FIDNET, Cyberwarfare, and Reality

Slashdot has received a number of submissions about FIDNET, so-called cyberwarfare, etc., since our first article about it two months ago. Here's a grab bag of more news about it -- Pro-, Neutral, and Anti-. Click below to read more.

Neutral: Foxxz writes "Shortly after the article ran on Slashdot about the FBI computer monitoring program called FIDNET, I wrote to my congressman. Finally I have received a response from him concerning FIDNET. Its not a very pretty picture for the internet; allowing email captures and the monitoring of remote logins. I took the time to type up the letter and post it. I hope to get the document scanned early this week." It's just a form letter, firmly in the middle of the road, but interesting anyway.

Pro: Effect sends this article from a legal publication. "The article is a little old, but a new example of how are tax dollars are spent is here. The rundown is on a new $1.5 billion dollar program to gauge the threat of cyberterrorism and looking for security breaches in critical networks like banks, telecoms and government nets. Any one else want the govenment poking their noses into their files looking for problems? Bear in mind that this is just a proposed start up cost, and the actual program will run much higher."

Anti: George Smith, of the Crypt Newsletter, has been debunking this for some years now. His articles include Electronic Pearl Harbor: A slogan for U.S. Info-warriors, An Electronic Pearl Harbor? Not Likely, a tale about how the FBI finds new computer threats (in April Fool's jokes about computer viruses), and a recent piece written for CyberWire Digest. Smith says, ""Clinton" [a fake virus] was an April Fool's joke published in a PC mag along with a number of similar tales, it was republished in an FBI paper on computer crime in 1996. While it's amusing that the FBI would be taken in by an April Fool's joke, it's rather confounding to realize that this was passed off as serious research. It's a great lesson in why it pays to be skeptical of our leaders when they talk of "cyberterror.""

Future: Johan writes "Jane's Intelligence Review is running an article about cyberwarfare for its next issue, which I'm editing at the moment. It has a number of broad assertions, including:

"For terrorists, CBRN/Cyber weapons provide the opportunity to cause death and disruption at unprecedented levels--resulting in thousands of casualties and billions of dollars in damages to critical infrastructure nodes."

"Acquiring a CBRN/Cyber capability requires extensive funding, an overt or covert acquisition capability, a technological research and development program to produce, weaponize and stockpile CBRN materiel (or the capability to purchase or steal ready-made weapons), and a level of technical expertise and logistical infrastructure that is appropriate to launch successful CBRN attacks..."

"Commercial-off-the-shelf (COTS) software products can easily be obtained to conduct cyberterrorism, making CB/Cyber attacks much more feasible to launch than heretofore..."

Although 'cyberwarfare' is a bit of a cliche, given the IT-related nature of many of your readers, I wondered if any of them would like to comment on this, ie, is all this stuff really so?"

The floor is open. -- michael

Comments

Like John Vranesevich

[Anonymous Coward]

see today's /. story about JPV

Re:It's just a bunch of guys sitting in a boiler r

[Anonymous Coward]

They snag them out of college. Speaking as an Ex-government Coorperative Education student, it's very tempting to say, "No thanks, I already have a job." and stay with a low paying job instead of doing the job search. Hear that, kiddies? Do the job search, no matter who you are co-oping with and what they're offering. Consider your current job an offer, and get out there and find more offers!

Re:Jane's Article Comments...

[Anonymous Coward]

Yeah I remember about 8 years ago when I set my wardialer going locally. Lo a behold I found a modem that went back to later.
It was an interface to some traffic lights on a major highway south of town. There were controls to rest switches and to manually cycle the signals.
Being the nice guy I am and knowing several people that used the road I wisely decided not to play with it and set anything permenate.
But the interface was still there for anyone to mess with or crack. -Scary!

Re:Neither of those countries is "Western"

[Anonymous Coward]

Seriously, India and Japan? Privacy rights in the European Union are very different from those in other areas. Sure they have tech - just like Singapore has tech - but they don't have the same level of privacy rights as "Western" countries.

It is REALLY amazing to listen to people who have no clue about what they are talking, and their judgements are based on B class movies, CNN stories, and similar crap...

What you see in the movie != real life
What you read on the news != real life

How do YOU KNOW what kind of privacy they do have? You live there? It happens that I've had quite a nice life and travelled a lot, and worked in many different countries. I can tell you only one thing:

take everything your govt/news tell you, and stick it ... you know where.

