September 19, 2014

A mighty wind

Roch the win i the clear day's dawin
Blaws the clouds heilster-gowdie owre the bay
But thair's mair nor a roch win blawin
Thro the Great Glen o the warl the day

So now we know. Scotland really *wasn't* desperate enough to embrace the uncertainty and change of full independence. The English powers that be may, as The Good Wife star Alan Cumming wrote in the New York Times, be patronizing and disrespectful, but they're not parking tanks in St. Andrews Square, burning down churches, or abrogating freedom of speech.

In July, in Edinburgh, it was difficult to find anyone terribly interested in the upcoming referendum. This week in Glasgow, a pair of days before the vote itself, it was everywhere. (I will admit to having provoked some of the conversations). My small, skewed sample held more Yes votes than Noes or Undecideds, but: small, skewed, unrepresentative, of Scotland as a whole though not of Glasgow in particular (since Glasgow voted Yes). One thing everyone agreed: both campaigns sucked, though the No campaign sucked more.

The Yes campaign has been criticized for vagueness about what an independent future might look like. It's an understandable complaint and yet uncertainty is at least somewhat honest: no one can have any idea how Scotland will really fare as an independent country until (or unless) it's put to the test over a century or two. On Monday night, on an extended edition of Newsnight, academics batted figures back and forth comparing how much of a funding gap an independent Scotland would have to fill. The No voter cited the withdrawal of funds from Westminster; the Yes voter cited contributions made by Scotland to Westminster and the EU. You would think facts would provide greater clarity - but in politics somehow they never do.

One thing we really can learn from the Scottish referendum is that people will turn out in droves - 97 percent of the population registered to vote, 85+ percent showed up at the polls - if they have something to vote about that they believe matters and offers the prospect of real change. (Even if that vote is ultimately to avoid change.) Politicians wittering on about electronic voting to improve citizen engagement are utterly missing the point: it's not *how* you vote that matters but whether you think someone at the other end is listening to your opinion on a subject you care about. Add up the various financial crises, bank bailouts, and resulting austerity measures, and is voter alienation any surprise?

Exactly how to reverse that isn't clear. The temptation, for an American observing the ability of British political parties to ram policies through like elected dictatorships, is to think that greater power for local government is at least a partial solution. In turn that requires local areas to have their own tax-raising powers. In the UK, control inevitably tends to revert to the center because the tax structure ensures that any power local authorities have is delegated by central government and can be withdrawn at any time. On the other hand, if local councils are using the Regulation of Investigatory Powers Act as an invitation to snoop on people suspected of minor infractions, greater local power is clearly not a complete answer to the kinds of issues net.wars frets about.

In one of my Glasgow conversations, someone suggested that an independent Scotland would have to dial back on surveillance because it wouldn't be able to afford the cost. Sadly, the reality is more likely the other way around: having built the infrastructure to comply with UK and EU law since 1999, a small, newly independent country might not be able to afford to reengineer its systems to rip the surveillance structures out. And even if it did: a quick glance at the map of submarine cables shows the truth: as long as England holds Cornwall it holds the key entry and exit points for the entire island.

It remains to hope that the promises David Cameron has been making for the last few days - greater devolved powers not just for Scotland but for the other parts of the UK - will find some reality. The utterly anti-democratic passage of the DRIP Act shows how badly *some* kind of change is needed to counteract the complete arrogance and contempt with which large portions of all three major parties are now treating their constituents. I mean us, the people who pay their salaries.

Wendy M. Grossman is the 2013 winner of the Enigma Award. Her Web site has an extensive archive of her books, articles, and music, and an archive of earlier columns in this series. Stories about the border wars between cyberspace and real life are posted occasionally during the week at the net.wars Pinboard - or follow on Twitter.

September 12, 2014

Lying blackfoots, truthful whitefoots

"Do you think the Internet is a failure?"

I'm not sure where that ranks on the shortlist of questions I never thought I'd ask, but it's high up. The clarified version: "Do you think the Internet is a failure in terms of being able to support secure transactions?"

