4 ms·

Wouldn't part of preparing for cyber war include shoring up your local defenses? But instead of increasing security requirements or making software vendors som

Wouldn't part of preparing for cyber war include shoring up your local defenses? But instead of increasing security requirements or making software vendors somehow liable for bugs they produce, they're still going with lowest common denominator tactics for defense contract procurement. Because of this, I have a hard time seeing this as preparing for cyber war in any way other than aggression tactics. I see little evidence of increased defense focus at home.

jjoonathan 12y ago
Fix a bug, two more take its place, your enemy researches the two still out there instead of the one you fixed and you're right back where you started. Fix a bug and keep the fix in reserve (to be applied via a latency-privilidged backdoor and/or traffic filter if a large-scale attack is detected) and you've parried the first blow in a cyberwar. This has the added advantage that you don't have to nag people to install the fix.
- gaius 12y ago
  You know, if we'd used a grown-up protocol like X.400 as the standard for Internet email instead of the hacked-up SMTP, there would be no spam now? Same for TCP/IP, HTTP, yadda yadda. We know how to do secure computing. Just everyone prefers convenience - users, and developers who want easy implementations.
SapphireSun 12y ago
tl;dr: Uncertain effectiveness of proposed measures, proposed measures are not directly controllable by the executive branch. Not totally sure of proposed explanation, but some of it seems plausible. Declaring that software vendors are liable for these mistakes does a few things: 1) Requires that an explicit threat be identified to justify the economic hardship 2) Depending on how the policy is applied, can slow the development of the golden goose US internet industry 3) May not be that effective in actually closing security holes (hard to say) 4) May not be politically possible (hard to say). Additionally, in this framework, the executive branch would consider PRISM and related programs components of a national defense strategy that they can exert direct control over rather than relying on civilians. I'm not completely sure of my theory. The world situation is complex and I think it's a little from column A and a little from column B (state aggression and terrorism respectively). However, assuming it's somewhat correct, the politicians have been trying to keep the heat down for obvious reasons (not causing a trade or actual war). South-east asia has been kind of uppity lately but there are plenty of other states to worry about as well. You do see politicians talking about elements of cyber war in the news from time to time, but they rarely make it a centerpiece. I don't know if that's because it's not that consequential or because making it a huge issue is aggressive. Very often you see it reported that a high level US defense, state, or executive official, as part of a larger package of talks, speaks to heads of state or their generals about cyber war but the details of that are not disclosed. This makes it seem as though the issue is small as much more ink is spilled on the other parts of the talks. However, it's hard to know just how large a component it is. Could be huge, could be small. My premise is in part based on the concept that administration officials are acutely aware that we're having an incredible peace dividend right now. Every time we have a war the public has to get invested in, it is insanely destructive. This is somewhat undercut by the Iraq and Afghanistan wars, but it's widely commented on how that although they cost over a trillion dollars and a scary number of lives on both sides, the public has been mostly disengaged and it's been basically peacetime over on US territory. That gives politicians freedom to basically do what they want without much pushback and without substantially hurting the economy. If war spending is ~1.5T over 14 years (https://www.nationalpriorities.org/cost-of/ https://www.nationalpriorities.org/cost-of/) (~107B/yr), and the current US GDP is ~17.55T/yr (https://en.wikipedia.org/wiki/Economy_of_the_United_States https://en.wikipedia.org/wiki/Economy_of_the_United_States) this amounts to 0.6% of US GDP (and shrinking). In comparison, US GDP growth ranges between -2% to 5% over the past 15 years and is more often positive (it was only negative during the sub-prime mortgage crisis years). A war with significant damage on the home front would not simply reduce growth, but could set us back decades in economic and human damage (drawing comparisons to the damage done to China, Europe, Korea, Vietnam, Cambodia, and Japan in 20th century, some of them have caught back up, but it took decades and they still are emotionally scarred over it). Fwiw, these numbers also emphasize how insanely mind bogglingly rich this country is. Would a cyber war be damaging enough to force the sorts of measures NSA has implemented to be taken? Would cyber war effectively complement other kinds of tactics on the part of an aggressor? Overall, I'm not sure, but it seems plausible if you think a major act of aggression is likely. How likely is that right now? I don't know. I do know that over a long period of time (decades, a century), acts of war have historically been a near certainty though the particular actor is hard to foresee. Of course, I'd like to reiterate that I'm still not convinced that these spying measures are required and it is very scary that such large scale changes to the nature of our communications have been done with little public debate. It's very anti-democratic in so many ways and I appreciate what Mr. Snowden has done for the public.

