption. In Bernstein v. the US Department of Justice, the government sought to block Daniel Bernstein from publishing his algorithm for his Snuffle encryption system, saying it violated export laws related to exporting weapons. Eventually, the 9th Circuit ruled that software source code was speech protected by the First Amendment and any regulations preventing publication would be unconstitutional.

So, for McQuade's "simple" solution to take hold, we'd have to first ignore the First Amendment and a ruling directly on point to the issue she thinks is an easy solution. To be clear, the court's ruling stated:

In light of these considerations, we conclude that encryption software, in its source code form and as employed by those in the field of cryptography, must be viewed as expressive for First Amendment purposes, and thus is entitled to the protections of the prior restraint doctrine.   If the government required that mathematicians obtain a prepublication license prior to publishing material that included mathematical equations, we have no doubt that such a regime would be subject to scrutiny as a prior restraint.   The availability of alternate means of expression, moreover, does not diminish the censorial power of such a restraint-that Adam Smith wrote Wealth of Nations without resorting to equations or graphs surely would not justify governmental prepublication review of economics literature that contain these modes of expression.

While it's true this technically only applies in the 9th Circuit (and McQuade's district is outside of that circuit), it's not like there's a competing ruling in another district and the ruling here would be a difficult one to overcome.

Second, even if she could get past it, it would be pointless and useless. At least in the Bernstein case, the argument would be to try to block an American citizen from publishing the content -- an "export" ban. An "import" ban would be an order of magnitude more futile, because anyone outside the US publishing such open source code would not be covered by US regulations, so they couldn't be blocked from doing anything by a US court. So then any "import" ban would come down to someone being forced to magically comb the entire global internet and make sure no one from the US could ever see or find that code -- which, of course, would bring us right back to questions of prior restraint and the First Amendment.

There may be reasonable arguments to be made about encryption and its impact on law enforcement, but if the argument includes such inane ideas as banning the import of strong encryption, it's difficult to take the speaker seriously, or to conclude that they have any useful or competent knowledge on the subject at all.

The $99 FlexBot DIY Camera-Drone Kit comes with everything you need to make your own quadcopter. The 3D printed parts come ready to assemble and you can create your own custom shells to personalize your creation. You can control it via your Android or iOS devices, and with the included flex camera, you can take stills and videos during your flights.

Note: The Techdirt Deals Store is powered and curated by StackCommerce. A portion of all sales from Techdirt Deals helps support Techdirt. The products featured do not reflect endorsements by our editorial team.

The latest in the Matthe Keys case is that Keys has been sentenced to two years in federal prison for his involvement in a minor incomprehensible web defacement of an LA Times story that lasted for all of about 40 minutes. The prosecution was asking for 5 years, while Keys' lawyers asked for nothing more than probation. As we noted, the whole thing seems fairly crazy. It is entirely possible that Keys acted like an immature jackass regarding his former employer, but the actual case revolved around a single action: the claimed sharing of login credentials for the content management system of the Tribune Company, which another person (who is apparently known to law enforcement, but has never been charged with anything) used to do a minor defacement of a single story to have the headline read: Pressure builds in House to elect CHIPPY 1337.

This minor defacement was up for about 40 minutes before being taken down. When the government tried to add up the damages, the Tribune Company at first admitted that there were basically none. After being pushed, they "found" more damages and somehow it turned into nearly a million dollars, by making emails that "cost" $225 and talking about something totally unrelated to this hack -- some alleged harassment Key did by emailing people in a database from his former employer. If he actually did this (he denies it), it was a really shitty thing to do, but it also was not what he was on trial for.

Either way, the government needed the number to be at least $5000 so it could use the CFAA (Computer Fraud and Abuse Act) against Keys. From the sound of things at the sentencing hearing (mainly via reporter Sarah Jeong's excellent tweets), the judge initially did sound fairly skeptical about the government's arguments, but eventually went with 24 months in prison. Somewhat incredibly, someone from the LA Times even presented that this minor bit of digital vandalism was "an attack" on the entire journalism field, and since there's already difficulty in figuring out what news is real, this was a true threat to credibility for journalism as a whole. Really, now?

The prosecution also apparently whined to the judge that Keys has been talking publicly about his case, which, last I checked, is protected free speech:

Prosecutor does not like that Keys has been tweeting and giving interviews as follows pic.twitter.com/jdG5eUHkC2

— sarah jeong (@sarahjeong) April 13, 2016

While the judge at least indicated she didn't care about all that -- she still sentenced him to two years in prison.

And, really, that's the crux of the issue here. For everything that Matthew Keys was accused of doing -- and some of it was undoubtedly obnoxious -- the single thing he was charged with was violating the CFAA by distributing a username and password. And he's now been sentenced to two whole years in jail for that. How in the world does the punishment here fit the crime? As David Graham noted, this is basically the same sentence (actually slightly longer) that the "affluenza teen" received on the same day for killing four people while driving drunk. Or, as Adam Steinbaugh notes, Keys will end up spending about 18 days in prison for every minute that the LA Times defacement (which, again, he didn't actually do) remained online.

