Slashdot Mirror
Grad Student's Work Reveals National Infrastructure
CodeHog writes "The WP reports about a student working on a PhD and how it relates to national (US) security. Very interesting that he has been able to get all this information. It raises some very challenging questions, should some of this information be classified?"
In the background, he plays the Beastie Boys.
He's got the right to party!
--------
Free your mind.
This software is used in the firmware of WMDs! It should be taken of the public internet immediatley!
I can't figure out how to download his dissertation. I want to judge for myself whether "tedious and unimportant" is an apt description.
You're either "land of the free", or you are not. So either live up to the hype, or change the tagline. Can't have it both ways, with a closed society fueled on fear, claming to be "free".
[jole]
Thanks shithead, Especially well before the article was /.'ed. Nice karma whoring attempt.
After this kind of publicity, he'll have some job offers coming in, I guarantee it.
I'd tell 'em to classify it all they want, just looks BETTER on the resume...
For instance, this is not the first time Sean Gorman has been talked about:
Article in Science Daily
Plus, someone with the same email address has posts in rec.sports.rowing...
The bottom line is that if you know where to look, you can find out lots of stuff. Classifying this guy's dissertation isn't going to prevent someone else (from anywhere on the planet) using the same tools he did to do the same things he did.
We either have to control all information (hello, Mr. Orwell!) or accept that information can't be controlled and plan accordingly. It's been said many times before, but security through obsucrity just doesn't work.
libertarianswag.com
I work for Transport for London (Transport Authority in London, UK, duh), and, after 9/11 my boss asked me to print out a huge map of the city and put a little sticky label over every "potential terrorist target". Buckingham Palace, Houses of Parliament, the big wheel thing, ministry of defence, big office blocks, army barracks, more palaces....
After three hours I was running out of sticky labels and was very scared.
But hey, look on the bright side, maybe it'll never happen!!!
evil math within Nature's Cubic Creation!
You cannot keep information like this secure forever, or even very long. Someone will always have this information. The question is, will we allow the US government to to deprive us of our liberties to the extent that the gov't really can keep this information for ourselves, and only let it out when it's in their interest for a building to get bombed, or do we fight to keep information free?
People who claim this information is a security risk are looking at things the wrong way round.
A hen is only an egg's way of making another egg. -- Samuel Butler
Is what kind of database and what kind of software he has used to create the program that is the basis of his PhD.
On a more serious note, I think his work is great. While it certainly has serious security implications, it could also be used by ISPs, telcos, power companies, etc. to disseminate information on outages and/or find the root causes of problems.
Ah, well... I suppose we'll never see the results... but I do hope he gets his PhD.
The right to offend is far more important than the right not to be offended. (Rowan Atkinson)
Did anyone else think that this article had a dark undertone of government and corporerations looking to lock down information in the name of security. I mean, some of this information is important and may have benefits to the general public.
The scariest line is that they wanted to burn his research. Flash backs of 1984 flashed in my mind.
--------
Free your mind.
Some people might wonder why in the world you'd need to have maps of electrical grids and fibre lines...
I'm working on the periphery of the emergency response industry, and suffice it to say, any infrastructure data is vital as hell for responding to major natural disasters like quakes, hurricanes and tornadoes.
Tossing all this "scary" data into the classified domain will hammer on emergency responders' ability to effectively map this stuff.
It's vital, and I think the anti-"security through obscurity" comment in the article hits the nail on the head...
It's very interesting the way that an assemblage of publicly available information is suddenly a matter of national security. This must be based on the assumption that evildoers are never grad students.
Extra points for somehow removing the carriage returns and making it into unreadable gobbledygook...
From the article, all of the data he compiled was obtained from public sources. If anybody else wanted to replicate the work, it would only take their time. I'd imagine that you could get all the information you need through public records for building permits and right of way use. I mean, squelching the person who took the time to compile it all isn't going to do much good unless you classify every public record the US has for infrastructure.
"Tedious and boring?" He's got an application that can actually do some of the stuff Hollywood hackers have been doing for years. How could anyone think that's boring?
"Tank, find a structural drawing of this building. Find it fast."
In a word, No.
Those who would exploit it for ill already have the data, or can easily obtain it. Classsifying the data now would only hide it from those with reasonable use; and would allow for mistakes or security lapses to be covered up.
If you don't think authorities - whomever they might be - won't abuse the privlege of 'classifying' data, then you have some big surprises in store...
Everyone will start to cheer when you put on your sailin' shoes.
With all this information, maybe he can tell me when they're going install my damn DSL line...
A close relative of mine applied for a job at the State Dept. while finishing up his doctoral dissertation on Cuba (back when Cuba was highly volatile). They asked to see a draft and he consented. Having read it, they said he could have the job provided he NEVER, EVER publish the dissertation.
He said okay and now he's ABD but pretty high up in the CIA/NSA (yeah, they work together now).
Gorman didn't talk about it when he went on dates because "it was so boring they'd start staring up at the ceiling."
What is this going on 'dates' thing? I guess stuff for nerds, as in stuff that matters to nerds. Guess im not a nerd then.
The other interesting thing this brings up is the student's right to earn a living and do what he enjoys vs. the national security implications of this. Like he says, putting classified down on a resume doesn't get you very far, especially outside the Military/Intelligence arena.
The other thing is that, yes, he did put all of the together, but according to the article the raw data he used is all available on the internet. Who's to day that Al Qadea hasn't hasn't already done the research to create their own version of his map. In that case this work could very well prove to be a map of what to defend.
"You can't fight in here! This is the war room" --Dr. Stra
Correlating information is what gives you the bigger picture. Sure, it might be a secuirty threat as a whole, but it's been made up of snippets of information gleaned individually that probably aren't much use on their own.
Same as a bomb really, component parts are pretty common; chemicals, circuitry. It's about knowing how to connect stuff together to make it a bomb. 9/11 was flying lessons, plane timetables, GPS and box cutters. Each on their own is pretty harmless until you join the dots...
