World Of Gadget

If you live in the US and have found 3G speeds aren’t cutting it for wireless data, the only game in town has been Sprint/Clearwire, which now offers WiMAX service in over 40 cities in the US. But just about everyone else in the cellular business is backing the alternative 4G wireless protocol, Long Term Evolution (LTE), meaning that the fight for next-generation supremacy will come down to Clearwire’s first mover advantage vs. LTE’s extensive adoption. Verizon appears to be doing its part to reduce that advantage, easily making its self-imposed deadline of starting service deployments in 2009.

As recently as February, Verizon was promising that it would be starting trials of LTE equipment by the time the year was out. The telecom has now announced that the tests had already been successful, with what it termed “data calls” being conducted in both Seattle and Boston. The fact that the company seems to be well ahead of its announced schedule bodes well for its stated plan to have up to 30 cities set for service by the end of next year.

The announcement also made one of LTE’s advantages over WiMax clear: a number of traditional wireless telecom powers were backing it. The tests’ description read a bit like a who’s who of the cellular world. Network equipment came from Starent Networks and Nokia Siemens Networks, Alcatel-Lucent and Ericsson provided the base station hardware, and devices were provided by LG and Samsung.

That’s in addition to LTE’s other advantages, such as higher maximum bandwidth (50-100Mbit/s downstream, depending on the amount of spectrum allocated) and multiple backers (Verizon, AT&T, and T-Mobile in the US), and backwards compatibility with GSM handsets.

But a key factor may ultimately wind up being bank balances. Verizon has continued to grow its earnings throughout the financial crisis, and wireless services account for nearly 90 percent of its income; it can’t afford to appear as an also-ran, and has the money to make sure that it doesn’t. Clearwire benefits from the deep pockets of its backers, most notably Intel, and has nearly $2.5 billion in the bank, according to its recent earnings release. But, at its current rate of operating losses, that cash will last it less than three years.

All of that may give LTE an edge even before AT&T gets involved, which is expected to happen in 2012. Of course, as iPhone users have found out, the company is still straining to provide reliable 3G service, so any expectations about its next steps seem premature.

Citizens living in China, Vietnam, Iran, and other countries may soon have another option for bypassing Internet filters, courtesy of a US-based agency. The Broadcasting Board of Governors (BBG) announced on Friday that it was working on a new system that would use e-mail to carry encrypted data to and from the recipient, including information that would otherwise be blocked.

The system, called “feed over e-mail” (FOE), is not yet ready for primetime, but BBG IT head Ken Berman said that it will be tested in China and Iran when it goes into beta. “China is the benchmark, the gold standard, of Internet censorship,” Berman told the AFP. “We try things. The idea is to extend freedom of the Internet, freedom of the press, freedom of inquiry to those that want to know more.”

Because the BBG would like to avoid tipping off the two governments before the software even gets to be tested, there are few details on how FOE currently works. It does, however, appear to be taking a different approach to filter circumvention by using e-mail instead of the traditional Web proxies used by some of the more prominent systems. Berman said that FOE uses encryption that comes with most e-mail systems, including Gmail, Yahoo Mail, and even Hotmail, to transmit news. One individual who helped develop FOE, Sho Ho, told Reuters that it could easily be tweaked to work with mobile phones, as well.

The announcement about FOE comes just as Internet censorship seems to be all over the news—China and Malaysia recently scaled back their plans to mandate more filtering, while Vietnam added an additional layer. These three are just the beginning, though; Reporters Without Borders also points the finger at Burma, Cuba, North Korea, Egypt, Iran, Saudi Arabia, Syria, Tunisia, Turkmenistan, and Uzbekistan for being “Enemies of the Internet,” and numerous others engage in some level of blocking or filtering.

FOE is making headlines because of its different approach to delivering content, not to mention that it’s essentially being funded by taxpayer dollars (BBG is responsible for Radio Free Europe, Radio Free Asia, Voice of America, the Middle East Broadcasting Networks, and all other non-military broadcasting for the US government). For many of the people behind the filters, however, FOE will just offer yet another option for getting around the government’s restrictions.