For "some reason" (well, we can really speculate a lot), 'western' govts usually influence the media in order to present "others" as bad & ugly. Then, you happen to go to the place where everyone is supposedly "stupid, ugly, non-technical", and you find some of the best technicians on this planet (sorry pals, I'm not management type of guy - can't judge about that), and you find out that ,even if your CNN is telling you "we rule", you and your country are not the most clever, most developed, or most civilized (especially this - 'civilized' has really much different meaning than 'technically developed').

Then, your 'clever' govt explains you how other countries do not have resources to fight cyber-crime (or put any other favourite thing in here), but then - they do have Internet. So, how people in those countries live?

a) If they have Internet, they can have tools that can protect their 'privacy'
b) If their police is shite and can not fight cyber crime, then it means they won't be able to do anything against those tools = those people have even more privacy than people in the US (where police is working hard to make YOU HAVE NO PRIVACY)

Of course, here comes the "Yeah, but their police is bad & dirty & will force you to tell them this/that, bla, bla, bla..." - again how does ANYBODY know that? CNN? Basically, police in EVERY COUNTRY on this planet will do the same - using different methods. In US, they will try to 'legalize' the illegal actions (done by police, of course). In some other countries, they just won't care. So, explain me...

How is it different what US police is doing, than what [put your favourite 'non-developed' country in here] police is doing?

US police is trying to make their actions LEGAL. And then US people tell me stories about the privacy... At least in 'non-developed' countries, you can still SUE the police (yeah, beleive it or not - they don't go around with guns and kill everyone who they don't like - they do have to follow some rules too...) - and even win. In the US... you won't be able to do anything

Hmm.. Probably the fact that I've been living in different countries for a long time makes me think like this, but... until you see & smell all the various kinds of sh*t - you can't judge which one is the worst...

So, think twice before judging other people and other countries. No matter how much we all think 'our country is so special' - it is not really... Instead of reading news, talk to people. It helps a lot...

Re:What about non-Americans?

[Anonymous Coward]

Too late to worry about that. Echelon is doing a great job. Argh!

>> Wouldn't this behaviour be considered as
>> international spying?

A more balanced account

[Anonymous Coward]

There's a great site that's pro-hacker, pro-crypto, anti-PearlHarborScenario, but that still takes the issue seriously: http://www.7pillars.com/

Can't find it anywhere

[Anonymous Coward]

I read a study on the internet a couple of months ago. The government ran a simulated attack on the nation's infrastructure. The attackers were only allowed to use information they had found on the internet. The red team won. i.e. they took down a whole bunch of important stuff. If anyone knew where the study was, that would be great. So, to all you anti-pearl harbor guys -- it might never happen, but if bad guys were smart enough and wanted to, (iran, for example, has sleeper terrorists in the us that get activated if we make iran angry for some reason or another) it could.

Also, someone said something about "letting banks handle their own security." You know, that's great, but the WORLD ECONOMY depends on just a couple of very large financial instutions. Now, Mom and Pop's S&L on the corner should handle their own security. However, if you have ever used money, if you plan to ever use money, or if you are close to anybody who will ever use money (if you aren't a homesteader), then it's in your interest to support the government protection of these institutions.

Infrastructure security vs. Personal Privacy

[Anonymous Coward]

I think many people participating in this debate are missing the real issues.

The degree of protection currently in existence for US "Critical Infrastructures" is abysmal for most electronic attacks (and a surprising level of physical ones, especially w/r/t EMP). My job is in security, primarily cryptographic protocols and systems designed to protect just these sorts of systems (banks, ect.), so I get to see some of the "real" information.

Most corporations idea on how to secure their systems is to "buy firewall[s]" and/or "deploy a VPN", even if they don't know what either are. And when they are actually plugged in, they often aren't configured correctly for the convenience of some idiot in the management pipeline who insists that he NEEDS to edit ACL's from his laptop on a transatlantic flight over an unencrypted telnet session. And even when perimeter security is properly configured, nearly 100% of internal networks allow trivial access by employees and contractors 'cause few companies want to partition the networks internally.

Contrast this to the position the USGOV has been taking historically on federal rights vs. states rights. This is a classic case of "since we can prove you're not doing it for yourself, we'll step in and do it for you - trust us to protect you". So another few percent of the bill of rights drop into the shredder - its been happening at a steady pace for decades now (especially during this administration) to every element of the bill of rights, and will continue until something fundamental happens to stop it.

Bottom line - because these corporations can be shown in closed committee to be dangerous, this administration has a pretext to "solve the problem", and in the process 'incidentally' can put into place a national Internet surveillance infrastructure to 'protect the children'. Corporate greed and stupidity have provided all the "justification" the USGOV needs, and unless that changes, the rest is a matter of time.