Same with information, connected together in the right way, it's just as dangerous. Ask the CIA or any intelligence agency...
the same questions have been asked about some of Tom Clancy's work. I remember reading that he was paid a visit by the FBI asking where he got his classified information, only it turned out everything he used was publicly available. My thought is that suppressing information will not prevent terrorism, only when would-be terrorists change the way they think of the free world will it stop. /rant
The article mentions an interesting website: But even with the wonderous google I am unable to find the website that they are talking about.
Anyone know of it?
--Tim
Is everyone forgetting that a part of the price of freedom is safety? An open society is a vulnerable society in some ways. The same vulnerability keeps society safe from itself and its own excesses.
Of course if we classified everything like this no one would have a road map to destruction. But they could still poison the water supply, blow up buildings and cause untold grief. They could still locate some of the bottlenecks themselves and exploit them.
Like so many things the government/corporations seek to classify, the real people they don't want to know are the ordinary people. It puts me in mind of the many "the area bombed last night is classified...we don't want to give the enemy important information" remarks we see. Like the enemy doesn't know they were bombed...
we could tell you but then we'd have to kill you - Verizon
When Tom Clancy published the Hunt for Red October the US Navy wanted to nail him because they thought he stole some confidential info about their submarine ops.
It turned out that he got all his info from public domain sources. And they could not do much about it. He just knew where to search.
The dangers of excessive individualism are nothing compared to the oppressiveness of excessive collectivism
Gorman's work and the access he used is vital - if I'm paying for two links that should be separate, I need to know that I can really check that we have separated physical facilities.
There are a lot more backhoe operators than terrorists - and historically, the chances of a backhoe impact on infrastructure are pretty high.
I do not understand why the information would be classified. Our national highways are critical infrastructure, without which we would all be brought to a standstill, yet maps of them are readily available online or at any bookstore.
Could you imagine if the locations of communications infrastructure were classified? Would you need clearance to set up a node? Would you need to pay to have every line technicican get a full background check? This reminds me of the reaction of "security" people when they see WHOIS entries for their companies for the first time. Their foreheads are usually bruised for weeks because of the knee jerking. The first thing they want to do is take it down. They forget that a certain level of openness is neccesary for a system that benefits everyone.
The whole point of a privatised distributed communications infrastructure is that a terrorist or enemy state cannot cripple the entire thing. Now if the people at banks and government insititutions have not done a good job of ensuring redundancy and disaster recovery then it's their own fault. The solution is to fix it, not suppress information about it.
Obviously, no one recommends mailing al-qaeda a copy of the telecom/data infrastructure, but this exposes a major flaw with what's going on and we would be foolish to ignore it or suppress it.
"The plural of anecdote is not data." -- Roger Brinner
From the article:
"This is why CEOs of major power companies don't sleep well these days," [CEO of power co. Pepco Holdings] Derrick said, flattening the pages with his fist. "Why in the world have we been so stupid as a country to have all this information in the public domain? Does that openness still make sense? It sure as hell doesn't to me."
Because security through obscurity is just as brainless an alternative for the physical infrastructure as it is for virtual infrastructure.
Hiding things doesn't make them safe. It makes them safe until found. With the added bonus of fostering the kind of clandestine, repressive, bitter societal climate that our govnt seems bent on pursuing these days.
You want to protect something? 1) Make it less desirable as a target (i.e. take away people's reasons for attacking in the first place). 2) Build in redundancies to dilute vulnerability. 3) Monitor, patrol, survey in an open and visible manner
I don't think you really got the point here.
This has nothing to do with any operating systems or computers.
You can easily criple companys and national infrastructure just by knowing the few substations and fibre switchs that need to be brought down. No power, no phone, no net.... oh dear.
Cliff S. in "The Cukoos Egg" tails down a spy selling secrets to the russians. Most of the info he steals is *NOT* classified, but by having *ALL* the info, he can piece together something he doesn't know:
1. New fighter being developed
2. Contract awarded to company X
3. Rifle through purchase orders for titanium and other strategic parts.
4. Get shipping info on said parts
5. now you know the facility where it will be built.
6. find airline reservations from company in question
7. look for engineers and test personell.
8. find nearest test base from point of arrival.
9. Fighter X will be built in location A and tested at location B, between arrival date and departure date.
Needless to say, this is why more things have become classified since the early 80's
meh
Hey, there IS a certain treshold where "national security" ends and "public domain" starts. Agreed, this is not a clear line, but a rather (thick) grey band between...
Problem is in the "human rights" department... everybody with a brain can use it [information] to do good or to wreak havoc.
Any democracy is far more exposed to terrorist acts than any totalitarian regime, and there's a cause-and-effect link between them.
YES, you could sacrifice all possible "public information" to the altar of "national security", but then where's the all-so-praised democracy and freedom of information ???
So we end up again and again to the same dillema: what is the treshold between democracy and a police state?
That "kid" was just exposing weaknesses. IF you were to classify something, you should classify the INFORMATION that he gathered to reach a result in his research, not clasify his research's result! This is as stupid as classifying (for instance) the formula of gunpowder and leaving all other informations about chemical reactions available to everybody!
That being said, would you rather live in a "safe and steril" or in a "free but slightly dangerous" environment ?
By reading this signature you agree to not disagree with the post you just read.
People are _SO_ freaking paranoid these days. Having access to a database like this could be enormously helpful to a great range of people. But all people think about is, "What will al Queda do with it?"
Since 2000 about 3,000 people have died in terrorist attacks. About 175,000 have died in car accidents. About what should we be worried?
True, it is not hard to find the information, but how difficult is it to pull it all together into one package as Gorman has done? Yes, classify it after the guy gets his sheep skin. Its one thing to have information out there to develop a bomb, its quite another thing to post schematics in a periodical.
The cancel button is your friend. Do not hesitate to use it.
Well, that's just it: Classifying data is different from making it sensitive and just not handing it out to anyone. Plenty of data is already designated as "sensitive" (see HAZUS at FEMA for example).
