Stewart Baker moves his blog

If you've been looking here, at Homeland Reading List, for imprudent Baker blogs, please note that I've moved to a new address: http://www.skatingonstilts.com/

"Skating on Stilts" is the working title of a forthcoming book on DHS and technology.

A European abuse of human rights that couldn't happen in America, but will happen to Americans

UK libel law has always been a great way for the wealthy to bankrupt their critics.  Now it's not just being used by terror financiers and their friends.  Chiropractors are suing to shut up their critics, and it appears that U.K. judges are enthusiastically stacking the deck against Internet critics of chiropractors' dubious claims.  This kind of human rights violation could not happen in the US, but UK courts are surprisingly willing to impose their values on the rest of the Internet, so it can happen to Americans who have the temerity to use the Internet. 

You might almost think that Europe is the seat of legal imperialism and unilateralism. 

Do hospitals and governors make money off medical identity theft?

OK, here I'll go out on a limb. I would appreciate some help from any readers, because I'm a little out of my area of expertise, but I've been doing some more thinking about medical identity theft, and there's a scary possibility that hospitals and governors might actually profit from some forms of medical identity theft.

Here's my thinking. Contradictions welcome:

Let's start with something I know for sure. If you're an illegal immigrant in the United States, you're not supposed to work here. With some modest exceptions, though, illegal workers have found that they can beat the system if they steal the name and Social Security Number of an American. And in many industries, such as meat-packing, identity theft by illegal workers is endemic. All of those workers, then, have IDs in the name of an American and they also have that American's social security number, which they used to get their job.

Now suppose you're an illegal worker who's just been laid off from an Iowa meat packing company when you discover you've got a serious disease -- heart problems or cancer or diabetes, say. You can't afford treatment for such a thing. So you go to the local hospital, and they tell you that, under federal law, only legal immigrants can get subsidized nonemergency treatment.

This is a problem for you, and for the hospital. You still want treatment, and the hospital is full of people who would feel pretty bad about themselves if they turned you away. You might die untreated or go home to get what they consider substandard care. Doctors don't like to think they would turn away anyone just because they can't pay, but realistically they can't afford to treat all the poor illegal immigrants in the community. Most of them probably think Congress made a terrible mistake in refusing treatment to anyone in the U.S. But not strongly enough so they want to provide the care without reimbursement.

That tension sends the hospitals back to the rule book. Is there a loophole? Well, maybe. Exactly what, they ask, do you need to do to prove that you are a legal immigrant? In 1996, Congress said you had to produce actual evidence that you were here legally -- a passport or a birth certificate, mainly. But that was a hassle for Americans and for hospitals. Not to mention illegal immigrants. So Congress decided last year to ease the requirement. Now you only have to produce proof of identity, plus a social security number that matches your name.

That's good for deserving poor people who've lost their documents. But it's even better for illegal workers, many of whom have already obtained a driver's license in the name of some poor American, whose SSN they've also borrowed. If the illegal worker presents that license and SSN, everyone's problems are solved. The illegal immigrant gets treatment, the hospital workers feel good about themselves, plus they don't have to pay a price for feeling good about themselves, because Medicaid is picking up the tab. And the State, which is on the hook for reimbursing the hospital, can pass the cost on to the the federal government. Everybody wins, except for the federal budget and the poor schlub whose medical records will be screwed up forever.

In short, the state and the hospital have a powerful economic incentive to look the other way when patients use stolen identities to get medical treatment. If no one looks too closely, the hospital and the state will come out fine. They'll all get paid, and the patient will get treated. But if the state or the hospital cracks down on fraud and stolen identities, they'll end up stuck with patients who can't easily be turned away but whose care will go unreimbursed, costing the hospital or the state a lot of money.

So, what could mess this sweet deal up? Well, better security standards for driver's licenses could. The harder it is to get a license using a fake name, the more likely it is that illegal immigrants will not be able to fake their way into the Medicaid program. And that will put hospitals and state reimbursement authorities back in the moral and economic dilemma of how to handle illegal immigrants with serious diseases.

