Musing on the Near Future

I read an interesting article online today. It is simply the latest in a long set of articles on related topics that have sparked some discussion with people over the last year or so.

I want to give this a little spin that I haven’t seen in the news or commentary, simply to provoke some thought. That, and I’m getting tired of all the Chik-fil-a discussions and yet more evidence of politicians being less concerned with the people than with (re)election. Here’s a chance to get some discussion on something else. (Yes, I suppose that makes this a long-winded troll.)


First, it is clear that Iran’s leadership is trying to push things as far as they can. In some senses, they do indeed have a right to enrich uranium so long as they allow international inspections and don’t head towards weaponizing it. After all, they have signed the non-proliferation treaty. However, statements and actions by the government there do not lead to any sense of calm and confidence that they would abide by the treaty, and to date they have violated it in several ways. They’ve repeatedly rejected attempts to resolve some of the issues.

So, the international community has pushed sanctions. The U.S. just ratcheted up the issue by setting indirect sanction in place on banks and firms in countries doing business with Iran.   

Some critics of the current U.S. administration have been claiming that the sanctions aren’t working, and we need a military option. In fact, reports out of Iran are that the sanctions are increasingly degrading the quality of life for common Iranians, and that is increasing their dissatisfaction with the government. That is precisely the plan. The more unrest and discontent in the populace, the more the government has to beat the drums about being under siege by the rest of the world because of their “righteous cause.”

OK, this isn’t news to anyone who has given it some thought, or thought about prior instances of countries under sanctions. However, given the sanctions, one wonders if they are likely to achieve the desired goals. The question is one of “what goals are those?

Here’s where some interesting events could come about, and may be the actual intent.

There have been repeated public claims by the Iranian government that it views the sanctions as hostile acts. There have also been statements about how they aren’t afraid to go to war and close the Straights of Hormuz, and will do so if provoked. There has been a fair amount of sword-rattling. This is one of the few ways they can really do anything militarily, because they really don’t have a strong navy or a lot of resources to employ.

Closing the Straights — or even trying to — would raise some panic among shipping companies that transit oil tankers through there. Loss of a big tanker would be very expensive, and insurance doesn’t normally cover acts of war. It would likely stop some of the tanker traffic, which in turn would raise the market price (and some availability) of oil, thus leading to strain on Western economies. The Iranians — and everyone else — knows this. That is why the threat has some impact.

However, quietly over the last year, various western powers appear to have been building up bases and anti-mine capabilities in the region, and are well-equipped to counter any Iranian moves to interdict naval traffic. There have also been some moves to change oil usage and flow, including a new Saudi pipeline that bypasses the Straights.

So, here’s how the scenario might well play out:

  • the new sanctions really hurt and the Iranian people are even more unhappy with the government
  • the Iranian government feels forced to make a public move to consolidate its position
  • the Iranian government makes some move in the Straights of Hormuz, and/or the Revolutionary Guards, under pressure, make some error that results in apparent hostilities in the Straights
  • given the excuse of threats to shipping in International waterways, NATO and/or other powers intervene
  • there is escalation until there is an actual shooting conflict involved

Again, that isn’t overly surprising. What I want to suggest, however, is that when this happens, it will also be perfect cover for launching an offensive against the nuke plants. Iran will have proven itself an aggressor, and will be in a pitched fight at sea — that will be perfect political and tactical cover for airstrikes, and maybe even deployment of some special ops teams to get things that airpower can’t.

The question is whether or not the Iranian leadership is crazy enough, defiant enough, and/or desperate enough to create the incident. The problem is, they don’t have many options. If they don’t do something, it threatens long-term support from within. And ideologically, it seems unlikely they will back off on enrichment because that would show the world they submitted to demands from both the Little Satan (Israel) and the Big Satan (USA).

My prediction: conflict by early October.


As with anything else, however, there are secondary effects to consider. If the above scenario plays out in any way similar to the above, there are at least three probable secondary effects:

1) North Korea occupies a roughly similar political position as Iran in the world: nuclear capabilities, pariah state, erratic political behavior, population under stress from sanctions. There has been some apparent thawing beginning with Kim Jong Un’s consolidation in power. If shooting breaks out with Iran, expect North Korea’s military to gain ascendency. This is not likely to trigger a crisis, per se, but it will wipe out the chance of some reconciliation that appears to be appearing.