Infrastructure data is often sensitive. First responders can certainly get it. However, if DoD and/or DHS go haywire and classify it, only those with Secret (or better) clearance level can get it.
And your average "first responder" fireman isn't going to possess a secret clearance...
As for currentness, you'd be surprised. Much of the interesting infrastructure (major emergency facilities, dams, etc) doesn't change very often.
Killing people causes terror, because nobody wants to get killed. Cutting off infrastructure causes annoyance, because it happens regularly already. And when it happens, people will get by like they always have.
Ita erat quando hic adveni.
I think you failed to notice the joke....
I thought the whole point of the Internet, being a packet-switched network, was that it could survive damage... like from nuclear war.
So now we're worried that a terrorist with a scissors is gonna bring it down?
He's able to leverage the data so that he can see gains (I'm thinking an entire career) while the folks that have lots to lose (banks, utilities, transportation, US gov) pay for him to help show their achilies heels and bottlenecks.
If 25 telcos happen to be sharing the same 'pipe' of fibre, it may not be a terrorist that breaks that connection... regardless of who severs that line, it ain't good for the telcos -- and the telcos should be using his data to reduce risks.
Insurance companies and actuaries for corporations and governments love this kind of stuff, as do operations research people. Tell me how much it'll cost to reduce risk to this level, or: I have $10,000,000 -- how can I spend it to ensure that the worst case scenario isn't as bad.
Hopefully the information doesn't become classified; hopefully, it's used over the next few years to sure up the bottlenecks and other weak points, making the infrastructure far more robust in the following years.
Support a few technologists in Washington.
It is easy enough for anybody to find out anything that they want about the US, but it is not due to ease of access. It is that we are a hetergenous society. Anybody can move easily here and simply look. This article, and some of people act like this info is difficult to obtain. It isn't. Want to locate fiber optics? Follow the rail system, the high tension power lines, and the highways. The installation involved obtaining ROWs which were almost always easier to follow other ROWs. As to finding out a set of central offices, simply get a job at a rboc or a power company. Once inside the company, the info is freely available.
For those who think this is bad, look at the old soviet union. Even for all their hard security (which seems to be the direction that we are headed), we knew most of their soft spots. So even if we truely implement the same society that Soviet Union had, we would still be a main target. Any time you have fixed assets, it is a target. period.
I prefer the "u" in honour as it seems to be missing these days.
...between all the pieces of information being publicly available and all the information being publicly available.
From most of the comments so far, it appears the majority of people seem to think that this guy's PhD took about as long to compile as mapping a route from coast to coast with MapQuest. Hello? I imagine there was quite a bit of work put into compiling this information, and that not just anyone would have the time, persistence or devotion to duplicate the complilation. So yes, there is a HUGE difference between the information being available scattered across the 'net and having it all compiled, cross referenced and searchable in one easily downloaded program.
And IMHO, you most definitely can had a compilation of 100% publicly available information be classified as a threat to national security.
And personally, I don't believe there is a "publicly beneficial" use for this info in its compiled form that couldn't be easily be satisfied with the publicly available pieces - if a link is severed, you only need the info for the area of the problem (where the tornado hit, for example), not for the whole country. And the utilities that would be effected and responsible for the repairs would have the info they need anyhow.
I think the biggest value to the public of this information is the fact that it exists and that this can be done. The information itself is only important to those who would protect it or exploit it.
666-607: 6th floor apartment of the beast
After all, IGNORANCE IS STRENGTH.
And unfortunately must give up some of our rights to buy security, or the terrorists will have already won. As we know, FREEDOM IS SLAVERY.
And it goes without saying - although it's been said many, many times recently by our dear Commander In Chief - that WAR IS PEACE.
We must ignore those who would warn us against this, and march into the brave new world of strictly one sided Total Information Awareness with flags waving and proudly chanting the pledge of subservience. As Jeb would no doubt tell us, Big Brother knows best.
If you were blocking sigs, you wouldn't have to read this.
Sometimes, small bits of information are not considered classified, when taken by themselves. However, when certain critical unclassified pieces are aggregated, the collection of information *is* considered classified. I believe this individual's work may qualify as classified information as just such an aggregate.
Yes, anyone with the time and resources can duplicate the effort, but they'd have to duplicate the effort, and expend the resources. And that's the point. It's not a guarantee that the information will not be collected by adversaries, but there's no point in making it any easier to hand it over to them either.
How's my programming? Call 1-800-DEV-NULL
For the right price, you can just buy the data from Platts - power line rights of ways, water pipes, etc. Once you have the data, you can throw it into any GIS software (purchased for the right price). Example: you need to get the natural gas pipline information to the road repair crews, so when they dig they're sure they won't hit anything... all this data used to be open, because noone thought you could do anything with it.
So what if I know where the local 500KV transformer yard is located over the 3rd hill on the left, who in their right mind would want to damage it? Then we realized how many people in the world really aren't in their right minds... I'm not complaining that this data should be bottled up again; what was really lacking was the chain of custody of who accessed the data, and for what purpose.
The smartest thing they could do, is use his information and go through each weakness and look to secure it as much as possible. Many of them may look at that as cost prohibitive and just try to obsure the information and hope no one finds it.
I'm not drunk, I just have a speech impediment. And a stomach virus. And an inner ear infection.
"Grad Student's Work Reveals National Infrastructure"
Oh my god, we have a national infrastructure? Quick, kill it. Get rid of it. Will somebody please think of the children?
"Grad Student's Work Reveals National Infrastructure"
It took a student earning their PhD to discover this? Should I be worried about the status of the University educational system?
With all this concern over whether the "terrorists" should be allowed to know where all of our weak spots are, where is the concern for our real weak spot: creating more terrorists? If we could just figure out how to stop behaving so idiotically and stomping all over the world, we wouldn't have to worry quite so badly about being open with our information. Granted, there would still be people who want to do damage, but not nearly as many.