“Chinese netizens have been using proxy servers to access the information blocked by the government for a long time, FOE is just a more convenient tool,” China New Media Communication Association director Hu Yong told the China Daily. Indeed, the University of Toronto’s Citizen Lab even released a guide to bypassing Internet filters in 2007 that contains a list of proxy and tunneling software, so if FOE makes it to a final release, it will likely be added to the list of possible choices for those looking for forbidden information.

There’s a new battle developing in the bitter war over the Performance Rights Act—proposed legislation that would require terrestrial radio stations to pay royalties to the artists whose songs they broadcast. The Federal Communications Commission has agreed to hear comments on reports that radio station owners are “targeting and threatening artists who have spoken out in favor of the PRA,” with some going so far as refusing to play their music. The FCC is responding to a Petition for Declaratory Relief submitted by the MusicFIRST coalition, a group backed by the Recording Industry Association of America, SoundExchange, and various musicians’ groups.

In addition to accusing radio stations of “engaging in a pattern of threats and intimidation against artists to chill their speech,” MusicFIRST says they are refusing to run the coalition’s ads. All this is part of a coordinated campaign “designed to spread malicious and untruthful information—all in an effort to avoid royalty payment to artists,” the group warns.

Quite a lot to throw at radio—but it appears that the first charge is true, at least in the case of Dalhart, Texas radio station KXIT, which plays oldies, and its panhandle neighbor, country station KIXK-FM. Earlier this month, Inside Radio broke the story that their owner, George Chambers, says he won’t broadcast the tunes of almost 100 PRA supporters. We contacted Chambers, and he told us that he got the list of musicians that he’s banned from MusicFIRST’s pro-PRA artist website.

“I purchase the songs I play, so I will decide what songs I play,” he explained in an e-mail. “Artist that are radio-friendly get airplay.”

Musicians on the list include some country/oldies performers, but it also contains Sheryl Crow, Suzanne Vega, will.i.am of the Black Eyed Peas, the Smashing Pumpkins, and other artists who probably never got much air time on Chambers’ stations in the first place. Still, although it’s worrisome, it’s also unclear how the FCC can respond. There aren’t any hard-and-fast rules that say that radio stations must broadcast certain performers or accept ads regarding controversial legislation or public issues. In the case of ads, the Supreme Court has actually ruled that they don’t.

And there are no knights in shining armor in this story, either. As we’ve reported, it’s definitely big content versus big radio here. Nonetheless, the MusicFIRST petition raises tricky questions about when license owners have crossed the line between broadcasting in the “public interest” and just serving their own.

Not a single station

Much of the petition is based on the testimony of Jennifer L. Bendall, MusicFIRST’s executive director, who has spent recent years as a lobbyist for various media groups, including SoundExchange, Viviendi, and the Motion Picture Association of America. Bendall’s statement cites a variety of instances in which artist intimidation allegedly took place. 

“A representative of a record label told us that a Delaware radio station informed them that it boycotted all artists affiliated with the MusicFIRST coalition for an entire month,” she charges. “A representative of an artist told us that, immediately before going on the air for an interview, the artist was pressured by a Texas radio station to state on the air that the performance rights bill would cripple radio stations.” MusicFIRST says it’s not disclosing the names of these folks, at least at this point, in order to protect them from further discrimination.

In addition, Edelman Communications Vice President Martin Machowsky testified that radio stations are routinely refusing to broadcast MusicFIRST pro-PRA ads. “It is my belief that these broadcasters are rejecting MusicFIRST’s radio spots based solely on the fact that MusicFIRST’s advertisements take a position that is contrary to the private interests of these broadcasters,” his statement in the petition warns. “I based this on the fact that several of the broadcasters have not even asked to listen to the spots and have stated that they are rejecting them because they come from MusicFIRST.” As of the filing of the petition, not a single radio station had accepted a spot from MusicFIRST, Machowsky contends.

MusicFIRST also doesn’t like what big radio routinely says about the PRA over the air and in print—it charges that stations have said it would constitute a “tax” on radio stations (indeed, it’s not; none of the money would go to the government); that the royalties would go to “foreign owned” companies (thousands of US copyright owners would receive payments); and some reports implied that a trio of historically black radio stations were sold to the Catholic church as a consequence of the bill’s approval by the House Judiciary Committee.