Not-so-Offtopic-New ways of lucre after the Y2K

[Anonymous Coward]

Ask you Government to fund your useless project!
Just Complete the form where's appropiate and send to your favourite agency.

TO: Security Agency Director
FROM: ___________________________

I need funding for a new project to prevent free world to be dominated by:
(mark with an X)

__Cyberterrorists
__Militias
__Drug Mafia
__Anarchists
__Leftists
__Child Abusers
__Porno Distributors
__MP3 Compression


The project consists in attack this evil organizations by
(mark only 3)

__Disabling the whole Internet
__Reading their e-mail
__suscribing them to the a USENET list
__Banning crypto software
__Filtering web content
__Analizing content of each net packet
__Playing Quake until late night
__Probing for security holes
__Analizing network routing
__Taking over IRC channels
__Spamming them
__Analizing ICQ message contents
__Attacking them with ICBM's
__Rising communication rates
__Invading underdeveloped countries

This resource intensive task can only be acomplished succesfully using high skilled

__Windows Users
__Aliens
__Cobol programmers
__NFL players
__Foreign soldiers

in cooperation with our group of expert

__gourmets
__C++ programmers
__Hollywood script writers
__Linux developers
__NSA Officials
__Bowling Team

The project will be directed by me and myself, and I will be the only person with entire knowledge of the entire secret operation.
Our operating office will be undercovered as a

__Pizza Hut Restaurant
__Software Development Company
__Gay Bar
__Open Source Software Project


The total funding requeriments, for a initial development of the project is

__$1.000
__$1.000.000
__$1.000.000.000
__other, please specify ($_____________)

due the need of high end equipment.
This equipment will be the core of the project and will consist in

(describe quantity)

__Sony Playstations
__Texas Instruments TI99
__Pamela Lee's Videos
__Calculators
__DVD Rentals from BlockBuster
__Complete Ricky Martin discography
__Windows Licences
__cans of Coca-Cola



Waiting for your positive response, yours:


______________
your signature

Re:FUDNET

[Trepidity]

It's also a bit too close to FIDONET, which is quite unfortunate, since FIDONET is good, while FIDNET is not.

Re:What about non-Americans?

[jafac]

"We've decided to trade you Seattle and
Redmond for Montreal. I think it's a damn good trade."

Artie FM, have you ever considered running for public office?

"The number of suckers born each minute doubles every 18 months."

Duh!

[Urmane]

"Acquiring a CBRN/Cyber capability requires extensive funding, an overt or covert acquisition capability, a technological research and development program to produce, weaponize and stockpile CBRN materiel (or the capability to purchase or steal ready-made weapons), and a level of technical expertise and logistical infrastructure that is appropriate to launch successful CBRN attacks..."

Well, duh! With a zillion dollars, an army of scientists, years of research, and spies at all levels of the country's infrastructure, cyber-terrorism could achieve amazing levels!

The same argument might be made of efficient tax-fueled government projects.

Which one is more likely? ;-)

Privacy Statements

[Listerine]

Privacy in computers can not feasibly exist. The only way you could go about doing something like that is having everyone be trustworthy which is not going to happen.

Other than that, there will be no stop to the privacy invading software that will be made in the future.

Were fucked.

Re:It's just a bunch of guys sitting in a boiler r

[Listerine]

How do they convince intelligent geeks that, after all, the long-term assurance of privacy and personal liberties isn't that important. Is it money? Do they snag them early in college? What? My guess would be that they start be either being really really bad BOFHs or that they think that there is some security needed, and over time they just get deeper and deeper into the whole security thing... losing site of reality.

I expect better from Jane's...

[The Dodger]

The excerpt from the Jane's article (also check out the full article) demonstrates the errors of judgement that are made by so-called "experts" who are approaching the concept of information warfare from the military/intelligence arena.

First of all, classifying infowar/infoterror alongside nuclear, biological and chemical attacks is wrong. They are completely different things, although there are some vague similarities in the skills and expertise needed to successfully carry out attacks.

Secondly, many analysts are failing to appreciate the differences between hacktivism, infoterror and infowar.

Hacktivism is about drawing attention to one's cause and spreading propaganda. It's most often achieved by defacing websites. We've seen an awful lot of hacktivism, from the 'Free Kevin' campaign to the Mexican Zapatistas. For hacktivists, hacking is merely a means to the end of getting exposure in the mass media.