2) Any threat of conflict in the oil production zone or the shipping lanes will impact oil prices. If that happens for more than a few weeks, it will have a negative impact on many economies — especially within the EU. It will hasten defaults by several governments and the probable breakup of the Euro zone. (If there is no conflict, I expect the same to happen by the end of the year anyhow. Spain and Greece are going to go into default, and France and Italy may join them. The debt loads are unsustainable and default is inevitable. It is simply a matter of time, and an oil crisis would move it forward.)

Fallout of European defaults will not be pretty. It will cause significant hiccups in both the Chinese and US economies. It might be enough to trigger a slide into a global depression.

3) Depending on timing, this will have an effect on the US elections. Late in the fall, it will likely aid in Obama’s re-election as the decisive commander-in-chief will be the image voters will have going to the polls. Between now and late September will give time for the economy to slide, and that might well be in Romney’s favor.


Black swan events could change a lot of this, of course. My personal “favorites” involve major earthquakes (California, New Madrid fault, Istanbul, China); major eruption of Katla in Iceland, shutting down air travel across Europe; conflict involving Pakistan (accidental war with India or internal rebellion); major solar storm that damages electrical transmission systems in North America or Europe. There are undoubtedly others (that is part of the definition of Black Swan!), but any one of those would be sufficient to make the world situation much more complicated.

There are also the troubling issues of what happens if the al Assad regime uses its chemical weapons, or allows them to fall into the hands of jihadists. Or any scenario with Iran where they start lobbing ballistic missiles into Israel, even if only armed with conventional warheads. The results of either would be very ugly: Israel does allegedly have nuclear weapons, and the hardliners in charge will strike back, hard, at any perceived existential threat. The follow-on to something like that would be very bad.


Overall, I expect the rest of this year to be interesting.

My sincere hope is that I’m totally wrong. After all, my day job is computing. But if not, you read it here.

You may now return to your lolcats, Pinterest, and competing rants about the economy. :-)

Crowdsource comments on a talk

On July 18, I’m giving a keynote talk in Las Vegas at Worldcomp 2011 (the World Congress in Computer Science, Computer Engineering, and Applied Computing). I’ve enclosed the abstract of my presentation, below.  The talk will be in the Lance Burton Theater at the Monte Carlo Resort and Casino. I’m told that the audience is likely to be around 1000 people, so there won’t be much opportunity for comments from the audience.

I have most of the talk prepared, but I thought I would ask, ahead of time, if anyone has some thoughts on the topic/abstract that I should consider before I finish my preparations. I can’t share the talk ahead of my presentation — sorry. I may not be able to respond to every email, but I’ll try. Any and all comments will be appreciated.

If you have any comments or ideas you think I should consider, please share them with me by email.

My talk is partly informed by things I’ve written about in my CERIAS blog over the last 3 years, and by a JASON report, The Science of Cyber Security, from November 2010. (Many people hailed that Jason report, but I think they missed the mark in several places.) Of course, I also am applying 30 years in computer research and applied computing, but I don’t have a specific link for that!


The Nature of Cyber Security

Abstract—There is an on-going discussion about establishing a scientific basis for cyber security. Efforts to date have often been ad hoc and conducted without any apparent insight into deeper formalisms. The result has been repeated system failures, and a steady progression of new attacks and compromises.

A solution, then, would seem to be to identify underlying scientific principles of cyber security, articulate them, and then employ them in the design and construction of future systems. This is at the core of several recent government programs and initiatives.

But the question that has not been asked is if “cyber security” is really the correct abstraction for analysis. There are some hints that perhaps it is not, and that some other approach is really more appropriate for systematic study — perhaps one we have yet to define.

In this talk I will provide some overview of the challenges in cyber security, the arguments being made for exploration and definition of a science of cyber security, and also some of the counterarguments. The goal of the presentation is not to convince the audience that either viewpoint is necessarily correct, but to suggest that perhaps there is sufficient doubt that we should carefully examine some of our assumptions about the field.

My reflection on 9/11

This is really two posts in one: some reflections on where I was on 9/11, and some of the follow-on effects.

