Trails

This week, I’m in Montreal, Canada, attending the 29th International Conference of Data Protection and Privacy Commissioners. I will try to use some of my spare time to report live from the conference.

Speaking at the opening ceremony was none less then Michael Chertoff, secretary, US Department of Homeland Security (DHS).

Chertoff’’s presentation was clearly defensive. He knew that he was not among friends and used his keynote to defend and explain some of the controversial and intrusive practices his department had recently introduced for cross-border travel.

He started out that to say that the conflict between security and privacy was a false dichotomy. “I want to reject the implicit zero-sum premise that privacy must be traded for security,” Chertoff said. In a police state, such as the Soviet Union, citizens have neither security, nor privacy. He assured the audience that the DHS was committed to both security and privacy.

He specifically cited his department’s controversial initiative requiring everyone crossing a US border to carry a passport meeting certain standards and containing a RFID chip, the transfer of Passenger Name Record (PNR) data and travel histories from airlines to the US authorities, and the fingerprinting of visitors to the U.S.

According to Chertoff, cross border travel is a logistical problem. 80 million people each year, up to two million people on a give day, passes through US borders, most of them by plane and most of them during a peak period lasting only three hours. Also, more than 8000 different ID-documents had been in use prior to the new regulations, many of them very simple to forge. Border officers had problems both in spotting forgeries and in getting relevant information from the some of the legacy identity-documents.

Air travellers into the U.S. are now required to carry the new type of passports (for land and sea ports, the requirement has been delayed until as late as June 2009) that encodes biometric data and that contains an RFID-chip that can be read at a distance.

Travel is essential both for cultural exchange, and for the free flow of trade, so it was important that border crossing presented as little inconvenience and interference as possible to those with benign intentions, while still preventing those with ill intentions from entering the US.
The security system set up by DHS was based upon three strategies:

• Looking for suspect behaviour (i.e. training border officers in psychology to recognise potential terrorists and carriers of contraband).
• Technology (i.e. RFID passports, x-ray machines and body imaging technology).
• Information gathering (i.e. PNR obtained from airlines, and travel history).

The idea behind all this was to pick out the exceptions (potential terrorists) for second level questioning and further examination, while letting the majority of passengers pass through the system with minimal interference and without having their privacy invaded.

By collecting little pieces of information from everyone that aren’t overly private or invasive to gather, security officials can quickly target potential threats and avoid subjecting all travellers to intensive scrutiny or searches.

The alternative to this system, according to Chertoff, was either wholesale screening of all passengers,or racial and ethical profiling – the former was dismissed as not practical and latter as unethical and not an option for a democracy.

Chertoff had some good news, the initial proposal of retaining data collected at the border for 40 years had been deemed excessive, and such data are now retained for only 15 years. However, long retention times was necessary, because terrorists work with along time frame, Chertoff asserted. For instance, some of the individuals behind the 1993 attack on the WTC, was also involved in the Sep. 11 2001 attack.

As for the value of the PNR data, Chertoff mentioned one case, where a man stopped at Chicago’s O’Hare airport was flagged as suspicious, referred to second level questioning and refused entry after his fingerprints were obtained. The next time his fingerprints were identified was on the steering wheel of a vehicle used in a suicide bombing in Iraq that killed 132 people. “I have to say, I’m very glad that individual was not let into the United States,” Chertoff concluded.

(Coming up next, Bruce Schneier’s keynote)

A number of anti-phishing tools are now available. They are supposed to warn web surfers when they are about to enter a phishing web site, so they can steer clear. Unfortunately, they seem less then perfect. Unfortunately, they seem less then perfect. Not only is one my own web pages branded as a “known phishing web site” by one of these tools (Norton Internet Security Online), but another tool brand a well known phishing site as “verified”. For documentation, see the following article.

According to an article in today’s InfoWorld, the French Constitutional Council has approved a law that criminalizes the recording or distribution of acts of violence by people other than professional journalists.

The controversial paragraph makes it an act of complicity to record or distribute images of violence, and then goes on to say:

“The present article do not apply when the recording or distribution results from the normal exercise of a profession devoted to inform the public or is carried out in order to be used as proof in justice”

Original: «Le présent article n’est pas applicable lorsque l’enregistrement ou la diffusion résulte de l’exercice normal d’une profession ayant pour objet d’informer le public ou est réalisé afin de servir de preuve en justice»

The law, proposed by Minister of the Interior Nicolas Sarkozy, is named Projet de loi relatif à la prévention de la délinquance (Law relating to the prevention of delinquency) and is addressing a wide range of public order offenses. The ban of filming is supposed to clamp down on the practice known as “happy slapping”, where somebody is beaten up, and the attack is filmed and put on the Internet for amusement and to insult the victim. However, the law is broad enough to also make it possible to use the low to prosecute citizen journalists reporting on, say, police brutality.

