Just Say No to Cyber

Bloomberg Businessweek sat down a couple months ago with five security experts including Robert Rodriguez, chairman of the Security Innovation Network and senior adviser to the Chertoff Group. The five were asked questions like “Is it important to determine who’s responsible for security? Is it the seller of the computer, the way that a seller of an automobile is responsible for a level of safety? What’s the alternative?

An answer from Rodriguez, which built on an answer from Brvenik, recently was brought to my attention.

[SourceFire VP] Brvenik: We can make it harder, we can make it more expensive for the adversary, but they still have entry points. In order to truly solve this problem, we have to educate everybody from the start. Elementary schools should be teaching children before they’re ever online about the risks of it, and safe behaviors and how to identify bad things.

Rodriguez: I totally agree with you. Education, increasing awareness, and starting with a national ad campaign, almost like Nancy Reagan did with “Just Say No to Drugs.” It sounded silly to people in the beginning, but it was highly impactful.

While I am all for user education, I can hardly believe someone would cite Nancy Reagan’s program as “highly impactful.” I assume he means that in a positive way. I’ve always considered Reagan’s slogan a complete and abject failure due to the emphasis on an inflexible and unthinking response to a complex problem. We might as well tell people to just say no to anything “cyber” because it can cause harm.

Perhaps Michael Hecht, a Penn State professor of crime, law, and justice, put it best:

Critiqued by some for reducing a complex issue to a catch phrase, Reagan’s campaign is generally considered to have been unsuccessful, and the phrase “just say no” has become a pop-culture joke.

Hecht makes an interesting point about the slogans that work best and why:

…it is clear from a large body of research that students are more receptive when their peers are involved with delivering the message.

The nuance on these political issues is probably important. While I am for user education I am against a “Just Say No” program. Here’s another example: while I am for passenger screening I am against the Chertoff Group lobbying to sell their own product a millimeter wave scanner into airports.

I guess I would have given Bloomberg’s question a different response. I would agree with Brvenik and Rodriguez on user education but also would have disagreed with them. I would have emphasized don’t blame the victim (different from Brvenik), don’t be top-down and inflexible in reasoning (different from Rodriguez) and I would have said a reasonable level of liability should be put on manufacturers (more direct answer to the question).

This Day in History: 1962 Cuban Missle Crisis

Two days before October 16th, 1962 an american spy plane taking photos of Cuba recorded the presence of Soviet nuclear missiles. This not only revealed a clear danger but also gaps in American intelligence operations. The missiles posed an immediate threat.

President Kennedy first saw the sobering photos on this day, 50 years ago, which started a series of events that brought the country to the brink of nuclear war. Over the next eight days the US moved towards launching its own missiles, as re-told by veterans of the incident.

“We are very near going to war, you will launch your missile to DEFCON 2,” Johnson, 77, [ballistic-missile analyst technician for the 578th Strategic Missile Squadron supported by Dyess Air Force Base] recalled the sound of the alert and then the message to raise the Atlas F-series missile 185-feet to a launchpad and wait for the Defense Condition 1 (DEFCON 1) alert to push the button and send the weapon into a nuclear holocaust.

Kennedy gave a strong stance publicly during the crisis but as we know today he actually resolved the crisis peacefully through compromise; the President led a series of intense and secret diplomatic meetings with the Soviets, the United Nations and other countries. A direct phone line was installed that enabled Kennedy and Khrushchev to talk; through November they worked out how both sides would reduce their arsenal and quit the forward positions.

Foreign Policy refers to the crisis as “The Myth That Screwed Up 50 Years of U.S. Foreign Policy

American leaders don’t like to compromise, and a lingering misunderstanding of those 13 days in October 1962 has a lot to do with it.

In fact, the crisis concluded not with Moscow’s unconditional diplomatic whimper, but with mutual concessions.

[…]

For too long, U.S. foreign-policy debates have lionized threats and confrontation and minimized realistic compromise. And yes, to be sure, compromise is not always the answer, and sometimes it’s precisely the wrong answer. But policymakers and politicians have to be able to examine it openly and without fear, and measure it against alternatives. Compromises do fail, and presidents can then ratchet up threats or even use force. But they need to remember that the ever steely-eyed JFK found a compromise solution to the Cuban missile crisis — and the compromise worked.