Irony

Eight years ago this morning, I was sitting in a conference room at the National Security Agency with a number of colleagues from university programs in infosec education. We were awaiting a speaker to address us on the topic of counter-terrorism. The speaker was late, and then someone came into the room and told us the schedule had changed – and turned on the TV to CNN’s live coverage of the burning World Trade Center tower, hit by flight 11 a few minutes earlier. We watched as flight 175 crashed into the second tower. Our hosts seemed unable to determine what we should do next, until the order came to evacuate the buildings – all nonessential personnel were told to evacuate.

As we were exiting the building, Flight 77 crashed into the Pentagon.

The ensuing traffic jam was a nightmare. I sat in my rental car with Peter Freeman, then the dean at Georgia Tech, for nearly 2 hours as traffic crawled out of the parking lot and towards our hotel in Linthicum. Our group reassembled in the restaurant, watching TV, trying to get a cell phone signal to call our homes, and discussing what was happening.

Personal Impact

My personal experience with this was confounded by having my father in a hospital in Alexandria, having suffered a stroke on 9/8. Unbeknown to me, he was moved to another facility that afternoon as part of a regional disaster plan, to make room for more potential victims if there were other attacks. It took me a day to find him, and several more days to complete arrangements for his care after I went home. I then drove all the way back to Indiana in a rental car, as air travel was still not operational.

It also changed my own personal plans in several major ways. When I returned to Purdue, I found the completed forms for my planned sabbatical, awaiting only my signature ….to go be the first CTO at the NSA. General Mike Hayden (then DIRNSA) and I had discussed a project to examine how to modernize some of the computing internally, and to get a sense of what would be good to build into the university curriculum to train for a new era of computer threats around the world. As a result of 9/11, Gen. Hayden recommended that I cancel my plans, as the environment would not be the same (obviously), and would not likely be something I would enjoy or benefit from.

I basically lost my sabbatical. It was too late to cancel with the university, and I was unable to make alternate arrangements, so I resolved to stay at home and catch up on reading and writing. Within the next few months both of the most senior staff at CERIAS had left for better arrangements (for them) and I ended up working more than my regular position simply to keep the center going. It was not pleasant, and although I was able to hire outstanding replacements, it was not immediate.

It was the second of three of my sabbaticals that have all been occupied with external events such that I did not really get a sabbatical. And each time, Purdue has charged me for the time and I have ended up more drained than refreshed. Ah well, that is minor compared to the world events here.

Cyber

9/11 changed the attention that we were beginning to get on cyber security, too. Our meeting that morning of educators and researchers was enabled by interest generated by Richard Clarke and Mike Hayden (among others). Soon thereafter, everyone was focused on issues related to further (non-cyber) attacks, and momentum was lost on the efforts we had spent years to build. That is not to suggest that such a focus was incorrect, but one wonders what our cyber security would be like now without the 9/11 incident? (Dick Clarke kept some focus on our community, and I visited him several times in the following two years before he left government. He always understood the role of cyber security, but the policy environment was all focused elsewhere.)

The Scholarship for Service program started up around that time, and the public concern and a desire to “do something” led many people to enroll in the program. We had a large number of students in our program over the next few years (although it tapered off to only one remaining student this year). Most of our former students are still working in the government, some in senior positions. That clearly was one ray of sunshine in the gloom.

It is only now that some focus has really returned on Cyber from the Congress and the White House. Even so, it is primarily directed towards “cyber war” and “cyber terrorism” as boogeymen, rather than the more general problems of crime, fraud and abuse. We continue to be drained by cyber crime, with some estimates of the damage as high as $100 billion per year. That is a heavy burden to continue to bear.

Some Numbers

I was asked to give a talk at Tufts University yesterday, and to look at the 9/11 incident as part of my talk on security. I came up with some some numbers, and an interesting quote.

It is generally understood that the Al Qaeda goal of the 9/11 attack was to try to foment unrest among Muslims around the world, to rise up against the West and re-establish the Caliphate. They completely misunderstood the overall world reaction to the attack. Although there was celebration in a few places (such as by the Palestinians), there was near universal outrage, and great solidarity of purpose. The invasion of Afghanistan to overthrow the Taliban and get the leadership of Al Qaeda had widespread support.