Infoterror is the use of information warfare tactics to disrupt a nation's information and communications infrastructure in such a way as public opinion turns against the Government, forcing the government to accede to your demands. This can be equated to the IRA's tactics in the lead-up to their final ceasefire, where they disrupted motorways, postal deliveries, etc. in the UK - instead of actually causing physical harm to buildings and people, they disrupted the country's infrastructure, causing hassle for ordinary citizens, but without incurring the righteous indignation which accompanies terrorist bombs which kill innocent people. The attacks upon various internet sites belonging to NATO, the US and the UK during the Kosovan conflict were an example of a hacktivism campaign which was trying to be an infoterror campaign (but failing miserably).

Full infowar is an out-and-out attempt to completely disrupt or destroy an enemy nation's critical information, communications, command and control infrastructures, both civilian and military, and is likely to include attacks upon the physical infrastructure (e.g. bombing telecoms exchanges) as well as logical attacks (hacking, viruses, worms, etc.).

There's another complication in that the intelligence community is worried that terrorists are beginning to use the Internet for communications and to organise themselves (see the RAND report on Netwar for more on this). This use of the Internet by the Bad Guys muddies the water and obfuscates the threat presented to the 'Net by Other Bad Guys.

Thirdly, few so-called "experts" are realising that, as we move into the 21st century, a country's national security doesn't rely so much on the strength of it's armed forces, but instead upon it's economic strength and well-being, and as the economy begins to rely upon information and communications technologies more and more, the threat is growing.

Fourthly, just as soldiers know next to nothing about conducting naval battles, and sailors aren't exactly experts in air combat, existing military and intelligence people know next to nothing about information warfare. You have to turn to the hackers and their equivalent on the other side of the fence (i.e. system and network administrators who have the same skills as the hackers).

Even then, there's a world of difference between a script kiddie (the equivalent of a foot soldier who knows how to march and shoot, but little else), a real hacker (the equivalent of, say an officer, who can formulate tactics, etc.) and an information warfare strategist, who understands the big picture.

Finally, I will say this - this is a threat and, at the moment, it's a significant one, because our information and communications infrastructures are vulnerable and poorly defended. However, reducing the risk is neither particularly difficult nor expensive.

More significantly, the role for the military and intelligence communities in reducing the risk, is much smaller than most people think (and much smaller than the military and intel guys want it to be.

I've been studying information warfare for over six years. I've had articles published in military magazines, I've written reports, I'm even currently writing an article for a government magazine and I've spoken at security conferences, both white- and black-hat. I don't claim to know everything about information warfare, but I'm pretty sure I know a hell of a lot more about it that the guy who wrote that article.

As do many of Slashdot's readers, I suspect.

The Dodger
dodger@2600.com

Re:It's just a bunch of guys sitting in a boiler r

[Bad Mojo]

For every 100 or so pony-tails, there is a guy with short hair who wears a tie to work and knows his shit. He wants to keep America safe and still think the US Government is the most powerful ally he has to do it. It happens. They didn't think the hackers messing with his mainframe were funny. Everyone laughed at him. And now he's keeping cyber-terrorists at bay. Or so he thinks...
Bad Mojo

Re:It's just a bunch of guys sitting in a boiler r

[Brigadier]

>>>>How do they convince intelligent geeks that, after all, the long-term assurance of privacy and personal liberties isn't that important. Is it money? Do they snag them early in college? What?


You ppl definately under estimate the US Gov. Just think of how many US Armed Forces Personel get brainwashed for pride and being all you can be and college tuition. Knowing the little I do of history, never underestimate the Gov or any Gov and the lenths that they will go to, to get what they want. Look at the manhattn project many of those scientist had first hand expereince of what war could do and strong morals. However who can denie their passion to do what they want to the highest level ?

Re:It's just a bunch of guys sitting in a boiler r

[Lord Kano]

>>How do they convince intelligent geeks that, after all, the long-term assurance of privacy and personal liberties isn't that important.


Seemingly reasonable people can disagree on topics from Abortion, to Gun Control, to Capital Punishment. People can see things in totally different ways. I would never help take away privacy and freedom but if I won the lottery I'd donate tons of case to my political causes. There are other people who'd never donate a cent to the groups that support my side of certain political issues who'd think that they are helping keep the world safe by eliminating privacy.

A person can be brainwashed into thinking anything as long as you indoctrinate them for long enough or if you get to them when they are ripe.

LK

the evolution of a closed environment

[RobSweeney]

actually, that was going to be my follow-on. (ooh, I'm scared! do that again!)

I can't see anything quite so extreme, but I can see how standards and protocols might be manipulated in such a way that instead of promoting openness and access, networked systems come to emphasize restrictiveness, security, and control. It doesn't even have to be officially mandated.

