Former NSA director Mike McConnell thinks we need to gear up for cyberwar, and he has a modest little plan:
We need to develop an early-warning system to monitor cyberspace, identify intrusions and locate the source of attacks with a trail of evidence that can support diplomatic, military and legal options — and we must be able to do this in milliseconds. More specifically, we need to reengineer the Internet to make attribution, geolocation, intelligence analysis and impact assessment — who did it, from where, why and what was the result — more manageable.
“Reengineer the Internet”? But what are we going to do after breakfast, Admiral?
Instead of funneling billions into the Department of Defense, here’s another idea: why don’t put a tiny bit of effort into regulating all the computer-based electronic devices we’re deploying, like “smart electric meters”. We have 8 million of those in the field, and a utility company study found they contained “security failures we’ve known about for the past 10 years.”
Almost every commercial, computer-based system failure follows the same pattern: weak regulatory standards, closed-source software, reliance on security through obscurity, and shoddy engineering discovered after the fact. If we required that every widely-deployed computer-based system was subject to regulation and open review, we’d close the kinds of vulnerabilities that have dogged technology like voting machines and SpeedPass.
Of course, it’s not as much fun to talk about regulation and open review of devices used by millions, mainly because you can’t talk about reacting in milliseconds, use cool code names, or refight the last war:
Ultimately, to build the right strategy to defend cyberspace, we need the equivalent of President Dwight D. Eisenhower’s Project Solarium. That 1953 initiative brought together teams of experts with opposing views to develop alternative strategies on how to wage the Cold War.
Bob K
For the 2010 fiscal year, the president’s base budget of the Department of Defense rose to $533.8 billion. Adding spending on “overseas contingency operations” brings the sum to $663.8 billion.
Cyberwar? Aren’t we spending enough for “Real Time” wars? The only R&D I want the DOD to do is that which leads directly to flying cars. We were SUPPOSED to have flying cars by now, I want mine DAMMIT!!!
El Cid
.
Let’s not forget their partner — industry captured and/or anti-regulatory administrative leadership.
MattF
Or- how about something completely off-the-wall, like “If our hackers can take down your operating system, you get 30 days to fix it before losing your federal contracts.” But… reacting in milliseconds is much more… stimulating.
Violet
The movies about cyber war are very boring. A bunch of geeks sitting around staring at screens. On the Wolverine Scale, this is definitely on the low end.
jeffreyw
I know what they need to do: Install a destruct charge in every device so that when someone is wrong on the internet they can be properly dealt with. I get to hold the button.
dan robinson
I did firmware for cable television set top boxes and the processors we used were made to be secure once the security fuses were blown. We need that level of security in all of the things that connect to the Internet.
The idea behind the design of the Internet was that stations would be “good citizens’ when connected to the network. It was designed for research and sharing information, not to withstand dedicated attack.
rachel
I know I’ve seen that before… Wait! That’s Microsoft’s business model!
KC
At this point, I don’t know what you can do about this, or if you need to do anything at all. The internet is so diffuse, so international, it seems we could keep developing security measures forever and still not stop the dreaded super internet threat. It’s like Cold War missile development, but stepped up several notches.
kommrade reproductive vigor
Sounds like the plot for TRON! the musical.
scav
and ain’t it just the giggle that the tuubz were designed to be resilient?!
MistaSparkle
B-but if we can’t go “peeeeew” “ratatatatatatatat” “POOOOOOW” in our minds while we describe it, then how is it worth spending billions on? Note to Mr. McConnell: the Internet is not a series of tubes that you can cut off or send troops through whenever you feel like it. Despite what the movies might say, you can’t just put a gun to some nerd’s head and tell him to “reengineer the Internet” to your liking, and you can’t stop massive DDoS attacks by yelling at your computer and typing random keys on your keyboard.
Christ, it seems like a lot of government-funded technology these days either has to be “dual-use” or “find your own funding.”
PS: The WaPo link is broken.
mistermix
@dan robinson: This is it, exactly, Dan.
@KC: If you have a network you can’t trust, everything that attaches to it needs to protect itself.