Apart from the mind-boggling aspect of limiting the right of expression based upon the profession of the expresser, this French law is the first example I’ve seen (outside obvious dictatorships) of legislation that attempts to close the Internet “hole” that gives ordinary citizens the same access to an audience as used to be the privilege of the governement and the few moguls that own traditional mass media.

I hope this is just a fluke, but I will not be surprised if other governments follow suit and tries to regulate the right of expression afforded by bloggers and citizen journalists. Singapore already has a sophisticated system where, among other things, you need a government license to blog. The day when such measures are implemented in the west may not be far away.

Here are pointers to some key sources that indicate the rate of change for some core technologies and usage patterns:

• CPU-capacity/chip complexity has since 1965 followed the empical pattern that is expressed in Moore’s Law (se, for instance, original article in Electronics (38:8) (pdf), this comment by Haim Mendelson and/or Wikipedia). The original “law” said that capacity doubles every 12 months (i.e. an annual increase of 100 %). In 1975, Moore revised his prediction to say that numbers of transistor on a VLSI chip doubles every 24 months (i.e. an annual increase of 41 %). The most often quoted figure in media today is doubling every 18 months (i.e. an annual increase of 59 %).
• Bandwidth has Edholm’s law (pdf). His graph shows an 28 % annual increase for wireline bandwith, and about 60 % annual increase for nomadic and wireless bandwidth, indicating that the two will be the same around 2030.
• Storage capacity is discussed in the Wikipwedia article on Moore’s Law, in this article and this (somewhat inaccurate) article in Scientific American (August 2005). Historically, the annual increase has been around 60 %, but recently, this has dropped to around 40 %
• The number of domains registrations are continiously kept updated at http://www.whois.net/.
• The number of Internet users are discussed in my paper on adoption rates (TIS 19:2)

See also: IDC white paper: he Expanding Digital Universe: A Forecast of Worldwide Information Growth Through 2010.

The Nieman Foundation for Journalism (Harvard University) has just put online its Winter 2006 issue, titled Goodbye Gutenberg.

The entire issue focuses on web journalism and new media and of particular isterest to me is their coverage of Web 2.0, citizen reporters, online communities and webforum anonymity and pseudonymity. The main viewpoint is from “old media”, where edited news is under attack by the forms and genres of the web. Here is a typical example, from Francis Pisani’s article on Journalism and Web 2.0:

The role of editors is under attack from three sides. On Google News and on sites such as Le Monde.fr, algorithms are used to redistribute stories onto the home page. Search engines direct readers to articles, effectively bypassing editors’ guidance and, with RSS and aggregators, users grab what they want from sources they fancy and organize them in personalized spaces.

But despite the conservatism of this and most of the other pieces, the issue contains a lot if food for thought, and is required reading for anyone interested in online communities and new media.

Google News indexes a large number of newspapers on the web, and publishes short abstracts with links to the source. Newspapers often presents the articles for free in their online editions for a short time. Then they are moved to a premium area, where you have to pay to read. However, after the article is moved, its headline, lead-in and often also sized down copies of accompanying photographs are still available via Google, and often the entire article is available for free in Google’s so-called “cache”. A sizable portion of online newspapers is not too happy about it.

A complaint (reported by ChillingEffects.org and Expaticia) filed by Belgian publishers association Copiepresse, representing 17 French and German language newspapers in Belgium, was recognised in a summary hearing on September 5 2006, and confirmed in an appeal hearings published on September 22. A new hearing, on November 24, resulted in a ruling was announced on February 12, 2007. This ruling reduced the daily fine for non-compliance, but otherwise upheld the previous decisions.

The ruling appear to be based mainly on the testimony of an expert witness, Luc Golvers, (lecturer at the ULB, Université libre de Bruxelles, and president of CLUSIB, Club de la Sécurité Informatique Belge), about Google’s so-called “cache”:

Considering that his research has led him to prove that, while an article is still online on the site of the Belgian publisher, Google redirects directly, via the underlying hyperlinks, to the page where the article can be found, but as soon as the article can no longer be seen on the site of the Belgian newspaper publisher, it is possible to obtain the contents of it via the “cached” hyperlink which then goes back to the contents of the article that Google has registered in the “cached” memory of the gigantic data base which Google keeps within its enormous number of servers.