So getting rid of REAL ID and making sure that driver's license security continues to be bad may save the states money in two ways. First, they won't have to pay for things like validating breeder documents. And second, by making identity theft easier, it will allow states and hospitals to get federal reimbursement after they treat people who aren't actually eligible for Medicaid. As long as they don't look too closely at their patients' actual legal status.

So the complaint by governors that REAL ID will cost them billions might actually be true. Of course, not having REAL ID will cost federal taxpayers those same billions, but that's not the governors' problem.

Oh, and the risk that your medical records will be contaminated by an identity thief's blood type, allergies, and health conditions? Also not the governors' problem. They've got budget problems to worry about, and this is a twofer. What, did you think they were elected to worry about you?

***

OK, that's harsh. And maybe I've missed something in the way the incentives of the Medicaid and Medicare programs work; that's not my field. I'm happy to correct myself if I've been too cynical about the way all this fits together. Let me know.

Wait! Does that mean the National Governors Association is going to kill us?

The medical identity theft report I cited earlier shows a startling connection between medical identity theft, REAL ID, and the National Governor's Association.

The report contains this charmingly clueless passage about what health care providers are doing to stop medical ID theft.

Some providers at Kaiser Permanente, a health network with 30 medical centers and 431 medical offices, now ask to see a driver’s license in addition to the program’s health card. The University of Connecticut Health Center, concerned after a case of medical identity theft occurred there, began checking patient driver’s licenses.

That would be a great idea if driver's licenses were actually a secure form of identification. But they aren't. They suffer from a variety of bad security practices that make it easy to get a real license issued in a false name. That's something that REAL ID was designed to fix. To take one example, it would have required states to actually perform an electronic validation of "breeder documents," like birth certificates, before the documents could be used to obtain a license.

But the National Governors Association doesn't want states to have to spend money improving driver's license security, and it bridles at the federal government setting standards for license security. NGA is leading the charge to repeal REAL ID and substitute a new driver's license law that would among other things eliminate any need for states to validate breeder documents. The NGA is likely to win that battle.

If they succeed, of course, it will remain easy for people to get driver's licenses in other people's names. And then to get medical treatment in other people's names. And in the process to change the blood types on record for the poor sucker whose identity they've stolen with that driver's license.

(The privacy advocates who neglected identity theft when HIPAA was passed are playing an even worse role here. The ACLU and others are campaigning to repeal REAL ID, and they've laid down covering fire for the NGA's attack. So in the name of protecting privacy, they're making the world safer for what could be deadly forms of privacy invasion.)

So if you're wondering whether your governor is trying to kill you, the fairest answer is "Not exactly." That's just a side effect of the effort to unravel REAL ID.

Identity theft can kill you?

Yep. How so? Well, first, medical ID theft is a growing problem. Here's a fascinating report on this undercovered problem: http://www.worldprivacyforum.org/pdf/wpf_medicalidtheft2006.pdf

It turns out that doctors and nurses with a drug problem make fake entries in patient files to justify prescriptions that they fill for themselves. Medicare and Medicaid fraudsters concoct entire courses of treatment for real people and bill for them. And illegal immigrants who wouldn't be eligible for services on their own use the identities they've already stolen to get jobs as a way of getting treatment.

That's bad, but what's especially troubling for ordinary citizens is the way it screws up their medical records. They may only find out about the fraud when they're told they've used up the lifetime health insurance limits they paid for. Or, worse, they could go in for treatment unconscious and be given a transfusion of the wrong blood type because their records had been altered to match the blood type of the identity thief. That's a pretty heavy price to pay for identity theft. And it's likely to get worse as the Administration's electronic medical record initiative takes hold, and medical records are increasingly consolidated into a single electronic patient history that is accessible by all providers.

HIPAA, perhaps unsurprisingly, is more or less useless in addressing the problem. The privacy advocates who helped draft it were so busy abusing pharmaceutical companies and insurers that they evidently didn't have time to think about privacy violations that might kill us.

Does hacking fund terrorism? Maybe so

I'm still waiting to see evidence that music and move piracy has been used to fund terrorism, but the Post has a remarkable story about hacking that may have funded terrorism.

The story also shows how hard it will be to deal with this problem. The scam featured a Jordanian and a bunch of Pakistanis and Filipinos operating out of the Philippines and Italy; they hacked into PBXes with weak security and then charged calls around the world to the unsuspecting companies that owned the PBXs. The calls were made from Italian call centers and generated profits that the authorities suspect went to terrorist groups in the Philippines.

