Category Archives: Security

Cyber War Book Review

Here’s my response to Bruce’s review of Cyber War: The Next Threat to National Security and What to do About It by Richard Clarke and Robert Knake, HarperCollins, 2010:

I guess I should blog about this separately, and I have done so a little already, but here’s my take:

1) Clarke is great about warning us of yesterday’s windmills. The discussion has been public for a while now (since at least 1999) and money is being funneled into the congressional-military-industrial complex (original term preferred by Eisenhower). It’s not necessarily a bad thing, and he should be congratulated on this, but it’s time to update the story.

2) The (newish) risks he could warn about are related to a dimension of hyper-collaborative bonds and time-bound social groups. When people ask “who was behind stuxnet” they really should be asking who was *not* behind stuxnet. What Gonzales showed in spades is that special collaboration is the new nuke. Attribution is a pain and definition of foe is nearly impossible. This is part of what I tried to argue at RSA Europe — don’t ban crossbows; out-think the mercenaries. A government could seed a group with a dumb and attributable tool, for example, like LOIC; that makes definition of their foe easy, since they’ve tagged a group (even for future reference).

3) I asked Clarke how and why he brings up but does not compare the risk of a mechanical gas-pipe explosion in California with the cyber-alteration of uranium enrichment in Iran. He said it was because the latter is “so much more complex”. That indicates a common cybermistake to me — fear of the unfamiliar, rather than the likely or the severe. Maybe he can make a good case for the stuxnet severity, but I still don’t see it.

To me the cold and calculated assassination of the uranium enrichment scientists should have been in the press as much as stuxnet, no? Motorcyclists who stick a bomb to the door of a scientist and then ride away? How’s the treaty against that going?

Back to 2) there are many other examples of real (severe and likely) risk that need to be addressed, such as the impact from failing education and health of children. That’s why, turning his own model around, I wish Clarke spent less time on how to respond to printer fires and worms and more on new forms of attack prevention — why/how to keep youth from being recruited into (temporal social network) groups that will intentionally or even accidentally blow gas lines. Whether they use a wrench, ssh or java does not scare me as much as how easily they are misdirected.

A couple weeks ago Clarke wrote this update:

…because the attack on the Iranian nuclear facility got out into the wild and analyzed, it can now be used against the US by altering it slightly (changing the Zero Day and the SCADA system-PLC target). And we are completely vulnerable. Get it now? Think power grid black out.

Power grid blackout like the Northeast in 1965, New York City in 1977, West in 1996, Northeast in 2003, or something worse?

Lets assume this slightly altered Stuxnet is made; would it be any more likely than any of the other attacks that can cause a power grid blackout? I mean is the power grid only “completely vulnerable” to Stuxnet or is it already completely vulnerable to other attacks and we just do not see them yet? I am thinking of the San Bruno explosion again.

The War of Efficiency: Out-Greening the Terrorists

In 2005 I wrote about a story in Wired called “Green Berets Prefer Biodiesel” where the military said they had found ways to reduce dependence on foreign oil. In 2006 I gave the following analysis on advances in diesel technology — quiet, fuel-efficient engines reduce risk and save lives:

Even the HumVee is going to [diesel-electric hybrid] (rebranded the Shadow RST-V), according to military.com. They wax poetic about “going green”, but let’s face it, dependence on fuel is a giant security vulnerability issue — the more efficient a vehicle the less risk to soldiers from a supply chain.

Technically I was wrong about the rebrand — the Shadow RST-V was a DARPA and ONR project for a Marine Corp deep reconnaissance vehicle. Nonetheless, reduced dependence on fuel, quieter operation (e.g. element of surprise), and more environmental features (e.g. drinking-water recapture systems from exhaust) should be in high demand beyond the Marines. However, that paradigm of innovation is pretty much the very opposite of what American car companies seem to want to sell to the American consumer. A Dodge Charger or a Cadillac Escalade makes about sense to me as a team of Clydesdale horses parked in my garage. Sure, they look pretty, but the smell, noise and mess is unacceptable.

Thomas Friedman now writes in the NYT that the US military is now forcing greater demand for efficient vehicles based on data that shows fuel efficiency saves American lives

Spearheaded by Ray Mabus, President Obama’s secretary of the Navy and the former U.S. ambassador to Saudi Arabia, the Navy and Marines are building a strategy for “out-greening” Al Qaeda, “out-greening” the Taliban and “out-greening” the world’s petro-dictators. Their efforts are based in part on a recent study from 2007 data that found that the U.S. military loses one person, killed or wounded, for every 24 fuel convoys it runs in Afghanistan. Today, there are hundreds and hundreds of these convoys needed to truck fuel — to run air-conditioners and power diesel generators — to remote bases all over Afghanistan.

Mabus’s argument is that if the U.S. Navy and Marines could replace those generators with renewable power and more energy efficient buildings, and run its ships on nuclear energy, biofuels and hybrid engines, and fly its jets with bio-fuels, then it could out-green the Taliban — the best way to avoid a roadside bomb is to not have vehicles on the roads — and out-green all the petro-dictators now telling the world what to do.

Unlike the Congress, which can be bought off by Big Oil and Big Coal, it is not so easy to tell the Marines that they can’t buy the solar power that could save lives.