This lead the court to the conclusion that:

[t]he way in which the Google News presently operates cause the publishers of the daily press to lose control of their web sites and their contents.

In the end, the court found that Google infringed upon the publisher’s copyright, caused the publishers financial harm, and violated the conditions for use posted on the publisher’s web pages.

Google was ordered to:

• remove all content belonging the publishers represented by Copiepresse from the sites Google Nieuws België and Google.be, including the material stored in Google’s so-called “cache”;
• post the court’s ruling on Google’s Belgian the home pages for a period of five days.

As always, there is no mentioning in the ruling of the fact that the robots.txt (Robots Exclusion Standard) allows publishers to opt-out from being being indexed by search engines, but in an interview with Groklaw Margaret Boribon, secretary-general of Copiepresse, explains why the society do not accept robots.txt as a solution. Quote:

This is not acceptable. No. No, no. We cannot choose between being dispossessed of our content or erased. It is not acceptable. It is not Google who can make the laws governing our content. That is not acceptable. And all the standards and techniques they use, as brilliant as they may be, are techniques which belong to them, but which have no legal value. None whatsoever. They are not standardized, they have no legal status, there is no law which says: if you are not opposed, it’s normal that we take; there is no law which says that. […] No. Their opt-out, it’s their own strategy but it has no legal basis. […] I mean, it’s just something which is technologically proven, which works well.

Google’s official response to the ruling has been posted in GoogleBlog. Google say that they intend to appeal the decision, and add:

We believe search engines are of real benefit to publishers because they drive valuable traffic to their websites. If publishers do not want their websites to appear in search results, technical standards like robots.txt and metatags enable them automatically to prevent the indexation of their content. These Internet standards are nearly universally accepted and are honored by all reputable search engines. In addition, Google has a clear policy of respecting the wishes of content owners. If a newspaper does not want to be part of Google News, we remove their content from our index - all the newspaper has to do is ask. There is no need for legal action and all the associated costs.

In a statement to Reuters, Copiepresse’s Margaret Boribon, declared that she was pleased with the court’s decision, and added that the association would still consider allowing Google to display extracts from the Belgian newspapers for a fee, although she said it was up to Google to initiate contact.

I think Danny Sullivan’s comment, Show Me The Money, Not The Opt-Out, Say Publishers (SearchEngineWatch.com), summarizes the present situation well.

See also commentary at legal firm Pinsent Masons: Google will appeal Copiepresse decision and Why the Belgian court ruled against Google (Out-Law.com).

I’ve just finished writing down my thoughts on adapting Ansel Adams’ Zone System for digital photography and putting them up on my website.

After a lot of trial and (mostly) error, I found that the Zone System is just as useful with digital as it is with film. However, shooting digital is different from shooting film. This meant that some old rules of thumb (e.g. “expose for the shadows, develop for the highlights”) had to be reformulated, and that some new rules of thumb (e.g. Micahel Reichmann’s “expose (to the) right”) is no substitute for using a spot meter.

National Geographic has published their guide to photography web sites. The list is compiled by asking some two dozen photographers about their favourite web sites.

If you know about other photography sites worth visiting, please add a comment, and also tell us why the site you list merits mention.

In addition to the lawsuit for copyright infringment filed in Jult 2006 by Robert Tur’ s Los Angeles News Service, Time-Warner recently announced that it planned to sue YouTube, a very popular site based upon user contributed videos, over copyright infringment.

EFF responded to the annoucement with an article by Fred von Lohmann, saying that YouTube should be safe from infringment due to the limitations of liability relating to material online that follows from Digital Millenium Copyright Act (DMCA), § 512, and in particular from the provisions outlined i DMCA § 512(c) (Information Residing on Systems or Networks at Direction of Users).

This is the infamous notice and takedown part of the DMCA. It was originally designed to protect commercial Internet Service Providers (ISPs), which feared they might be held responsible for the illegal material their customers placed online. EFF claims that it makes YouTube (and other online services with user created content) immune to lawsuits as long as they have adequate procedures to follow up notices about copyright infringment in place.

The core of DMCA § 512(c) is made up of three provisions, and to be immune to lawsuits, the site must meet all, i.e.:

1. (A) does not have actual knowledge that the material is infringing or removes it if it finds out that it is;
2. (B) “does not receive a financial benefit directly attributable to the infringing activity, where the service provider has the right and ability to control such activity; and”
3. (C) responds expeditiously to take down infringing material.