Then, for reasons that still do not make sense to many of us, before we (as an international community) finished the task at hand, President Bush & company initiated the invasion of Iraq – despite no threat from Iraq, and no connection with Al Qaeda. Rather than editorialize on that, let me simply list some numbers:

  • Number of casualties from the 9/11 attacks: 2974 (and 19 hijackers)
  • Number of US casualties from all domestic terrorism from 1900 to 2000: about 250
    • People killed by Timothy McVey 4/19/95 in Oklahoma City: 168 (about 2/3 of total)
  • Deaths of US military personnel since 2001 in Afghanistan and Iraq: 5130

    • With deaths of coalition forces and US military contractors included: 6508
    • Wounded: over 100,000 and perhaps as many as 300,000 US troops with brain injuries and PTSD
  • Estimated number of civilian deaths in Iraq and Afghanistan from military operations: 1,339,771
  • Estimated direct cost of the military actions in Iraq and Afghanistan: $908 billion and growing.
    • Estimates of indirect, eventual costs to the US: $1-$2 trillion more.
  • Refugees from Iraq as a result of hostilities: 4.7 million. Another 1 million from Afghanistan.

Yet, we have a paradoxical response to losses that happen regularly, over time. Consider:

And yet we have people fighting to be allowed to smoke and go without seat belts.

I wonder how each of the 2974 victims of the 9/11 attacks would react to hear that, as a response to each and every one of their deaths, the US and its allies spent $675 BILLION apiece to kill 450 people in the Middle East and cause another 1916 to be refugees from their homeland. Oh, and for each of those victims, 2.2 coalition military personnel died, and as many as another 1000 suffer permanent injuries.

And the architects of the 9/11 attack are still free and plotting more mayhem.

I have no grand, sweeping conclusion from all of this. Terrorism is clearly a bad thing. So is untimely death. I fear the greater tragedy, however, is losing sight of how we, as civilized society, treat the lessons of the 9/11 tragedy and its aftermath. Osama bin Laden was quoted as saying:

“All that we have to do is send two mujaheddin to the furthest point east with a flag on which is written the words al-Qaeda, and the Americans will panic and send a general and an army there, and engage in military operations which cost them blood and money and political capital, and then we’ll just do it again. … so brothers, we’re pursuing this strategy of bleeding the United States to exhaustion and bankruptcy.”

As a country, we tend to react violently when attacked overtly – we remember the Maine, we remember the Alamo, we remember Pearl Harbor, and we certainly remember 9/11. We grieve for those who lost their lives suddenly. We condemn the evil deeds that caused their untimely deaths. We seek some justice and retribution, usually in the form of war.

Let us pause to mourn the fallen, but focus on a better future for all, because we seem to be doing what the terrorists want. And that does not bode well for a peaceful future. I have lived through one 9/11 catastrophe. I do not wish to see another.

Nice Kitty

Last week, I heard about the impending release of MacOS X 10.6, aka Snow Leopard. So, being the early adopter, bleeding edge kinda guy I am, I pre-ordered a family pack from the Apple Store online. Apple moved up their release date, and lo, my copy was delivered via UPS to my doorstep Friday morning.

Installation

I have 5 Macs in the family: three Intel-based, and two-PowerPC. The PowerPC Macs aren’t capable of taking Snow Leopard, but the other three are. So, I went through my usual steps for an upgrade to my main MacBook Pro (late 2007 model):

  • Ran DiskUtility to check the disk and fix permissions
  • Upgraded all my applications with VersionTracker Pro
  • Uninstalled PGP (see note)
  • Ran DiskUtility again
  • Ensured I had a fresh backup of the disk

And then I inserted the install disk. Unfortunately, this resulted in no great joy, as I got an error message about

Mac OS X cannot start up from this disk. Mac OS X cannot be installed on [my disk], because this disk cannot be used to start up your computer.

Huh?

This is my regular disk! I’ve been booting the system from that disk for nearly 2 years!

The same error occurred when I booted from the DVD and tried the install. I ran the DiskUtility repair several times, to no avail.

A quick check of posts on the Innertubes revealed that several other people had the same problem, and the Apple techs they consulted were not able to help much. I was not at all keen on blowing away the disk with a reformat and install, which I assumed would have fixed things.