The various Internet protocols as they exist are well-understood, well-documented, and open. As security becomes an ever-more-serious concern, especially amongst the biggest, most powerful buyers of networked technology (governments among them, but also business entities which depend on the net for one reason or another), might insist on, and specify that their correspondents use, products which are more "secure" - and more limiting and more controlled.

Imagine, say, an environment where interprocess (and by extension interhost) communication had to be done thru an API which permitted only certain operations subject to authorization (by who/whatever) - and the set of operations was strictly limited. Sort of a computer Newspeak, where it's not possible to do dangerous things because the environment offers no way to express them.

Re:Much Ado About The Naughties

[RobSweeney]

I wonder what would happen if some script kiddies just happened to hack all the members of congress and US Senators private medical and banking records? MAybe that would change something ...

Yeah, like: programming without a license becomes illegal? Ownership of hack(sic)ing tools becomes restricted ? (same way that guns have become)

There are times when it must be done, but messing with the powerful and (relatively) clueless might provoke the wrong sort of response these days.

Times gave too much credit

[D3]

I think the NYT gave too much credit to the government to actually be this organized. The more likely scenario is that they are trying to get different government orgs to link their IDS systems together in an attempt to better respond to highly coordinated cyber-attack. Anyone else out in /. land work for the government, contractor or otherwise? If you work in a place as poorly managed and generally screwed up as I do you know how hard it is for them to get anything done.

Other countries have more freedom how?

[D3]

When in some countries you can't go anywhere/ do anything (ie rent a friggin' video tape) without your personal ID# (ie SSN equivalent) on a card or your passport? Where in the UK you have to give up samples of your DNA WITHOUT being a criminal? Where in countries like China and Australia you have content filtering initiated by the government? Sure, we have given up some freedoms in the name of 'security' and it sickens me. But to say other countries are flat out better. To me, no better and maybe no worse.

Oh, please.

[tuxedo-steve]

Seems to me that this is just more hype from the powers that be. I'm an Australian, and as such have been witnessing my government's ignorant panic to censor the web - this is just more of the same. "Cyberwarfare", outside of using the net to send warfare-related e-mails and running DoS attacks on the webserver of the country of your enemies just isn't feasable. Bollocks, in a word.

Tangible vs. Intangible

[Raetsel]

That's the nice thing about software

Unlike a physical device (like a gun), there is no one thing that can be intercepted. Anyone can make more copies, and give them to their friends and associates. It costs next to nothing to do this. (That's why Microsoft hates pirated software -- people are realizing the real value of their product!)

Building a gun takes skill, time, and resources. There are choke points where things can be regulated.

On the other hand, if I kick my conspiracy-generator into high gear, I can see the government making everyone use a SunRay / Network Computer-type system hooked into a government server... No-one gets a compiler unless you have a license and your psych profile and biometrics are on file and up-to-date!

Boo! Did I scare you?

Other countries look silly?

[Foogle]

As far as I can see, that's just not true. Take a country like India, for example. The US has a greater abundance of technology, no doubt about it, but the state of our technology is not dissimilar. You can find the same sorts of technology in countries all around the industrialized world. Hello? Japan?

Privacy?

[Foogle]

What privacy do you have? Paranoia aside, we've only got as much privacy as we allow ourselves. If you don't encrypt everything, then it's going over the wire PLAIN AS DAY. Anyone who knows what they're doing, and is in the right place can make your data theirs. And don't kid yourself - Foreign countries have just as good, sometimes better, cryptography anyway, because of the US's export laws.

I can have JUST as much privacy in Singapore as I can in America - it's all about how you do it.

All of what I said is assuming that the NSA doesn't use Quantum computers to crack 4096-bit keys in 5 minutes. That being the case, then yes, you are completely correct.

Re:Much Ado About The Naughties

[Mentat21]

I wonder what would happen if some script kiddies just happened to hack all the members of congress and US Senators private medical and banking records? MAybe that would change something ...

Are you suggesting that it would lead to more privacy rights? People tend to see threats (especially threats to them directly) as people abusing the rights they already have. It would more likely lead to stronger restrictions on encyption and a larger intelligence force (because of course the intelligence community only looks for the "bad guys") to make it easier to find the perpetrators. It's a lot simpler to try to make it easy to find the perpetrators rather than hard to get into the system. Anyone who has tried to make a "secure system" knows that secure is a limit problem, there's always something missing. So it comes down to a "postive / negative" action question. Negative meaning that you try and prevent people from getting access to the system (which people can't see). Positive meaning that you "track down criminals and bring them to justice." Politicians usually choose the positive, visible action.