YouTube meets provision (A) and (C). But what about provision (B)? YouTube is funded by advertising, and by displaying advertising on its video pages, YouTube does receive a financial benefit directly attributable to the infringing activity. They also obviously have the ability to control this. For instance, they could delay the placement of revenue generating ads until the content had been vetted and found to not constitute copyright infringment.

In the EU a similar provision is found in the eCommerce Directive (2000/31/EC), article 14-

In the EU, an ISP is not liable for illegal user generated content provided that:

1. (A) “the provider does not have actual knowledge of illegal activity or information and, as regards claims for damages, is not aware of facts or circumstances from which the illegal activity or information is apparent; or”
2. (B) “the provider, upon obtaining such knowledge or awareness, acts expeditiously to remove or to disable access to the information.”

There is nothing like provision (B) in the DMCA § 512(c) in the European eCommerce legal framework. In Europe, EFF’s defence of YouTube should hold up. But I am not so sure about the US.

When Google News launched its Norwegian site on Nov. 16 2006, the Norwegian Media Businesses’ Association (MBL) immediately threatened legal action unless Google refrained from republishing thumbnails of copyrighted images on the site. On Dec. 9 2006, Google succumbed, and removed all images belonging to MBL member sites. Some images appear, but they all originate from sources that are not member of the MBL.

Source: Steffen Fjaervik: Google News Norway Removes Images.

A lot of the spam you find in your mailbox, in particular of the enlargment pill and pump & dump variety originates from a zombie botnet that is created by a trojan known as SpamThru.

Because the SpamThru controller keeps statistics on what version of Windows each infected client is running, down to the service pack level, one can analyze this data to find out what sort of systems are vulnerable to infection.

Joe Stewart of SecureWorks has just published a report with SpamThru statistics, showing that 47.23 % of infected hosts are running Windows/XP SP2. In fact Windows/XP SP2 is dominating the makeup of this particular botnet.

This indicates that contary to claims by many industry analysts, Windows/XP SP2 is still very open to this type of attacks.

Image (left): Facsimile of ad featuring photo of broken iPod.

When photographer Lars Flem took a photo of a friend’s broken iPod Nano, he put a picture of the mishap on Flickr. As many other users on Flickr (including yours truly), he put it there under a Creative Commons Attribution Noncommercial License. This is a license type that let other people use the image provided they make proper attribution (i.e. name Lars Flem as the photographer), except for commercial purposes, such as advertising, advertising supported publications, or publications that are sold for money. The license is very clear on this point. To use this particular image for commercial purposes, you have to buy the rights to do so from the photographer.

But this didn’t stop a major Norwegian chainstore selling electronics and appliances from downloading the image from Flickr and use it to advertise their “Happy Care” appliance insurance scheme. The photographer spotted the ad, and contacted the store and asked for an explanation. After some discussion, the store admitted breech of copyright, and initially offered the photographer goods valued NOK 10000 (US$ 1500) as compensation. The photographer first wanted to know how many times the photograph had been used. It turned out that the photo had been used three times. Normally, a company will pay NOK 1350 (US$ 200) for each use of such a photo, so had the store bought the rights to the photo before using it, their cost for three ads would have been NOK 4050 (US$ 600).

However, in Norway, it is usual to double the amount if the photographers moral rights has been violated by not naming him or her as author of the work, and if an uncredited work is used in advertising, the amount is usually tripled. After thinking things through, the photograher asked for NOK 14000 (US$ 2150) as restitution. This was accepted by the chain store.

My main reason for blogging this is that there has been some doubt whether the Creative Commons License is enforcable. In this case at least, the license was honoured in the end.

Update 2007-10-13: There has been several similar cases recently. For reference, I list those I know about below (please leave a comment if you know about others):

• They stole an image of my son and just had to pay $4000. Norwegian electronics shop uses snapshot of photographer’s infant son, appearently lifted from photographer’s blog, in two catalogues without permission. Resolved through settlement for NOK 20000 (US$ 4000). See also Restitution for copyright breech (in Norwegian).
• Young Concervatives-magazine Stole Front Page Photo (in Norwegian). An image marked “© All rights reserved” was downloaded from Flickr and used on the front page of a magazine for members of a political youth organization and also on their website without permission. Resolved through settlement for € 5980. (US$ 7300)
• A photo of the photographer’s infant daughther was submitted to a photo competition in 2006. It did not win any prizes. The photo was later used in several newspaper adverts by the company hosting the competition, and also given to a partner of that company, which also used the photo for advertising. The infringers first refused to pay for the use, on grounds that by entering the competition, the photographer had implicitly agreed to a clause in the competition’s rules that in effect transferred unlimited usage rights to them for all photos entered. Resolved through settlement, where an undisclosed (but substantial) amount was paid by the two infringing companies as compensation to the photographer and the model.

Two of the more interesting features on Canon’s new EOS 400D DSLR (Rebel XTi in the colonies) is its ultrasonic dust removal feaure (Automatic Sensor Cleaning) accompanied with the ability of Canon’s RAW converter, Digital Photo Profes­sional (DPP), to map out dust particles (Append Dust Delete Data) in software. Michael Reichmann says it “seems to do its job well” in his Rebel XTi first impressions. But Reichmann only had a access to the camera for a few days - not really enough time for dust to accumulate on the sensor - and there is no indication that he looked very hard for dust. Just glancing at some frames and concluding: no dust - so it must work, is IMHO worthless.

Seasoned photographer Bill Hilton has taken a closer look at sensor dust cleaning options in the EOS 400D. This is what he found:

• Canon’s ultrasonic sensor cleaning function does not work very well.
• Canon’s dust removal software do a good job.
• To use this software, one must use Canon’s DPP RAW converter, which might interfere with your workflow if you prefer another RAW converter.

Hmmm… Not very encouraging.

Sony does not seem to do better. In the July 31, 2006 edition of ePhotoZine there is a review of Sony A100 that compares the automatic dust removal feature of the A100 with Olympus E-300. The verdict: “After five cleaning cycles the [Olympus] SuperSonic Wave filter appears to be much more effective than Sony’s solution as it has removed much of the dust from the sensor surface.”

Here is a link to a German web page from 2005 that argues that the Olympus E-1 dust removal feature works.

Update 2007-03-26: Hungarian website PixInfo has now tested all brands. Their verdict on effectiveness: Olympus: 50 %, Canon: 5 %, Pentax: 0 % and Sony: 0 %.

It looks as if the media industry, represented by the World Association of Newspapers, is finally starting to recognize that in order to generate revenue on the Internet, they need to work with search engines, not against them. So they’ve come up with the brand new idea (how is that for subtle irony) of using machine readable metadata to regulate how search regine robots make use of content available online.

The new scheme is called ACAP (Automated Content Access Protocol), and according to a recent press release put out by the association’s British affiliate, it will “provide an automated system, allowing search engine crawlers to recognise copyright content owners’ access and use permissions’ information, instead of merely allowing or forbidding them to search and index the content”.

No technical details are known at the time of writing, but presumably ACAP will allow finer regulation of access rights than the existing opt-out scheme called robots.txt (Robots Exclusion Standard).

A young british boffin, Jonathan Friend, and his startup company Friend Media Technology Systems is causing quite a stir these days with his claims about being able to stop film and music piracy. On September the 8th, Financial Times (Joshua Chaffin: Young gun, FT, Sep. 8th, 2006) devoted two full pages to him and his company.

The story has a dramatic lead in, blaming Universal’s $80-90 million loss on Ang Lee’s movie The Hulk on a single act of Internet piracy by an individual named Kerry Gonzales.

However, whether the movie flopped because of Gonzales indiscretion is debatable. An equally likely cause is that a number of prominent reviewers pronounced it a stinker. In comparison, Spider-man, a Marvel superhero movie reported to be even more heavily pirated than The Hulk, was a huge box-office success.

The FT article reports extensively from a demonstration conducted by Jonathan Friend in New York in September 2006.

Belows are some typical quotes, with my comments:

With a laptop computer hooked up to a large screen at one end of the conference room, Friend logged on to a peer-to-peer file-sharing network like the one Gonzalez had used to post The Hulk. From the library of films and television shows on offer, he selected a music video and, with a few mouse clicks, began to download it. Looking up at the screen, the assembled guests watched a Hollywood nightmare play out in miniature as the blue status bar began to extend from left to right across the monitor, indicating the computer’s progress at digesting the file. Then Friend moved to a separate computer armed with his software. With a few mouse clicks, he activated a blocking measure to interrupt the download. Almost instantly, the bar’s steady progress was interrupted. A task that would have taken a matter of minutes had suddenly been extended to a day or more.

What Friend is doing here, is to mount a denial of service (DOS) attack on the computers serving as sources for the pirated video. This is trivial to do, because the only thing you need to know for mounting a DOS attack on someone is their IP-address, and anyone offering a service on the Internet (in this case the service is a bittorrent) must publicize their IP-adress. DOS-attacks are acts of cyber-terrorism, illegal in most jurisdictions, and highly disruptive of network traffic, legitimate as well as illegitimate. Using a DOS-attack to hamper piracy amounts to digging up the street leading to the pusher’s house to stop drugs trafficking.

As a demonstration, he typed the name of a popular television programme into his software, and soon a column of numbers and flags popped up on the screen, indicating how many illegal copies of the material were available for download in each country at that moment. The US led the field, in this case, with 126, followed by Canada, the Czech Republic and Israel. With a bit more digging, Friend was able to sift the data by city, and then to list specific internet protocol addresses (the unique number identifying a specific computer).

This is pure showmanship. The writer makes it look as if Friend is going through an elaborate process to obtain the internet protocol address (IP-address) of the perpetrator. In fact, the IP-address is his starting point. His software harvests show titles and IP-addresses from publicly available torrent trackers and possibly other peer-to-peer networks. After stuffing this information into his system, he makes a trivial WHOIS-database query to tabulate the results by city and country.

IP addresses are like unlisted phone numbers, and they change regularly throughout the day. Friend claims that he can dig up the history of downloads from particular addresses over time, creating a record of file-sharing behaviour for specific users.

To do this with static IP-addresses is trivial, but there is no way one can do this with dynamic IP-addresses (i.e. those that change regularly throughout the day) without having access to internal logs from ISPs that tells you which IP-addresses are allocated to which user at which specific points in time. I think this claim is either bogus, or that the FT-journalist has misunderstood the claim.

He can determine whether a pirate was working from a company or university - two file-sharing hotbeds because of their fast internet connections - and list their name and location.

This is more credible. Companys and universitys use static addresses, so a WHOIS query will tell him the name of the institution the IP-address belongs to. But most companys and universities also have strict rules against using company/faculty resources for piracy, and most of these also monitor the use of their networks - and will dicipline employees or students enganged in piracy. So the “hotbed” bit of the claim is a bit over the top.

Besides, no sensible pirate will ever use a machine with a static IP-address for his or her activities (unless the machine is hacked and belongs to someone else).

Using route-tracing technology that tracks data in its journey across the trunks and elbows of the internet, he can even pinpoint the latitude and longitude of a downloader to within 10 miles. To illustrate this, Friend gathered the co-ordinates of an IP address that was sharing the television programme and entered them into Google Earth, a downloadable program that maps the world with satellite imagery and aerial photography. Soon a satellite picture appeared on the screen, and after a few enlargements, a patch of land along a road in Kentucky was visible.

This is showmanship with very little practical value. It is probably based upon 3rd party software such IP2Location, which may give accurate coordinates for some static IP-addresses, but is just as likely to give you a completely wrong or out of date answers for dynamic IP-addresses.

Aydin Caginalp, a partner at Alston & Bird, the law firm that represents Friend, claims that his client’s technology has value that extends well beyond piracy. The data could be used as marketing intelligence for entertainment companies, who are just learning to sell products online. Or it could be applied to a whole host of customers in need of internet security, such as banks or even the
military.

Oh, well. Dot-com was not dead after all. The film and music industry is wasting a lot of good money on useless and unworkable technologies these days, and unlike various DRM schemes, Friend’s technology seems to be fairly harmless with respect to legitimate customers. I hope his showmanship gets him the funding he is looking for.

The US National Press Photographers Association’s Code of Ethics says that photo manipulation is unethical:

In documentary photojournalism, it is wrong to alter the content of a photograph in any way (electronically, or in the darkroom) that deceives the public.

This rule has lead to the dismissal of Reuters photographer Adnan Hajj and Los Angeles Times staff photograher Brian Walski, resignation of Toledo Blade staff photographer Allan Detrich, while photojournalist Patrick Schneider has been being stripped of an award and temorary suspended.

Hajj’s and Walski’s actions are univerally condemned. The Scnheider case is more controversial. Read, for instance, photographer Pedro Meyers defence of Schneider, and the blogged debates at PhotoDude, MetaFilter, and ZoneZero.