But after a three-year FBI investigation, the Bureau arrested exactly zero suspects, and the indictment filed by Justice will sit in the NJ district court while the authorities in Italy and the Philippines decide what to do with the people they arrested. For a law enforcement culture that values busts and convictions, this can't be an entirely satisfying conclusion to a heavy investment in resources. But without that investment, our infrastructure will be increasingly at the mercy of organized crime and perhaps even terrorists.

Missing the point on cyber security

The Washington Post decides that the new cyber-command is mainly interesting because it is an opportunity to raise privacy concerns. Here's the lead:

The Pentagon's development of a "cyber-command" is prompting questions
about its role in the larger national strategy to protect government
and private-sector computer networks and whether privacy can be
protected. And the command is fueling debate over the proper rules to
govern a new kind of warfare in which unannounced adversaries using
bits of computer code can launch transnational attacks.

We're actually closer to 1984 than most people realize. Antidemocratic forces have the ability to turn on cameras in our homes and offices -- to monitor our every action and every keystroke. That's the lesson of the ghostnet report. http://www.scribd.com/doc/13731776/Tracking-GhostNet-Investigating-a-Cyber-Espionage-Network

But you won't find any sign of that problem in today's story.

That's because the 1984ish powers aren't being exercised by the US government or NSA. And apparently there's no room in the Post for a story that doesn't make the US and NSA the chief privacy villains.

Downgrading Biological Weapons Funding?

If H1N1 gets bad, the Obama administration plans to fund its response effort by pulling billions out of the fund devoted to bioweapons defense.  The bipartisan WMD commission thinks that's irresponsible.  The commission is right.

Sec. Napolitano: "I'm a big supporter of E-Verify."

Whew!  That's a relief.  Otherwise, she might, you know, just keep delaying the federal contractor rule -- over and over and over again.

Girl Talk

Most of my workout picks were pretty obvious, but Girl Talk deserves a bit of context. Girl Talk is really Greg Gillis, a Pittsburgh biomedical researcher (if he worked with Tara O'Toole, it's time to queue the Twilight Zone theme).

Girl Talk's been doing mashups and concerts for years, and he's got a brilliantly exacting sense of timing and a knack for finding unlikely cuts to mash up. I hear the sixties in there; you'll hear whatever music was popular when you were seventeen. Remarkably, he's sampled dozens of popular artists without being subjected to the large licensing demands that usually come with sampling. It turns out to be easier to make music these days if you're judgment-proof; he just stopped worrying about legal rights and released his music. But the music industry deserves some credit for letting him continue to sample unmolested. (He's apparently offered some small fees that reflect his returns to sampled artists.)

Girl Talk isn't for everyone. You'll like it if you like M.I.A. and have to have a high tolerance for bad language, of both the old school (the seven dirty words) and the new school (ethnic and racial slurs). Even then, some of the material is too hip-hop for me.

I wanted to post a clip or two here, but Blogger only allows the posting of videos, not mp3s -- I assume that's the result of music industry antipiracy scrutiny. But the good news is that you can sample the music free. Girl Talk's album is available (in a Creative Commons license) on a "pay what you want" basis here. So you can pay nothing, download the album, and decide whether it's worth anything to you. Then you can go back and pay -- and they'll throw in bonuses if you pay more than $10. Of course, you'll have to explain to your spouse why there's a charge for "Illegal Art" on your credit card. That's Girl Talk's label.

Evolution of the Cyber "Czar" in Four Easy Steps

Remember the original proposal for a cyber "czar" who would bring coherence to all network security activities across the government? The lines of authority would be crisp and clear. The cyber czar would report directly to the President as a sign of his or her authority. He or she could just walk into the Oval Office all alone and tell it like it is.

Need an organization chart? Piece of cake:Well, on second hand, that may not quite work. Cyber security is a matter of national security, and the departments need to weigh in on cyber issues through existing channels.

But, really, that's no problem. We'll put the cyber czar into the National Security Council. There will still be one voice and one chain of command for all cyber security issues. It will just go up through the National Security Adviser. And, of course, the National Security Adviser will escort the czar into the Oval Office.