We want responsiveness

But even assuming that all this mischief is true, the petition struggles to identify clear legal remedies that the FCC can apply to the problem. As written by Sam Feder, until recently the FCC’s former general counsel, the MusicFIRST appeal hastens to note that it doesn’t want a return of the Fairness Doctrine. But it calls the alleged behavior of these radio stations “anticompetitive,” using their broadcasting power “to gain a competitive advantage over the artists and record companies to whom they would have to pay royalties if Congress passes the PRA.”

Conduct an investigation, MusicFIRST urges the FCC, then declare these alleged shenanigans against the public interest. And then? “The actions of broadcasters described in this petition support the calls for strengthening the license renewal process and shortening license terms in order to better ensure broadcasters’ responsiveness to the public, rather than their private interests,” the petition concludes, citing Commissioner Michael Copps frequent urgings to trim license periods down to three years.

So, what does this mean on a practical level? we asked Machowsky in an interview. “We’ve asked specifically for a few things,” he replied. “We’d like the behavior to stop. And we have asked in the context of the petition that this is information that the FCC should consider in the context of a license renewal. That’s all we’ve said.”

OK, we pressed, but does MusicFIRST want the FCC to revoke the license of George Chambers or some other pro-PRA-artist-boycotting station when its next renewal period comes up? “We want the FCC to consider that in the context of license renewal,” Machowsky said again, and no more.

It’s up to the individual broadcaster

So we went over to the other side and contacted National Association of Broadcasters Executive Vice President Dennis Wharton, who—no surprise here—thinks MusicFIRST’s petition is pretty specious. When it first came out, the group called it the RIAA’s “newest stunt.” Now that the FCC is actually considering an investigation, NAB’s tone has become a bit more circumspect.

“NAB will be commenting on the distortions raised in the musicFirst petition at the appropriate time,” the latest statement says. “Contrary to suggestions in the petition, broadcasters are under no obligation to carry everything that is offered or suggested to them.”

But what about this Chambers fellow and perhaps other boycotters? We asked Wharton whether that sort of behavior is in the public interest.

“I guess I’d respond by saying that it’s up to the individual broadcaster, ultimately, the licensee of the station, to decide what programming is appropriate for the community,” Wharton said. “I also don’t think that it’s some kind of coordinated effort. If indeed there are some broadcasters who are disappointed after having nurtured the careers of many artists, who decide in a moment of anger at performers who’ve come out in support of legislation which they believe threatens the very livelihood of free over-the-air broadcasting, for them to not play that music for a while, it wouldn’t surprise me if there were one or two stations who did that.” Wharton went on to call the coordination charge “ridiculous.”

Various players in the media reform community are keeping tabs on this skirmish. The Future of Music Coalition supports artists compensation, and it’s concerned about the allegations that MusicFIRST makes, FMC’s Casey Rae-Hunter told us. But the group hasn’t got a position on the petition. Still, “we will be following the comments on this closely,” he said.

The Media Access Project doesn’t have a stance on the PRA. But MAP’s Andrew Schwartzman says that, if MusicFIRST’s allegations “are proven to be true, they will raise serious questions as to whether some radio stations deserve to receive free licenses for exclusive use of the public’s airwaves.”

If you want to weigh in on this issue, the FCC is accepting comments on MusicFIRST’s petition through September 23. You can upload a text file here. The number for field #1 (”proceeding”) is

09-143.

The US Department of Justice has weighed in on Jammie Thomas-Rasset’s $1.92 million liability for damages, calling the amount perfectly constitutional. In fact, Congress intended for such massive damages to fall like a stone upon even noncommercial P2P users.

Thomas-Rasset was the first defendant in the RIAA’s 18,000-person war on file-sharing to take her case all the way to trial. After two trials, she ended up owing $80,000 per song, for a total of $1.92 million, an amount promptly challenged as “unconstitutional” by the defense.

But the DOJ says that the range for statutory damages was clearly laid out by Congress to apply precisely to such cases. The amounts involved were last increased in 1999 as part of the Digital Theft Deterrence and Copyright Damages Improvement Act, which “improved” statutory damages by raising the maximum to $150,000 per infringement.

