Security – Page 47 – a sibilant intake of breath

Why the Allies Won

Among the hundreds of books I read at Oxford, Richard Overy’s Why the Allies Won stood out as an especially engaging piece of historical argumentation. It is one of a handful of books I was determined to re-read when I had more time available. Given the fundamental importance of the Second World War in the establishment of the contemporary international system, the question is a rather important one. Overy’s explanation is well-argued, convincing, and consistently interesting.

This complex book has a number of general themes, each of which is based around a necessary but insufficient cause for the victory of Britain, the United States, and the Soviet Union over Germany, Italy, and Japan. Overy goes into detail on the Battle of the Atlantic – particularly the importance of American supplies for Britain, the U-boat menace, and the tactics that turned the tide in that theatre. He likewise covers the war on the eastern front: from early German successes to the battles at Stalingrad and Kursk that marked the watershed point of the war. In the Pacific theatre, he does an excellent job of explaining the significance of the Battle of Midway, including the considerable role luck played in the victory. The outcome was largely decided by ten bombs in ten minutes that struck Japanese aircraft carriers while they were refueling their air wings.

An entire chapter is devoted to the cross-channel invasion from Britain into occupied France. Of particular interest is the role played by intelligence, a subject Overy arguably neglects to some extent in other circumstances. The ways in which the Allies kept German defences spread out through misdirection make for especially interesting reading.

Overy also covers more thematic reasons for the Allied victory: mass production, especially in the United States and Soviet Union; technology, especially air power; the surprising unity between the Allies; and the moral contest between the Allied and Axis states. Unlike many historians, he highlights Allied bombing as an effective military strategy. He remains ambiguous about whether the military utility justified the bombing of German and Japanese civilians, but argues relatively persuasively that attacks on oil facilities and other key bits of industrial infrastructure served an important strategic purpose.

Midway is not the only example of good fortune Overy highlights – partially in an attempt to undermine the argument that the war could only have ended the way it did. Adding external fuel tanks to the fighters escorting bombers into German airspace dramatically reduced losses, substantially bolstering the effectiveness of the strategic bombing campaign. Likewise, equipping a few aircraft to close a small ‘Atlantic gap’ helped secure the end of the U-boat threat. Even the devastating trap sprung by the Soviets upon the German supply lines approaching Stalingrad could not have succeeded without the incredible success of a few thousand isolated troops occupying the entire German 6th army.

This book is enthusiastically recommended to anyone with an interest in military history generally or the Second World War in particular. It is also a good general disproof of the idea that the outcome of wars is decided by basic material facts like the relative sizes of economies, or the idea that there aren’t decisive turning points in history where the world is pressed along one path as another is closed off.

Mifare RFID tags reverse engineered

I have written before about security weaknesses in pin-and-tumbler mechanical locks. I suggested that electronic token based systems have a greater capacity to be secure, since they do not rely upon mechanical parts that can be manipulated.

Of course, poorly designed electronic systems can also be breached easily. That was demonstrated in September, in relation to the KeeLoq system used for keyless entry in many cars. Now, another brand (Mifare) of RFID tags have been reverse engineered and found wanting. As is usually the case on matters of physical security, I saw this story first on blackbag.

Three climatic binaries

One way to think about the issue of mitigating climate change is to consider three binary variables:

Cooperation
Expense
Disaster

By these I mean:

Is there a perception that all major emitters are making a fair contribution to addressing the problem?
Is mitigation to a sustainable level highly expensive?
Are obvious and unambiguous climatic disasters occurring?

These interact in a few different ways.

It is possible to imagine moderate levels of spending (1-5% of GDP) provided the first condition is satisfied. Especially important is the perception within industry that competitors elsewhere aren’t being given an advantage. Reduced opposition from business is probably necessary for a non-ideological all-party consensus to emerge about the need to stabilize greenhouse concentrations through greatly reduced emissions and the enhancement of carbon sinks.

It is likewise possible to imagine medium to high levels of spending in response to obvious climatically induced disasters. For instance, if we were to see 1m or more of sea level rise over the span of decades, causing serious disruption in developed and developing states alike. Such disasters would make the issue of climatic damage much more immediate: not something that may befall our descendants, but something violently inflicted upon the world in the present day.

Of course, if things get too bad, the prospects for cooperation are liable to collapse. Governments facing threats to their immediate security are unlikely to prioritize greenhouse gas emission reductions or cooperation to that end with other states.

We must hope that political leaders and populations will have the foresight to make cooperation work. It may also be hoped that the cost of mitigation will prove to be relatively modest. The issue of disasters is more ambiguous. It is probably better to have a relatively minor disaster obviously attributable to climate change, if it induces serious action, than the alternative of serious consequences being delayed until it is too late to stop abrupt or runaway change.