Bill E Pilgrim
@MistaSparkle:
See? It’s started already.
Red Dawn– you’re soaking in it.
PS Here’s the right link:
http://www.washingtonpost.com/wp-dyn/content/article/2010/02/25/AR2010022502493.html
RSA
A friend of mine who used to work at the Software Engineering Institute at Carnegie Mellon University once told me that developing software for the space shuttle costs about ten times more than commercial software. I’ve recently been involved in a project that looked at certification standards for a type of open source software–they’re currently abysmal, and I suspect this is the case in general. So let’s convince software companies that they need to spend double, triple, or more on making sure their software really works, and to adopt open source licences. And let’s convince independent open source developers that regulation is just what they need. And let’s convince consumers that good software costs a lot of money and takes a lot more time than they think. And… well, you get the idea. All this would be good, but I’m not sure how practical it is, aside from special cases.
Scott
I kinda doubt they really mean “re-engineer the Internet to make it more secure.” They really mean “re-engineer the Internet to make it easier to shut people up when they say stuff we don’t want them saying.”
mistermix
@Bill E Pilgrim: Thanks, I fixed the post.
@RSA: I agree that it’s a hard problem, but if we’re talking about spending billions, let’s spend them on this rather than a DoD fantasy plan.
soonergrunt
@jeffreyw: BoB and Makewi–so long in 5…4…3…2…
RSA
@mistermix:
No disagreement here.
Brian J
OT, but worthwhile: I think it’s time to pack it in for the Obama administration. He’s only at 53 percent approval in the latest ABC/Washington Post poll, and only 76 percent of Democrats are enthusiastic to vote in November. Considering that’s only one point higher than the enthusiasm for the Republicans and that there are fewer Republicans than Democrats, it’s impossible for them to escape with anything other than a loss of 20 seats in the Senate and 80 in the House. He should just resign now and end the horror show.
Bob K
Mike McConnell thinks we need to gear up for cyberwar – upon seeing the following I have to agree. This thing has got to be nipped in the bud. Oh – the humanity!!!
http://www.onlinetaxrevolt.com/
Punchy
Can you imagine this today? The two alternatives would be 1) Be aggressive but cautious redesigning the web and 2) BOMB THE FUCKING SHIT OUT OF IRAN, SYRIA, LEBANON, AND AUSTRALIA !ONE!ELEVEN!
jeffreyw
@soonergrunt: You have proven yourself worthy, you get second shift on the button. Still need to man the graveyard shift.
gnomedad
@Bill E Pilgrim:
Hahaha, excellent!
Linda Featheringill
From the WaPo poll:
Question 18. Thinking about the past few months, have you tried to contact your Senator or representative in Congress about the health care reform effort, or not?
Date – 03/26/10
Yes – 26%
No – 74%
***
I think this means that when we contact our congresscritters, our voice carries a lot of weight.
inkadu
RFID/Speedpass technology is kind of hilarious when you think about it. Here’s this chip broadcasting it’s private information to anyone who asks it. The only reason it was secure was that 10 years ago people didn’t have the technology; now they do.
I bet Speedpass will become much more interested in this phenomenon when they start being liable for the fraudulent charges. It’s a tribute to corporate greed that credit card fraud detection has grown by leaps and bounds.
Sentient Puddle
I like Wired’s take on this:
Belafon (formerly anonevent)
Fixed. As someone pointed out, the type of model you pointed out will not apply in all cases: My iPod OS does not need to be that secure. Also, as has been shown many times, you can never completely prepare for the next attack, otherwise anti-virus software would never need to be updated. In CS, this is equivalent to the halting problem, where you cannot write a general program that can detect a particular feature, you can only solve each problem separately. So, some of what McConnell is proposing would be some interesting areas of research and would probably be useful, even if they couldn’t catch everything.
me
Bleh, Erick Erickson is on CNN right now.
David
Cookies of Mass Destruction!