Guess we'll have to change the title, though:


Wait! We reckoned without Larry Summers and the National Economic Council. We don't want national security types running amok and wrecking the most innovative sector of the economy with incautious regulation in the name of security.

Anything the cyber czar does really needs to be subject to the full discipline of an economic review. Make the position part of the NEC process too. The czar can report up through both the National Security Adviser and the National Economic Adviser. Once the czar has found a position that both advisers can agree on, well, they'll both go into the Oval Office with him, just to keep him honest.

Okay, with two bosses, perhaps another description of the position is in order:



Hold the presses! NEC isn't the only White House office that wants to assert its prerogatives. What about OMB, which traditionally sets budget standards and measures departmental compliance with White House priorities? What about the CIO and CTO positions that the President just filled with such fanfare? They aren't chopped liver. Cyber security is all about information and technology. Oh, and the Office of Science and Technology Policy -- what is cyber security policy if it isn't science and technology policy?

Better give them a veto over what the cyber czar says to the President, too. We'll have to move the meetings out of the Oval Office, of course, but there's bound to be an auditorium nearby.

With these changes, we'll need a new org chart and a new title, but surely there's a czar who could serve as a role model for the position. ... Um ... hang on ... it'll come to us ...

Yes! We've got it:

Messing with Moblin

Last week, I downloaded the Moblin 2 beta and installed it on an Asus Eee. It's a pretty quick boot, the boot manager is slick, and the beta is reasonably bug free.

But I don't get it.

The interface is willfully different. Navigation requires clicking on utterly uncommunicative icons whose labels only show up with a mouseover. Here's one: oOo. That says it all, eh? Even the mouseover just tells you it is the icon for "zones". Whuh? In fact, it's where active applications are displayed.

I feel the same way about Chrome, the Google browser. Using it, I miss my Firefox tabs and addons, and I sort of resent being told that I have to learn a whole bunch of new conventions with no promise that the system will actually work better. Of course, the interface is more austere and Applish and aesthetically satisfying, so I guess we're supposed to sit down and shut up. It's Design, and Design has only a limited interest in the hoi polloi.

I'm also having trouble figuring out where the repository is for apps like open office. (Contacts and calendar programs come with the install, but not a word processor.)

Oh, and somehow it doesn't seem possible to display websites on the whole screen. There's always a good half-inch of black space at the top of the screen that I can't get rid of. Not sure whether to blame Moblin or Chrome, but it's a good 10% of the screen on a netbook, and I can't afford to lose it.

Ok, I suppose there are some advantages to Linux here, but frankly, I'm using the XP partition on the same machine a lot more than I'm using the Moblin partition. XP is almost as fast to boot, and Firefox over XP is as speedy as Chrome. It finds my Wifi connection automatically as soon as the netbook is turned on. Moblin in contrast just sits there and waits for me to remember to go turn wireless on, usually after I've said, "Hey, how come none of my websites are coming up?" I bet all this is fixable if I tweaked a few settings. But Moblin is too new to have a bunch of support sites to mine for advice.

All in all, an argument for being conservative about computer interfaces. (Of course, for a 20% discount off the price, lots of people would learn a new interface, so the real question is whether netbook makers will pass on Linux's low initial cost to buyers, who will then see a reason to try new interfaces.

New workout music

Current favorites:

Jazmine Sullivan's "Bust the windows out your car" -- Soaring strings. Great beat. Vindictive woman. Hard to resist.

BoA -- K-pop: where Britney's music team went when Britney lost it

Daddy Yankee -- reggaeton with swagger

Mark Ronson's love affair with horns pays off again in "God Put A Smile Upon Your Face"

Maybe best of all: Girl Talk -- mashes and remixes the sixties into a sweet puree

He didn't even have to hear the announcement or read the report

To ask "Who Would Want to Be the Cyber-security Czar?"

And then there's this:

President Obama has made document and information security a priority,
and we’re nearing the end of a 60-day review period. That’s just a
fancy way for the government to say they’ve studied a problem to the
point where they can announce more work needs to be done.

Ouch.