Guillaume Lovet, the senior manager for threat research amd response for Fortinet, had just finished a presentation explaining the state of cybercrime, circa September 2014. The three key points: 1) everyone is a target; 2) the cybercrime scene is layered, and the top players earn a return on investment of over 400; fighting cybercime is a matter of governance, not laws. Subtopics: Android is the new Windows, financial technology is likely to be a wonderful playground for criminals, putting international pressure on safe havens for cybercriminals.

To return to my question. When I said it, Lovet looked thoughtful and then began drawing mathematical formulae on the whiteboard. The gist was this: the mathematician Paul Cohen proved that there is no way to write an algorithm that can perfectly detect whether the program you feed it is clean or malware. There is a nice analogy for this from the 1963 movie Charade, much of which Audrey Hepburn spends trying to figure out whether Grant's character is a good guy or a bad guy. To help confuse her further, Grant's character offers the logic puzzle of two Indian tribes, one of which always lies and the other of which always tells the truth. You cannot distinguish them because whomever you ask will always say, "I'm a truthful whitefoot" - but half of them are lying.

And so it is with programs. And on you will go down the rabbit hole of trying to figure it out. As Hepburn said, "Which one are you?"

The second bit of mathematics Lovet mentioned was Cantor's Theorem, which holds that the set of all subsets of a single set is greater in number than the original set. In other words: take the set of all possible programs. Malware is a subset; clean programs are a subset. You do, as they say, the math.

So we will never eliminate malware. Lovet offered the development cycle's three steps: 1) replicate your target's defense system; 2) test your malware against the target and see if it's detected 3) if it isn't, deploy the malware. If it is, keep iterating the steps until it isn't. It is, he said, always possible to find a piece of malware that will not be detected if you can accurately replicate the defense system. So the first idea is to raise the cost of the replicating the defense system - keep making it more difficult to replicate by, for example, adding complexity and randomness. This is, of course, the same approach security engineers are taking to make the Internet more resistant to passive mass surveillance.

The unhappy difficulty with that, of course, is that the more complexity you add the more difficult you also make the system to manage and use. Adding randomness means that you also cannot predict accurately what it will do. Worse, your opponent - at least, a top-level opponent - has more resources than you do and more time to study your system than you probably do. A serious opponent may wait for years for the right moment to exploit the knowledge gained through painstaking study.

Mathematics again: if you can make the process of iteration too costly in terms of time - if you can map that iteration to an NP-complete problem - that is, turn it into a problem too complicated to solve in any reasonable amount of time, maybe you can win. Finance, he said. No one understands finance now. Or e-voting, as Rebecca Mercuri proved in 2000..

I'm not sure that's encouraging. Are we safer returning to the analog world?

A pause for this story. I went to the local branch of Barclay's Bank the other day to pay my phone bill. It's under £20, a stamp costs 53p, I refuse to use Direct Debit, and it's a two-minute walk. The teller suggested mobile banking. I said, "It's not secure enough." "Oh, no," she said, "our system is very secure." The problem, of course, is not just the bank but the phone platform itself. While I was still gearing up to say this, she added that the bank had a seminar I could attend to learn how safe and secure the system was. "First of all," I said, "I've written about this stuff for more than 20 years. And second of all, don't you *want* your job?" She got so rattled she forgot to stamp the payment stub.

"There was fraud in the analog world," said Lovet, reminding me of the European Computers, Freedom, and Privacy, held in 1993, when someone asked David Chaum, then touting the first cryptocurrency, DigiCash, "What if it gets cracked?" The questioner was answered by John Giilmore: "I believe paper has also been cracked."

Yes, he's right. But analog cracks don't scale. This is the fundamental problem. The digital world gives fraudsters economies of scale.

Wendy M. Grossman is the 2013 winner of the Enigma Award. Her Web site has an extensive archive of her books, articles, and music, and an archive of earlier columns in this series. Stories about the border wars between cyberspace and real life are posted occasionally during the week at the net.wars Pinboard - or follow on Twitter.