Category: Security

Security is immunity from the will of others.

Primer on website security

Smashing Magazine has put up a good article introducing some of the most common security vulnerabilities in websites. They are all things that site administrators should at least be aware of – including those who never actually touch code, but rely on something like WordPress to sort it out for them. Some of the attack types described include SQL injection, cross-site scripting (including the vulnerability of JavaScript), path traversal, cross-site request forgery, remote file inclusion, phishing, and clickjacking.

For those who run websites but know nothing about coding, there are three take-home messages:

  1. Update your software, to ensure that security holes get patched as they emerge. If you are still running WordPress 1.5, you have a big problem.
  2. Keep an eye out for weird behaviours. Are links appearing on your site that you didn’t put there? If so, there is a good chance it has been compromised.
  3. Remember: the internet is a dangerous place. Running a Mac doesn’t mean you’re safe from malware and other sorts of attacks. Neither does running a virus scanner or avoiding dodgy websites. If you have information you want to keep private, keep it encrypted. If you have data you don’t want to lose, back it up.

Sadly, the great majority of people are annoyingly indifferent about security these days. It seems like a couple of my friends always have their MSN or Facebook accounts taken over by spammers, and others are content to let their blogs fill up with spam comments. Such recklessness makes the internet a worse place, and it would be appreciated if people who choose to engage online do so with a bit more diligence and respect.

Surviving climate change

The failure of Copenhagen and other climate change setbacks raise the real possibility that the world will continue to obsess over trivialities, missing the big picture until it is too late to prevent radical change. As such, we need to at least contemplate the possibility of seeing more than 4˚C of mean global temperature rise within our lifetimes, with all the radical effects that might accompany that.

As individuals, what kind of strategies could permit that? Warming is likely to be far more pronounced in the higher latitudes than in more temperate ones. Sea levels are likely to rise significantly, while summer snowpack and glaciers are likely to vanish. Crops that have been well suited to regions for all of human history may no longer grow where they used to. How can someone with no intention of having children maximize their odds of living decently in a world we are so actively undermining? What should those who have reproduced (or are considering doing so) take into consideration, above and beyond that?

For the sake of this planning exercise, it is worth considering outcomes that are plausible and serious, even if they are more unlikely than likely. After all, there are a lot of powerful feedback mechanisms that haven’t yet been incorporated into climate models. It is also worth remembering that even business-as-usual projections, based on emissions continuing to grow at the present rate, involve projected warming of over 5˚C by the end of the century, making the planet far hotter than at any time in human history.

Note that this has been partly discussed here before.

Military fuel use and climate

One of the organizations taking possible future fossil fuel scarcity most seriously is the American military. The Air Force is investigating how to make jet fuel from coal or natural gas. Meanwhile, the other branches of the military are looking for ways to reduce their fuel bills and vulnerability to fuel shortages. There is plenty of reason to do so, given that American forces are using about one million gallons of fuel per day each in Afghanistan and Iraq, and the cost per gallon in the most remote locations can run as high as US$400. The average cost for a gallon of fuel at a forward operating base is about US$15.

Some efforts being made include insulating tents, installing ‘smart grids’ on military bases, increasing usage of renewable forms of power, and investigating ways to use wastes for energy. As with other attempts to reduce fossil fuel dependence, there is no guarantee that these efforts will prove to be beneficial overall from a climatic perspective. If the Air Force manages to produce biofuels that are suitable for use in aircraft, have a decent energy return on investment, and do not compete with food crops, they may develop products and processes with considerable civilian applicability, and potential to mitigate greenhouse emissions. If, instead, they just perfect the oil German and Japanese trick of turning coal into liquid fuel, they may end up making the problem much worse. The very last thing humanity needs is another excuse to burn coal, when we really ought to be working out strategies to leave all that planet-warming carbon safely underground.

Of course, militaries are fundamentally hugely wasteful and destructive things. If we do manage to make a global transition to zero-carbon forms of energy, it seems probable that the world’s various armed forces will be the most resistant to accepting any restrictions on their emissions or fuel use. Much will depend on whether we can find energy sources that are actually cheaper and better than fossil fuels, or whether we manage to content ourselves with inferior options that don’t generate the same sort of climatic risks. In the first case, militaries may largely shift to low-carbon technologies on their own accord. In the latter case, prodding them into environmental responsibility may prove extremely difficult, especially if ongoing climate change has helped to make the world a less geopolitically stable place.