MobiusKlein
@Scott: I’m thinking just the same thing. The ability to track down ‘bad people’ in milliseconds on the net is basically an invitation to tyranny. Geolocation and attribution for everything? No thank you.
scav
@MobiusKlein: Tricky, isn’t it? Because this and the Patriot Act and AT&T et al is “keeping us safe” while the census is intrusive govt. tracking.
Fergus Wooster
Someone is clearly unaware of all internet traditions.
Bill E Pilgrim
@Scott: Yeah I think were in far more actual danger from “denial of Democracy” attacks than anything else.
@Fergus Wooster:
They want a new tradition of all-Internet awareness…
Short Bus Bully
Sounds like some general can’t keep up with the trolls on his favorite messageboard…
“Goddamn it! Who is this ‘KeWldeWD’ guy? He’s such a dick!”
“Sir, you should really stop responding to him, it’s called ‘feeding the troll’ and it just encourages him–”
“I don’t give two shakes of a dead rat’s ass what it’s called! I want him found and jailed!”
“Sir, it’s the internet, everyone’s anonymous.”
“WHAT? How do we spy on people then?”
“Well, we can’t really.”
“Even the guys who make fun of ME?”
“That’s correct sir.”
“The intertoobz are a threat to national security!”
And so we go. Good thing this is in the hands of people who know about technology (*cough* STAR WARS *coughcough*).
asiangrrlMN
@kommrade reproductive vigor: JAZZ HANDS!
Good lord. Don’t we waste enough money as it is? Yes, yes, you are strong, macho, and virile. Now, will you stop with your robotic fantasies?
P.S. Over at Yahoo!, the headline is how President Obama is deepening the partisan divide by using recession appointments. Yes, HE’S the one deepening the divide. Uh huh.
Alex S.
@MobiusKlein:
We need a digital version of black helicopters.
Martin
@Belafon (formerly anonevent): Except that anything the military does on this front won’t get shared with the broader community. Sure, if he’s successful cyberterrorists won’t be able to shut down our ICBM system, but the power grid and every non-military entity will still be susceptible to pissed-off 15 year olds.
These security measures need to get funneled down through a whole host of agents, but we don’t have an agency like that in the US. That would be a meaningful change, even if all they did was help secure open-source code.
gnomedad
@MobiusKlein:
We need a companion to IOKIYAR — INTIYAR: It’s Not Tyrrany If You’re A Republican.
Pigs & Spiders
This. And only this.
wasabi gasp
Chinese hackers are too big to fail.
stuckinred
Obama is in Kabul!
Bob K
What I want to know is, did any of the targets look like Mitch McConnell? Cause that would be so Tea-Party like.
In the crosshairs, also.
http://www.lasvegassun.com/news/2010/mar/27/tea-party-town-harry-reid-helps-open-shooting-park/
Polish the Guillotines
I’m in the industry — in QA, as a matter of fact — and I’m sure there are many other Juicers who are also in software development.
The problem, in my opinion, has less to do with these things than it does with current business practices.
As long as the business cycle is focused on per-quarter earnings, commercial software development will always be subject to the drive for quarterly profits. Take the pressure off business to put up numbers EVERY quarter, and there will be less incentive to defer software defects just to get releases out and numbers on the books. But that means fundamentally changing the way the current market operates and probably requires a return to the practice of delivering dividends rather than quarterly stock increases. Good luck with that.
The other big issue I’ve experienced is that the non-engineering folks involved in the development process tend to think quality is solely the responsibility of engineering. It’s not. It’s everyone’s responsibility. For sales and marketing types, that means being flexible enough to punt on pet features or be willing to extend schedules in order to protect quality, and for management types it means ensuring adequate resources are available to get the work done. That’s going to take a sea-change in the MBA culture in addition to the death of the quarterly-growth model. Again, best of luck.
I’d also add that from my personal experience using open-source stuff: it is frequently NOT significantly better in quality than comparable commercial products, is inconsistent and just plain bizarre in terms of user-interface, and documented by developers for developers. Just my experience, YMMV.
I don’t mean for this to be defensive, but the view that open-source is the path to digital wonderland is naive.
gnomedad
@Bob K:
Barf. I guess from now on, all politicians need to wear a flag lapel pin, end each speech with “God bless America”, and open a shooting range.