Much Ado About The Naughties

[WillAffleck]

While it won't be that apparent this year, this area will become, in the upcoming decade of the Naughties, a growing segment of international warfare. Face it: Our tech makes the other countries look silly. If you can't stand the heat, you throw bags of ice, no?

Given that, what are the implications for the citizens of the countries "defending" against cyberterrorism? Well, if you live in the EU, you probably will have about the same rights as before. With the exception of the UK.

But if you live in the US, you'll have even fewer rights. We're already the laughing stock of the free world - a country where our citizens have less privacy rights than anywhere in the European Union and yet go on and on and on about our tattered Constitution.

I wonder what would happen if some script kiddies just happened to hack all the members of congress and US Senators private medical and banking records? MAybe that would change something ...

Neither of those countries is "Western"

[WillAffleck]

Seriously, India and Japan? Privacy rights in the European Union are very different from those in other areas. Sure they have tech - just like Singapore has tech - but they don't have the same level of privacy rights as "Western" countries.

Re:Neither of those countries is "Western"

[WillAffleck]

Do I live there? No. Do I have friends and relatives who have lived there or visited for long periods of time? Yes.

And I've seen some of the local films produced there in the Seattle International Film Fest, Women's International Film Fest, and Santa Barbara Film Fest. And corresponded with people who live there over the years. And followed the news from those countries for years.

Yeah, you're right, I must not know anything about privacy rights in India or Singapore. Or how being "high tech" doesn't mean you get privacy rights - if it did, we'd have better privacy rights in the US.

But we don't.

Re:What about non-Americans?

[WillAffleck]

Yes, as you indicate, we (the US) will intercept the Canadian (and European) packets. What makes you think we care about the rest of the world's attitude towards international spying - we just had a bunch thrown out of Germany yesterday.

Cyberwars

[BradyB]

I recently saw on CNN where there were a couple of countries using cyberterrorism to defeat another country in a war.

Is this what we are looking at here. A way for the U.S. to do that. It looks to me as though they are looking at a way to intercept it and prevent it from happening. They sure are dumping a lot of money into this venture for just defense, but when doesn't the government over spend. I hope they don't make an army of cyber-soldiers.

This also seems pretty far reaching like they can check into really anything that anyone person is doing. That kinda scares me and I'm sure it scares others as well.

Re:Cyberwars

[MedBob]

I read the same article. All I saw was that
India and Pakistan were hacking one another's
web pages. (Don't let Jane's get wind of this
or they'll revise their death estimates up
a couple thousand)

You want real cyberwarfare, look back to the
Gulf War when some of our folks hacked into
the Iraqi Command and Control system and
caused havoc beyond that caused by the
bombs.

No More Secrecy..

[Weezul]

There are lots of people that simply don't care enough about Civil Liberties. They just don't understand what is happneing. People need to understand how much not being able to talk about your work affects your life.. I know I studdy mathematics and it is hard to find people to talk about it with in the first place. It would be nice if the Gov. had a harder time getting technically competent people, but I'd really be more concerned about them getting the few exceptiopnal people they have. I know of mathematicians who have been forced to stop publishing their research.. and are then hired at the NSA. These people probable should have taken them to court or moved to another country.

All that having been said, there is some hope i nthe form of a philosophical shift. More people are beginning to value communication.. and these people can not work in secret. Example: when you read a book by a really good author you think a little more like that author.. and if you understand this much is not a big jump to say "I want to have that kind of effect on other people." (See Churh of Virus, Meme's, etc.)

Hopefully, NSA style serecy will be unstable or self-destrctive because the more open ideologies will get to people first. Course it don't hurt to instill a dislike of the NSA, CIa, etc. in the younger generation of Technical people. It would be really nice if the Internet would give large numbers of kids access to these ideas sooner.

Jeff

BTW> It wouldn't hurt to pass a law making it illegal to hide abstract math or pure science from the public.

FUDNET

[nano-second]

For some reason, the thing that comes to my mind is that a better name for FIDNET would be FUDNET...

---

Equipment usable in a crime..

[radja]

Might as well arrest me for rape then.. always carry around the tools for that..

Jane's Article Comments...