An idea for reducing electoral fraud

When it comes to elections, there are a number of different kinds of attacks against the voting process that should concern us. Excluding things like bribing and threatening voters, we need to worry about votes not getting counted, votes getting changed, and votes being inappropriately added. In the first case, an unpopular government may remove opposition supporting ballots from ballot boxes in marginal constituencies. In the second, they might alter or replace ballots, converting opposition votes to government ones. In the third, they might simply add more ballots that support the government.

A relatively simple measure could protect against the first two possible attacks. When a person votes, they could be given a random string of characters. One copy would get printed on their ballot, another would be theirs to keep. Then, once the ballots had been tabulated, a list could be posted on the internet. Sorted by electoral district, it would list the various options people could have chosen, the total number of people who chose each, and a list of the random strings that each person brought home. The importance of the random string is that it preserves the integrity of the secret ballot. Because each string is generated using a random number generator, no string can be tied to an individual. Only the copy given to the voter allows them to check that their vote was properly counted.

Under this system, if I voted for Candidate A and got the string “GHYDMLKNDLHFL,” I could check the list under Candidate A on the website and ensure that my vote was counted for the right person. If my vote hadn’t been counted, my string wouldn’t be anywhere on the list. If it had been miscounted, it would appear in the wrong place. People who found themselves in that situation could complain to the electoral authority, the media, and foreign observers.

The system remains vulnerable to an attacker adding new ballots in support of their candidate, but only to a certain degree. Provided there are some independent observers watching the polling station, the approximate number of people who voted can be pretty easily determined. If the number of votes listed on the website is well in excess of that number, it can be concluded that fraud has occurred.

None of this is any good against a government truly committed to rigging an election; they will always be able to brush off complaints from foreigners and the media, and they will rig the electoral authority. At the same time, it would make rigging more difficult and increase public confidence in the electoral system in any state that implements it. Being able to see your vote listed in the appropriate place may also make elections feel more concrete and personal.

The system does create some new risks. Attackers might force voters to share their random string. If they did so, they could determine who an individual voted for: a worrisome prospect in situations where people could be threatened to vote in one way or another. Likewise, having confirmation that a vote went one way or the other could make vote-selling a bigger problem. With a standard ballot, there is no way to know whether a paid voter actually voted the way they were paid to vote. These additional risks should be borne in mind in the context of any particular election or state. In some cases, they could make the dangers of this approach outweigh its benefits. In most places, however, I suspect it would be beneficial and relatively inexpensive.

Some previous posts on electoral security:

Conditional support for our troops

Walking through the Rideau Centre yesterday, I came upon a cart selling t-shirts with various slogans on them. Beside the silly Che Guevara stuff was one shirt that caught my attention. In white letters on a red background it said “Support our Troops.” Under that were both a maple leaf and the flag of the United Nations.

It struck me as admirably post-nationalistic. We recognize the sacrifices made by members of the armed forces, but also that their conduct needs to be bounded by international law. While the sentiment is admirable, it sits uncomfortably with the reality of how ignorant most Canadians seem to be about what we are doing in Afghanistan. People really think we are mostly building bridges and distributing big bags of rice. The reality of the all-out war in which we are committed is very different.

That is not necessarily to say that we shouldn’t be fighting the Taliban along with our NATO allies; it is simply to highlight that Canadian governments manipulate the perception of Canada as a ‘peacekeeping nation’ to keep people from looking too closely at what our armed forces really do. The degree to which many people seem happy to continue to believe in the peacekeeping myth just because it makes them feel good is also problematic.

A few thoughts on climate justice

A couple of articles at Slate.com address the issue of ‘climate justice.’ This is, in essence, the question of how much mitigation different states are obliged to undertake, as well as what sort of other international transfers should take place in response to climate change. The issue is a tricky one for many reasons – most importantly because anthropogenic greenhouse gas emissions constitute a unique experiment that can only be conducted once. If we choose the wrong collection of policies, all future generations may face a profoundly different world from the one we inherited.

If we accept Stern’s estimate of a five gigatonne level for sustainable global emissions, that works out to about 760kg of carbon dioxide equivalent per person on Earth. Releasing just 36kg of methane would use up an entire year’s allotment, as would just 2.5kg of nitrous oxide. One cow produces about 150kg of methane per year. Right now, Canada’s per-capita emissions are about 24,300kg, when you take into account land use change. American emissions are about 22,900kg while those of India and China are about 1,800kg and 3,900 respectively. Because of deforestation, Belize emits a startling 93,900kg of CO2e per person.

The questions of fairness raised by the situation are profound:

Should states with shrinking populations be rewarded with higher per capita emissions allowances?
Should states with rising populations likewise be punished?
Should developing states be allowed to temporarily overshoot their fair present allotment, as developed states did in the past?
To what extent should rich states pay for emissions reductions in poor ones?
To what extent should rich states pay for climate change adaptation in the developing world?