SiubhanDuinne
@Sentient Puddle #26:
This is my favourite part of the article:
The Moar You Know
@Martin: Actually, you would probably be quite surprised to learn that this is not the case. The DoD is extremely concerned about the impact that network security failures can have on society at large, and is reaching out and working with pretty much anyone who is interested in improving their security.
A particular point of concern with them, for example, is our utility system.
There are two issues, however. One is that the military is just not that good at security – an ideal network security force would likely be comprised of a bunch of fifteen-year old anarchists who break into systems for fun, and the military is not geared to work with people whose entire purpose in life is subverting any given “chain of command”. The other is that getting folks like privately owned utilities to pony up the cash to improve their abysmal security has proven to be damned near impossible.
The military would like to help – but I don’t think they’re the people to be leading the effort on this. Wrong mindset and an incompatible culture.
Martin
@The Moar You Know: I’m glad to hear that the military is sharing, but that seems rather counter to their culture, which was really my main concern.
As to getting privately owned outfits to improve their systems comes under the heading of ‘regulation’. We have all kinds of standards that need to be followed, for power transmission, broadcast, plumbing, waste treatment, and so on, but none or virtually none for the systems that control all of this stuff. Honestly, the software engineering community has been shitty on this front – they need to take a page from the civil engineers and establish some standards for these things. Yeah, I know it’s counter to the culture, it won’t be followed by certain groups, it’s too constraining, will impede innovation, whatever, but all of these things were said about all other engineering standards, yet it’s been shown time and time again that having the standards works, saves lives, and leads to broader economic efficiencies and savings.
Once standards are established, it’s straightforward (if not necessarily easy) to hold people to them. Cart, horse, and all that.
RSA
This matches what I’ve observed as well. The best open source software is competitive with the best commercial closed source software in many areas, but the former has a longer tail when it comes to quality. Further, there are structural and cultural issues in open source development that make it hard to address some of the problems you mention.
Grumpy Code Monkey
@Polish the Guillotines:
Speaking as a developer, you’ve pretty much nailed it. I’ve worked in both the commercial and defense sectors, and the commercial sector simply isn’t willing to pay the real costs in time and resources to produce truly secure, robust software.
Open source is not a panacea. OSS quality is highly variable, and everyone has their own ideas on how to do things, so you have multiple, slightly incompatible interfaces.
I don’t think people appreciate just how much work goes into writing large, complex systems.
Nethead Jay
@Polish the Guillotines: Hi there. Sysadmin here, do some coding too and know enough about networks to be dangerous. I don’t envy you doing QA but I’m glad you’re there because it’s necessary
I’m so there with you about the business cycle, MBA thinking and corporate culture being a major problem. Hell, it’s a fundamental one and across many sectors, not just software developments.
Regarding open source, certainly you’re right that there’s crap and stuff with problems out there. That said, I wouldn’t be afraid of pitting a good part of the open-source landscape against its closed competitors. I don’t think closed-source and for-profit software is evil, quite the opposite, and I try to actively support for-profit open-source based companies.
I think what mistermix is talking about is a clearly delineated, standards-based approach. In such an environment open-source would have an advantage in some areas but I believe other software would still be quite competitive.
Voting software is to my mind a special case where open code and independent auditability should be an absolute requirement.
JGabriel
Polish the Guillotines:
I have to take some issue with this.
Not a lot, mind you. In a general sense, I agree.
But the distinctions you’ve described here are largely the distinctions between amateur and professionally produced software. To the extent that open source software is frequently of unprofessional quality, that’s because the use of open source licenses correlates highly with amateur development.
When open source software is professionally developed, it achieves the same levels of interface and documentation consistency and usability as closed source, and over time can become more robust.
And, frankly, there are several applications where, to my mind, open source licenses, or at least openly published source code, should be mandatory — specific examples include voting and medical software. After all, drugs are required to go through published trials to determine there efficacy and side effects. It seems like software that controls medical protocols and equipment should require the same level of publicly available analysis.
.