Crush the Cell

Covered bridge at night, Vermont

Michael Sheenan’s Crush the Cell: How to Defeat Terrorism Without Terrorizing Ourselves covers ground that overlaps with that of Ghost: Confessions of a Counterterrorism Agent and Securing the City. Namely, the history of Al Qaeda in relation to the United States, and the question of what sort of policies the United States should adopt in response to terrorism. Sheehan brings an insider’s perspective, having served as New York’s Deputy Commissioner for counterterrorism. While Sheehan provides a lot of information and tries to argue a few key points, the book succeeds more as a source of raw information than as a source of analysis. In particular, Sheehan fails to fully justify his views that Al Qaeda will fizzle out in a few decades, and fails to provide a comparative justification for why targeting cells is the most effective way of undermining terrorist plots while avoiding unwanted secondary effects.

Sheehan covers a number of important and interesting topics: methods for counterterrorism, intelligence, and law enforcement; the (limited) competence of Al Qaeda operatives; the risks that arise then officials practice ‘cover your ass’ security; the significance of weapons of mass destruction; torture and human rights; and the importance of not granting terrorists the psychological advantages that arise when we allow ourselves to be terrorized. In the last of those, he echoes a point well-made by Bruce Schneier. Sheehan also provides an insider’s perspective on the controversial rebuilding of the former World Trade Center site, including why construction has been so slow to begin.

Among the three books I have recently read on this subject, Securing the City probably provides the most insight into effective counterterrorism strategies developed and deployed in New York, while Ghost may be the most compelling personal account (though one lacking in balance). Crush the Cell occupies a middle territory – worth reading for those who want even more details and examples than they have found from other sources, but probably not essential reading for those only moderately interested in the subject.

The torture prorogation?

It was bad enough to prorogue Parliament to avoid an election, but doing the same to try to silence questions about Canada’s role in torturing detainees is far more dubious. As an article in the Ottawa Citizen explains:

When Harper prorogued last fall it was to avoid a vote of non-confidence. This time, it will be to avoid something possibly far more serious — Parliamentary censure of the government, the banishment or imprisonment of Harper and some of his ministers, or the RCMP being asked to execute a Speaker’s warrant.

While the torture allegations are being treated as a partisan issue, I don’t think that is the appropriate frame of view. This is an issue of international law, human rights, and how Canada is going to conduct itself in international military operations. The precise manner in which Canada should deal with detainees and other governments is one that should be scrutinized by Parliament (and, if necessary, the courts) and that scrutiny should occur where Canadians have the opportunity to observe it.

Our procedures for military oversight also need to be examined, to evaluate the question of whether key information is being properly routed up through military and civilian command structures.

[Update: 25 January 2010] This whole situation generated a considerable amount of protest: 200,000 or so coast to coast.

Intercepting UAV video

Metal steps

In an unexpected development in the contest between insurgents and drone-wielding western armies, it seems that cheap software is capable of intercepting video feeds from UAVs, and that this is being put to use in Afghanistan, Iraq, and Pakistan. This is done using software like SkyGrabber, which is available online for about $25.

Insurgents with radio gear and the software cannot control the drones, but they can see what the Americans consider to be worth watching, work out where convoys are located, etc. The US is apparently working on improving the encryption used by the drones, in order to make it harder to intercept and interpret their communication. You wouldn’t think it would be so difficult to put chips on the drones that are capable of applying strong symmetric or public key encryption algorithms to outgoing communications. And as for bandwidth on the network, few contemporary encryption algorithms produce ciphertext that is substantially larger than plaintext; as such, the burden of transmission should be about the same with or without strong encryption.

Partly, all this is an illustration of how the security of a whole chain of operations can be compromised by the weakest components – especially when other components in the system will reduce their security level for the sake of compatibility. Just as it is problematic to have card readers for chip and PIN cards that will fall back to using the magnetic strip when the chip doesn’t work, it is problematic to have a drone communications network in which a few non-upgraded components degrade the quality of encryption across the entire link.