An open, friendly society breeds safety simply by virtue of not pissing so many people off to the point where they want to do unsafe things. On the other hand, greed, power-lust and secrecy just breeds more conflict. With less secrecy, greed and power-lust become a lot more difficult to hide, and therefore more difficult to perpetrate. This information, as well as so much more, should be out in the open.
Besides, if he got it, it already is, as has been pointed out.
It strikes me as very odd, that we are so concerned about fighting the symptoms of terrorism rather then eliminating the cause.
Actually, it would be easy for me to put "classified" on my list of publications on my résumé. It is just the "mostly as bullshit" part that wouldn't do me any good.
The problem is that terrorism is all about using simple means to get effective results. It is practically impossible to prevent all possible types of terrorist attacks.
If you've got an imagination, try thinking about what you would do if you were a terrorist. If you really wanted to create havoc, you wouldn't necessarily do it by stuff like cutting communications cables. What you would want to do is make the man on the street afraid to do basic everyday things. I've thought about it a bit (let me emphasise - just as an entertaining mental exercise!) and I think there are things that a single person or small group could do that would cause chaos in a big city. And they are things that don't require access to any particular technology. Relatively simple things. But I'm not going to post those types of ideas on a public forum like this.
If there is one thing that September 11th should have taught us it is that terrorists don't need access to fancy technology. People are maybe going to slam me down for this, but I beleive one of the main abilities of an effective terrorist is a good imagination and - to use a cliche - the ability to think "outside the box".
So what's my point? My point is that passing laws and banning things (and invading countries and dropping bombs) isn't the best way to combat terrorism.
Terrorism is a symptom of a disease. You can try to combat the symptom, but it will never be cured if the disease is not cured. I always thought that they way Tony Blair and the rest of them tackled the Northern Ireland situation was very sensible. They did not take the easy route - the easy route is to say "we will not be influenced by terrorists", and "shoot to kill" - that was Thatchers approach. It didn't work. More recently, the actual disease has been tackled rather than the symptoms, and although there isn't peace in N.Ireland yet, things are much better now than they were a decade or so ago.
I'm afraid that Bush is taking the "hard man" approach to terrorism like Thatcher did. I'm afraid that the war on terrorism is going to be a very long one.
The infrastructure is all interconnected... High voltage lines and their rights of way are used for fiber optic cable runs, Oil and gas pipelines and their rights of way are used for fiber optic runs, same for railway rights of way... because they all have the same basic need, to go from point A to point B, without crossing anyone else's properties. Start correllating telco/internet outages with railroad derailings (which tend to dig up the right of way), and you'll see what I mean. I have known for 10 years, the easiest way to cripple "the typical city" (since the fire in chicago, that destroyed the phone Central Office!) -Jazz
-- All That's Evil in the Geek Space
Here's a dangerous application for a rather new field: GIS.
Plastic freezes polycarbons for generations in landfills.
Internal combustion engines have shaped our landscape and controlled the structure of our society in many ways.
Power lines? deep cell protein denaturalization? Neuron deformation? who knows (nobody wants to find out-- too costly at this time)
very few swords of science have one edge.
name me one that doesn't, eh?
This is the epitome of information is power. A couple people at each of these sensitive points were probably aware of their personal weakness, but this guy's research collects all of them into one place -- kind of making a menu from which attacks can be selected.
But if you had wide-reaching data on any system/infrastructure you could see its vulnerabilities. For example, just using Rand McNally or some equivalent you could determine what locations on what highways would need to be blocked in some way in order to completely paralyze those in a nearby area from leaving/escaping. Then from this collection choose the one with the most populated area in the center, combined with some form of attack -- voila you've just wreaked more havoc than any attack could alone with a few staged accidents, spills, etc using only Rand McNally to guide you.
where'd my typewriter go?
They make it sound like it will be hard for him to get a job because most of his dissertation won't be published. I think that's probably completely wrong.
Even though it does suck that he can't release it in its original form; he'll have absolutely no problems finding a job. If that many large financial corporations were concerned about their communication infostructure surely one (if not all of them) are scratching to hire him.
If all he wants is money and no real academic prestige this is great. Otherwise, it wouldn't be fun to be in his position right now
You'd be surprised at how easy it is to penetrate the security of a lot of facilities.
For instance, I worked in one somewhat secure facility that requires ID bages with magnetic stripes to get in and out.
Only thing is, they had one door to the facility that didn't have a card reader attached to it. It was for the union guys that worked in the shop, who according to contract, could not be required to swipe an ID badge.
Which is fine, because to get into any place but the shop you have to have a card swipe anyway.
Only thing is, the doors between the shop and the badge-secured office area were kept open more often than not. And even if they weren't there was one interior door that you could use to access the service tunnel that wasn't carded either.
So you could walk into the service tunnel. Once there, you could get into the badge-coded office area because the doors near the elevator that takes you to the office area had to be kept open for ADA compliance (a wheelchair user couldn't be expected to swipe their card and open the door, apparently)
So once in the elevator, you were free and clear. You just got in the building without a single card swipe. And though there are cameras, anyone walking around with anything that looked *close* to the visible badges around their neck/clipped to their lapel, etc. were ignored.
I simply observed my surroundings and in less than a day of working there, I knew how to get in and out of the facility without going through security. Even if I left my security pass at home, I could get in and out, no problem. I've noticed similar scenarios in hospitals or banks other places where tight security is supposed to be the rule but the people working there just don't think this stuff through.
My journal has hot
Why on earth was this modded up as insightful? It's not insightful, it's completely offtopic. It's gobbleygook that has nothing at all to do with the article.
Similar things have not been done -- Mapquest doesn't offer anything like this. Sat images don't give this information, and this isn't at all about "getting from Point A to the mall". Nor does it have anything to do with business or marketing, excepting that the entirety of our economy is now dependant upon this seemingly irrelevant infrastructure.