Alex Ponebshek
US wants to increase cybersecurity?
How about if we stop buying routers that were manufactured in China, and we already know can be and have been backdoored?
No wait, that costs more money. Lets just re-engineer the Internet.
mclaren
This is just the latest in a long line of scams and con jobs designed solely to pump up the already insanely bloated Pentagon budget.
In 1956 there was a mythical “bomber gap” with the Soviet Union that turned out not to exist; in 1960 there was an alleged “missile gap” with the Soviet Union that didn’t exist either. In the 1970s, the Pentagon warned of Soviet
“first strike” capability that was purely imaginary, and in the 1980s the Pentagon issued dire warnings about imaginary Soviet stealth planes and other superweapons which (as usual) turned out not to exist.
Then the Soviet Union fell apart and ceased to exist.
Immediately the Pentagon began screeching hysterical warnings about Saddam Hussein. Eventually we invaded Iraq and, surprise, surprise! The predicted weapons of mass destruction turn out (can you guess?)…not to exist.
Fast forward to 2010. Cue the latest warning, uttered in tones of punitive hysteria, about the allegedly world-ending consequences of losing a cyberwar against…well…against someone. No one in the Pentagon is quite sure who.
Cyberwar, the new threat — not contaminated drinking water that’s killing us because our sewer and water systems are so old they’re falling apart…no, no, nooooooooo, that’s not a threat, the real threat is cyberwar!
Source: New York Times article on America’s deteriorating water and sewer infrastructure.
“The 2 trillion dollar hole” — from the article: “Promised pensions benefits for public-sector employees represent a massive overhang that threatens the financial future of many cities and states.” Our states are going broke, but
we have to spend hundreds of billions to fight fantasy hackers playing space invaders:
Source: Barrons magazine
“The Pentagon Church Militant and Us” — why and how the U.S. military budget is literally out of control: civilians no longer have any say in U.S. military policy or in the Pentagon budget, including the president. The U.S. military-industrial complex has become such a large parasitic part of the American economy that it is now self-sustaining, and any effort to reduce or direct its colossally wasteful and pointless expenditures would throw so many people out of work that it would create a major economic depression.
Source: “You Have No Say About Your Military,” TomDispatch
As a result, America keeps spending and spending and spending on our military which can no longer even win wars in third world hellholes against barefoot kids who are armed with bolt-action rifles… And none of that matters. The U.S. military-industrial complex is now self-sustaining and self-generating, creating imaginary threats to fight, producing Rube Goldberg superweapons that don’t work and cost too much to deploy and thus can’t win wars against
fantasy threats like the Al Qaeda in Afghanistan (there are currently estimated to be less than 100 members of Al Qaeda in all of Afghanistan, yet we spend more than 200 billion dollars a year to fight them there — and we’re losing), and then the Pentagon draws up even bigger budgets to pay for even more exotic superweapons (that don’t work) in order to fight these undefeatable imaginary threats.
Civilians have completely lost control of the U.S. military. The U.S. military decides what the threats are, not civilian politicians. The U.S. military decides what its budget will be next year, not civilian voters. The U.S. military decides how many troops it will send to the next lost war in some third world hellhole, not civilian planners.
This current cyberwar scare is just the latest in a long line of imaginary threats ginned up by the U.S. military-industrial complex to justify its infinitely increasing budget. We currently spend more than 1.3 trillion dollars on the U.S. miliary, broadly defined to include the NRO, the NSA, the CIA, military pension, the VA hospital system, Blackwater (which we now know is a front for the CIA), the DOE (which primarily does research on new Pentagon high energy weapons systems like airborne lasers and plasma cannons) and NASA’s manned space program (which exists primarily to service military spy satellites). And our military spending keeps going up and up and up, forever increasing, never ending, always spiralling farther and farther into the stratosophere. We spend and spend and spend, and for all that money, we get full spectrum impotence: America now can no longer win a war. Our weapons are too old and obsolete, or too expensive to be deployed, or they simply don’t work, like the F-35 fighter which none of our armed services actually wants and which will probably never even be deployed, even as its cost continues to spiral far out of control. Google Chalmers Johnson, “The Pentagon’s Economic Death Spiral,” for details.