jjoonathan 12y ago

Fix a bug, two more take its place, your enemy researches the two still out there instead of the one you fixed and you're right back where you started. Fix a bug and keep the fix in reserve (to be applied via a latency-privilidged backdoor and/or traffic filter if a large-scale attack is detected) and you've parried the first blow in a cyberwar. This has the added advantage that you don't have to nag people to install the fix.

gaius 12y ago
You know, if we'd used a grown-up protocol like X.400 as the standard for Internet email instead of the hacked-up SMTP, there would be no spam now? Same for TCP/IP, HTTP, yadda yadda. We know how to do secure computing. Just everyone prefers convenience - users, and developers who want easy implementations.

SapphireSun 12y ago

tl;dr: Uncertain effectiveness of proposed measures, proposed measures are not directly controllable by the executive branch. Not totally sure of proposed explanation, but some of it seems plausible. Declaring that software vendors are liable for these mistakes does a few things: 1) Requires that an explicit threat be identified to justify the economic hardship 2) Depending on how the policy is applied, can slow the development of the golden goose US internet industry 3) May not be that effective in actually closing security holes (hard to say) 4) May not be politically possible (hard to say). Additionally, in this framework, the executive branch would consider PRISM and related programs components of a national defense strategy that they can exert direct control over rather than relying on civilians. I'm not completely sure of my theory. The world situation is complex and I think it's a little from column A and a little from column B (state aggression and terrorism respectively). However, assuming it's somewhat correct, the politicians have been trying to keep the heat down for obvious reasons (not causing a trade or actual war). South-east asia has been kind of uppity lately but there are plenty of other states to worry about as well. You do see politicians talking about elements of cyber war in the news from time to time, but they rarely make it a centerpiece. I don't know if that's because it's not that consequential or because making it a huge issue is aggressive. Very often you see it reported that a high level US defense, state, or executive official, as part of a larger package of talks, speaks to heads of state or their generals about cyber war but the details of that are not disclosed. This makes it seem as though the issue is small as much more ink is spilled on the other parts of the talks. However, it's hard to know just how large a component it is. Could be huge, could be small. My premise is in part based on the concept that administration officials are acutely aware that we're having an incredible peace dividend right now. Every time we have a war the public has to get invested in, it is insanely destructive. This is somewhat undercut by the Iraq and Afghanistan wars, but it's widely commented on how that although they cost over a trillion dollars and a scary number of lives on both sides, the public has been mostly disengaged and it's been basically peacetime over on US territory. That gives politicians freedom to basically do what they want without much pushback and without substantially hurting the economy. If war spending is ~1.5T over 14 years (https://www.nationalpriorities.org/cost-of/ https://www.nationalpriorities.org/cost-of/) (~107B/yr), and the current US GDP is ~17.55T/yr (https://en.wikipedia.org/wiki/Economy_of_the_United_States https://en.wikipedia.org/wiki/Economy_of_the_United_States) this amounts to 0.6% of US GDP (and shrinking). In comparison, US GDP growth ranges between -2% to 5% over the past 15 years and is more often positive (it was only negative during the sub-prime mortgage crisis years). A war with significant damage on the home front would not simply reduce growth, but could set us back decades in economic and human damage (drawing comparisons to the damage done to China, Europe, Korea, Vietnam, Cambodia, and Japan in 20th century, some of them have caught back up, but it took decades and they still are emotionally scarred over it). Fwiw, these numbers also emphasize how insanely mind bogglingly rich this country is. Would a cyber war be damaging enough to force the sorts of measures NSA has implemented to be taken? Would cyber war effectively complement other kinds of tactics on the part of an aggressor? Overall, I'm not sure, but it seems plausible if you think a major act of aggression is likely. How likely is that right now? I don't know. I do know that over a long period of time (decades, a century), acts of war have historically been a near certainty though the particular actor is hard to foresee. Of course, I'd like to reiterate that I'm still not convinced that these spying measures are required and it is very scary that such large scale changes to the nature of our communications have been done with little public debate. It's very anti-democratic in so many ways and I appreciate what Mr. Snowden has done for the public.