[Jonny Royale]

In the Jane's article, I beilieve that they have made a ciritial logic mistake in lumping cemical, biological, radioactive,, and nuclear (CBRN) attacks in with "cyber" attacks.
First, from the items quoted in the original /. story, there appears to be two directrly contradictory statements. First, the story says:

Acquiring a CBRN/Cyber capability requires extensive funding

then, in the next quote:

Commercial-off-the-shelf (COTS) software products can easily be obtained to conduct cyberterrorism, making CB/Cyber attacks much more feasible to launch than heretofore

Now, call me confused, but does the "cyber" capability require extensive funding, or not? The story seems to indicate both.
But this brings me to the point of this post, and that is that I don't think you can lump a CBRN attack in the same category as a "cyber" attack. An attack on an information technology infrastructure doesn't destroy lives similar to a chemical weapons attack.
Unfortunately, many of our elected and appointed officials apparently haven't gotten this point yet. It's this kind of correlation that can cause the loss of individual freedoms as officials expound on the threat of "cyber" attacks.

$.02 deposited.

Re:Jane's Article Comments...

[Capt Dan]

Cyberwarfare is the use of networked computers to attack an opponent. With the continuing addition of systems to computer networks, this makes the attack range of Cyberwar/terrorism very great.

Yes, cyberwar would target financail institutions, etc. but it could also very easily be used against the domestic populus. I realize that my examples are big What If's, but they are possible. Hacker stories in the 80's were all aobut this type of thing: For example, take Utilities. Power, water, gas. What would happen if they were shut down? Say that all the stoplights in the city went haywire. Accidents could occur. I live in Texas where you have stoplights on highways. The sun can be very bright, and the lights hard to see. What happens at the intersection of two fast roads, when both directions have a green light?

What if someone could abuse a cities Utilities to cuase a Riot? People and property would be injured. What if the cell networks and phone lines were taken off line at the same time? Emergency reponse by police and ambulances would be hampered. And if the Hospitals lost power? What about Airports? How many systems need to be compromised there before someone is hurt?

Re:Jane's Article Comments...

[Capt Dan]

Basically, if it Cyber Warfare wasn't dangerous, they wouldn't call it WARFARE.

Re:Jane's Article Comments...

[FooGoo]

Anytime the government is involved it requires extensive funding.

It's just a bunch of guys sitting in a boiler room

[konstant]

Sure, they're the Feds, yes they have lots of money, but fundamentally how are they going to operate at a high level of competence without hiring people who know what they're doing, i.e. some of us? Think 8 days of the Condor Basically its a bunch of guys with ponytails sitting in a boileroom, with an extra guy to fill out requisition forms.

It's a scary thing, but there are probably people working for these agencies that most of us could respect, or even admire under other circumstances. As much as the violation of privacy bothers me, I'm far more disturbed by the perversion of good, powerful brains. How do they convince intelligent geeks that, after all, the long-term assurance of privacy and personal liberties isn't that important. Is it money? Do they snag them early in college? What?


-konstant

Widen your views...

[Capt Dan]

Granted that FIDNET as it is talked about now has some serious Issues. But the issue is bigger than that, I'm going to try to bring up some points, but I may miss some, and may be wrong on some...

Keep in mind that there is a wide variety of people in the world. All too often posts here end up with examples of US and THEM. In a post above, ponytails vs. the guy in ties. The tech students in school right now is a much more varied group of people than there was 10 or 20 years ago.

Asking a question like what self respecting geek would work for the FBI is the same as asking "who goes to work for the FBI in the first place?" or "How does the NSA get people?" The NSA is what, three, four times the size of the CIA?

I think that it may be as simple as service. How does the Military get bright intelligent minds when all they do is Destroy? People want to work on cool stuff. People want to serve. (BTW, my father was career army out of West Point. I am proud of that and support the Military) Nationalism and Patriotism are very strong principles.

The only way to prevent a situation like FIDNET is for another Organization to rise up and take its place. The solution may be sitting in the open source community, but if it is, it won't EVOLVE fast enough to fix this problem. Look at it like this. Hidden in the community is a football team, and the organization I talk about would be the coach, making sure everyone came to practice and showed up to games.

There is another issue that Cyberterrorism IS NOT the same as cracking. The tech is the same, but the purposes and final goals are not. The FBI/Government knows about Terrorism. We as a group are not prepared to deal with it. Your team may have a star Quarterback. But the coach has a whole team of Offensive and Defense Coordinators to figure out the game strategy. What happens if the Quarterback sets up a play that allows that lineman to come around the side and sack him? The QB's smart and fast. His runningbacks were all out in the open and hauling ass downfield. It's just that this one guy came around the side, and BOOM down he goes. What does setting up a secure linux/UNIX/NT server have to do with someone attacking the power grid? We're talking about security at a NATIONAL LEVEL much much more complex than making sure a ISP or a bank is secure.

I bet you that there are PLENTY of security guys who would be willing to work on the counter-terrorism aspect. Why? It's New. It's Different. No ones really done it before. It's very very serious. There is a very real possiblity of innocent people dying. Would you save a life if you could?