Matthew Keys will spend ~18 days in prison for every sixty seconds that the LA Times said Chippy 1337 might pass in the House.

— Adam Steinbaugh (@adamsteinbaugh) April 13, 2016

And while Keys still maintains his overall innocence, even if he did exactly what he's accused of doing this sentence is absolutely insane and highlights just how ridiculous the CFAA is as a law -- and why it's so beloved by prosecutors who can use it to go after lots of people for doing really small things.

As the push to backdoor or ban encryption heats up, kneejerk politicians have rushed to embrace each and every recent attack and to immediately point fingers at encryption. Right after the Paris attacks, politicians started blaming encryption, even though evidence suggested they communicated by unencrypted SMS. Even months later, the press was ridiculously using the total lack of evidence of any encryption... as evidence of encryption. Then with the Brussels attacks from a few weeks ago politicians like Rep. Adam Schiff immediately tried to blame encryption insisting that "we can be sure that terrorists will continue to use what they perceive to be the most secure means to plot their attacks."

Of course, now it's being reported that a laptop seized from one of the suicide bombers in Brussels shows little attempt to actually hide plans of attacks. In fact, it showed that attack plans were kept in an unencrypted folder titled "Target." And the only attempt to "hide" it was that the computer had been thrown in the trash.

The bomber referred to striking Britain, the La Defense business district in Paris, and the ultra-conservative Catholic organisation, Civitas, in a folder titled “Target,” written in English, according to the source.

The laptop was found in the trash by police in Brussels shortly after the suicide bombings on March 22 that killed 32 people at the city’s airport and on a Metro train.

I'm wondering if Rep. Adam Schiff will now talk about the need to ban "folders" in operating systems?

With the FCC glacially pondering whether or not zero rating (exempting some content from usage caps) is a bad idea, the wireless industry has decided to try and settle the argument. According to a new study by the wireless industry, 94% of Millennials are more likely to try a new online service if it's part of a free data offering, 98% are more likely to stay with a carrier that offers such services, and 94% of Millennials are likely to use more data if it doesn't count against their data plan. As intended, the survey resulted in a lot of varied news headlines insisting that "consumers actually like ISPs to play favorites on mobile data caps."

The study is, the CTIA proceeds to claim, proof positive that zero rating is a great thing for everybody, from companies to consumers. Just ask Meredith Attwell Baker, former FCC Commissioner, former Comcast lobbyist, and now the top lobbyist for the nation's biggest wireless operators:

"It is no surprise that Americans embrace free data services that offer wireless consumers more data, more competitive choices and more flexibility to try new mobile applications and content. Free data services empower consumers with the freedom to choose what works for their mobile life, and that’s an outcome that everyone should support,” said CTIA President and CEO Meredith Attwell Baker."

If a revolving-door telecom lobbyist saying it's true doesn't convince you, here's an accompanying graphic of stock photo Millennials thrilled at the very idea of zero rating: So, yeah, some problems. I requested and received the methodology (pdf) used in the commissioned Harris poll, and you'll be shocked to learn that the questions asked weren't particularly nuanced. After asking survey participants whether they were familiar with such terms as zero rating or sponsored data (the results of that inquiry weren't shared), the survey basically just consists of asking consumers whether or not they like "free stuff." If somebody's unaware of the current zero rating net neutrality debate and is asked if they like "free stuff," it seems pretty clear what kind of answer they're going to give.

And therein sits the problem with zero rating. The majority of consumers still don't really understand what zero rating is, much less that there's some obvious hidden costs involved. As such, when approached with "free" services, they're thrilled.

They generally don't understand that the usage caps selected by their ISP are an arbitrary, artificial construct to begin with, untethered to financial or network congestion reality. Or that the very practice of giving wealthier, bigger companies cap-exempt status puts other smaller companies (and non-profits and educational efforts) at a very real disadvantage in the market. Or that over the years, data has shown that caps aren't an effective way to target network congestion, can hinder innovation, hurt competitors (especially if an ISP's exempting only its own services), and confuse consumers, many of whom aren't even sure what a gigabyte is. So yes, it's complicated, and requires some education.

Sure, even after being informed there's surely many people who simply adore the idea of getting anything for "free." But had the CTIA made the slightest effort to inform survey participants or explore zero rating more deeply, the survey's results would have been dramatically different.

Last week, we wrote about a "discussion draft" of Senators Richard Burr and Dianne Feinstein's new anti-encryption bill that would effectively require any company doing anything with encryption to make sure that encryption was flat out broken, putting everyone at risk. Feinstein and Burr's offices refused to comment on the criticism of the draft, insisting that they were still working on the bill. Well, late Wednesday Burr officially released a copy of the bill and it's basically the same insane bill we saw last week. As far as I can tell, the only real change is further defining what is meant by a "court order." It used to just say any court order, but now says only court orders for specific issues, but it's a pretty broad list: crimes involving serious bodily harm, foreign intelligence, espionage, terrorism, sexual exploitation of a minor, a "serious violent felony," or a serious drug crime. So, I guess we should feel relieved that it won't be used for cases where someone's caught trespassing or something? It's still a ridiculous bill (and it still doesn't explain what the penalties are).

