Power in Whose hands?

Across the UK computer usage is increasing, for both social and business areas, and it looks to continue to do so. This is leading to an increase in the ways in which we as individuals, households, service providers, and the organisations we work for may be attacked.  Ownership of numerous gadgets and systems that we have, all increase the technical attack surface we expose. See page 10 of the IMIS Journal (Bring Your Own phenomenon), and the Google powermeter.

Earlier this year Dave Clemente in written evidence to a Select Committee said “Protection of critical national infrastructure (CNI) is an area of significant importance and one that is becoming more difficult to analyse as inter-dependency increases between CNI sectors.”
He also says that in a conflict situation it may be necessary for the military and wider Government to operate in a degraded or insecure cyber environment. This requires acceptance that total control of ‘UK cyberspace’ – however defined – is impossible. As the late Prof Philip Taylor noted, ‘full spectrum dominance is impossible in the global information environment.’  This was meant in the context of military psychological operations, but it holds equally true when attempting to secure highly inter-dependent computer networks and information systems.

A recent Daily Mail article tells us that the Government has plans to install smart meters in our homes. Essentially a large scale Supervisory Control And Data Acquisition system. As well as the Government wanting information from these devices, people will want to access it on their various portable gadgets.

This prompted me to revisit an article the March 2012 IMIS Journal. Certification constraints and product life spans are pointed to as throwing up problems. Allan Dyer says that “New PC operating systems are released every few years, but they may be connected to systems with much longer life spans, such as line-of-business mainframe applications, or SCADA systems, or medical equipment. Medical equipment is often certified to medical standards, and the certification includes the computing hardware and software. The software may be obsolete and no longer supported by the software developers. There are Windows 98, Windows ME and Windows XP systems controlling medical systems still in daily use and the situation is ongoing”

In the case that the Daily Mail is talking about, the network linking 46 Million meters would have to be highly secure, as it could become impossible to ensure all those systems are up to date and protected against malicious hackers. As the system grows older, so the availability of protection would diminish, and the potential for infection increase. Malware disrupting the operation of just a few meters might be manageable, but malware could rapidly spread and disrupt many devices. The MIDPM article suggested that network traffic be strictly filtered so that only legitimate transactions are allowed. Maybe also there should be physical breakpoints or switches in the system to isolate parts, should the monitoring or firewall systems become compromised.

In the US, federal researchers discovered that outside hackers could take control of the generators used to produce electricity in the US and destroy them.  Presentations at a Black Hat hackers conference showed how control systems can be located with special Google searches and then ordered to shut down or speed up, potentially blowing up a power or water treatment plant.

Joseph Menn writing in the Financial Times says that “Hundreds of thousands of people in darkness, hospitals in chaos, a banking system under siege – a cyber attack on the US electricity grid could have catastrophic consequences”. See also an article in the Busines Insider.

Back in the Daily Mail Article Ross Anderson, a Cambridge computer science professor and chairman of the think-tank, said: ‘GCHQ have also told us they are worried about it.  ‘Once you have the ability to turn off meters remotely, then it becomes a strategic vulnerability. ‘If the Iranians or Chinese want to attack Britain, they could do so easily through smart meters. This is the modern day equivalent of a nuclear strike.’

How do we trade off the need/want for integrated systems against what happens if those systems become compromised? Individuals can install protection on their own systems, but what of the wider world?

P vs NP. A big Problem?

I have just been reading write up’s about a new film. The subject is perhaps not on the usual list of things we see the cinema.
http://www.travellingsalesmanmovie.com/

Complex math problems are probably near the bottom of things that people get excited about. But Travelling Salesman might just change that. The film is an, “intellectual thriller" about four mathematicians hired by the U.S. government to solve the biggest unsolved problem in computer science. Four people have jointly created a ‘system’ which means major advancement for civilisation or the destruction of humanity.

The P vs NP problem lies unsolved despite a $1 million bounty.  The problem is whether the P and NP classes are actually identical. Most researchers believe they are not.   It seems that we live in a world where some problems are fundamentally harder than others (or impossible).
Travelling Salesman takes place in a  world where Horton and colleagues prove that P = NP, This means that they can solve a range of incredibly difficult real-world problems from gene sequencing to the “travelling salesman” problem, crucial for logistics and scheduling.

According to the New Scientist article the plot unfolds after we learn that the solution enables the mathematicians to crack any cryptography system in the world, which is why their four-year research project has been funded to the tune of millions of dollars by the US government.
This was interesting as it follows on from another article in the New Scientist about Alan Turing. He invented the computer while trying to solve the above fundamental mathematical problem. By building his machine, he demonstrated that mathematics wasn't as perfect as many at the time believed, while also showing how powerful a computer could be.

Alan Turing, was one of the 20th century's most wide-ranging and original minds, and was born 100 years ago. In the New Scientist there is an article by John Graham-Cumming explaining why his ideas still matter now. Turing essentially founded computer science, helped the Allies win the Second World War with hard work and a succession of insights, asked fundamental questions about the nature of intelligence and its link with the brain's structure, and laid the foundations for an area of biology that is only now being fully appreciated and researched. I Blogged a bit about him before.

Remote control cars?

The Department for Transport has a project looking at Intelligent Speed Adaptation. ISA  is a system by which the vehicle 'knows' the permitted or recommended maximum speed for a road and makes this information available to the driver or limits the vehicle maximum speed to the local limit. I blogged about something like this ages ago on a different site.

In my book Cold Suspenders, which is set slightly in the future I expanded this ability to control other parts of the car. One could imagine that once a system is in place, Governments will love to extend the use of it. Even with just the speed restriction, the Highways Authority could cause your car to halt if there was an accident ahead, or if you tried to enter a cordoned off area.

I was set thinking about this again by an article in the New Scientist about "Driverless Cars".   The self driving Lucas Jaguar PROMETHEUS car from 1994 had some interesting features - http://youtu.be/xlVx4Dhglkg . The video shows what could be done with the technology then. The article says that  the media were not impressed, describing the idea of cars that drive themselves as "madness".

Now take a look at the Google Blog where you will find:

So we have developed technology for cars that can drive themselves. Our automated cars, manned by trained operators, just drove from our Mountain View campus to our Santa Monica office and on to Hollywood Boulevard. They’ve driven down Lombard Street, crossed the Golden Gate bridge, navigated the Pacific Coast Highway, and even made it all the way around Lake Tahoe. All in all, our self-driving cars have logged over 140,000 miles. We think this is a first in robotics research.

All very interesting, and of course it would rely on all sorts of other technological stuff already in use, and some yet to be developed. One suspects an awful lot of reliance on Satnav type stuff.
"Automation of cars is going to happen," says Paul Newman, a robotics engineer,  "Computing has caused devastating change and transport is going to be its next target."
Newman's team at the University of Oxford is developing autonomous cars - The Oxford Mobile Robotics Group.  

Extradition .com ‘wire fraud’ - Who next for extradition?

In my last Blog Post I ended with:
"Mulgrew is also critical of America’s claim that any ‘wire fraud’ crossing its national boundaries gives it the right to prosecute. ‘British parents with teenage children should know that a simple email sent through a US server could be enough – in the wrong circumstances – to see them extradited."

Does anyone really know where their communications get routed? Where is the cloud things are located?
Try http://www.webwiz.co.uk/domain-tools/traceroute.htm 

Now today we hear that Richard O'Dwyer, TVShack creator US extradition has been approved.

O'Dwyer argued that TVShack did not store copyright material itself and merely directed users to other sites, making it similar to Google. Apparently US prosecutors state that they have jurisdiction to hear the TV-Shack case as it runs through a .com domain name.

The Telegraph says that a British attempt in 2010 to prosecute the operators of a similar website, TV-Links, failed because of European laws that give internet firms such as Google protection against copyright infringement claims if they have little influence over the material to which they link.

According to the Open Rights Group UK citizens should not be subject to US legal standards on copyright infringement. Reported in Computer Weekly, David Cook, a cyber crime expert at law firm Pannone, says " The 'mere conduit' defence for online file-sharing hosts was successfully used in the UK in the 2010 case of TV-Links. I then mounted a multi-faceted defence in the OiNK case, which included the 'mere conduit' point, but the prosecution dropped the case prior to responding in Court to the issues raised. I used a nearly identical defence in FileSoup and, again, the prosecution backed off and discontinued the matter."
But he also says that "The mere conduit defence relies on the host being unaware of precisely what the material was"

Speaking to BBC Newsbeat, Mr O'Dwyer said: "I've done nothing wrong under UK law, and, it's pretty ridiculous isn't it? "A 65-year-old man was extradited a few weeks ago, so if they can extradite someone that old they can extradite anyone really, couldn't they? "Copyright laws differ between countries and that's yet to be fought, that argument."