Making the transmissions more directional, and employing other techniques like frequency hopping, could also reduce the vulnerability of UAVs to both cryptanalysis and simple traffic analysis. Drones operating off satelite uplinks could be set up to broadcast overwhelmingly upward, where signals are unlikely to be intercepted. More autonomous drones that can operate independently and transmit information in short bursts might also be more resistant to interception. While the Taliban can’t be too advanced in their cryptographic capabilities, you can be sure that competing navies will be tryingt to get into the drone-based Broad Area Maritime Surveillance (BAMS) system the US Navy is building.

Open thread: Canada and Afghan detainees

As anyone who reads the news knows, it has been alleged that many detainees passed on by Canadian troops to elements of the government of Afghanistan were subsequently tortured, and that the government of Canada was aware of this likelihood. If true, that could represent a violation of Canadian and/or international law on the part of both those who gave the orders to continue making the transfers and those who actually carried them out. Knowingly passing along a prisoner to an authority that will torture and abuse them is a violation of the Geneva Conventions, but it is not yet fully known what Canadian troops and officials knew or believed prior to making these transfers.

The latest development is a reversal of position by Walter Natynczyk, Canada’s Chief of the Defence Staff. He now accepts that a man was taken into custody by Canadian soldiers in 2006 and subsequently severely beaten by Afghan interrogators.

Given that Canada cannot single-handedly reform the Afghan government and security services, this raises the question of how Canadian troops should be dealing with anyone who they capture during the course of Canada’s ongoing involvement in that country. Given that Afghanistan won’t be turning into a liberal-democratic state governed by the rule of law anytime soon, how should Canadian forces deployed there behave in the future?

Military assessments of climate change

In his scrupulously evenhanded book What’s the Worst That Could Happen? A Rational Response to the Climate Change Debate, Greg Craven makes reference to four different assessments of climate change conducted by organizations with a link to the American military. All conclude that climate change is a serious problem, and that actions must be taken to mitigate it.

The first is the 2008 National Intelligence Assessment, drafted by 16 U.S. intelligence agencies including the CIA, FBI, and NSA. While the report itself is classified, the chairman said that climate change could disrupt US access to raw materials, create millions of refugees, and cause water shortages and damage from melting permafrost.

Another is a 2003 Pentagon study: An Abrupt Climate Change Scenario and Its Implications for United States National Security: Imagining the Unthinkable. It considers a worst-case but plausible scenario, and concludes that abrupt climate change could destabilize the geopolitical environment:

In short, while the US itself will be relatively better off and with more adaptive capacity, it will find itself in a world where Europe will be struggling internally, large number so [sic] refugees washing up on its shores and Asia in serious crisis over food and water. Disruption and conflict will be endemic features of life.

It also argues that “with inadequate preparation, the result [of abrupt climate change] could be a significant drop in the human carrying capacity of the Earth’s environment.”

The third report is from the Center for Naval Analyses. Their “blue-ribbon panel of retired admirals and generals from the Army, Navy, Air Force, and Marines” produced the report National Security and the Threat of Climate Change. It calls climate change “potentially devastating” and advises that the risks to national security will “almost certainly” get worse if mitigation action is delayed. It also stresses how we don’t require 100% certainty about the precise seriousness of a threat before it starts making sense to address it.

The last report was drafted by two national security think tanks: the Center for Strategic and International Studies and the Center for a New American Security. Their 2007 report is titled: The Age of Consequences: The Foreign Policy and National Security Implications of Global Climate Change. Their team included the head of the National Academy of Sciences, one Nobel laureate economist, a former CIA director, a former presidential chief of staff, climatologists, and others. They concluded that current projections from climate models are “too conservative” and that “at higher ranges of the [warming] spectrum, chaos awaits.” The authors conclude that an effective response would have to occur in less than a decade “in order to have any chance” of preventing irreversible disaster.”

The only fair conclusion that it seems possible to reach about these reports is that they have been ignored. If American policy-makers and members of the general public accepted these conclusions – and interpreted them with the seriousness accorded to matters of national security – we would not be seeing so much doddering around before meaningful action is taken. While the military does have an incentive to scare people, since doing so likely increases their funding, Craven is probably right to claim that the overall bias of these organizations is towards economic strength rather than environmental protection. That, and the calibre of the individuals associated with these reports, seems to provide good reason for taking them seriously.

Note that the issue of climate change and security has been discussed here previously.

