return to ICG Spaces home    ICG Risk Blog    discussions    newsletters    login    

ICG Risk Blog - [ InfoT Public ]

France 1, EU 25: It's not your grandfather's Common Market


While I muse that France's nuclear Force de Frappe is being retargeted at certain EU capitals, the political equivalent may be just as severe as France makes a Realpolitik reassessment of the sea change wrought by the EU's European Commission president-elect, Jose Manuel Durao Barroso, in the naming of the new Commission portfolios to take effect 1 November after the formality of an October endorsement by the European Parliament.

For a president-elect that was seen as neither "too pro-American for the French, nor too anti-American for the Poles," Barroso has upended the cart on the six largest EU members by appointing "a record number of women and politicians from smaller European countries to high-profile posts" while relegating the "EU heavyweights," France and Germany, to "comparatively lightweight portfolios."

All this from a fellow that started political life with the Maoist Reorganising Movement of the Proletarian Party (MRPP), becoming a leading MRPP member, denouncing "capitalism and preached the dictatorship of the proletariat," only to join the Social Democratic Party, rise through conservative ranks, join the bar, and become a "Thatcherite reformer" with close ties to the US.

Barroso supported the Iraq War, hosted the Azores "war council" summit prior to hostilities, and if you believe the socialist press, "along with Blair and Aznar, worked behind the scenes to develop the coalition and ensure the isolation of France and Germany [and] believes that an alliance with the US is Europe’s key strategic task."

This seems to give weight to La Repubblica's caution not to take Barroso as weak, noting that, "He has the makings of a good president of the EU Commission... He is such a flexible politician that he started his career as a sympathiser of Communist China and ended up the leader of an openly conservative party."

In a stroke Barroso has set a changed course for the EU's next five years by breaking tradition in handing the most important posts to Europe's heavyweights and by appointing politicians with a "reputation for laissez-faire economics and low-tax policies." Key posts went to non Franco-German hands:

  • Senior vice-president, representing Barroso in his absence, and institutional relations and communication strategy to Margot Wallström of Sweden
  • Competition and antitrust post to Neelie Kroes-Smit of the Netherlands
  • Trade post, coordinating EU common positions in trade talks, to Peter Mandelson of the UK
  • Regional policy, overseeing distribution of monies for infrastructure projects in poorer EU countries, to Danuta Hübner of Poland
  • Enlargement, which will oversee Turkish admission to the EU, to Olli Rehn of Finland
  • Financial programming and budge to Dalia Grybauskaite of Lithuania

As for the heavyweights:

  • The lightweight transport portfolio, dealing with the like of air traffic rules and tanker safety, to Jacques Barrot of France
  • Enterprise and industry to Günter Verheugen of Germany
  • Justice, Freedom and Security, a low position as this area is largely under member state control, to Rocco Buttiglione of Italy

Everything else, including Customs, Energy, Agriculture, Employment and Taxation, went to Austria, Belgium, Cyprus, Czech Republic, Denmark, Estonia, Greece, Hungary, Ireland, Latvia, Luxembourg, Malta, Slovakia, Slovenia, and Spain.

Consider the French situation: In Electoral buffeting in Europe, I noted:

France was intent on anchoring West Germany into western orbit, while blunting its military growth and so deflecting further Soviet ire. As EC, and now EU, membership expanded southward and now eastward into former Warsaw Pact nations, it has been my opinion that it will be harder and harder for members to find common cause and effective collective policy. (They certainly will bridle under continued French hegemony of EU foreign policy.)

And in Why the French behave the way they do:

The French were stunned to emerge from the Second World War as a second tier nation. Only, in part, by leading the EC and assuming the status as spokesman for Continental Europe could France command a first tier status. The second part of their postwar nation self-image as a first tier state was their ability -- and willingness -- to project force outside the EC/NATO perimeter, hence the extensive force projection and garrison forces in Francophone Africa. And once one grasps this combination of forces, much of postwar French policy becomes clear.

Barroso's commission rejects French goals, French Eurosocialism, and French worldview. The French will now be revising their approach to the EU. Must be difficult to lose three empires in three hundred years.

Barroso increases small nations' role with new postings for EU
Thomas Fuller
International Herald Tribune
August 13, 2004

Papers assess new EU president
Published: 2004/06/30 12:53:49 GMT

Gordon Housworth

InfoT Public  Strategic Risk Public  


  discuss this article

Soccer causes a bump in China's masterful effort to bring Asia under its sway


China's soccer misstep in Beijing is all the more interesting when one considers how, for example, it is bringing the Republic of Korea (ROK) and the Democratic People's Republic of Korea (DPRK) -- South and North Korea -- to heel while laying a claim to North Korean territory should the régime collapse. China did it by laying ancestral claim to Koguryo, one of Korea's three kingdoms along with Shilla and Paekje, launching it in 2002 completely under Korean radar with an archeological World Heritage Site declaration.