In the Guardian Julia O'Dwyer said: "The US is coming for the young, the old and the ill, and our government is paving the way. By rights it should make for an interesting conversation between the Obamas and Camerons aboard Air Force One – but I'm not holding my breath. If Richard appears to have committed a crime in this country, then try him in this country."


Recently five people were selected to ask their questions live and put "Obama in the hot seat" in the forum arranged by Google Plus. The most popular question among Google Plus users asked to vote was about the case of Richard O'Dwyer. (See here)

A questioner asked why extradition laws written to combat terrorism were being used in the case.

Obama said that separation of powers meant he played no role in the case but that more broadly defending intellectual copyright protects US jobs.

However, the president repeated concerns about the two bills aimed at cracking down on online piracy that have stalled in the US Congress in the face of widespread objections. Obama said the need was to balance protection of intellectual property without undermining the openness and transparency of the internet.

Hackers’ ancient modern and extradition

There has been a lot in the press recently about phone hacking and that hackers working through a Chinese-based IP address that broke into the network of Nasa's Jet Propulsion Laboratory and gained "full functional control" of computers (Telegraph). Hackers have been around for a long time though, as a recent New Scientist article highlighted.

Things did not go smoothly for Marconi and Fleming at the Royal Institution one day in June 1903. Just before Fleming was due to receive Marconi's Morse messages from Polduh Cornwall, a rhythmic ticking noise sputtered from the theatre's brass projection lantern - Someone was beaming powerful wireless pulses into the theatre and they were strong enough to interfere with the projector.

The Morse printer first of all kept outputting the word rats. It then got more personal, with “There was a young fellow of Italy, who diddled the public quite prettily" it trilled. Rude epithets from Shakespeare followed.

Marconi was probably a bit peeved, but he did not respond directly. Fleming fired of a missive to the Times, dubbing the hack "scientific hooliganism", and "an outrage against the traditions of the Royal Institution". He asked the newspaper's readers to help him find the culprit.

Nevil Maskelyne, a British music hall magician wrote back to the Times and justified his actions on the grounds of the security holes he had revealed for the public good.

Marconi had claimed that his wireless messages could be sent privately over great distances.
Marconi in London's St James Gazette in February 1903 claimed that "I can tune my instruments so that no other instrument that is not similarly tuned can tap my messages."

One of the big losers from Marconi's technology looked likely to be the wired telegraphy industry, and they hired Maskelyne to undertake spying operations. He obliged by building a radio mast and met success by receiving Marconi messages with a 25-foot collecting circuit. Marconi had patented a technology for tuning a wireless transmitter to broadcast on a precise wavelength. A tuning that he claimed meant confidential channels could be set up. Maskelyne’s broadband receiver bypassed all that.

Nasa was one of the organisations breached by the British hacker and Asperger's sufferer Gary McKinnon in 2001 and 2002. He is still battling extradition to the US. (Blog July 2009,  Guardian and at http://freegary.org.uk/ )


Gary Mulgrew, one of the NatWest Three and the author of an account of two blood-spattered years spent at the hands of America’s penal system says that Gary McKinnon, faces an ordeal of terrifying brutality if he is extradited to the United States (Daily Mail). McKinnon claims he was looking for evidence of UFOs when he hacked into 97 Nasa and Pentagon computers from his flat in 2002.

Mulgrew is also critical of America’s claim that any ‘wire fraud’ crossing its national boundaries gives it the right to prosecute. ‘British parents with teenage children should know that a simple email sent through a US server could be enough – in the wrong circumstances – to see them extradited.

We Still Miss Him

http://alvin-finch.blogspot.com/2010/03/farewell-to-my-farther.html

http://alvin-finch.blogspot.com/2011/03/church-graves-and-tombs.html

Money and Mobiles

People are already jittery about using the internet for transactions apart from the convenience factor - Could this App pull in more electronic customers?

Some time back I wondered about the use of mobiles for transferring money - Barclays seem to have taken this on now.
The Barclays Pingit system uses a smartphone app to permit person-to-person cash transfers of up to £300.
A BBC article says that "This looks like a big step forwards in the long delayed mobile money revolution. When it comes to turning the phone into a wallet, this country - and much of Europe - is in the slow lane compared to some countries in the developing world."
The Telegraph says that Sean Gilchrist, head of Digital Banking at Barclays,claims the new app features “industry standard encryption”, and can automatically be wiped from a phone if a user tells the bank they have lost their device.