As Fred Reed remarks in his “12 maxims for military success”:
Fred Reed, from “Fred on Everything” — Fred: A True Son of Sun Tzu
The U.S. military is run at the highest levels by incompetent cowards, at the mid level by bootlicking yes men ever since all the best and brightest major and colonels abandoned the American military in disgust, and at the lowest level of the enlisted ranks by gang members and felons and rapists. At this point, the American military couldn’t win a war against the Tijuana police force.
So what do you expect our impotent grossly incompetent military to do? Of course they discover yet another new imaginary threat, and demand hundreds of billions of dollars to fight it — and fortunately this new fantasy threat
doesn’t involve sending real troops into real theaters of war, like, oh, say, Mexico, which is rapidly falling apart and represents a real security threat right on our 3000-mile border…because, as the Pentagon well knows, it can’t
win wars anymore. So instead the Pentagon gins up these kinds of cyberwar fantasy threats and slurps up hundreds of billions of new dollars for shiny new computers and cyberwarriors, and into the bargain it gets to extend its
tentacles into the internet, bloating its budget and miltarizing American society even more.
The cyberwar fantasy threat has proven popular among the giant corrupt collusive monopolies that currently run most of the U.S. economy. Nothing threatens the economic status quo as much as the internet, which is rapidly destroying the newpaper and magazine industries, the TV networks, the record industry, and just about every other basic capitalist institution, so naturally America’s major players are eager to get rid of it and replace it with something more amenable to corrupt crony capitalism.
Tubbs
Don’t we first have to solve the possible threat of having gay military programmers?
Ruckus
@Alex S.:
Black electrons?
Liberty60
Being only one step above a confirmed Luddite, I can’t really tell the bullshit from the truth re: cyber security.
But I can’t help but noticing- how is it that the Wingnuts are being whipped into a frenzy over Obama Taking Over Teh Internetz via Net Neutrality, and this guy whipping same Wingnuts into a frenzy demanding that The Gummint MUST Be Able To Control Teh Internetz!
kdaug
@Martin:
Not sure where you’re going with this…
Functions should be contained in Structs? Local vars can’t have the same name as global vars?
Polish the Guillotines
@Grumpy Code Monkey:
@RSA:
@Nethead Jay:
@JGabriel:
Wow. Very thoughtful responses from all of you.
I have to say that’s a very fair statement and a worthwhile distinction which goes hand in hand with this:
I’ve had some pretty time-intensive snipe hunts looking for documentation or support with certain sketchy OSS stuff. I will say that I’ve also used some very well developed OSS stuff that’s been somewhat mission critical to my job. And yes, it tends to be very professionally conceived and executed — in fact, I would say it has advantages over a competing commercial application we’re migrating to. So, yes: Amateur vs. Professional is a much more reasonable distinction.
I definitely agree that voting software should be one of possibly several special cases where commercial considerations should be moot (control of the power and communications backbones would be two others), but we run full speed into the brick-wall of politics. The only way this can succeed is to utterly decouple the standards-making and enforcing process from workaday politics. How we get Congress and the Executive to ever turn this over to a neutral body is a mystery to me.
And therein is the heart of the matter. In fact, I’d extend that to even smaller and less complex systems.
And again, I’d say that’s got much more to do with the business side of things than anything else: People see software as either a disk they insert in a DVD drive or an installer they download. It gives a very false impression of the amount of time and intellectual struggles required to develop and test quality software and therefore a diminished sense of value.
catclub
There are some criticisms here of the “Open Source is no panacea” variety. This is not really news.
But the secret source methods that this statement protects
includes all the security by obscurity designs that lazy – or rushed – or incompetent software engineers resort to when they know that no one else will ever look at their code.
The code could often (except in the case of voting machines, which appears to be the toughest nut to make NOT crackable) stay secret, if the interfaces and behavior were well documented and reliable.
J Gabriel apparently can type faster than I can.
Elwood
But then there would be no one left on the internet except fro me. And that would be boring.