Why you shouldn't get your US domestic news from Australian papers

Instapundit and Slashdot (and probably others) are featuring a story about Homeland Security scanning the fingerprints of travellers leaving the US.

Unfortunately, the story, from an Australian IT outlet, made serious errors. It claimed incorrectly that US citizens would be fingerscanned. It also succumbed to the assumption that any idea that can be made to sound like creepy and dumb security must have been the brainchild of the Bush Administration, accepted only reluctantly by the new administration.

In fact, the requirement for fingerprints on exit was first put in law in 1996, was recommended again by the 9/11 Commission, and was also included in the 9/11 implementation act. Despite this, the Bush administration was always a little ambivalent about the requirement -- mainly because the requirement is not a security measure.

Departing travelers are, well, departing. If they're terrorists, they've had their chance to attack us already.

Plus we already get passport data on departing passengers. Getting fingerprints too just makes the identification a little more certain, so the error rate goes down two or three percent. Since fingerprints are a hassle for everyone, and expensive, the Bush administration was pushed by Congress into gathering prints on exit. Congress has in essence said that Poland and other candidate countries will not be eligible for visa-free travel unless the Administration implements prints-on-exit.

Congress wants the prints because some in Congress believe visa-free travelers overstay their 90-day travel permission and become illegal immigrants. If people must check in and then check out, Congress believes, we could track down the ones who don't check out and deport them. Even if overstays from this group were a big problem, and in the scheme of things it probably isn't (these are travelers from developed countries, after all), it isn't particularly cost-effective to create a big program just so we'll have marginally more accurate check-out records. What exactly will we do with the newly improved list of people who didn't leave on time? It wasn't likely that the Bush administration would find the resources to track down every overstaying backpacker from Japan, and it's even less likely that the Obama administration would treat that as a priority. So we're perfecting a bookkeeping system that probably will never be used in the fashion that Congress envisions.

My guess is that the Obama administration is setting up fingerscan pilots for the same reason that the Bush administration probably would have -- to preserve the option of bringing new countries into the visa-free travel program. But the idea that this is some Bush administration plot foisted on the new guys is a figment of Aussie media imagination.

O'Toole hit job, part 2

Milton Leitenberg, the author of the "Army War College report," has asked me to put up a few points that he'd like to make about my Tara O'Toole post. Leitenberg's points are below, followed by my comments.

1. Leitenberg says that, in fact, the Army War College did not pay for the study:

There was NO "contract", neither to the University of Maryland, to the institute at which I sit, the Center for International and Security Studies , nor to me. Nor, as is implied by the word "contract", was there any payment for the work, which took about six months to complete. Instead, the editor of the publication series produced by the Strategic Studies Institute at the US AWC solicited the study from me after seeing an earlier conference paper that was published in another book.... In fact the University does not provide me with a salary either. I have been working that way for some years now. (I am 75.5 years in age ....) But I have been working on CBW issues since the mid-1960's. Some of my recent and current work is funded by Foundation grants ( a book about the history of the Soviet BW program) , but some is not , and this was not. In this case, it didn't even occur to me to ask the AWC/SSI if they could provide any funds because I simply assumed that they didn't do that."

2. Leitenberg says it's not unusual for an AWC study to include a disclaimer that it doesn't reflect the views of the Army:

"[T]hat statement and the rest of that page appears in precisely the same format in every AWC publication, even ones written by members of the Army War College faculty, which is the great majority of the cases, and even if those AWC faculty have been there 10 and 20 years. The statement therefore denoted no specific disengagement by the AWC/SSI from my text in any way different from that of any other author whose work they publish . "

3. Leitenberg also feels that I did not do justice to the length and heft of his work:

"Finally, other reviewers have referred to that study as a "book" , but in any case, 115 pages is most certainly not an "op-ed"."

My responses:

1. Leitenberg is correct but off point. The point of my original post was that the Leitenberg report was not "an Army War College report" because it was not written or endorsed by the Army War College. That's true. It was written by Milton Leitenberg, and it reflects his views, not those of the Army War College. Does it matter that Leitenberg was not paid, which is the error Leitenberg is complaining about? I don't see how. It's still a personal opinion piece; indeed, not being paid for the report separates it even further from the Army War College. (Usually, research you pay for is likely to be something you value; getting a research paper for free doesn't imply the same level of interest or commitment.)