According to Congressional thinking at the time, these amounts were not intended solely to apply to massive corporations; the DOJ quotes an explanation from the negotiations that says higher damages are necessary because “many computer users are either ignorant that copyright laws apply to Internet activity, or they simply believe that they will not be caught or prosecuted…”

The DOJ adds that Congress also wanted to “deter the millions of users of new media from infringing copyrights” by setting the awards this high, and that there is nothing problematic about this unless the amounts are “so severe and oppressive as to be wholly disproportioned to the offense and obviously unreasonable.” $1.92 million for downloading and uploading 24 songs does not reach this threshold, says the government.

“We are pleased the Administration has filed a brief supporting our position,” an RIAA spokesperson told us. “Its views are consistent with the views of every previous Administration that has weighed in on this issue.”

Statutory damages are certainly a useful tool; as the DOJ points out, the actual damages can be tough to quantify in many copyright cases, and so statutory damages provide a relatively straightforward system for taking claims to court. But the damage awards in this case and in the recent Joel Tenenbaum P2P case have been life-altering, bankrupting judgments when applied to young, noncommercial infringers. Given the publicly stated antipathy toward this litigation from both federal judges overseeing the cases, the post-trial damages ruling should be worth waiting for.

Not helping Joel Tenenbaum’s case, however, is the front page of The Pirate Bay—which is now displaying a graphic of Tenenbaum labeled “DJ Joel: The $675,000 mixtape.” Naturally, it provides a link to all of the songs Tenenbaum was sued over.

(For the record, Team Tenenbaum says it had absolutely nothing to do with this.)

Obsessive compulsive on the cellular and organismal level, via strep throat: In some ways, an autoimmune disease is a bit like an obsessive compulsive disorder, with the immune system getting so keyed up to clean up an infection that it starts going after anything that even looks like the original invader. But now there’s an indication that some cases of obsessive-compulsive behavior are the result of an autoimmune disease. Apparently, streptococcal infections (think strep throat) can leave their younger victims suffering from tics and other obsessive-compulsive syndromes. A recent paper describes how inoculations with strep bacteria could trigger an analogous set of symptoms in mice. Apparently, the same symptoms could be transferred to new mice simply by injecting them with antibodies isolated from the first, indicating the involvement of an immune response. Weird on many levels.

A vicious Facebook cycle: The title of this paper about says it all—”More Information than You Ever Wanted: Does Facebook Bring Out the Green-Eyed Monster of Jealousy?” The only thing that’s missing is the answer, which is a statistically significant, personality controlled, and hierarchically regressed “yes,” at least when it comes to college undergraduates. The authors speculate that it’s a bit of self-reinforcing process. Anyone who’s prone to use Facebook will obviously use it to check out their new partner, come across notes and photos that are probably ambiguous (or evidence of past relationships that’s not), get a bit jealous, and start searching for more details.

Birds with a hormone flock together: In humans, the hormone oxytocin has a powerful effect on social behavior, helping mediate a mother’s bonding with her offspring and generally predisposing us to look upon our fellow species members a bit more favorably. So, if you think about it, the results of a study of its avian equivalent shouldn’t be so surprising. And yet, it seems amusing that you can apparently manipulate a bird’s decision to get involved in large groups by altering levels of the bird equivalent of oxytocin. The unexpected finding is that the birds are equally social—they just don’t like large groups.

Not only embarrassing, but painful: This paper lays the issue out right in the first sentence: social pain may use the same neural systems that underlie physical pain. It’s an idea with testable consequences, and the authors go after one of them. If opioid receptors are involved with physical pain, they’re probably involved with social pain, so they tested a bunch of volunteers for their response to social pain, while genotyping them at the µ-opioid receptor locus. One particular variant of the gene was found to associate sensitivity to being rejected in social contexts. So, if you’re too paralyzed by fear of rejection to ask someone for a date, heroin should do the trick (we kid!).

Monkey see human do monkey impression: Those of you with siblings have undoubtedly suffered periods where they thought it would be funny to immediately repeat everything you said (or perhaps you tormented your sibling using this method). Imitation may not always be the sincerest form of flattery for humans, but Capuchin monkeys are apparently good with it. In interactions with strangers, the monkeys showed a pronounced preference for humans that imitated their actions. The authors speculate that, even if it can be annoying in some modern contexts, imitation is probably a way of facilitating social behavior among most primates by demonstrating the equivalent of a shared norm.