Koreans on both sides of the DMZ are wide awake now as the Chinese Foreign Ministry website has just "removed all references of Koguryo - as a period of Korean history" while "Chinese academics, all on the state payroll, have been revising history fast and furious, with new "evidence" and "findings" being dutifully published by the state-controlled media."

Paralysis might be a better term as pan-Korean silence has been deafening. ROK economic growth is tied to the "relatively unfettered access to China's markets and labor" while the DPRK is even more dependent upon Chinese largesse as the "state functions largely through support from China. Chinese pipelines guarantee a subsistence fuel supply, and China's maintaining the 1961 Treaty of Friendship, Cooperation and Mutual Assistance is the country's only remaining security agreement."

China knows that it acts from a position of strength as Korea was a Chinese vassal state for 400 years, instilling a deep "client-patron relationship" that "has left an enduring legacy of respect for China." As Koguryo was sited in what is now the DPRK, a Chinese post Kim Jong-il scenario could leverage historical claims with treaty obligations as legal justification to enter the DPRK militarily, "giving China access to North Korea's eastern ports and airfields, ensuring power projection potential (vis-a-vis Japan) far beyond China's possibilities at present."

Masterful all around. So what happened when fierce anti-Japanese antipathy erupted during Japan's defense of the Asia Cup, calling into question Beijing's "worthiness to host the Summer Olympic Games in 2008." While Beijing has embarked on a "complete reversal of its attitude toward Japan," dropping its WWII victim mentality as it aims to "cement a relationship necessary to assume its leadership role in Asia," it is having to deal with its fifty-year investment in nurturing anti-Japanese sentiment among Chinese citizens.

While Beijing still holds Japan accountable for wartime excesses and wants apologies and obeisance commensurate to its stature, it wants to position Tokyo as a loyal/dependent linchpin in China's economy, now China's:

  • Largest foreign direct investment (FDI) source
  • Largest official development assistance (ODA) donor
  • Largest source of Chinese imports
  • Second-largest Japanese export market
  • Upgrade source for value-added manufacturing and business processes

It has to now drag along its citizenry, just as must Japan which, unlike Germany, never confronted its wartime past. In exploring postwar anti-Japanese behavior, Yone Sugita offered an interesting explanation for continued Chinese rage in the face of Japanese denial:

[Japan's postwar] civilian leaders held the militarists and ultra-nationalists wholly responsible for the war and its ravages, thus gratifying the nation's political and psychological need for scapegoats. Japan's civilian leadership defined the Asia-Pacific War as a great aberration, wrought by militarists and ultra nationalists…

[Civilian leaders] who had cooperated with the militarists to expand Japan's political and economic influence over China [accepted demilitarization as a means to forestall domestic social revolution while retaining political authority].

The Japanese people desperately needed someone to blame for their misfortunes [in the postwar economic disaster]. As the Japanese came to imagine themselves as helpless victims, betrayed by brutal leaders, their rejection of militarism was followed by an almost fatalistic pacifism. Since they had been "deceived," most Japanese felt they had to deny any personal association or endorsement of prewar and wartime militarism.

Although Japan's militaristic actions generated within Japan itself both victims and victimizers, Japan as a nation focused mainly on the former, ignoring the latter. Consequently, Article Nine [of the US occupation-authored constitution forever renouncing war as a sovereign right] had the perverse effect of sparing the Japanese people from taking responsibility for the Asia-Pacific War, especially the unprovoked attacks on other Asian countries.

Fatalistic pacifism and the denial of war responsibilities became mutually reinforcing tendencies in post-war Japan... In the end, Article Nine became the capstone of pacifism in Japan, but it also inaugurated a distorted legacy of fatalistic pacifism and denial of war responsibility.

I'm sure that Beijing will find a solution to its liking. While the Koreans and others have begun "to realize that China is not the all-benevolent fraternal ally many naively believed it to be," they have little choice and China knows it. And just as with the Stans, they know that China is local, patient, and firm while the US is distant, impatient, and fickle.