The point is that -- it maps out the infrastructure. Are you going to want to go to the mall if it has no power? Or maybe no inventory, because the power and data lines have been cut to the suppliers? Of course, that presumes you even have gas for the car -- those gas pumps won't do much without power. And while you can still move trucks on the freeway, the supply chain is now totally dependant on computer interaction to indicate when stations need more fuel. It used to be that the data flow was via sat, but it's now done through DSL for stations in major metro areas. Of course, it may be difficult to pay for the gas -- the ATMs won't be able to dispense cash without network access. Your credit cards won't work either - that whole network thing again.
No, you don't need to know the infrastructure. That's the whole point afterall. But other people do -- either for disaster planning (and I'm not talking terrorists here... tornados, earthquakes, floods, and other natural occurances can be enough of a problem), city planning, or other uses. And, yes, there are national security concerns here, but the answer isn't to bury the research -- it's to utilize the research. Use the maps to show where the points of vulnerability are and then diversify them. Build backups and redundancy into the system. Don't ostritch on the problem. No, it's not cheap. And in many cases it's not easy, particularly when faced with natural obstacles like rivers and mountains. But it's doable and necessary.
From the Clancy FAQ:2 0CIA%20and%20FBI.htm
http://www.clancyfaq.com/Clancy%20contacted%20by%
public knowledge that you could find a few rogue backhoe operators in Columbus, cut some copper and fiber on Compu$erve's network, and kill every credit card transaction in the US, as they all went through CS's network.
Ask anyone who's been a phone guy. We don't fear lusers, we don't fear over-zealot bosses, we fear backhoes.
I also have a real problem with classifying/patenting things that have been funded with educational dollars. OSU has patents on what their grad students have done for their Ph.D stuff, and I'm not sure I really like that. Those students were receiving government grants to fund their research, and now, the public is 'protected' by it...even though they paid for it.
I disable sigs...do you?
Big corporations have been compiling huge databases and mining them for interesting and very valuable information about individuals for a long time. It should not be a surprise to anyone reading slashdot that given a social security number and access to the right databases, it's not hard to discover enough about you that you'll feel that your privacy and security have both been seriously compromised.
So it's a little bit funny that Sean Gorman has apparently compiled and mined a big database full of information on corporations and government, and that it scares the pants off them. I'd like to think that in the long run, Gorman's work might inspire some hard thinking on how and when databases can be compiled and combined, and this might eventually lead to greater protection for both our national security AND individual privacy.
The implications, however, in the post-Sept. 11 world, were enough....
In this post-September 11th world, I'm getting REALLY sick of that phrase.
"I either want less corruption, or more chance
to participate in it." -- Ashleigh Brilliant
Most of the posts above say that information should be free and no one should be allowed to withold information.
And whenever there is a talk about spam or privacy the whole slashdot community cant stop hanging or shooting the "defaulters"....
Strange?
Nandz.
Sorry, couldn't resist. I grew up in the USSR where everything was classified - so here is a map story for you.
Map information was classified and map publishers were required to add deliberately inaccurate information to their maps. You would have whole cities that were not on the map or shown a couple of hundred km away from their real location. This was done in the name of national security, so the enemy (US) would not be able to use maps to plan a nuclear strike or sabotage military installations.
The enemy of course just used satellite imaging to create their own maps and ended up with better maps of Russia than the Russians had. In the 80s folks who needed maps (geologists, archeologists, hikers, ...) would try really hard to get their hands on foreign made maps, because they were so much more accurate.
Security by obscurity is counterproductive...
That information wasn't readily available when I was interested in that back before 2000 and I assume it's even harder to come by now.
I suspect that we are a lot more vulnerable than we suspect. And considering a power outage in Northern Mexico affected parts of the U.S. I wonder if someone could successfully attack our infrastructure without even attacking a physical point in the U.S., but in Mexico or Canada.
Security through obscurity is NOT "security" at all, because it's impossible to know what the other guy knows.
In fact, STO is WORSE than NO security because it leads to a FALSE sense of security.
This weekend I took a ferry to Long Island and I used my GPS to record my track. As I was doing so it occured to me that my activity could be considered suspicious, and suddenly I got very nervous about using my GPS on the ferry. What the fuck kind of country are we living in now? Why should ANYTHING _I_ do be considered suspicious? I am an upstanding tax paying public serving ham radio operating red blooded patriotic citizen of the USA. If I really WAS planning some kind of attack on the ferry, why would I bother with GPSing it? Why would I bother to pull it out of my pocket in public in the first place? Am I wearing a towel? NO!
Knowledge is power and if EVERYBODY knew EVERYTHING then the world would be in perfect balance. That was the idea that brought about the Internet as we know it today, a medium for the free exchange of information. Open the fucking floodgates!
KNOWLEDGE IS POWER!
-73, de n1ywb
www.n1ywb.com
Look, I haven't seen his work, but this article and the previous one cited both seem hype-ridden and reek of cluelessness.
I mean, it's great that here in America someone can actually get a PhD by doing a lot of traceroutes and then using gnuplot of whatever to overlay the data onto scanned images of telco fiber-maps or whatever, but the whole premise of the article - including the moronic comments about how the guy shouldn't be allowed to leave the building with the laptop (maybe I have too much faith in humanity, but I can't imagine anyone making such a stupid comment other than in jest) is much ado about nothing.
This information has been available for years, and continues to be available; it's just that this guy has nothing better to do than sit around collating it and putting it into MySQL or somesuch. So what? Terrorists aren't interested in blowing up the Internet - they're interested in blowing up -you-.
So does this mean that I can now justify a PhD by sitting around correlating MapQuest thumbnails with wardriver plots open WiFi APs, or something, and then claim I'm mapping possible 'nodes of anonymous 'terrorist Internet access'? Sign me up!
Think about it.
Conpanies (i.e. financial institutions) don't mind compiling scads of public information on us until they can tell what brand of hemorrhoid cream you use, but when we do the same thing to them, they scream bloody murder.
Hmmm.....
If you locked up all of the infomation he's compiled, you'd shut down the Economy just as effectively as using that same infomation to blow up critical infrastructure points. The real point of his data is that he also allows the good guys to see just whwre the choke points are so that they can design backup plans and structures.
As Ghandi said (and I'd bet he'd be on the terrorist watch list if he was doing his work today).
Now, at least, these companies are clear that they need to get their ISPs to use different fiber lines to deliver their data. It's not like they couldn't have known this before. It's just that now they have it at their fingertips.
Free Software: Like love, it grows best when given away.
Julia Roberts' character pieced things together from public information and came up with a theory about something. She didn't know if it was right, but the dissertation made it to the gov't and suddenly she was on a hit list until she was able to get a reporter (Denzel Washington) to publish it.
It would seem that life is imitating art here.
True security comes from risk reduction and mitigation. In the case of the dam (or chemical factory or other dangerous installation) the people who might be affected by a dam colapse need to know what kind of danger it is. They should have been told about the danger it posed BEFORE it way built. You can't keep the location of that dam secret so why try? And terrorist are the least likely cause of most earth dam failure.
As for the fiber optic cable, you should assume that it can fail. I don't know about terrorist, but I do know that Joe farmer is going to be digging a ditch and WILL cut through a critical cable this year. If the phone company does not have a redundent solution then the end-users need to know about it so thay can plan for that kind of failure.
Many eyes makes for quick risk reduction
Finally, lets put 9/11 in perspective. While any loss of life is tragic, we lost the equivelent of several weeks of smoking deaths to 9/11. The economic distruction was less than a few weeks of a war in the middle east. The thing to keep in mind is that this is terrorism not war. The goal of terrorism is to inflict terror not destruction. They could have done more economic damage by blowing up a few "uneffective: car bombs in front of shopping malls the day after Thanksgiving with little risk to the terrorist. Why haven't they done something like that? It's been two years and nothing happened. Something will happen again, but there is so much good we could be doing with our talents and time rather than frittering it away on tin-hat paranoia. Let's fix the few glairing problems, reduce risks from all sources (those old toxic solvent drumbs in the back of your company for example) and move on.
Simply calling miss utility will give you most of the information about gas lines, power lines, fibre lines etc, in fact, before you do any construction, by law you have to call Miss Utility (stupid name, and I think they are changing it now too), who then go and notify the relavant parties (power, gas, telco), who then come out to mark with chalk or paint, exactly where their lines run in that area.
And there is no way they can classify that info, else you would have to get ALL building contractors, electricians, basically everyone who wants to do any digging or construction, clearances.
Building permits and architectural diagrams are also publically available, aerial maps are out there too.
There is just really alot of info that is freely available that must remain that way for our society to function.
Rather then shutting this poor student up, they should try to resolve the problems, not keep it quiet.
I came, I conquered, I coredumped
1. Map important stuff.
2. Indulge paranoid fantasies of security-industrial complex.
3. Sell them "exclusive access" to your map.
4. Profit!!!
1) As many people have pointed and will continue to point out, classifying the report won't make any difference because people can re-create the work. And this wouldn't take much effort, because an attacker has no need to map the entire US, they can pick whatever area is convenient for them.
2) Slowing down internet connections doesn't scare people. Temporarily cutting corporate offices off from the grid doesn't scare anyone (save, perhaps, the CEO). Think how much more terror-bang a terrorist could get for his buck with a 9mm in mall. That would terrify people and significantly damage the economy. Attacking communications infrastructure isn't "terrorism," it's something else. It's guerilla warfare, directed against an economy rather than a person, I suppose. If our "war" descends to this point, we are totally screwed, as it is impossible to defend (or even think of) all the economically "soft" targets.
3) In the end, the security of all civillians and civillian infrastructure depends on good will. Well, that, and fear of punishment. But the latter doesn't apply to acts of international sabatoge and/or murder. I am sick of all this talk about defending our civillian infrastructure, securing the homeland, etc. It can't happen. Until there is a soldier in body armor with a rifle every few yards down every street in the USA, this goal will not be achieved. That isn't the society any of us want to live in. We haven't put any effort into civillian security up to this point, and I say: Good for us. We didn't need to, because the general good will of human beings was protecting us. Our effort would be better spent restoring *that* state of things, rather than moving toward the soldier-on-every-corner model. For those who would like to call me naive, I ask you: why has there not been an attack on soft infrastructure before? Why has there never been a wave of men with 9mms in malls? These things are undefended. The only reason it hasn't happened is that no one ever wanted to do it.
Three good reasons why it is a waste of time and effort to classify this fellow's dissertation. I'll let others cover the reasons why classifying it is damaging to security, an open society, and democracy.
What's good for the syndicate is good for the country. --Milo Minderbinder
I completely agree, a lot of people in academia, or even working, aren't just in it for the money. I'm in publishing myself, ask me what I think of IT salaries.
That said, what is a geography degree for anyway? Security issues aside, it doesn't sound like a terribly innovative topic for a PhD. useful, interesting, and not necessarily trivial, but a doctorate?
And to the geography fans out there, I honestly don't know what goes on in university level study for it, and therefore could be completely wrong.
Terrorists used information like this to attack the U.S.? I may just be young and stupid, but I don't recall any attacks that would have been thwarted if locations of buildings or infastructure was better hidden. It always seems to be bombs, bombs in public places.
Hiding information like this that one can go out into the world and witness for themselves (I can walk up to a powerplant and see it, as well as all the wires attached to it) seems impossible to me.
Back in September of 2002, I wrote an essay entitled, Cyberwar: How Terrorists Could Defeat the U.S., and Why They Won't.
www.cryptogon.com/docs/cryptogon_cyberwar.pdf
This brief essay explains how vulnerable information infrastructures are to very simple attacks. I intentionally removed all company names and locations of the critical assets, not because I was afraid my written-in-one-evening essay would be used by terrorists, but because I was afraid the FBI would think I was a terrorist.
After reading about the pressure that Sean Gorman is under, I am convinced that I would have had a (probably not pleasant) sit down with federal agents if I hadn't sanitized my essay.
What we see here is a combination of simple things building up. Information here, information there - but add the tools to combine it all together, and suddenly said information is a lot more meaningful and powerful.
It's not just the data. It's not just the technology. It's what you get when you combine them, mine the data, and find something that isn't there originally.
The problem of regulating this, of course, is that the various sources of information are "innocent," and that information itself can be deceptively harmless until you combine it with something else.
So what do you do? You can't control the information, you can't know what to control, you can't outlaw the process. Welcome to the 21st century, where Data Mining is our new concern.
As an IT professional, I've had to deal with much lesser concerns of the same nature - what happens when you combine and mine data. A simple-to-create synergy can reveal far more than the data sources it uses, and that synergy has to be treated as a completely different thing when it comes to concerns over access, availability, etc.
"The Sage treasures Unity and measures all things by it" - Lao Tzu
Would anyone here be willing to have their usage fees for their net connection go up by %50 to cover the cost of installing and maintaining this additional redundant infrastructure? (Bear in mind that if you say "Stick it to big businesses!", they will indirectly stick it back to you.)
There is a lot of public information. It has lots of stuff that 99% of the population finds useless. The other 1% of the population either wants to use it for 'good' or 'evil' and thus finds it useful. Those that want to use it for 'good' are welcome to it, but because there are those that want to use it for evil, let's lock it all up and make sure no one knows it...except for those 'evil' people who can find it out anyway.
Hey while we're at it. Let's make sure that no one is allowed to see, let alone come near, critical pieces of infrastructure like bridges, power plants, or country roads that have large amounts of fiber under them. That way we'll know who the terrorists are because they'll go near those things in order to figure out how to blow them up.
Pardon? What's that? We should acknowledge the weaknesses and put people to work making them less vulnerable? Why? It's so much better to hide them and pretend they don't exist until snotty grad students point them out.
</mini-rant>
In all seriousness, I applaud Sean Gorman and Laurie Schintler. They took one step from corporate/private risk analysis and expanded the view of where risks are and how big they are. This is something that organizations should be thinking about constantly. It's not enough to say "Well in order to hurt us directly you have to go through this, that, and the other hoop." You have to say "Ok, we've dealt with the direct risks. Now how bad are the n-fold indirect risks? What happens if this, that, or the other thing is directly or indirectly damaged and how does that affect me?" Most of the time, companies limit this to power and communication lines and as a result some of them make separate locations with duplicate functionality that can start working when the primary location goes down, but that's not enough all the time.
Personally, I think the dissertation should be treated like any other dissertation. And then FEMA should hire them (and others) to figure out ways to protect the identified weak points.
The next big field will probably be risk-mitigation.
You know the NRA's "If guns are outlawed, only outlaws will have guns" saying? I'm finding that it applies to more and more things in modern times. Crypto -- do you really think if the US bans crypto, al Queda terrorists are going to stop using it? This -- if he could find this information, don't you think organized terrorists could, too? If not more information? I can understand the concern, but frankly, censoring the information will probably have no effect on keeping terrorists from it. (And do you really think Osama's going to be running around New York clipping fiber lines with a pair of scissors to slow down some random company's Internet connection?)
________________________________________________
suwain_2
I keep seeing comments to the effect that the information is out there, so "why try and hide it because someone else can do the work and compile it anyway?".
.02.
It seems to me that this neglects a critical piece of the puzzle, namely resources involved.
I'm no general (though I *was* in the military for a bit...) but from my experience one does not win a war by killing the other soldiers, one wins a war by making it increasingly difficult for the enemy to fight, ie: hinder their ability to make war.
Yes, the information may be able to be compilied by someone else. The thing, though, is that it takes time and resources to do it, and, make no mistake, any information denied to the "enemy" that causes them to expend more time and resources has a positive effect on security.
No, it may not be ultimate. No, it may not be complete. But yes, it does help...
Just my
So what are they going to do now, make GIS illegal, what I'm I suposed to do for a job? I'm sure they've gone light on the details but I could make a "super-map" similar to this one in my spare time at work. Any kind of infrastucture information needed for this is readily availible from MapInfo & ESRI.
Jaysyn
There is a war going on for your mind.
Former senator Daniel Patrick Moynihan wrote a book detiling his experience with just this issue, listing many cases where cold-war over-classification lead to serious policy shortcomings. He was referring primarily to foreign policy. Adding basic domestic public services to the "classified" list will compund the problem.
...can hijack a gasoline tanker truck and drive it into the side of a school auditorium.
This attack would take an hour tops to plan and execute.
My point: there is no viable active defense against terrorism.
The concept of "security through obscurity" is bogus.
I am very small, utmostly microscopic.
The Post article refers to a similar project initiated by John Young, a New York City architect.
He's worked hard on his research and doesn't want it to get seen by him, his professor, and a few miscellaneous others. He wants to be proud and publish his results...
Why does he have to publish to be proud? I'd be pretty damn proud to have my work classified.
You are making his work seem trivial and it's not.
His own professor called the work "tedious and unimportant." Do you have more knowledge about this work than this guy's professor?
Good for you. When you come up with something that the government thinks should be classified, you be as proud as you like and keep it all to yourself. The title and subject matter of what is classified will also probably be classified because letting people know about what was classified is likely to be deemed sensitive information that should be classified. See where this is going?
Sean Gorman wants to graduate with his degree, publish and continue academic research. It's not unreasonable that he would want others to see the product of what he's been on working for years. Part of completing a PhD is to do a defense of your research, which usually is before a panel of peers and professors who have some knowledge of the area you are studying. Dissertation defenses are usually open to the public (read "other students and academics" because few people tend to be interested in specific disserations) which means that potentially anyone can sit in and learn about the subject matter. If his research is classified then none of that can take place because it would be illegal for anyone to read the paper or hear about its contents without first getting clearance from the government.
Just because his professor lacks imagination, vision and insight (not uncommon in academic circles I assure you) it doesn't mean this prof is right. Maybe his prof is tedious and unimportant. There are lots of people who said the same sort of thing about the Internet. Even "visionary" Bill Gates is on record as saying the the Internet is a fad, though he quickly changed his tune. History is full of brilliant people whose work went unrecognized because it was considered fringe, tedious and unimportant. In this case, based on the attention this research is getting, there are obviously many people who think otherwise.