The Climatic Research Unit’s leaked emails

160 megabytes worth of emails – ostensibly from the University of East Anglia’s Climatic Research Unit – have apparently been obtained by hackers and posted online. Being emails between colleagues, they are written in a less formal style than public documents. Some blogs and news sources critical of the mainstream scientific view are hailing the emails as proof of poor practice within the scientific community, or evidence that the consensus view on climate change is incorrect or an intentional fabrication. Various climate change blogs have put up responses to the whole event and to those allegations:

Firstly, it isn’t clear that these emails contain evidence of any wrongdoing. Secondly, it hasn’t been established whether the documents are all genuine and unaltered. Thirdly, and most importantly, the consensus on anthropogenic climate change is bigger than any one specific institution. It is based on multiple lines of evidence that support the same conclusions – something that cannot be said about alternative hypotheses, such as that nothing is happening or that observed warming is not mostly being caused by greenhouse gasses.

RealClimate probably has the best analysis on the significance of all this:

More interesting is what is not contained in the emails. There is no evidence of any worldwide conspiracy, no mention of George Soros nefariously funding climate research, no grand plan to ‘get rid of the MWP’, no admission that global warming is a hoax, no evidence of the falsifying of data, and no ‘marching orders’ from our socialist/communist/vegetarian overlords. The truly paranoid will put this down to the hackers also being in on the plot though.

Instead, there is a peek into how scientists actually interact and the conflicts show that the community is a far cry from the monolith that is sometimes imagined. People working constructively to improve joint publications; scientists who are friendly and agree on many of the big picture issues, disagreeing at times about details and engaging in ‘robust’ discussions; Scientists expressing frustration at the misrepresentation of their work in politicized arenas and complaining when media reports get it wrong; Scientists resenting the time they have to take out of their research to deal with over-hyped nonsense. None of this should be shocking.

It’s obvious that the noise-generating components of the blogosphere will generate a lot of noise about this. but it’s important to remember that science doesn’t work because people are polite at all times. Gravity isn’t a useful theory because Newton was a nice person. QED isn’t powerful because Feynman was respectful of other people around him. Science works because different groups go about trying to find the best approximations of the truth, and are generally very competitive about that. That the same scientists can still all agree on the wording of an IPCC chapter for instance is thus even more remarkable.

That said, you can be sure that climate change delayers and deniers will be milking these emails for years – using them to continue to cast doubt on the strength of the scientific consensus about climate change. Thankfully, it does seem as though the world’s political elites are increasingly aware of the strength of the scientific consensus and the incoherence of the views of those who deny it.

[Update: 3 December 2009] Nature has posted an editorial about this whole incident. It makes reference to two open archives of online climate data – maintained by the IPCC (http://www.ipcc-data.org) and the US National Climatic Data Center (http://www.ncdc.noaa.gov/oa/ncdc.html).

[Update: 14 December 2009] Newsweek has printed a comprehensive evaluation of the significance of the CRU emails, written by Jess Henig of FactCheck.org. It concludes that the emails sometimes “show a few scientists in a bad light, being rude or dismissive” but that the emails do not undermine the IPCC consensus, and that: “E-mails being cited as “smoking guns” have been misrepresented.”

[Update: 20 June 2010] Wrap-up video on the CRU emails

The Khalid Sheikh Mohammed trial

A number of recent articles have provided interesting commentary on the upcoming trial of alleged 9-11 plotter Khalid Shheikh Mohammed in an American federal court:

Given everything that has already happened, it is very hard to see how this can have a good outcome. The trial cannot be fair – since there have been so many rights and due process violations, and no impartial jury can be found – and the precedent seems highly likely to make bad law.

Slate contributor David Feige is probably right in summing up the likely outcome:

In the end, KSM will be convicted and America will declare the case a great victory for process, openness, and ordinary criminal procedure. Bringing KSM to trial in New York will still be far better than any of the available alternatives. But the toll his torture and imprisonment has already taken, and the price the bad law his defense will create will exact, will become part of the folly of our post-9/11 madness.

Given the situation they inherited, the Obama administration may not be able to do any better. Still, it is worrisome to think what the future consequences of this may be.

[Update: 12 February 2010] Due to the opposition he has encountered, Obama has abandoned plans to give KSM a civilian trial in New York. Disappointing.