China ups ante in ancient-kingdom feud with Korea
By David Scofield
Aug 11, 2004
Asia Times

Historical lessons from Asian Cup
Yone Sugita
Japan Times
August 9, 2004

China vs Japan - it's not just a soccer game
By Kosuke Takahashi
Asia Times Online
Aug 7, 2004

Economics overrides anti-Japan sentiment
By Macabe Keliher
Feb 11, 2004
Asia Times

Gordon Housworth

InfoT Public  Strategic Risk Public  


  discuss this article

Intellectual property theft: the unspoken unknown of offshoring


Domestic and international outsourcing, the latter now known as offshoring in the US and also as nearshoring in Europe, is a subject I follow closely for its impacts on supply chain risk, intellectual property theft, risk pricing, and certain counterthreat needs.

What I find remarkably absent in the general discussion of job and economic loss to the country's nationals being outsourced, and economic gain to the outsourcing domestic firms and to the outsourcing destination, is the virtual absence of the impact of intellectual property (IP) theft on the outsourcing firms and, ultimately, the national economy of those firms.

For those firms sufficiently advanced to look beyond mere supply chain 'cost at tier' so that they look at the troika of cost, time, and risk, the risk focus is devoted to business interruptions to timely delivery and component quality, and not IP theft. Thus I read with dismay the otherwise fine writing of Forrester's John McCarthy on offshoring. IP theft is effectively not in attendance.

And it is not, I believe, that McCarthy is unaware of risk and security issues as he made an extremely thoughtful presentation to the SafeNet 2000 security summit well before 11 September that holds up well today, laying out a tiering of personal privacy, the desire of businesses to gravitation to regulation in order to achieve stability, and a phasing of "government intervention into security and privacy online." Yet, I feel that McCarthy today stops short of the total offshoring threat when he says that" companies, for the most part, face the same security issues whether managing data with local employees or overseas workers."

While I submit that there are added, but addressable, risks in employing foreign nationals and foreign firms, the larger risk is the placing of critical IP resources in an offshore environment where they are vastly more susceptible to exploitation by one or more collectors -- often many collectors from the same entity each intent on gaining specific bits of corporate information. The risk is effectively present in varying degrees for US offshoring in India, China, Korea, Russia, Belarus, or European nearshoring to the Czech Republic, Poland, Hungary, the Baltic states, Morocco and Tunisia.

It is that IP theft risk that is not being addressed, and it applies to both the venture capital (VC) community and established firms. We regularly address three categories of exploit:

  • Pricing model compromise, i.e., loss of market pricing advantages by whatever means at one or more tier points in the supply chain, often at multiple points in the same tier or location
  • Data citadels, i.e., targets of immense attractiveness to IP collectors, e.g., R&D centers or data centers 
  • Human resources "turnover," i.e., collectors rotate in with legitimate job applicants to acquire specific data and then move on

At the VC level, investors are driving their stable of firms to create product and to produce revenue without sufficient consideration to risk. Risk assessment is very low on their horizon. Private conversations reveal that VCs preach the mantra to their portfolio companies, for example: "Outsource hardware development and manufacturing to China or become uncompetitive." Most VC conferences conducted today direct firms to go low cost without an understanding of the risks to the underlying assets.

Some VCs have already taken the next step of forming development groups in Asia precisely to serve their entire stable of firms. In so doing the VCs have put a target-rich environment under one roof. Unlike established industrial firms that already have revenue streams and so will soften the immediate impact of foreign commercial IP harvesting, VCs have little of value in their stable of firms save their intellectual capital. The same problem affects established firms as they locate R&D facilities offshore, often at the demand of the host country to be able to do business there. Both larger firms and VC stables are moving their assets to low (direct) cost sites but high (total) risk areas.

Threats are often obscure and indirect. For example, we have observed rampant IP theft by one nation in particular both in-country and in adjacent countries where it has either penetrated or bought stakes in local firms with ties to US firms.

In each case, firms are putting their leading edge designs in an environment where diversion is almost assured. Without appropriate, early -- earlier the better -- countermeasures that both protect the asset and minimize adverse impact to the firm's relationship with the host government, it becomes a matter of not if, not when, but how often. That is an element of offshoring that I submit is being greatly ignored and underpriced to our economic peril.

Tough talk on offshoring
By Ed Frauenheim
August 9, 2004, 10:54 AM PT

'Nearshore'--the new offshore?
By Andy McCue
August 6, 2004, 10:08 AM PT

Near-Term Growth Of Offshoring Accelerating
by John C. McCarthy
Forrester Research
May 14, 2004

3.3 Million US Services Jobs To Go Offshore
by John C. McCarthy
Forrester Research
November 11, 2002

Gordon Housworth

InfoT Public  Intellectual Property Theft Public  


  discuss this article

Pandemic flaws at the architectural and base component level


Hidden flaws at the architectural or base component level that have over time come to be shared as "givens" not subject to investigative review continue to open significant exploit potential across multiple operating systems.