Meanwhile, Senator Ron Wyden has renewed his opposition to the bill by going a step further and promising to filibuster if the bill is brought to the floor:

“The encryption debate is about having more security or having less security. This legislation would effectively outlaw Americans from protecting themselves. It would ban the strongest types of encryption and undermine the foundation of cybersecurity for millions of Americans. This flawed bill would leave Americans more vulnerable to stalkers, identity thieves, foreign hackers and criminals. And yet it will not make us safer from terrorists or other threats. Bad actors will continue to have access to encryption, from hundreds of sources overseas. Furthermore, this bill will empower repressive regimes to enact similar laws and crack down on persecuted minorities around the world,” Wyden said.

“Americans who value their security and liberty must join together to oppose this dangerous proposal. I intend to oppose this bill in committee and if it reaches the Senate floor, I will filibuster it.”

Stay tuned, because this fight is just beginning...

It's political season here in America, which means that it's time for everyone to disagree as violently as possible and to such a degree that all conversation is at an impasse. You know, basically just like every other time in America, except now we televise this stuff because the brains of our citizenry might still have a little meat left on the bone that can be melted away through "debates." But two companies are bucking that trend in a way readers here might not expect: two breweries are dealing amicably with having come up with politically-themed beer brews named very similarly to one another.

Thirsty Dog Brewing in Ohio had recently announced its latest beer, Unconventional Ale, named after the RNC convention set to take place in Cleveland. The convention is of course gaining even more attention than usual this presidential cycle, mostly because reports on the machinations of the party suggest it might be exactly the best kind of shit show to watch from the outside. That notoriety explains why Platform Beer Co. too had announced it was releasing a new brew, entitled UnconventionAle. So the names are similar to the point of being nearly identical. I'm sure you're already bracing for the nasty threats and legal filings. But no, these two breweries have managed to do what our politicians won't: talk to each other.

Occasionally, brewers come out with identical or too-similar names for beers, and most of the time a quick call or cease-and-desist letter decides the outcome. Who had it first becomes the arbiter. And in this case, both sides say this was determined in an efficient and friendly manner.

"It is what it is," said Platform's Paul Benner. "John had already planned something with that name and registered it. It's a good example of the brewers taking care of it without having to get dirty. It was a couple of calls and an email. It was amiable."

Najeway agrees. He said he called Platform, saying Thirsty Dog had trademarked the name.

"Unlike politicians we were able to agree to change it," he said. "Maybe we can have a brewers debate about the beers at a beer hall instead of a town hall."

A political event at a beer hall? Sure, what could possibly go wrong? But the lack of historically sensitive phrasing aside, it's worth noting when two companies can work out a trademark issue without having to involve the lawyers, the courts, and any kind of threats. The craft beer industry used to be famous for this kind of business congeniality, but we've seen some of that pleasant facade fall away recently. Seeing two breweries talk to one another and work things out, particularly with the backdrop of a politically-themed beer, is something of a ray of sunshine these days.

When Najeway was asked if he could envision a candidate or supporter touting the beer from the podium, he said: "If they are smart they will."

A drunk RNC convention? Yes, please...

A few years ago, there were some video demonstrations about perception and how when you're focused on looking for one thing, you can completely miss seeing obvious other things (like a gorilla or other monkey business). People tend to rely on vision a lot (unless you're Daredevil), but it's not always the most reliable sense.

• If a person who was born blind could be given eyesight, would he/she be able to understand a visual world based on past sensory (eg. tactile) experiences? This is called Molyneux's problem, and the answer appears to be "nope" -- based on several congenitally blind patients who gained vision by various surgeries (to remove cataracts, etc). People who gain vision can subsequently learn how to map their tactile knowledge to their new eyesight, but it takes some time. [url]
• Prosopagnosia is a different kind of blindness -- it's also called "face blindness" and gives people suffering from it the inability to recognize faces (and even facial expressions). This problem can also affect a person's ability to recognize animals and cars, as well as a sense of direction. This disorder might also not be that uncommon if about 2.5% of the population has it, and there's no cure, but maybe augmented reality glasses might help. [url]
• Blindsight may be a strange form of consciousness? Some people with healthy eyes can be blind if their brains don't recognize visual stimuli, but visual information may still make its way into a subconscious awareness. Blindsighted patients can sometimes recognize facial expressions, and blindsight can be induced in normally-sighted volunteers using transcranial magnetic stimulation. [url]

After you've finished checking out those links, take a look at our Daily Deals for cool gadgets and other awesome stuff.