As pointed out by ZombieTime, digital editing is only one of several ways to fake an image. In a recent editorial, John C. Dvorak argues that most photographs are “fakes”, and that fakeness often has little to do with photo manipulation:

When we really examine photographs, most of them are fakes in the sense that they don’t capture reality. When you see photos of President Bush shaking hands with some diplomat, how fake is that? “Mr. President, look over here. Shake his hand again.” Ribbon cuttings, Derek Jeter signing an autograph, Aunt Millie holding a baby, all posed, fake by any standard. Nobody complains.

Dvorak has a point. Not only are a lot of news photos posed and arranged, but many controversial news photographs are captured in controlled environments. For instance, when field photographers work “embedded” in military units, they are for all intents and purposes working under control by the military. In such cases, their controlling officer can allow access to some zones, while restricting access to others, and thereby have a strong influence on what parts of reality the photographer is able to capture. And even the minute parts that the photographer is able to control himself is subject to other selection mechanisms. By choice of the angle, focal length, point of view, or by leaving things in or out of the scene, the photographer can impose his own meaning on the scene which may or may not coincide with the truth. As this controversy over a 9/11 photograph shows, even that an (inaccurate) caption can alter the meaning of an image.

While the norms for news and feature photography should ban outright photo manipulation, the public need to be aware that also unaltered photographs may be deceptive.

Update, March 2007: Reuters address some of these issues in their new and stricter rules for field photographers. These rules are clearly prompted by the Hajj incident, and the message is that “photoshopping” should be conducted at the picture editor’s desk, and not in the field by the photographer. According to this story in Wired, Adobe is now developing a plugin for Photoshop that will make sure field photograhers follow these rules. The new rules also outlines how Reuters plan to treat photographs captured in a controlled environment, as well as staged and posed photographs. Reuters will allow such photographs, but to make sure the caption divulge the true context of capture.

There is one camera I really would like to own. For lack of a better name, I will call it the DSS (Digital Street­shooter Special). It is inspired by the great rangefinders used for street photography since the 1930ies, but modernized to make use of current technology (autofocus, variable ISO).

But rangefinders are now mainly bought by camera collectors - not working photographers. I want a modern digital camera with a compact size and autofocus. To make it fit in shirt pocket, a zoom lens is out of the question.

I would really like it to be a “system camera”, designed from the ground up, with a range of custom made interchangeable lenses. A good start for the system would be just three lenses: 28mm (wide), 40mm (normal) and 85mm (portrait) - all pin sharp wide open and reasonable fast.

If a “system” is too much to ask for, I would settle for a camera with a fixed lens. A f/2.0 28 mm (135-format FOV equiv.) would be ideal. With 12 Mpx files, cropping (aka. “digital zoom”) is a realistic option if one wants a tighter FOV.

The DSS should come with a plain optical viewfinder with crop marks for the three “standard” focal lengths. There should be an accessory shoe for additional viewfinders. An LCD live view would be nice, but not absolutely necessary.

To summarize, here is the specifications for the DSS:

• No mirror slap, immediate response.
• Fast and accurate tracking autofocus.
• DX, APS-C sized, or larger, sensor.
• Around 12 Mpx resolution.
• B&W (monochrome) sensor. No anti-alias filter.
• RAW mode, as well as RAW+JPEG.
• Good high ISO performance (i.e. usable at least up to ISO 3200).
• Interchangeable lenses, or a pin sharp 28mm f/2.0 fixed lens.
• Hot accessory shoe for flash and accessory viewfinders.
• Optical viewfinder (optional LCD preview would be nice).
• Considerable lower price than the Leica M8 :-).

I think this is realistic with today’s technology. By leaving out the Bayer filter matrix, one gains about 1.5 stops, so ISO 3200 in a B&W sensor requires the same sensitivity as ISO 1200 in a Bayer sensor. The lens is probably the most difficult requirement to meet. It may be that f/2.0 is too much to ask for. Perhaps f/4.0 is a more realistic figure?

How likely is it that some bold manufacturer sets out to design such a system? Not very likely I am afraid. But one can always hope …

Anyone who has tried to buy photographic equipment online is familiar with “bait & switch”, understood as a scheme where a webstore lure you with a very low initial price - then contacts you by phone to sell you a lot of extra junk at inflated prices.