This time it is the library for the Portable Network Graphics (libPNG) graphics format used an alternative to Graphics Interchange Format (GIF) and other image formats. The libPNG flaws are not Microsoft specific in that they the affect:

  • Apple's Mac OS X Mail application
  • Opera and IE browsers on Windows
  • Mozilla and Netscape browsers on Solaris

The wide use of libPNG components reminds me of the flaws of ASN.1 Basic Encoding Rules (BER) written by Xerox back in the 1960s and so has been at the baseline for subsequent applications of which MS was one - others being cell phone calls, Signaling System 7 (SS7), air traffic control systems, package tracking, SCADA systems, X.9 financial transaction protocols, public key cryptographic standards, VoIP, video teleconferencing, messaging systems, and public directory protocols.

Of the six vulnerabilities discovered to date in libPNG, the most serious could allow a remote attacker to execute arbitrary code on an affected system, whereas the others will crash apps using the library. Secunia gave the vulnerabilities a highly critical rating, its second-highest:

The vulnerabilities can... be exploited by tricking a user into visiting a malicious website or view a malicious email with an affected application linked to libpng.

Yet the problem is not new:

Both Microsoft and Linux have previously had security issues stemming from the PNG format. Eighteen months ago, Microsoft labeled as critical a flaw in how Internet Explorer handled PNG images. More than two years ago, a compression format flaw in Linux allowed PNG images, among other types of data, to crash programs running on the operating system.

Now, more than two years later, users on a wide spectrum of MAC, Linux, and MS apps are confronted with the specter of specially created PNG graphics executing "a malicious program when the application loads the image." Unfortunately while patches have been made for Linux and Mozilla, they have yet to be affected for IE. And of course, one still has to install the patch when it is made available.

Not a comforting situation in the era of zero-day exploits.

Multiple Vulnerabilities in libpng
Original release date: August 4, 2004

Image flaw pierces PC security
By Robert Lemos
August 5, 2004, 3:06 PM PT

Exploit code for Microsoft vulnerability circulating
By William Jackson
GCN Staff

Gordon Housworth

Cybersecurity Public  InfoT Public  


  discuss this article

Uzbekistan is 'the Man' of the Stans


Of all the Stans, Uzbekistan is in demand by the US, Russia, the PRC, Saudi Arabia, and Iraq:

  • The US wants Uzbekistan to send troops to Iraq as part of a Muslim peacekeeping force, thereby improving the odds for a tidier US exit in Iraq and building bilateral state and military relations that cement US diplomacy initiatives in the Stans that improve chances of access to regional energy sources. (If Uzbek troops go to Iraq, the US will promptly restore, and likely improve, its aid budget.)
  • Russia wants to recover its suzerain in Central Asia, eject the US, and take the leading hand in developing and exporting Uzbek energy reserves, thereby also keeping it out of China's hands
  • China wants Uzbek cooperation in suppressing Uighur separatism thereby improving its chances to achieve internal stability in Xinjiang so that it can pursue rapid economic modernization while insuring "zero tolerance for secession."
  • The Saudis would like to have the US out of, or in reduced numbers, in the Persian Gulf, see a Muslim force under UN rather than US control, return to a more proactive pan-Arab, pan-Muslim foreign policy, and find any means to reduce terrorist threats within the Kingdom.
  • The Iraqis would also like the US presence reduced and some manner of domestic order restored to that they can get on with rebuilding their nation.

I suggest readers review my note, Accelerating our aid to Trashcanistan, in order to understand the reality of states such as Uzbekistan that is now being courted with renewed interest by the US, Saudi Arabia, Russia, and the PRC, i.e., states marked by:

  • Authoritarianism
  • Weak state capacity
  • Primitive nation-building
  • Economic collapse
  • Rising Islamic fundamentalism

In the case of Uzbekistan's Karimov, all are treating with a player that "is worthy of Franklin Roosevelt's comment of General Anastasio Somoza that, "He may be a son of a bitch, but he's our son of a bitch.""

Unlike the Russians and the Chinese, the US is at a "human-rights" disadvantage when dealing with Uzbekistan, whose foreign ministry has said that US human-rights standards "may be too high for Uzbekistan." Whereas the US slapped Uzbek hands with a $18 million "fine" in bilateral aid, the Russians boosted bilateral ties, poured money into the pockets of Karimov and Gulnara Karimova, his daughter known as the "Uzbek Princess", while promoting money deals to develop Uzbek energy extraction and transmission capacity.