Then I saw a note on one of the Apple forums. It suggested that there was something wrong in the disk label or volume header that was causing the problem. So, I tried the following:

  1. Booted from the install DVD
  2. Selected and ran DiskUtility from the Utilities menu
  3. Within the utility window, highlighted the physical disk that my startup partition was on
  4. Selected the “Partition” tab
  5. Clicked on the little tab at the bottom of the partition window and shrunk the partition
  6. Then I moved it back to the same size with a new mouse click
  7. Clicked the “apply” button
  8. Quit DiskUtility

This works because of the allocation scheme used in the OS. If there is free space at the end of your partition, you can shrink or split it without difficulty – you don’t lose data. However, had my disk not already been formatted with a GUID volume header, this wouldn’t have been enough, but GUID is the default format for any Intel-based Mac boot disk.

The same partition “jiggle” procedure was required for my iMac install (early 2008) but not my new MacBook Pro install.

I then reran the installer and everything worked as it was supposed to work.

Tip: When you are doing your own install, be sure to click on the customization button at the lower left corner of the screen before starting the install on its merry way. You will find that there are things selected that you may want to omit, such as all the language versions and some of the printer drivers. This can save install time and a lot of space on your disk.

Apres-Intall

The installation took about 45 minutes. When it was done, I had regained about 9Gb of space on my disk! That alone was a good reason to upgrade.

Lots of little things don’t work now, and I need to wait for updates (if they will be released). Almost none of the programs I use on a regular basis are a problem – it is only some of the gadgets and little shortcuts that seem to need tweaking, along with some items that have start-up issues that are solved by reinstalling. Overall, the major software vendors have had releases out that were Snow Leopard-ready.

There are only a few programs I use regularly that don’t seem to work right and no updates yet available:

PGP explicitly does not work, and the folks at PGP send out email recommending uninstalling it before the upgrade, which I did. Judging from their past behavior, they’ll charge a hefty charge for the new version. However, I have not had good luck with GPG in the past, so I’m willing to pay the cost and either have the university cover it (for my work machines) or write it off as a business expense (home machine).

I have had one problem with VersionTrackerPro, which hangs when installing anything from the Omni Group (e.g., OmniWeb, OmniFocus). It may be because when mounting the disk image of the installers, those programs put up an interactive license agreement that somehow VersionTracker no longer notices. If I force-quit the VersionTracker program, it leaves a hdiutil process cranking away in the background using up 90%+ of one of the cpu cores. That requires termination with extreme prejudice (using a Unix kill -9 from a terminal window). My temporary workaround is simply to download the updates using VersionTracker and install them manually.

Oddly, a few old things showed up in my Dock and startup items — things I thought I had deleted months or years ago. I am not sure where they were or why they reappeared, but they were easy enough to delete.

There are a few noticeable changes in the interface to a few things, such as the Dock, that I am still getting used to. So far, I would judge that all the changes are good because they seem to add features that I wish had been there all along.

From a perception standpoint, 10.6 seems a bit zippier. It is definitely faster to startup and shut down, seeming to be at least twice as fast (no, I don’t have experimental times). Mail and Safari are also faster. Time Machine still seems to slow everything down when doing a backup, but it is tolerable.

By default, 10.6 boots into the 32-bit kernel. I tried booting all three machines into the 64-bit kernel by holding down the 6 and 4 keys while booting. It seems to work on the new MacBook Pro, but not on the older 2 machines. How to tell? Run the System Profiler from the “About this Mac” menu item. Click on the “Software” label and you get something like the following:

Screen shot 2009-08-29 at 11.03.01 PM.png

If the line with 64-bit Kernel and Extensions says “Yes” then it is running in 64-bit mode. I guess I’ll need to update these machines before too long. I usually do that on a 24-30 month cycle, so perhaps Santa will have a new MacBook Pro for me…..unless Apple comes out with their rumored tablet by the end of the year. Even so, I think a MacBook Pro with a large SSD instead of regular disk might be better for me.

Overall, with the exception of the disk volume header issue, the installation went smoothly and everything seems to be running fine. It took me about 4 hours (with other distractions and work) to get all three machines converted and running fine.

I will post followups if anything else interesting shows up.

%d bloggers like this: