Security – Page 19 – a sibilant intake of breath

The TOR browser bundle

The TOR browser bundle seems like a reasonably effective and very easy-to-use means of circumventing web censorship and surveillance.

The speed of web browsing falls significantly when data is routed through the TOR network, but tools like this are increasingly essential as governments undertake more and more inappropriate meddling with the free flow of ideas online.

There are versions for various operating systems. I have tried both the Windows and Mac OS installs and they are both easy to use and at least a bit effective in avoiding tracking and censorship. Remember, however, that TOR is useless if someone is tracking all your web traffic at your point of connection to the internet, for instance by reading all the traffic through your broadband connection or cell phone. If you are worried about that, use public networks along with TOR, or set up an encrypted connection to a proxy or virtual private network and then run TOR from there.

Remember, all security bets are of if an attacker gets malware on your machine or gains physical access to it.

The second rule of the internet

Back in 2010, I described what I called the ‘first rule of the internet‘:

Against a sophisticated attacker, nothing connected to the internet is secure.

To this, I feel like I should add a second item:

Everything is internet now.

While there were once large numbers of electronic systems entirely disconnected from the internet, nowadays virtually everything is either connected to the internet constantly or occasionally connected to a device that is online. Your cell phone is probably always accessible to a sophisticated attacker using the internet, and the same is probably true for landlines using VoIP. Many of your computers are probably constantly connected to wireless networks (themselves targets for attack) and exposed to the wider internet through your broadband connection at all times.

Web integration with computers has reached the point that Google’s Chrome browser now treats ‘search’ and ‘GMail’ as apps within the Chrome environment.

The implication of combining the first and second rules is pretty plain. If you manage to attract the attention of a sophisticated attacker, they can probably get into the contents of your cell phone and your GMail account, as well as the hard drive of your PC and laptop, the ubiquitous webcams now built into computers, and so on. There is also a good chance they can take over your email, websites, Twitter accounts, and the like and use them for their own purposes.

Advice to supervillains – killing your own scientists

One classic mistake made by cartoon supervillains concerns the complicated piece of machinery that is inevitably at the heart of their secret plan. It might be a time travel device of some sort, or a machine that strips the opposing superhero of their power, or a key part of a world domination scheme.

As a way of illustrating just how evil and ruthless they really are, supervillains will often kill the whole team of scientists who built the thing, perhaps by having them all drink poisoned champagne. This does make a certain measure of sense. Killing the scientists keeps them from going off and telling people about what they did, which could cause problems for you.

That being said, I strongly object to the timing that is frequently used for these killings. The supervillain will kill off the science team right before testing the device for the first time. As anyone who has worked on anything remotely technical and complex can tell you, this is the worst possible time to kill off all the people involved. Chances are, the machine will not work properly on the first try and that the only people who can figure out what went wrong are the people who designed and built the machine.

By all means, kill the science team once you are confident that you have a machine that will do what you want. Build it, test it, build an improved model, build a backup copy or two, and then hand out the glasses of killer champagne.

Tagging explosives

On a television show I was watching, they mentioned that C-4 explosive is tagged in a way that aids the tracing of its origin if it is used in an illicit way like in a terrorist attack.

Possible method of tagging

I have no idea if that is true, but an idea did occur to me about how it could be done if an organization wanted to. What you need is a collection of chemicals that are stable – that can survive an explosion – and which are rare and can be detected individually. Say you have a set of six such chemicals: A, B, C, D, E, and F.

Each is essentially one bit of data: a zero if absent in the explosive in question and a one if it is present. With six bits of data, you could then label 64 different batches with a unique combination of those chemicals. They would range from 000000 to 111111.

As the number of chemicals used increases, the number of distinct batches you can tag increases rapidly, according to the formula 2^x, where x is the number of different chemicals used.

After undetonated explosives or an explosion is found, tests could be administered to detect the presence or absence of the marker chemicals. Based on the combination of chemicals present, the marker could be read.

Uses of tagging

If you had a couple of dozen distinct chemicals, you could label a huge number of distinct batches. You could have factories making the stuff identify whether it was sold for civilian use or military use, where it was to be initially sold, etc. You would then have a forensic ability to trace back the explosive to the point of manufacture and maybe identify who was the final user.

This could be especially useful if you suspect a legitimate customer is illicitly trafficking in explosives. Say you suspect a mining company of providing explosives to paramilitary groups, or you suspect an allied country of providing explosives to armed rebels in another country. You could make sure to provide the suspect entity with a specially tagged batch, and then you could take samples at sites of suspected use and look for the markers.

Of course, you could also get caught in the act yourself if you got careless. Someone could work out your marker system for themselves or buy information about it from someone who knows. Then, they might be able to find cases where you were redistributing explosives yourselves through illicit channels.

Also, there will always be some homemade explosives like triacetone triperoxide (TATP) that groups will have access to, but denying them the ability to make covert use of explosives manufactured for legal military purposes or commercial use could nonetheless be valuable.

Inside Canadian Intelligence

Edited by Dwight Hamilton, Inside Canadian Intelligence: Exposing the New Realities of Espionage and International Terrorism is an interesting read, though I would say that there are some important counterarguments to the main ideological positions adopted by the various authors.

The book describes Canada’s various present and historical intelligence services, including the intelligence branch of the Royal Canadian Mounted Police (RCMP), the Canadian Security and Intelligence Service (CSIS), the Communications Security Establishment (CSE), military intelligence, and others. There are chapters on counterintelligence, on the Air India attack and subsequent investigations, on special forces (including JTF-2), and on various other topics connected to matters of Canadian security and intelligence. For those wanting to get a better understanding of the history and present operations of these organizations, it is probably a worthwhile read. There is also some interesting information on technical capabilities and techniques, such as some information on the RADAR and infrared data fed into NORAD, how internal government security screenings are conducted, automated facial recognition, how some information from human sources is validated, and voice recognition in mass surveillance of telecommunication.

Most books written by people closely linked to intelligence organizations have a tendency to represent the officers of those organizations as heroes who can do no wrong, opposed by inhuman monsters, and hampered by meddling politicians and judges (for example). What this ignores is the dangers posed to the general public by intelligence services themselves, as well as the willingness they sometimes demonstrate to protect their own interests at the expense of the general public. Oversight may occasionally prevent good things from being done, but it surely prevents abuses as well.

Another assumption I question is that it is appropriate to categorize counterterrorism efforts as a ‘war’. First, I don’t think that is accurate. Terrorism is a tactic, not an entity that can be defeated. Secondly, I think it causes problems when we describe the fight against terrorism as a war. It justifies a lack of oversight, and can be used to justify human rights violations. It also creates the misleading impression that the ‘War on Terror’ could end. In reality, as long as there are people willing to use violence for political purposes, there will be terrorism. It can no more be ended than tax evasion or petty crime.

Above all, what this book lacks is a sense of perspective. Terrorism really isn’t such a huge problem. It kills far fewer people than chronic or infectious diseases, war, or accidents. It’s a mistake to turn our society upside down or spend an excessive amount of money trying to stop people from using certain violent tactics. We need to remain aware of the importance of other priorities, as well as the ways in which ‘being at war’ corrodes the integrity of democratic states. One example of such corrosion is the dangerous tendency of states to spy on everybody, in hopes of catching the few people who may be up to no good. Because it is so powerful, and has so many abilities to hide its mistakes and abuses, the state is far more dangerous than any terrorist cell, and it is critical to human freedom that the power of states be kept in check.

By all means, we should be grateful for the good work done by the security services, but we must also recognize the danger that they will go too far and become violators of rights, as well as the much greater importance of other governmental undertakings. Dealing with cancer and providing a better education for children are far more important to the welfare of Canadians than stopping terrorist attacks. It’s a shame that we are continuing to spend billions on the latter, while government is cutting back on virtually everything else.

Stratfor hacked

A few times before, I have mentioned the website Stratfor. They normally provide a very ‘realist‘ take on global politics. They have interesting sources of information and arguments, and I have found them to be worth reading.

Unfortunately, their entire database of past and present subscribers has been stolen by hackers and released online. If you have ever given them your credit card number, you should probably contact your credit card company immediately to cancel it and have a new card issued with an updated number.

It’s probably a good idea to change your credit card number every few years, regardless. The people at MasterCard said that website hacks like this happen all the time. So often, in fact, that they didn’t want to hear any details about it at all. There are probably a lot of websites that would not notify their users in the event of a breach like the one Stratfor has suffered.

As a side note, this hack demonstrates a couple of things about security. First, the more you hold yourself up as being an expert about security, the more alluring a target you risk making yourself for hackers driven by prestige. This is why the websites of people like the CIA are targeted so often (though such hacks probably aren’t indicative of significant security breaches). Second, there are reputational risks associated with having lax security, especially if you represent yourself as a security expert. I have no doubt that Stratfor’s business will suffer at least a bit because of this.

Unproductive investments that harm the world

Since the 2008 credit crunch, the governments of the world have been obsessed with economic conditions: trying to find ways to increase growth, improve the stability of the financial system, and cut unemployment. All other societal projects have taken a back seat. Given reasonable concerns about the economic future of the world, it seems like common sense to say that governments and societies should be investing their wealth and effort into things that will yield a beneficial return in the future. Unfortunately, that does not seem to be the course Canada is following. We are making big investments in things that are bad for our own economic health, and even worse for the world at large.

Take the F-35 stealth fighter jets. They have no conceivable use. Canada is not going to war with any country that is capable of shooting down lesser jets, at least at any time in the foreseeable future. In the longer term, the jets still look useless, as it is increasingly clear that the age of manned combat aircraft is ending. Canada is spending tens of billions of dollars on weapons we do not need now, and which will probably be obsolete long before they go out of service. We should just skip this generation of killing machines, and perhaps invest later if some credible threat to Canadian security actually emerges.

The new crime bill is an even worse example of putting good money to counterproductive uses. There is no crime epidemic that requires a government response. There is no evidence that imprisoning more people will reduce crime below the already-low level where it is now. Indeed, the only things we can be sure about is that imprisoning people for longer will do more to wreck their chances of living a productive life, while harming their families and communities.

The oil sands may be the biggest example of Canada’s misplaced priorities. Look at the big picture. There are two possible futures for the world:

A world where we do nothing about climate change, and warming of well over 4˚C takes place
A world where we wake up and begin the process of aggressively phasing out fossil fuels

The first possibility is a suicide pact. We would probably be condemning the world to radically destabilizing climate change, with sea level rise of many metres, dramatic changes in precipitation patterns, and enormous human suffering as a consequence. In the second possibility, there is no place for an industry like the oil sands. Indeed, unconventional oil and gas production serves only to lengthen humanity’s dependence on fossil fuels. The smart investment is figuring out how to live on carbon-neutral sources of energy. Spending billions of dollars on an industry that will either be dismantled soon or will persist as a witness to a burning planet doesn’t make either economic or moral sense.

Even if Canada never wakes up and takes the obligation to address climate change seriously, it is quite possible that the rest of the world will do so. The people who say that oil sands extraction are inevitable are the same people who said that the Keystone XL pipeline was a sure thing. As people become aware of the dangers of climate change and the ethical imperatives that flow from them, they will be less and less inclined to invest in the suicidal fossil fuel industry, and less and less willing to buy its lethal products. The billions Canada is investing in fossil fuel infrastructure may end up rusting unused. Leaving the Kyoto Protocol is just one indication that Canada is out of step with the international community, and risks becoming an international pariah based on its selfish focus on fossil fuel profits.

There are so many things we could be spending money more usefully on. We could be investing in the skills and training of the Canadian workforce. That would be a sensible recognition of how global patterns of trade and production continue to change. We could be investing in sustainable infrastructure: buildings, transport links, power generation and storage facilities, and an agricultural system that can function without fossil fuels. We could be investing in assistance to those who are suffering from extreme poverty, both in Canada and around the world, as well as those who struggle with serious mental illnesses.

Canada can make smarter choices, not to mention choices that cause less needless harm. We just need to think a bit more about what sort of world we want for our children and examine whether our current priorities are aligned well with those goals.

Precision and avoiding error

It is fundamental to the nature of truth as accessed by human beings that there is a trade-off between how precise a view we express about a particular subject and how certain we can be of avoiding error.

This can be expressed in a basic way by thinking about estimation. If we are asked to guess how many years Genghis Khan lived for, it is safe to say ‘between 1 and 1000’. It’s not very precise, but the real figure is in there somewhere. Every time we specify a narrower band, we increase the risk of missing the target.There is an inescapable connection between providing a more precise answer and running a greater risk of excluding the answer that is true.

This remains true when it comes to questions that are much more complex and abstract, such as “what is likely to happen in Afghanistan after NATO leaves” or “what are the likely consequences of climate change on international security”. In responding to complex questions, we probably need to acknowledge the limits of what is really knowable. We have limited information, and often a limited span of time in which to make choices. Dealing with that probably requires an awareness of the precision/certainty trade-off, along with a willingness to keep all possibilities in mind, even if they are unproven.

Quite possibly, we should be more willing to err on the side of caution when the level of uncertainty is high and at least some large credible risks seem to exist. When a nuclear reactor may be melting down, it may be a good idea to inject the core with seawater. Doing so ruins the reactor for future electricity generation, but reduces the risk of a terrible outcome in which a meltdown is coupled with a large-scale containment failure. Excluding the worst possibilities usually involves real costs of various sorts, but it is probably better to accept the certainty of a known loss to significantly reduce the probability of an unknown but potentially much worse outcome. In short, it pays to play it safe on important matters.

Holmes: people versus puzzles

The sterling reputation of Sherlock Holmes as a detective is legitimately based upon a combination of a keen ability to reason from observation coupled with a high level of personal energy. Holmes is not above waiting for hours in the dark to catch his culprit, disguising himself for long spans of time in uncomfortable ways, or even living in a rough shelter on a rainy moor so that his client doesn’t know that he is close at hand and observing.

At the same time, it is worth pointing out that Holmes frequently subjects his clients to unnecessary danger, so as to satisfy his own curiosity about the precise nature of the peril they face. In “The Hound of the Baskervilles”, Holmes intentionally uses his client as bait, knowing full well that whatever danger he faces is capable of being fatal, since it already killed an escaped convict. In “The Adventure of the Solitary Cyclist”, Holmes repeatedly exposes his client to an unknown pursuer, who later turns out to be armed. In “The Adventure of the Speckled Band”, Holmes leaves his client in the power of her violent stepfather, who he suspects of having killed her sister (though he does relocate the client on the night when he expects her assassination to occur). In “The Adventure of the Priory School”, Holmes leaves the son of the Duke of Holdernesse with his kidnappers for an unnecessary span of time, so that he can explain the manner in which he located him with maximum drama and in a way that earns him £6,000.

All this demonstrates the dangers of choosing a consulting detective who is obsessed with solving the puzzle, potentially at the expense of the welfare and safety of the client. Someone more inclined to precaution and less obsessed with solutions may be a better choice, for those who value their lives more highly than precise answers.

(As a separate criticism, Holmes sometimes allows murderers to go free because he personally approves of the murder they undertook most recently, for instance in “The Adventure of Charles Augustus Milverton” and “The Adventure of the Devil’s Foot”. This may not be so commendable from a public safety standpoint.)

Designated whistleblowers on corporate boards

In my continuing campaign to come up with specific policy ideas for the ‘Occupy’ movement people, I had another idea: designated whistleblowers on corporate boards of directors.

Basically, they would be people who would need to attend all board meetings and who would have a specific obligation to immediately report any activity that is either illegal or a possible threat to the financial system as a whole.

They could be company insiders who are specifically charged with this role, with rewards for doing it well and penalties for doing it badly. Alternatively, they could be civil servants who are knowledgeable about the firm’s line of work.

Arguably, this would just lead to nefarious activities being orchestrated in venues other than board meetings. Even if some of that happens, it could still be useful. At the very least, it would obligate nefarious board members intent on breaking the law to arrange ways to trick the designated whistleblower, which would interfere with some kinds of bad behaviour. Also, having a designated whistleblower constantly present would be a reminder to others that you are allowed to point out unethical behaviour when it is being practiced by your employer.