The Chinese are accelerating an 'ethnic substitution' program in the Xinjiang Uighur Autonomous Region in which Han Chinese are being relocated west to improve the security of the region, replace the Uighurs in lucrative cotton production, and insure development of energy reserves desperately needed to the east. China still needs to suppress Uighur liberation movements in all the Stans but especially in Uzbekistan which has been home to much of the Uighur diaspora and whose Ferghana Valley has been a base for Uighur liberation efforts since pre-Soviet times.

With Uzbekistan's entry into China's Shanghai Cooperation Organization, it responded with near-Soviet crackdowns of Uighur activity, banning pro-Uighur, anti-China messages, severely restricting Uighur press, and eliminating all public or press comments on the Uighur political situation -- including press and books from Turkey and the EU. In return, money and credits are flowing to Uzbekistan even though it does not share a common border with China. 

Suppressing any Muslim group plays well in Moscow at the moment and any support offered to eliminate military action by, or support to, the Chechens will be seen as a boon.

It is hard for me to see a long-term US control or authority in the region, Uzbekistan included, as the US is the only player 'plagued by' distaste over Karimov's human rights record, is not a 'native regional' player, cannot provide the kind of intense, lucrative diplomacy at any and all levels that is a hallmark of Chinese and Russian 'outreach,' and I doubt is seen as a player able to sustain a long term interest and financial commitment to Uzbekistan.

Tug-of-war over Uzbekistan
By Sergei Blagov
Asia Times
July 31, 2004

Powell Welcomes Saudi Proposal For Muslim Troops
By Robin Wright
Washington Post Staff Writer
Friday, July 30, 2004; Page A10

China-Uzbek pact bad news for Uighurs
By N T Tarimi
Asia Times
July 30, 2004

Xinjiang and China's strategy in Central Asia
By Stephen Blank
Asia Times
April 3, 2004

Gordon Housworth

InfoT Public  Strategic Risk Public  Terrorism Public  


  discuss this article

In Pakistan, bullets come in political and full metal jackets


Despite his impact on the wellbeing of US nationals, I doubt that many US readers are familiar with Syed Shah Mardan Shah, known as Pir Pagara II, a powerful spiritual leader with a million tribal members in tow, leads the armed militia, Hur (free and brave man), has deep ties into Pakistan's military by virtue of decades of providing volunteers to Pakistan's wars against India, has great personal wealth, a "palatial residence" in Karachi, and great numbers of willing acolytes to do his bidding.

Pir Pagara, as he is more widely known is also a king-maker in Pakistani politics, has just withdrawn his own party, the Pakistan Muslim League (Functional) party, from President Musharraf's ruling Pakistan Muslim League, which he had joined at Musharraf's personal request. This defection is expected to drive others to decamp just as a large number of critical domestic and international issues require attention:

  • Continuing the contentious military operations against al Qaeda in the tribal areas
  • A second military incursion against Balochi tribes
  • Sending troops to Iraq (which was earlier declined without a UN mandate
  • Posting a non-political technocrat as prime minister
  • Replacing important military staff officers
  • Countering Benazir Bhutto's return to resuscitate the opposition Pakistan People's Party

And did I mention Musharraf's looming 'commitment' under the current constitution to yield one of his two offices, President and army chief of staff.

I hope that you care about Pir Pagara now. In The brothel of infidel powers: Blow of the pious Muslim speaks of the United Nations, I noted that the US would face "a more grim and immediate threat from a determinedly nuclear Pakistan that deorbits the War on Terror." A deorbit can be 'by bullet,' as the three recent attempts on Musharraf's life, and today, on Pakistan's prime minister designate, Shaukat Aziz. A deorbit can occur incrementally by political means that see a national and Muslim agenda as a higher priority.

I maintain that Pakistan is third to the US and Saudi Arabia in al Qaeda's targeting priority. The Saudis are the surrogate target for the US as al Qaeda's being able to invoke the "oil weapon" would be tantamount to an attack on US soil. The loss of, or even the significant shift or, Pakistan would redraw the balance in Southwest Asia and pull off the western anchor of US military planning. At worst case, it could put 25+ fissile packages in unfriendly hands. Anything that al Qaeda can do to interfere with Musharraf's policies is in its best interest. Consider what is at stake:

  • Continuing to pursue al Qaeda sanctuaries in the tribal areas
  • Suppressing the Pakistani-led proliferation efforts of A.Q. Khan
  • Supporting US foreign policy aims, and now:
  • Capturing one of America's most wanted, the Tanzanian, Ahmed Khalfan Ghailani, responsible for the 1988 twin US embassy bombings -- and promising to transfer him to US custody
  • Discussing a Muslim peacekeeping force in Iraq with the Saudis

Back to Pir Pagara, who is declining to accept calls from, or meet with, Pakistani politicians seeking an indication of his continued support. It would appear that Musharraf has not been listening to Pir Pagara's advice on as yet undisclosed matters and that Pir Pagara will not accept entreaties from anyone until "Musharraf personally speaks to him and accepts his complaints about the present and future premiers."