Yellow Rain and the Hmong Tragedy

RadioLab did an investigation of the “Yellow Rain” controversy involving Hmong people in Laos along the Thai border after the US pulled troops out of Vietnam in 1975 — when the “Laws of Humanity had been terminated”.

In brief, the show covers how samples collected from the area were sent to an American lab, which found artificial concentrations of T2. Since the “rain” was said to be dropped from the air, and sophistication was implied, a link to the Soviets was believed. President Reagan decided in the 1980s to restart chemical weapon development and build up an arsenal in America as a response to these findings.

The show then reports that the case was reopened by scientists who came to a completely different conclusion — a link to pollen and bees. Scientists looking at samples eventually said the improbability of “gathering pollen predigested by honeybees” undermined the argument for chemical warfare. Instead a new theory was developed that showed a link to a natural process and the original theory was challenged due to probable contamination of the lab that did the analysis.

While the style and method of the story are hotly debated now and generating a response from the RadioLab show, what remains as certainties are Reagan’s reaction to a threat, restart of the manufacture of chemical weapons in America (based on faulty discovery of T2) and documentation of genocide of the Hmong.

The Fourth Bullet – When Defensive Acts Become Indefensible

At the RSA Conference Europe 2012 last week David and I explained how businesses can build a real Active Defense plan, as reported by The Register.

Companies and governments are constantly under siege by hackers and malware. Standard incident response is failing and police are overstretched. Faced by these challenges, small businesses have the option to actively respond against attackers rather than mounting only a passive defense.

Rather than jumping to the conclusion that any defensive action beyond currently accepted techniques is illegal, better and more effective options need to be considered, the argument runs.

Our presentation emphasizes the philosophy and law of self-defense and the need to formally document engagement rules and steps. After the presentation an audience member asked me to comment on the Clegg criminal law case from Northern Ireland.

I found this case described in detail at a school of law and in Cases & Materials on Criminal Law: Fourth Edition by Mike Molan

In relation to the first three shots, the judge accepted Private Clegg’s defence that he fired in self-defence or in defence of Private Aindow. But with regard to the fourth shot he found that Private Clegg could not have been firing in defence of himself or Private Aindow, since, once the car had passed, they were no longer in danger.

The situation involved soldiers on patrol who ordered a car to stop. When the car failed to follow orders it was fired upon. The soldiers’ claims were evaluated against scientific proof that a fourth shot hit the threatening vehicle after it had passed (entered it from the rear) and was more than 50 feet away. This contradicted Clegg’s testimony that he fired three shots through the front and the fourth shot through the side door as the car passed nearby. The judge thus ruled a fourth bullet was fired “with the intention of causing death or serious bodily harm” and Clegg was found guilty of murder.

YouTube has this archival video of the news with more detail, including an attempt by the soldiers to falsify proof of motive.

In a somewhat related news story of today, several Royal Marines have been arrested for how they handled a captured combatant. The arrests were based on video of the incident found on a laptop during a civilian investigation of one of the soldiers.

Footage discovered on a serviceman’s laptop prompted the arrest of seven Royal Marines on suspicion of murder over an incident in Afghanistan, Sky News has learned.

The Ministry of Defence (MoD) said the arrests by the Royal Military Police relate to an incident that happened after an engagement with an insurgent.

Sky sources revealed it only came to light following an arrest last week by civilian police – for a separate matter – of a man who had been serving in Afghanistan.

During that investigation, they had to look at his laptop – where they discovered a video that showed what were allegedly Royal Marines in a compound in Helmand Province with what appears to be an injured Taliban insurgent.

Sources say the clip contains a conversation about what to do with the injured man and whether to administer first aid.

Five soldiers have now been charged with murder.

Defense Secretary Philip Hammond pledged that any abuse would “be dealt with through the normal processes” of military justice.

“Everybody serving in theater knows the rules of engagement. They carry cards in their uniforms with the rules on them in case they should need to remind themselves,” Hammond told the BBC on Sunday.

These cases bring two points to mind.

First, defensive acts have to be measured and proportionate. Preparation and training are essential so action in the heat of the moment can be found reasonable. Some may see these as prohibitively costly calculations but let’s face it, organizations already are working on disaster recovery policy and procedures that do the same thing.

It is a cost relative to threats; a company that wants to stay in business simply has to do the math and make a business decision.

Second, even trained professional soldiers obviously can violate codes of conduct or rules of engagement. That is why formal documentation and verification of procedures are essential to the success of a defensive action.