There is a time for thought and there is a time for action. Most of the items I have posted to this blog are in one form or other thought pieces — journals of ideas. As some of you have pointed out the thoughts are sometimes half-formed or just plain wrong but to me this medium seems best suited to reflections – on my work on the future of media and technology or on the joys of sport and family life.
This piece is different. I want to convince you that all peace-loving people regardless of country face an imminent threat: the threat of cyber attack on the technological infrastructure upon which we and the societies in which we live increasingly rely.
In a recent post Harry Potter and the Conflict of Laws I argued that the transition from a unilateral world dominated by the United States to a multilateral one coupled with the increasing proportion of commerce that is electronic was leading to an international conflict of laws. The US is also losing its status as the sole cyber superpower with the result that other nations and far more ominously small unaligned groups are gaining the capability to wage cyber war.
Think about how reliant we have all become on the internet to live our lives. No I don’t just mean watching Hulu Skyping or Gmailing with our friends or shopping on Gilt. I mean airline reservations navigation and air traffic control systems; power grid just-in-time manufacturing supermarket inventory and ATM systems; and nuclear arsenal and military command and control systems.
The good news is that responsible governments have worried about and taken reasonable precautions to isolate and protect the last category of systems. The bad news is that we are very exposed to attack on all the “civilian” systems upon which we rely. The vast useful and fascinating internet we know today was originally designed as a relatively small network linking the early computers of government and trusted academic institutions. Few security features were included in this early “Arpanet” since its computer endpoints and users were trusted. However as the modern internet has evolved into a sprawling network of unknown and proxied users no corresponding security features were added to authenticate and protect the computers that were connected to it. Thus the inherent power of the network its “network effect” has become its Achilles’ heel.
We should assume that the power grid ATM and financial systems and civilian aviation networks of most advanced nations have already been penetrated. Most of these know incursions have been made by the military or clandestine services of other nation states. While worrying in its own right I more fear the spread of this capability to smaller unaligned criminal and terrorist groups. Sure China could probably take down the US financial system for a few days but they know this would only mean that the US could not calculate and pay the interest due on the trillion dollars of US sovereign debt they hold. While this could still be a risk if hostilities broke out over Taiwan or North Korea I worry more about the threat of asymmetrical warfare: A small group with nothing to lose who decide that one Apple Mac and a couple of smart programmers can inflict more damage than a wave of Predator drones.
So what should we do? I said this was a time for action not ideas. First start at home. Take sensible security precautions with your computers and mobile devices (eg use robust password protection install security software to sweep for malware viruses worms etc. don’t open files from unknown sources). If you would not leave your front door open at night don’t do so with your computing devices. Be prepared to trade off some level of convenience and privacy for security – hey I don’t like to carry keys in my pocket either but it beats sleeping on the front step. Second raise awareness. Talk to your family adopt policies at your company write your government officials. Third don’t assume it’s someone else’s problem. Back-up your data keep paper copies of bank records and remember what it was like to live before the seductive convenience of computers.
Ultimately I believe that the answer lies in creating a “super net” or overlay internet among trusted and authenticated institutions akin to the role mil.net served for the US Department of Defense. We are slowly evolving from an unpoliced network of anonymous nodes to a multi-layered network of authenticated institutions and individuals. Just as individuals must be approved to receive a security clearance from their government so can their machines be identified and approved. What emerges need not be an Orwellian nightmare of government control. Rather I can imagine a layered internet in which the nuclear arsenal is controlled by the highest and most secure level the power grid air traffic control and ATM networks are secured by a sufficiently robust next layer but an open cyber frontier — a wild west — remains for individuals to roam free of government control and authentication but also open to attack and abuse.
No system will ever be perfectly secure but I would like to think that we can find the collective will to act before a harmful attack calls us to action.
I’m happy in principle to trade off some level of convenience and privacy for security. But before I do that I’d like to see some empirical evidence that things like robust password protection actually increase security. A lot of that stuff I suspect falls more into the class of security theater than security: it makes us *feel* safer but it doesn’t actually make us safer in reality. Also I think we *are* moving to a network of authenticated institutions and individuals — specifically with the rise of OAuth which before long we’ll see being used for banking and not just Twitter. I think that a lot of what you’re asking for is already being answered with OAuth no?
The survivability of data networks may be as vital as the survival of our more traditional infrastructure if we rely on the former increasingly. However there are two points that I would add to your timely warning. One is that the greatest enemy of electronic data may not be sabotage or outside attack but the obsolescence of the technology necessary to read it. Computerizing things has great benefits but also carries great risks and organizations today need to take institutional memory very seriously. In the old days carrier pigeons were the best insurance against a hostile interruption in communications. You might remember the Reuters story from six years ago in which researchers found that even carrier pigeons were now using modern road networks to navigate. It may be harder and harder to be independent of the networks that structure our lives. The other point is that when it is not possible to prevent a disaster it usually is possible to prevent it from happening again. I am reminded of the Dutch who refused to listen when Cornelius Lely warned them in the 1890s that the Zuider Zee was open to catastrophic flooding. Lely devised a master plan to build a long barrier to close off the inland sea from the North Sea. When disaster struck in 1916 he was ready and the Dutch parliament meeting up to their knees in water approved it. The great barrier was finished in 1930. Then Lely’s protege Johan van Veen pointed out in the 1920s that the Rhine delta was just as exposed and needed a series of barriers and gates that could be closed in an emergency. Nobody acted until disaster struck again in 1953. Van Veen was ready with a master plan that the Dutch completed in the 1980s. We should have had a similar master plan for New Orleans before Hurricane Katrina and for an oil spill before the BP disaster this summer. We should also have some kind of plan to strengthen civilian cyber-security so that if a breakdown occurs and the political will materializes something can be done to make it less likely in the future. We will still be in a cat and mouse game with some levels of attack but the more serious threats may be possible to anticipate and limit. David P. Billington Jr.
Hello Tom I agree with what you have to say. We are living in a day where all communication over the net is unencrypted. We will look back in twenty years and wonder how we survived. The wild west indeed. It is troubling to see the start of weaponized cyber world. I am in a grad program now (http://tli.umn.edu/graduate/msst) training leadership against cyber attacks and cyber terrorism. Some of the brightest minds in the US are teaching this program. I encourage you to get in touch with Professor Massoud Amin if you desire more information on the program.
It should be noted that the DOD is in the process of launching a “cyber” command; clearly the Pentagon shares your concern. There are those who believe strongly that many US computer systems have already been compromised so this call may have come a bit late.
Hi Tom. I read with interest your concern about the security of essential infrastructure in a world of insecure networks. It has been obvious for some time that even the most “secure” networks are not secure and fortunately at this stage those with malicious intent do not have the necessary skills to do the damage they could potentially do. But this could all change and we will learn that software used to manage defence and essential infrastructure has to be made secure in its own right. David Billington