Nerds win, finally. And the smart choice does not have to be ugly. The Shadow RST-V looked pretty cool for 2006.

Fast-forward to this year’s diesel V-6 (yes, it’s a V-6) powered Audi race car with some amazing lines designed to reduce drag and the frequency of pit-stops.

My only beef with Friedman is that he makes reference to the Prius instead of the real future of efficiency — surging diesel innovation and demand. That doesn’t make sense since he mentions at least two diesel military vehicles:

…the Navy has tested its RCB-X combat boat on a 50-50 blend of algae and diesel, and it has tested its SH-60 helicopter on a similar biofuel blend.

Neither of these examples compare well with the gasoline-based Prius, which has barely evolved since its main advocate and “Toyota hybrid guru” died in a plane crash on November 25th, 2006. They do, however, compare well with the VW, Honda, Subaru, Audi, Lexus, Mercedes, or BMW diesel vehicles, which also can run 50-50 on algae. Hmmm, strange that there are no American-made options in that list of manufacturers. Cadillac still might be the best hope, as I wrote in 2008. I have pretty-much given up on them but maybe, just maybe, someone at Dodge is looking at an SH-60 engine and thinking about a revised Super Bee that at least doubles its MPG without losing a second on the track.

They could start by just replacing the Hemi V8 SRT 6.1L (425hp, 420 lb-ft torque) with an upgraded V6 6.7L Cummins turbo diesel (350hp at 3,013rpm, 650 lb-ft torque at 1,500rpm); yes, again it’s a V6. Then give the new diesel Super Bee something Tron-ish looking with an “out-green” theme. Maybe call it the anti-terrorism machine…the Green Bee:

Audi and VW report surge in diesel sales

The Autoblog Green reports more great news for American car buyers: Audi diesel sales soar in November; TDI model accounts for 69% of A3 sales

Though Audi’s sales numbers certainly have improved over last year, it’s the automaker’s TDI-equipped clean diesel vehicles that have gained the most ground. The TDI engine accounted for 69 percent of all Audi A3 models sold in the U.S. in November. Additionally, the diesel-burning version of the Audi Q7 represented 45 percent of the SUV’s total sales volume. Both Audi and partner Volkswagen have witnessed a trend of growing interest in their clean diesel models and hope to continue to ride the surge with more TDI model launches scheduled for the U.S. in the coming years.

More TDI models? Excellent! Dear Audi, please include an all-wheel-drive option on the TDI passenger cars. I have been trying to find a way to import the amazing Audi Allroad TDI since 2004. The VW is nice, but variable height suspension and quattro are safety enhancements very useful in these big Sierra snow storms. I do not need the bling and mass of a Q-series, just the efficiency and functionality of the Allroad. At this point, however, I (and about ten others I know) would be thrilled to take delivery of an A3 quattro TDI.

Speaking of bling, the new V6 Le Mans diesel engine option would also be much appreciated as an option, even without anything like the stunning looks of the car:

The future of clean and smart engine design: Diesel by Audi.

Come on Honda and Subaru! Get in on the action. I have seen similar stories about your diesel models in Europe:

The company’s first horizontally-opposed boxer diesels have rolled out in Europe, and Subaru’s executive vice president Tom Doll said the diesel engine is a hot seller over there, so much so that Subaru total sales are increasing.

Autoblog Green says the car companies are now waiting on the government to mandate higher miles per gallon before they will believe American consumers are willing to buy better technology.

Our chance of getting this powerplant seems slim but new CAFE regulations requiring upwards of 35 miles per gallon by 2016 could convince Subaru that the time to offer Americans a diesel is now.

Toyota took a chance with the Prius and look what happened? The VW and A3 TDI sales are surging. Don’t wait for regulation; ship a limited run to the US and watch the data. Demand is here. Look at comments on the Autoblog Green for example:

I drive 25K miles per year in my 2000 Outback, need to burn 925 gallons of gas per year @ 27 miles per gal costing $2497 @ $2.70 per gal. If I used a diesel engine I would burn 500 gal @ 50 miles per gal costing $1500 @ $3.00 per gal. Save $997 per year or $29 per week. Additionally if diesel spikes up I have the option of making my own diesel out of various materials such as vegetable oil or algae. I really want that option in my next car.

That’s from an American with a low mileage estimate. I could not have said it better myself. Save money, clean the air, and shift America to alternative fuel sources through diesel engine sales, without sacrificing any performance or comfort.

Microsoft Stops Office License Test

The Microsoft support site says you might get an error message when you try to validate Office by using Office Genuine Advantage: “Why didn’t my computer complete validation” or “Error code: 0x8018111”. They give the following explanation:

The Office Genuine Advantage (“OGA”) program has been retired

This is awesome news for anyone who has been trying to run Office on dynamic hosts in virtual environments. Every time I started Office (basically every time I started a virtual machine) it would throw up a message with something like “Hardware change detected; you need to validate your copy of office using genuine advantage”.

It was particularly annoying at conferences where I could start my presentation only after I clicked “Ignore” on the license prompt.

I complained many times directly to Microsoft so perhaps it is this kind of issue that killed OGA.