2. This is not really a correction but an objection to something I didn't say. I didn't say that the AWC has repudiated Leitenberg, simply that they haven't endorsed him, and thus that it's misleading to call his very strong views, as Wired does, an "Army War College report." Leitenberg's point isn't wrong; it's just not relevant to my post.

3. Again, he's right but off point. The report is long; I'd be happy to call it a short book. A short and highly opinionated book. Which was my point. This is not a careful, even-handed government report, it's the work of a man with a very definite point of view.

And a very particular style of argument. Remember Leitenberg's complaint that the 2002 exercise was unrealistic because one of al-Qaeda's main bioterror researcher's had already been arrested? It was correct but irrelevant to the purpose of the exercise, which was to focus on things al-Qaeda might be able to do, not things it had a verified capability to do on a particular day.

His notes to me are very similar in style. You can't say the criticisms are wrong, exactly; they just sort of miss the point, or bury it in an avalanche of literalism. And they're accompanied by much the same misplaced passion. At one point he calls my original post "completely concocted disinformation," which seems a little overwrought given the irrelevance of the correction.

Now that I've corresponded with Milton Leitenberg, I have more sympathy than ever for Tara O'Toole.

RIM: hopeless

I thought I might download a few apps from the BlackBerry apps store.  Bad idea.  RIM seems determined to discourage customers.  You can't use its apps shop if you run Firefox; IE is required.  You also have to run ActiveX, a remarkably unsafe product to enable.  And you have to open a PayPal account.  All just to browse the store. 

Good luck with that, RIM.

Ka-boom! Can't get enough

Just because, really, you can't get enough pix of exploding buses, here's the best story yet on the "black box camera" that DHS Policy drove through the bureaucracy. CNN Tech - Big boom economics

A hit job on Tara O'Toole

Wired Magazine has smeared the new DHS nominee for Science and Technology, Tara O'Toole, as a “bioterror disaster.” I may have met O'Toole, and I certainly know her work, which left me impressed, so the attack on her seemed unfair. Even the first piece recognized that O'Toole is “a doctor, the CEO of the University of Pittburgh’s Center for Biosecurity, the former chairwoman of the Federation of American Scientists, and the brains behind a series of influential disaster response exercises that woke Washington up to the threat of terrorists with weapons of massive destruction.” In a remarkable display of support, the comment section of the article was immediately flooded by signed statements from prestigious scientists rebutting the claim, forcing the publication of a second, slightly more balanced article. (I apologize the lack of hyperlinks to this and other web accessible documents, but Scribefire, which is very convenient for some things, such as linking to a single article, is pretty much unbearably clunky for others, such as inserting new links or removing doublespacing from quotes.)

Even taken together, though, the Wired articles add up to a hit job designed to slow her confirmation. They are not even-handed journalism.

Why do I think that? Well, to take one example, Wired claims in both articles that O'Toole's war game scenarios in 2002 and 2005 were criticized in “an Army War College report” for “grossly misleading assumptions.”

The problem with that claim is that the reporter doesn't seem to have actually read the front pages of the report. The report was, it's true, paid for by the U.S. Army. But it says at the start that “The views expressed in this report are those of the author and do not necessarily reflect the official policy or position of the Department of the Army, the Department of Defense, or the U.S. Government.”

In this case, that's not boilerplate. The contract was apparently given to a Maryland research institute, which in turn subcontracted it to Milton Leitenberg, who is listed as the sole author. That's as it should be, because the report is clearly a personal op-ed in support of the proposition that, as he says, “Bioterrorism may or may not develop into a serious concern in the future, but it is not 'one of the most pressing problems that we have on the planet today.'” (Emphasis in original.) Leitenberg's candidate for the planet's “most pressing problem” seems to be getting ready for pandemic flu, which he (a bit anomalously) seems to think is not related to preparing for biological terrorism.

So the whole point of the Leitenberg study is to debunk bioterrorism as a risk. In that cause, he attacks the 2002 and 2005 bioterrorism exercises for what he thinks are unrealistic assumptions. That criticism boils down to the assertion that al-Qaeda is not (quite) ready to launch (exactly) the attack set forth in the exercises. Below, I quote a sample of the criticism; see how persuasive you find it.