Uk-based(?) webstore DexDigital.co.uk (gone, but resurrected as MobiTeh.co.uk, EastElectronics.co.uk, Gonex.co.uk, AnviDirect.co.uk, cxMusic.co.uk, wMusic.co.uk, DJOnLineStore.co.uk, Aigars.co.uk, OrvisInc.co.uk, StarkDigital.co.uk, DrumTeh.co.uk, Nexton.co.uk, wxComputers.com, DigiEquip.co.uk, DirectInc.co.uk, Xdigi.co.uk, DigitalSys.co.uk, Inteh.co.uk, PactElect.co.uk, PCDale.co.uk, DigitalDale.co.uk, wLogic.co.uk, CarsAudio.co.uk, WizMusic.co.uk, Instrum.co.uk, Euden.co.uk, Axcor.co.uk, Calemet.co.uk and PCdigital.eu) has given this concept a new, and far more sinister, twist. Read on to learn how the scam works.

Dexdigital.co.uk lists their address as “London Business Center, 203 Edgware Road #03-32, W2 1ES - UK”. There is no “London Business Centre”, nor a company named anything like “DexDigital”, at that address - only a reputable company that has been supplying “ironmongery, bathroom and electrical accessories” for years.

If you are an overseas buyer, the only payment option offered by DexDigital.co.uk and its successors are Western Union wire transfer and direct debit. Nothing new here: You transfer your money to them, they steal it.

But if you are an UK-resident, they say you can pay by debit or credit card. And indeed, if you indicate that you want to pay by card, you are taken to a “Secure Payment Page”, which is running a secure protocol as indicated by the padlock symbol. The secure payment page is part of an e-business solution operated by WorldPay - which is a subsidiary of the reputable Bank of Scotland (click on image to see whole page):

As it turns out, bad design on WorldPay’s part (and/or lax security at a website operated by a legitimate WorldPay merchant) has allowed the fraudulent webside to “hijack” the merchant’s secure payment page. If you go through the motions of completing payment, the transaction will initially go through, but then be caught by WorldPay and recognized as freudulent, which will lead to reversal of the transaction (after some time).

As far as I am able to tell, the thieves are not able to use WorldPay/credit card route to steal any money. However, by having a real and working credit card checkout page as “part of” their otherwise very fake web shop, they are able to appear to the casual visitor as to be a “real” webshop recognized by credit card companies (as opposed to the obvious fake sites that “only” accept payment via Western Union).

For some general advice on how to spot online fraud, please see my page on web scams.

For my portofolio I needed some software that would let me publish and maintain photo galleries on the web. I wanted something that was not too expensive, template based, did not require vistors to have flash or any other fancy plugins, was easy to customize, and generated a professional looking website.

I tried out several packages, including the “automate web photo gallery” module in Photoshop CS (which I didn’t like - I found it poorly documented and difficult to customize) before I ended up with David Ekholm’s JAlbum. I first started using it about a year ago, and I still use it, so I guess I like it.

It is by no means the fastest or slickest software I’ve used, but its simplicity, power and flexibility has grown on me. And of course, the price is right (it is free). The documentation is online (FAQ, user manual and tutorials), and while it doesn’t cover every aspect of the program, it is fairly comprehensive. There is also an active user community at the JAlbum site, so it always possible to find support.

This is the things I like the most about JAlbum:

• Almost no effort to create a basic gallery (you just put your images in an image directory, drags it to the image directory line, tell Jalbum what output directory to use - and you’re set). Yet it is possible to control almost every aspect of the gallery if that is what you want.
• Lets you save your settings so when you add more images to a gallery and regenerate it, it retains its “look”.
• It can be instructed to link to original images (so it just generates the thumbnails). Most other gallery software insist on resizing your images, creating extra JPEG and sharpening artefacts.
• The linking-to-original-images feature even let you create galleries consisting of images in several directories, so you can reuse images without creating duplicates.
• It recognizes EXIF and IPTC tags, and automatically generates captions based on these.
• It is easy to rearrange images (drag&drop) and to add or edit captions.

The only feature missing, as far as I am concerned, is a facility for visitors to add comments to the images. I might add that feature myself one day. JAlbum looks like it is easy to extend, just by hooking into an existing or custom made “skin”.

Microsoft Live Labs has just put out couple of new videos of a technology they call PhotoSynth. It is a software system that from an ordinary 2D starter image pulls together other 2D images relatated to it from the web and synthesises a 3D navigationable space from all these photographs. Click here to see the videos.

The technology is pretty cool in itself, but just as interesting is that this is a great example of how remix culture may work. If you had to clear the rights of all those images before you could start synthesising the 3D model, the whole thing would be rather pointless. But if the application is made to ignore image copyrights, or to work with some system for automatic clearing (e.g. Creative Commons), then this thing would really shine!