Results that will surprise no one: It took one researcher each from German, the UK, and US to determine that guys will pretty much sleep with anyone who asks, while women will generally only accept offers from the most physically attractive of partners. So, if you’re a guy looking for a one night stand, it might behoove you to check the mirror first.

Asia has seen quite a bit of action on Internet censorship in the last week, with China and Malaysia scaling back their censorship plans while Vietnam increases its control. Although most of the news was good, the region still has some way to go before free speech advocates will feel comfortable.

The highest profile of the three countries is China with its once-mandatory client-side filtering software, “Green Dam Youth Escort.” China’s technology minister, Li Yizhong, claimed to the press this week that the whole alleged requirement was one big “misunderstanding,” and that the software would no longer be required to be installed either by PC makers or by home users. 

This claim is disingenuous at best, considering that Chinese officials emphasized for months that the software would be mandatory and must be preinstalled or included on disc with every new PC sold in China—a plan that was suspended on June 30 in order to supposedly give manufacturers more time to comply. The software, which researchers have discovered sports numerous security vulnerabilities, isn’t dead, though, and will still be required in schools and Internet cafes. Some PC vendors are also including it voluntarily with their products.

Malaysia also backed off this week on a controversial plan to begin filtering pornographic websites so they could no longer be accessed from within the country. Communication and Culture Minister Rais Yatim had announced last week that Malaysia was already in the process of selecting software to carry out the task, but the reaction by bloggers and various Internet groups was so strong that the government was forced to reconsider. 

“We will not filter the Internet but Home Minister Datuk Seri Hishammuddin (Tun Hussein), (Minister in the Prime Minister’s Department) Datuk Seri Nazri (Aziz) and I have been tasked to look for instances of sedition, fraud, and child pornography,” he told Malaysian newspaper The Star. “We will then provide the relevant law enforcement agencies with the necessary particulars for them to take action.”

The CCIA (a nonprofit US trade group representing tech companies that push for open networks) praised both China and Malaysia for their decisions this week. “We welcome the Malaysian government’s decision to sideline plans to implement an Internet filtering system. Such a broad attempt at censorship would have blocked the free flow of information and ideas on the Internet—a communication tool that has become an enabler of democracy and economic development,” said CCIA head Ed Black in a statement. “China’s decision to block enforcement of Green Dam for PCs breaks what would have been a logjam on the free flow of information. It’s a wise move and a win for free speech, access to information and trade.”

Not all the news is positive, though. Vietnamese Internet users began reporting that Catholic websites were being blocked by the government following a number of Catholic protests within the country. Although the Vietnam government claims it only filters the Internet for pornographic and obscene content, it’s an open secret among citizens and Internet-watchers that the filters are often used to regulate politically sensitive chatter while, ironically, porn can easily be accessed within Vietnam. Human Rights Watch, Writers Without Borders, Amnesty International, and other human rights groups are also blocked within Vietnam.

Indeed, Reporters without Borders identifies Vietnam (along with Burma, China, Cuba, North Korea, Egypt, Iran, Saudi Arabia, Syria, Tunisia, Turkmenistan, and Uzbekistan) as the “Enemies of the Internet,” accusing them of “[transforming] their Internet into an Intranet in order to prevent their population from accessing ‘undesirable’ online information.” 

Even if countries like China have made subtle changes, such as backing off on Green Dam, they still remain top offenders when it comes to dreaming up new and creative ways of stifling the flow of speech and information online.

Video game sales date for July has come in from the NPD Group, and the industry continues to sink. “The US video games industry declined for the fifth consecutive month, bringing year-to-date sales to $8.16 billion, down 14 percent from the same time period last year,” wrote NPD analyst Anita Frazier. “In order for the industry to come in flat or slightly up for the total year, the back five months of the year have to come in 11 percent (or more) higher than the last five months of last year.”

She points out that we do have surefire hits like Halo: ODST and The Beatles: Rock Band coming later this year, but for now, the industry is treading water. Let’s see who’s doing it most efficiently.