First, Leitenberg explains the scenario's backstory:

The scenario posits that the al-Qaida group’s scientists received microbiological training at Indian and U.S. universities. These scientists received additional training when the group hired a scientist who was part of the former Soviet Union’s offensive biological weapons program. ... Then, with their own microbiology training, the terrorist group was able to acquire all the required laboratory equipment to grow and process the Variola major seed stock they had acquired into a relatively high-quality dry powder that was then used in the attacks.

Then he explains why this backstory is unrealistic:

In the real world, Al-Qaida had one single individual who had received a BS degree in Biology “with a clinical concentration” at a U.S. college. He could in no way be described as a “scientist.” Furthermore, he was arrested in December 2001. The individual with more advanced training who supplied al-Qaida with its microbiological literature was unwilling to himself do any laboratory work for them. The few pieces of standard equipment obtained by the group in Afghanistan were rudimentary in the extreme.

I find this utterly unpersuasive. Does Leitenberg really believe that we should only prepare for attacks that al Qaeda could carry out with exactly the personnel they had in 2001? Since the only real proof of al Qaeda's capability is likely to be an attack, that's not a recipe for being prepared. That's also not a lesson you'd expect government to learn from 9/11, which featured tactics and capabilities al Qaeda hadn't used before. And finally, that's not the usual basis for exercises, which ought to stretch the participants to respond to a range of possible disasters.

Leitenberg's criticisms of the exercise scenarios are such a stretch that they suggest he has a pretty big policy axe to grind. And Wired's credulous citation of his personal views as an “Army War College report” suggests that Wired is holding the grindstone.

That's not the only time Wired slants its coverage. Wired gives loving attention to this quote from Rutgers researcher Richard Ebright:

“O’Toole is as out of touch with reality, and as paranoiac, as former Vice President Cheney. It would be hard to think of a person less well suited for the position. ... She was the single most extreme person, either in or out of government, advocating for a massive biodefense expansion and relaxation of provisions for safety and security. She makes Dr. Strangelove look sane.”

OK, we're all aware of the Hitler rule -- the first debater to compare his opponent to Hitler has already admitted he's losing on the merits. I think we can update it a bit; in academic debate, it should be prima facie evidence that you've lost your sense of balance if you invoke both Richard Cheney and Dr. Strangelove in talking about a colleague.

Does Wired ask whether Ebright might also have his own axe to grind, something that would account for this peculiar passion? Nope.

But you don't have to dig far into Google before you discover that Dr. Ebright is a biological researcher who has received NIH funding – and who has argued passionately that research projects like O'Toole's have improperly shifted NIH funding away from traditional biological projects and toward the kind of research Ebright doesn't do.

Here's an excerpt from an undated Ebright slide show criticizing NIH for foolishly funding bioterror research in heavily secured labs. It's a heartfelt point of view; Ebright even puts it in red font so no one will miss it:

“[S]ub-par research has been funded. As a further result, an incentive structure has been created that has diverted scientists out of highly promising, biodefense-relevant, model-microorganisms and non-bioweapons-agents-pathogens research (where funding is tight and competitive) into less promising bioweapons-agents research (where funding is loose and easy).”

Now I'm not competent to judge whether Ebright himself has asked for funding to do “highly promising, biodefense-relevant, model-microorganisms and non-bioweapons-agents-pathogens research (where funding is tight and competitive).” But I think any reader of the Wired article would want to know just how personally Ebright thinks he's been affected by O'Toole's success in attracting funds.

At a minimum, even without a personal interest on Ebright's part, it seems clear that Wired has wandered into a medical researchers' food fight of epic proportions, with billions in funding at stake. Ebright is probably right to worry that O'Toole's appointment makes it less likely we'll see a return to the good old days of lavish funding for the “highly promising, biodefense-relevant, model-microorganisms and non-bioweapons-agents-pathogens research” that Ebright likes.

But descending to personal smears to shift NIH funding priorities is unworthy of him and of Wired.

Hey, this is good news

Tara O’Toole for Science and Technology.  Tara O'Toole is smart and has a clear focus on biological weapons risks.  Can't do better than that.