I'd have posted a response yesterday, but I was up to my ears trying to help my sister root out a new type of hack attack(*). As far as I can tell, it's not yet known to the security authorities (or not yet studied enough to go public with), and I've reported it to CERT.

My sister's computer has anti-virus software. AV software can only look for the signature of known viruses, and do a small number of algorithmic checks looking for certain patterns of activity. A new virus has to attack first before it's discovered and an antidote is formulated. AV software can only block viruses coming in on certain channels such as email; scanning the hard disk for an installed virus amounts to closing the barn door after the horses have escaped. The damage is already done.

The battle with hackers is an ongoing arms race, an eternal back-and-forth...

How long do you think the sophisticated computer user community would let them get away with that? Five minutes? Fifteen at the outside.

...with, as you say, a cycle time of five to fifteen minutes. Countermeasures without end. I'm not as sanguine as you, and I have to say with all due humility that it's because I'm more familiar with the subject. There is no permanent technological defense against digital attacks.

The Net is usually characterized as a frontier place populated by rugged individualists. That's mostly true, but certain key functions of the Net are based on trust: Digital certificate authorities, firewall and other security software, anti-virus software makers, and so on. Like Caesar's wife, these trusted parties must not only be above suspicion, they must be above the appearance of suspicion; and the government's new powers to coerce their cooperation undermines that trust. The possibility that we can't trust them is materially damaging in itself.

The guy who runs my ISP has told me (long prior to 9-11) that he's been visited by the FBI and has cooperated with them. I have to live with the non-trivial possibility that there's already a Carnivore box installed at my ISP intercepting my email. Does that make me a "conspiracy nut"? I don't think so...

Wake up, Tom. This is real.

--Robert

*--the hack attack, FYI:

Do not, ever, visit the Web site 0190-dialer.com. Its front page tries to install some nasty software on your computer that replaces your modem dialer with a dialer set to call a 900 number, and no doubt charge your phone bill hundreds/hour for Internet service. It has multiple points of infection, installs itself in multiple places, and uses at least three methods of ensuring it runs each time you boot your computer. Because of that, if you don't get all the infection out, it comes back, over and over. It took hours to root it out. I reported it to CERT, but (amusingly enough), they're out on holiday until January. Oh well...