Nintendo

Sales of Nintendo hardware are slowing down, but with both the Wii and the Nintendo DS enjoying such a huge lead, the company has plenty of time until it feels Microsoft or Sony hardware breathing down its neck. The Wii sold 252,500 units in July and the Nintendo DS sold 538,900 units. In July 2008, the Wii sold almost 300,000 more units than it did this July; has the momentum finally slowed?

Not when it comes to software… even if that software often comes bundled with hardware. Wii Sports Resort came in first place with 508,200 units sold, along with the MotionPlus. Wii Fit with the Balance Board came in fourth place with 164,300 units sold, and then Mario Kart with the wheel on the Wii, Mario Kart on the DS, and Pokemon Platinum version took the fifth, sixth, and seventh places. New Super Mario Bros. came in at ninth place with 101,800 units sold, and the EA Sports Active Bundle took the tenth place with 96,800 sold.

Nintendo hardware may see slipping sales year over year, but that just means the company is coming in at number one by a slimmer margin. Taking seven of the top ten slots with mostly catalog titles and first-party games also shows that Nintendo continues to enjoy massive success.

Microsoft

Microsoft just about matched 2008’s sales, with 202,900 Xbox 360 units sold in July. The second-best-selling game was also on the 360 as NCAA Football 10 sold 376,500 units. (That’s 139,100 more units than the game sold on the PS3.) The only other 360 game in the top ten was Fight Night Round 4, which took the number eight slot with 116,400 units sold.

“The Xbox 360 is the only console system showing a unit sales increase year-to-date,” Frazier pointed out, and in fact the 360 came within 50,000 units of catching up to the Wii.

Sony

Sony has very little to brag about in the NPD report. The PS3 sold 121,800 units, the PSP sold 122,800 units, and the PS2 sold 108,000 units. Each piece of hardware is well behind its competitors. The only game that Sony charted in the top ten was the PS3 version of NCAA Football 10, which took the number three slot with 237,400 sold.

That’s relatively good news, if you don’t notice how easily the 360 trounced those sales with its own port of the game.

Not much good news for July

Sales are down, the software chart is dominated by Wii and DS titles that have been out for years or that continue existing franchises, and Sony needs to do something to energize gamers. Perhaps… and we’re just throwing out ideas here… a redesigned PS3 along with a price drop?

It’s going to be quite a challenge to get these numbers out of the gutter, but the end of 2009 still has some heavy-hitters coming, including Call of Duty: Modern Warfare 2.

GameStop is an amazingly profitable company, and those profits are due largely to the margins the company enjoys on used game sales. When GameStop gives you $15 to $20 for a game that has been out a mere week, then sells the same game for $45, they’re making money that no retailer selling new games can match; new games have a very thin profit margin for retailers. Which is why it is surprising to see Best Buy make its new game prices competitive with GameStop’s used game prices.

In West Jordan, Utah, an eagle-eye Cheapassgamer reader snapped a picture of a sign at a local Best Buy. It said that Best Buy would price-match any used game from GameStop or GameCrazy with a new copy. So instead of going to GameStop for a $45 used game that has been opened—and of course, used—you can go to Best Buy and pay the same price for a brand-new, sealed copy. All evidence is pointing to this promotion being a small test run in a very few locations, but it didn’t take long for GameStop to fire back.

GameStop has the margins to make this fight ugly

Soon after the Best Buy story hit the Internet, Kotaku was given a copy of a flier from GameStop that showed some amazing price cuts on a wide selection of used games. Don’t be confused if you haven’t seen this sale at your local store; it seems to be localized around… wait for it… West Jordan, Utah.

The games on sale are newer titles, with an additional $10 or $15 knocked off GameStop’s normal prices for used games. It doesn’t take a cynic to realize that Game Stop is hoping customers flood Best Buy locations with the flier, demanding price-matched new copies of these games. And if gamers go into GameStop locations to take advantage of the sale, the company still wins; the margins on GameStop’s used games are so high that it can afford to run this sale and turn a profit, while forcing Best Buy to lose money on each game it sells at these prices.

The thought process going on at both companies has been opaque when it comes to the competing promotions—we contacted both Best Buy and GameStop and have yet to hear a comment from either—but the economics of the situation are clear. GameStop can fight the good fight on used game pricing and still come out the victor, because new games purchased from distributors, even with the scale of large retailers, leave only a few dollars of profit when the game is sold.