His professor, John McCarthy, thought that the research was important enough to introduce Gorman to national security contacts, so the "tedious and unimportant" line smells like a red herring. The article also talks about how the university is trying to get government funding beacuse it wants to develop a ''relationship'' with the Department of Homeland Security.
From the article:
"The government uses research funding as a carrot to induce people to refrain from speech they would otherwise engage in," said Kathleen Sullivan, dean of Stanford Law School. "If it were a command, it would be unconstitutional."
I amazes me how often the bureaucrats in the Intelligence Comunity ignore what they already know.
The nth Country Expiriment proved that once knowlege is available to the public, and similar results can be obtained without knowlege of the methods used in previous successes.
If this grad student could compile this information, then so could sombody else, and it's probable that sombody already has.
This information should be used to point out the weaknesses inherent in our infrastructure, and show where this infrastructure needs to be diversified. IMHO, attempts to improve security by centralizing comunications and power distribution are doomed to failure, and will only make us weaker. Micro supliers and home based power generation would make terrorist attacks against the power grid inconsequential. The weaknesses in comunications infrastructure can probably only be cured by creating a third alternative (community high-band?) to the cablemodem and telephone company monopolies on delivering service.
Read, L
"In the background, he plays the Beastie Boys."
Is he by any chance listening to the album, Sabotage?
This comment is fully compliant with RFC 527.
Another way of looking at it is that this is yet another attempt by the government to oppress us by suppressing impression. However I have a pragmatic view: all this information needs to be public anyway. (If I want to dig a ditch, wouldn't the owners of underground fiber want me to know where it is?) We can never have absolute security if we don't want to become a police state. So instead of screaming hysterically about the sky falling, why don't we think about the underlying causes of terrorism? Why would someone go to all this effort to hurt us? These are not script kiddies.
Disclaimer: I too have one of these here PhD dissertations under my belt. And I'm sure every dissertation has at some point been called tedious and uninteresting; I know mine has!
Unlimited growth == Cancer.
The article stated that the government officials to whom the student presented his research suggested immediately that his work be taken from him and classified, and that he not be allowed to leave the building with his laptop.
If this reaction does not cause you as an average citizen, concern, it should.
The attitude displayed by these government officials is one of, "We do not control it, therefore we must suppress it".
How dare an elected official behave in this way. But you know what, it probably wasn't an elected official at all. It was an appointed official or it was an official hired by an appointed official.
How disgusting it is that we have individuals in positions of power with the potential for abuse, conducting themselves with this attitude, individuals which we as private citizens have no direct or immediate means of knowing, preventing, or limiting certain abusive behaviors, actions, and practices of.
The solution to terrorism is not to treat everyone as a potential terrorist.
The solution must involve the recognition that we as persons in this modern society are due certain rights to privacy, to the potential to know the world around us: the good that could be done but isn't and the bad that is done in our name, and to a government which is maximally accountable to us within reasonable and minimal constraints which are never perpetual or absolute.
Whether or not realizing these rights leaves open the door to terrorism, these rights should not be negotiable. A solution which recognizes these rights must be found, or if none can be found, then we must live with these consequences of our freedoms.
> It raises some very challenging questions,
> should some of this information be classified?"
Of course. And MapQuest should be shut down, and you should be required to have license to use Google. In fact, no one should be allowed to put up a Web site without a permit from the Ministry for State Security.
And, of course, libraries should be required to report attempts to check out or read books on the "sensitive" list, and bookstores should be forbidden to sell them to anyone with out a permit...
Why, there are so _many_ more things we could doing to assure our "safety"!
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
First, the cat is out of the bag. If terrorists were interested then they have guys on it now collecting the same information.
Second, trying to keep information classified would be a huge undertaking. From the examples mentioned, we have to get security clearance for every trucker, technician, engineer, or architect that has access and knowledge of these key areas. I don't think the fbi is up to the challenge of doing all those background checks.
Third, I am sure that there is not one key target mentioned in that document that is this country's Archilles heel. Thus terrorist would have to be able to sustain multiple attack in short window of time to cause real trouble. They haven't demonstrated this ability to do that. Their attacks, even in the Middle East and Asia, have been isolated over a few months.
So, it would best to make it available (if not publicly) to those who could best use that information to sure up those vulnerabilities through redundacies, or contingency plans.
This is advantage of our open society. Someone can find mistakes and be able to speak up openly so someone can deal with it. Don't let fear that cut off.
You don't have to be smart to use a Mac, you just have to be smart enough to buy one
The last house I lived in was across a street from the Florida East Coast rail line. There were sign posts every few meters along the rail line warning about digging becuase of the fiber optic lines.
A half a km or so south of where I was living, there were two small air-conditioned barbed-fenced-in buildings, sitting next to sizeable propane tanks (presumably for backup generator). I assume they must be optical relay stations or something of the sort having to do with those fiber lines.
What sucked was that when I was living there, I couldn't get higher than a 21.6k internet connection (it was a rural area), but all the while there was likely gigabits/sec flying by my front yard =D
Please consider making an automatic monthly recurring donation to the EFF
> Terrorism, n. The unlawful use or threatened use of force or violence by a person or an organized group against people or property with the intention of intimidating or coercing societies or governments, often for ideological or political reasons.
E.g., the invation and occupation of Iraq by US forces.
unlawful - check (according to the international law)
use or threatened use of force or violence - check (both)
by a person or an organized group - check (US military)
against people or property - check (mostly people but some property git damaged in the process)
intimidating or coercing societies or governments - check (forced regime change)
for ideological or political reasons - big check
Thank you for clearing this up.
Mission critical infrastructure should have a properly protected communications link, and at least some form of redundancy (wireless or satellite with ipsec encryption as a backup, perhaps?) to cope with incidents like these...
smash.
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.