And right now the only place you can get access to it is through government work.

Our efforts would be best spent trying to raise public knowledge of what is occuring so that when somethign like FIDNET occurs, it has the correct set of powers so that it saves life and injury without giving up privacy.

Great just one more thing paying for...

[Tiger Smile]

...that I really really hate. I don't want to pay people to spy on us. Let banks do their own security. Feds, let us our lives, and leave us alone. We've done nothing wrong.

-- James

How?

[G27 Radio]

> How do they convince intelligent
> geeks that, after all, the long-term assurance > of privacy and personal liberties isn't that > important. Is it money? Do they snag them early > in college? What?

I dunno, maybe they arrest them for possession of electronic equipment that "could be used in a crime." Then lock them up and deny them a trial if they refuse.

numb

Orwellian

[mistalinux]

if != is the symbol for "is not", then +! is the symbol for "should not". Lets use this following statement for an example:

1984 +! 1999

Re:What about non-Americans?

[Artie FM]

During WW 1 the Germans sent a message to the Mexicans telling them to attack the US. The message went over American telegraph lines. Guess who intercepted the message. Was it international spying? or just stupid Germans?

As for you Canadians... we have your number. Because your info goes over our lines we've already know everything about your plan to conquer Seattle. We've decided to trade you Seattle and Redmond for Montreal. I think it's a damn good trade.

Electronic Perl Harbor? Some new script?

[Mr. Penguin]

So where can I download it? Do I need new libs? And is it as smashingly cool as regular Perl? Will O'Reilley print a book on this? What animal will be on the cover? Maybe a penguin?
Brad Johnson
Advisory Editor

Re:It's just a bunch of guys sitting in a boiler r

[Bantik]

I disagree with your assumption that the technical elite ("people who know what they're doing, i.e. some of us") by definition have a set of moral principles in opposition to the kind of creepy preemptive "counterterrorism" that the Feds are engaging in. As humans, we have a long history of putting our best minds to work on the most nefarious and wicked projects.

Hell, I wouldn't be suprised if some of the best and brightest were attracted to such programs because of the sense of power that must come with the job.

Recommended: A session with a net-sniffer

[Seth Finkelstein]

If you can do it in a legitimate way, I highly recommend attaching a network sniffer to a LAN and just looking at the contents of packets as they go by. This is not an inducement to commit any crime, get permission or use your personal LAN. But if the links are not encrypted, it's an eye-opening experience.

And if your job is to worry about security or criminality, it'll be shocking to you.

- Seth Finkelstein

interception capabilities 2000

[mediaeater]

This should really scare you then

interception capabilities 2000

...snip

Report to the Director General for Research of the European Parliament (Scientific and Technical Options Assessment programme office) on the development of surveillance technology and risk of abuse of economic information.

This study considers the state of the art in Communications intelligence (Comint) of automated processing for intelligence purposes of intercepted broadband multi-language leased or common carrier systems, and its applicability to Comint targeting and selection, including speech recognition.

....snip

. We gave away our privacy long ago the last hope of being annon in even a big city is perishing with the latest release of facial recognition software ... couple that with your DMV license photo and that's all it takes.

we should focus on low rent hacks

see also nyc camera project

What about non-Americans?

[Kinthelt]

From what I understand, any info that goes through the states could be intercepted by the FBI. What about communication by Canadians, whose TCP/IP packets just happen to get routed through the US? Wouldn't this behaviour be considered as international spying?

Re:What about non-Americans?

[goodaim]

If you keep Redmond we will give you the rest of the province of Quebec!

Re:What about non-Americans?

[FooGoo]

Actually, if the thought of this bothers you do a little research on the CSA (Canadian Security Agency) and that will scare the hell outta you.

Look for guidence

[paulra]

This really.. really is a tough topic.. should we support the govt in trying to secure the internet.. or fuck em all to hell? well.. there is only _ONE_ thing to do at times like this.. Turn to one of the forefounders of the internet.. He worked for years creating the internet.. Many of you know him as Al Gore.. I know him as.. the supreme being.. You see.. only someone as perfect as Al Gore could come up with something as innovative as the 'internet' i mean.. c'mon .. even the name.. where did that come from ? most people would've named it 'Computers Plugged up to Each Other' but good ole Supreme Being Al, hell no.. he chose a perfect name.. the internet.. a person with as much brilliance (or lack thereof) as Al Gore , should be the man to make all of these sort of decisions.. i mean.. after all.. he _did_ create the internet.. Politicans wouldn't lie would they ? that would be unethical ..

Just my 2 cents worth..
//Mephistol