GameStop doesn’t have to buy its games from a distributor; the retailer has a huge base of loyal customers who are more than happy to turn over games for low trade-in amounts, giving GameStop a margin that can be as high as $30. Best Buy has to be wondering if the buzz is worth selling games below cost.

Will this skirmish turn into a war?

It’s doubtful, since both companies are fighting in such a way that their bottom lines are compromised. Best Buy may not be ready to turn its entire new game inventory into a loss-leader, and GameStop loves its high-margin used games. The gaming retailer is likely hoping that its counter-attack will make Best Buy skittish about trying this tactic in other markets, and there may be room to dump used prices further in case the message wasn’t strong enough. Once Best Buy kills its promotion, GameStop kills its sale.

It’s a cat and mouse game between two giants in the gaming world, with only one clear winner: gamers looking for a bargain in West Jordan, Utah.

A group of security researchers has published a fascinating study that demonstrates how to hack a Sequoia AVC Advantage voting machine. We have already seen several electronic voting machines hacked by experts in controlled environments, but this study goes a step further and shows that it can be done in the wild without privileged access to source code or other specialized materials.

The study was conducted by a group of voting machine security experts led by Ed Felten, the director of Princeton’s Center for Information and Technology Policy. They used a technique called return-oriented programming to circumvent the built-in security mechanisms in an AVC Advantage voting machine and cause it to divert votes from one candidate to another in a simulated election.

In addition to providing a chilling example of the potential for real-world election hacking, the study also explores some important questions about the longevity of voting machine security. A well-designed machine that provides highly robust security today might become vulnerable over time as new hacking techniques emerge. The researchers point out that electronic voting machines will generally have long service cycles due to the lengthy procurement and certification process.

The AVC Advantage has several characteristics that make it more secure than many other voting machines. It has hardware mechanisms that prevent it from running code from RAM. This effectively protects against attacks that involve arbitrary code injection. To circumvent this security measure, the researchers used a technique called return-oriented programming that involves co-opting bits of code that are already in the system.

By chaining together small snippets of regular code from the system ROM, it becomes possible to perform more sophisticated and specialized operations—such as redirecting votes—without having to inject malicious code. This is a relatively novel technique that emerged in 2007, and some of the earliest research on return-oriented programming was published by Hovav Shacham of UC San Diego, one of the security experts who contributed to the AVC Advantage study.

“Since the AVC Advantage is a Harvard architecture computer, traditional code injection attacks cannot succeed because any attempt to read an instruction from data memory causes an NMI which will halt the machine,” the paper explains. “In practice, given a large enough corpus of code, this is not a barrier to executing arbitrary code using return-oriented programming—an extension of return-to-libc attacks where the attacker supplies a malicious stack containing pointers to short instruction sequences ending with a ret.”

The hack

The team wrote a small program that searched the BIOS for groups of instructions ending in “ret.” They found sequences that could be used together to manipulate the machine’s behavior and control its hardware peripherals, including LCDs and memory cartridges. They then devised a pseudo-assembly based on these code snippets.

The researchers reverse-engineered an AVC Advantage machine that was purchased through a government surplus auction site. A researcher was able to buy five units for only $82. Through their reverse engineering efforts, the team documented the voting machine’s internal operations and made an emulator for developing and testing hacks.

The hack is deployed in a modified results cartridge. It exploits a buffer overflow vulnerability in the machine’s cartridge handling code to gain control of the stack and direct the machine to execute the selected code sequences that fulfill the malicious objective. The exploit, which was developed entirely on the group’s home-rolled emulator, worked with the real hardware on the first try.

The researchers were able to devise and implement this hack in roughly 16 man-months of labor without having any access to the actual source code or non-public documentation. It worked flawlessly on actual devices during tests and could be used by a sufficiently motivated individual to manipulate the outcome of a real election. The team estimates that a comparable hack could be funded in the private market for as little as $100,000.

Democracy has never seemed so cheap.

Further reading

• Can DREs Provide Long-Lasting Security? The Case of Return-Oriented Programming and the AVC Advantage
• Found via Slashdot