It may well be that such questions are presently unanswerable, by virtue of the fact that answers that conform with basic notions of ethics clash fundamentally with the realities of economic and political power. We can only hope that those realities will shift before irreversible harmful change occurs. Remember, cutting from 24,600kg to 760kg per person just halts the increase in the atmospheric concentration of CO2. The level of change that will arise from any particular concentration remains uncertain.

Another vital consideration is how any system of international cooperation requires a relatively stable international system. While it is sometimes difficult to imagine countries like China and the United States voluntarily reducing emissions to the levels climatic stability requires on the basis of a negotiated international agreement, it is virtually impossible to imagine it in a world dominated by conflict or mass disruption. It is tragically plausible that the effects of climate change could destroy any chance of addressing it cooperatively, over the span of the next thirty to seventy years.

The eradication of smallpox

On this day in 1979, the World Health Organization certified that smallpox had been eliminated from the wild. It was probably the only intentional extinction in human history, and it was a considerable boon to the human race. The disease is an atrocious one, and it took a heavy toll across history. Notably, it caused much of the death associated with the arrival of Europeans in North America.

The extinction raises a number of questions. One is whether it will ever be repeated. We came close with polio. Very few people would mourn the elimination of tuberculosis, malaria, or AIDS. Worldwide eradication requires global coordination – something very hard to bring about when territories exist outside the control of any state. Think of the tribal areas bordering Pakistan and Afghanistan.

Another issue has to do with smallpox itself. It was horrifically destructive to the First Nations because they lacked any of the immunity conferred by prior exposure. Now, the whole world is in essentially the same boat. An intentional or accidental release of the weaponized smallpox produced by many states could thus cause of devastating global pandemic. It rather makes one wish we had never turned it into a weapon in the first place.

AXA lock flaw

In a situation somewhat similar to the bump key vulnerability, another serious mechanical lock flaw has been found, this one affecting a popular kind of Dutch bicycle lock.

I found this by means of an interesting blog about mechanical locks.

‘Green’ fuel for military jets

There has recently been a fair bit of media coverage discussing an announcement from the United States Air Force that they are trying to use 50% synthetic fuel by 2016. The Lede, a blog associated with the New York Times, seems to misunderstand the issue completely. They are citing this as an example of the Air Force “trying to be true stewards of the environment.” There is no reason for which synthetic fuels are necessarily more environmentally friendly than petroleum; indeed, those made from coal are significantly worse.

The actual fuel being used – dubbed JP-8 – is made from natural gas. Air Force officials say they eventually intend to make it from coal, given that the United States has abundant reserves. This inititative is about symbolically reducing dependence on petroleum imports, not about protecting the environment. The German and Japanese governments did the same thing during the Second World War, when their access to oil was restricted. Furthermore, it is worth stressing that efforts by militaries to be greener are virtually always going to be window dressing. The operation of armed forces is inevitably hugely environmentally destructive: from munitions factories to test ranges to the wanton fuel inefficiency of aircraft afterburners, the whole military complex is about as anti-green as you can get.

People should be unwilling to accept superficial claims that installing some solar panels and building hybrid tanks is going to change that.

Problems with government databases

By now, everyone has probably heard about the data loss debacle in the United Kingdom. The British government lost the child benefit records for 25 million people. These records include addresses, dates of birth, bank account information, and national insurance numbers. In total, 40% of the British population has been exposed to the risk of identity theft.

Obviously, this should never have happened. One government agency requested some anonymized data for statistical purposes. Instead, a different department sent them the whole dataset in an unencrypted format. Encrypting the discs would have made it nearly impossible for thieves to access the data; anonymizing the data would have made such theft unprofitable. The failure to do either is the height of idiocy, but it is probably what we need to expect from the civilian parts of government when it comes to data security. Security is hard; it requires clever people with good training, and it requires oversight to ensure that insiders are competent and not cheating. People who are naive and naturally helpful can always be exploited by attackers.

In response to this situation, two sets of things need to be done. The first is to correct the specific failures that cause this kind of problem: require encryption of sensitive documents in transit, limit who has access to such sensitive databases, and tighten the procedures surrounding their use. The second is to limit the amount of such data that is available to steal in the first place. That could involve using paper records instead of digital ones – making mass theft dramatically harder to accomplish. It may also involve not creating these kinds of huge databases, as useful as they may seem when working properly.

It is fair to say that there will always be people out there able to break into any information that a large number of civil servants have access to. This would be true even if all civil servants were capable and virtuous people, because a lot of the best computer talent is applied to breaking flawed security systems. Given that bureaucrats are human, and thus subject to greed and manipulation, the prospects for keeping a lid on government data are even worse. Acknowledging the realities of the world, as well as the principle of defence in depth, suggests that limiting the volume of data collected and held by all governments is an appropriate response to the general security risks highlighted by this specific incident.