And one wonders what else? At this nexus, Pagara can tilt all manner of Pakistani initiatives. If his efforts are solely for renewed domestic or personal authority, that is one matter. If it is for a political shift that Pagara has sensed, that is another.

I will continue to pay attention to Pir Pagara.

South Asia
Pakistan's king-maker drops a bombshell
By Syed Saleem Shahzad
Asia Times
July 30 2004

Pakistani Finance Minister Survives Suicide-Bomb Attack
Associated Press
July 30, 2004 2:50 p.m.
Wall Street Journal

Gordon Housworth

InfoT Public  Strategic Risk Public  Terrorism Public  


  discuss this article

Patch to dissemination to analysis to exploit: zero-day exploit tightens Boyd's OODA loop


Hackers and crackers are increasingly using reverse-engineering tools to analyze code in search of exploitable flaws as well as immediately analyzing patches upon release in order to identify holes in the patch. It is worthwhile to revisit Revisiting Clarke's six bleak IT trends from October 2003 which listed six trends, the first four of which were:

  • Rising vulnerabilities
  • Rising patches
  • Falling "time to exploit"
  • Rising rate of propagation

That was October 2003.  Look at the progression to date:

  • January 2003 Slammer worm - six months to exploit vulnerability
  • April 2004 Sasser worm - three weeks to exploit vulnerability
  • June 2004 Witty worm - two days to exploit vulnerability

Witty was not only quickly written, but it was well written, and stunningly successful in attacking its target set, the 12,000 worldwide installs of BlackICE/RealSecure, which it did in a mere 45 minutes.

Contrast that to the 'slowness to patch' figures from Qualys whose clients are most likely at the fast end of the scale as they are subscribing to a flaw-detection service and so at least demonstrate awareness if not action. For PCs attached directly to the net, the "half life of a vulnerability--the length of time it takes for half of assailable computers to be fixed" dropped from 30 days in 2003 to 21 days in 2004. It gets worse for PCs attached to LANs instead of directly to the net where sysadmins labor under a false sense of security and so take 62 days in 2004 (no figures for 2003).

The speed of vulnerability to exploit in the wild has placed an impossible burden on corporate network administrators:

  • Frequent patches without the necessary testing time to insure backwards compatibility
  • High IT manpower surges needed to contain a perpetual patch cycle that -- like painting a bridge -- never ends. As soon as one gets to one end, it is time to start again at the other end.
  • Need to find a better way, be it new code, new vendors, or new tools to block worms and viruses

While Microsoft is releasing a built-in firewall in XP Service Pack 2 update, it has far to go in aiding what it estimates as "the nearly two-thirds of Windows users who don't have up-to-date antivirus software on their computers." Given that Wintel dominates the desktop, that puts it at the center of controversy. (And contrary to the belief of Linux users, Unix and Linux have equal or more bugs.)

Hackers are now closing Boyd's OODA Loop around the individual and corporate user, operating inside our ability to Observe, Orient, Decide, and Act, or in Boyd the fighter pilot's terms, turning inside us so as to get into a shootdown position. We need better security tools immediately.

Better tools let hackers strike more quickly
By Robert Lemos
July 28, 2004, 11:11 AM PT

Companies patching security holes faster
By Robert Lemos
July 29, 2004, 4:47 PM PT

Gordon Housworth

Cybersecurity Public  InfoT Public  


  discuss this article

The magical idea of an OSA - Open Source Agency


The minutest appearance of a new 'intelligence entity, Open Source Agency (OSA), on page 413 of the 9/11 Commission Report, and carried into its Executive Summary on page 23, astonished me for three reasons:

  • that it every appeared in print at all given the resistance of the covert community to sanctifying open source collection
  • that it appears in a suggested reorganization chart but nowhere else in the entire document
  • that it is getting so little attention outside of those like myself that make their way via open source collection and analysis

An OSA is so long overdue, I wonder if its time has actually come. Time will tell but at least it crept into the final report albeit without attribution or additional comment. My firm makes its way as open source analysts, taking firm positions of questions put to us regarding assets in Africa and Asia where the answer usually comes down to "stay" or "run for the airport." We've no room for vacillation and we do it all from open source and sound analysis.  We know that it works.

Figures vary on the percentage of open versus covert sources, but 90+% figures consistently cling to the open source category. Yes, one must apply the same critical analysis as one would do with classified data, starting with validity of source and validity of datum from source, but the data is there and it is often free of a central overriding institutional filter. See my Value from the fringe: "committed" collectors and investigators.

The value of an OSA was noted by an anonymous author "still serving within the U.S. government":

My personal vision is: 1) small office of 300 officers outside of any intel agency (i.e., independent, far away from FBIS, CIA, and DoD); 2) would use only open sources to address national security challenges; 3) would provide liaison to academia, think tanks and private sector to contract out research and analysis; 4) would participate in the NIE process, but not be wrapped up in CIA/DIA/Intel bureaucracy... One of its fundamental purposes of this agency would be to compete with secret agencies on assessing national security issues. It should improve competitive analysis (e.g., Iraqi WMD). Further, start small (300 officers (not intel officers), $50 million) and focus on high value products that could be widely spread across government (i.e., insights into Muslim youth, motivations, aspirations, etc.).

I agree with Robert Steele that the dollars are "not sufficient to actually fund the collection of global multi-media multi-lingual information 24/7 and in 31+ languages at the five level of competency," but I would accept anonymous' idea of structure and a place to start. It actually strikes me as modeled on State's Bureau of Intelligence and Research (INR), a very successful group with a minimum of blinders. (Alternate view here.)

I find merit in the comment of Richmond L Gardner, charitably to my left, that:

If we had an OSA (Open Source Agency) in addition to the CIA, Congresspeople and bureaucrats could use those findings as a guide. If it's okay for the OSA to feature information in it's reports, it's by definition okay to publish it or do anything else with it.

The whole idea of the OSA in the first place is to study foreign policy problems using openly available information. They'd write reports exactly the way the CIA currently does, but all of the information they use must be publicly accessible.

I'd appoint people who were interested in making their reports as comprehensive and as detailed as possible, pressing against the sides of the envelope, as it were. But they'd also be aware of their limits...

When the CIA then follows up the OSA report, Congresspeople can keep an eye on whether the CIA is telling them truly secret stuff or whether they're being told things that should be coming from the OSA.

I recommend creating an OSA and putting it in an horserace with their covert colleagues. If the overt folks go off the rails due to their limited data, exploring the delta (difference) with their covert colleagues will be enlightening. I suspect that they will give as good as they get.

Chapter 13: How to do it? A Different Way of Organizing the Government
National Commission on Terrorist Attacks Upon the United States (aka the 9-11 Commission)
22 July, 2004

OSS.NET Applauds Recommendation for New Open Source Agency in 9-11 Commission Report - It Appears on Page 413 Within Chapter 13 of Report
July 23, 2004

Secrets Out of Control
Just a Bump in the Beltway
July 13, 2004
Richmond L Gardner

Gordon Housworth

InfoT Public  Infrastructure Defense Public  Strategic Risk Public  


  discuss this article

If Athens is like Boston...


Only those of you familiar with the labyrinthine 17th century geography of Boston's old town and financial district along with the decade long disruption occasioned by the "Big Dig" which is relocating major expressways passing through the city can appreciate a certain humor when the security perimeter around the Democratic Convention is referred to as the "hard zone." Those of us who braved Boston's traffic on a daily basis might have set the 'hard zone' perimeter out at the Charles River.

Seriously, when one hears the term "they paved the cow path" applied to a winding road, that is the exactly what happened in Colonial Boston. As carts gave way over time to wider vehicles, the roads were made one way. If I am building a word picture for readers of an already transit-challenged city, I shudder to think of that city beset by dump trucks blocking off more roads, a fortress-like environment where Secret Service makes hundreds of reporters alternately wait for hours or walk around the security perimeter before they're admitted. LNG tankers pass close by the city but deliveries are said to be curtailed during the Convention

Confusion seems to be well in attendance, and not just in the roadbed. Convention delegates and attendees will descend upon the city with laptops many of which are WiFi-enabled without encryption. A recent "war driving" exercise with a 'honey pot' open access point detected more than 3,000 unique WiFi devices, two-thirds of which were unsecured and so an open security breach. Given that "most Wi-Fi security breaches occur when the laptop's operating system automatically looks for available wireless networks when it's turned on, this potentially sets up a dangerous security scenario based on the level of open Wi-Fi networks in range of the FleetCenter [Convention site].

"457 unique wireless access points (the majority of which were unsecured) and wireless network cards were detected in the general area surrounding the Democratic National Convention site. "The proliferation of open wireless network access poses a significant security challenge for the DNC -- not just near the convention site but throughout the city," said Matthew Gray, founder and CTO, Newbury Networks, Inc. "With so much emphasis being placed on physical security at the convention, it will be important for organizers to also consider the implications of wireless security risks at this high profile global event."

A wondrous take-down opportunity in the making as conventioneers will obviate the Democratic Convention's conventionally wired network as transient WiFi-enabled laptops will connect to the hardwired network even as they simultaneously connect to the nearest hard point, thereby connecting to both networks.

While convention PCs may be patched to the appropriate level, many visiting laptops will not be and thus open to compromise, turning them into a zombie. The prize would be one of the Democratic network managers' laptop, given its access, could send confidential data out of FleetCenter.

Some may snicker that security is being backstopped by Microsoft as well as Cisco. I have the thought that if Athens is this way, it hasn't a chance.

Confusion reigns as security rules
By Suzanne Smalley, Globe Staff
Boston Globe
July 25, 2004

Laptops at the FleetCenter at risk of breaches, attack
By Hiawatha Bray, Globe Staff
Boston Globe
July 22, 2004

Gordon Housworth

Cybersecurity Public  InfoT Public  Infrastructure Defense Public  


  discuss this article

Reading Sword of the Prophets: what al Battar can teach us of forthcoming operations


It is instructive to read al Qaeda's monthly magazine, Camp Al Battar, the Sword of the Prophets, al Battar, used by King David to decapitate Goliath and which Islamic traditions claim will be used to defeat the Islamic Anti-Christ, Dajjal. Readers will, I'm sure, see the analogy. Al Battar extends al Qaeda's skill raising to the web and is apparently read at length in a distributed environment with each issue taking up specific themes in detail.

It's issues appear to track to subsequent acts. "Kidnapping & Hostage Taking" in issue 10:

This issue of Camp Al Battar, Al Qaeda’s online training magazine, is a continuation of detailed training of terrorists and militants in the practical and detailed concepts of kidnapping and hostage taking. This specific chapter is written in the form of a textbook style lesson that explains the methods of carrying out kidnappings of multiple targets, which is an extension of a previous article on the process of kidnapping a single target. Al Battar provides exceptionally extensive and detailed instructions on the proper techniques to be employed in the various kidnapping scenarios, from surveillance of specific targets to the disposition of the hostages.

It is important to note that the acts of global terrorism that have been performed over the last several months have followed the pattern established by each release of this manual. For example, issue 9 of Camp al Battar have addressed the methodical assassinations of public figures; within thirty days of the release of that issue, the world saw the assassination of Akhamd Kadyrov, President of Chechnya… The kidnapping of Thomas Hamill, an American contractor working in Iraq... was kidnapped 9 April 2004 in a scenario that closely mirrored the detailed instructions of kidnapping individuals that were contained in an issue of al Battar released close to the time the kidnapping.

Thus it should come as no surprise that Militants Use Kidnapping noted that:

The tactic emerged in a major way in the first intense outbreak of insurgency in April. [The] taking of hostages has emerged as the low-tech analog of the American "nuclear option" — a weapon of unparalleled power, and one so effective that even the threat of using it carries great influence… The method has the advantage, from the terrorists' point of view, of being cheap and almost entirely free of the risk that insurgents run when they confront American or Iraqi troops directly.

As I noted in Jihadists extend kidnapping and implied beheading down the coalition supply chain, "Expect to see a marked rise in twinned kidnapping/beheading threats wherever foreign and US nationals are exposed and undefended... There are far too many human targets who are far too dispersed to be easily and uniformly protected. We have a significant flaw in the critical path of our coalition supply chain that will not be easily resolved."

Keep reading al Battar.

Militants Use Kidnapping as Their Most Powerful Weapon in Iraq
New York Times
July 25, 2004

Summary & Analysis: "Kidnapping & Hostage Taking"
Excerpted from Camp al Battar, Issue 10
Analysis Date: 16 May 2004

Gordon Housworth

InfoT Public  Terrorism Public  


  discuss this article

Prev 26  27  28  29  30  31  32  33  34  35  36  37  38  39  40  41  42  43  44  45  46  [47]  48  49  50  Next

You are on page 47
A total of 68 pages are available.

Items 461-470 of 673.

Pages: [1 - 25] [26 - 50] [51 - 68]

<<  |  May 2020  |  >>
view our rss feed