Full hearing: US Senate on Cyber War Readiness

Highlights from the US Senate panel on cybersecurity 23 February 2010.

Mary Ann Davidson, CSO (Oracle). Required reading! Ms. Davidson masters the subject in bright prose. This is an excellent indictment of the rush deploy smart grid technologies before we’ve had time to harden them from the types of attacks that routinely take computers off line. Thought experiment: what level of unplanned downtime would you be comfortable with for your house’s electrical power? water? energy? Would you try to save 10% on your electric bill if for a system that you couldn’t be sure would work more than 99.9% of the time?

Even better, Ms. Davidson points out a crucial flaw in education. Computer science is applied mathematics, and few departments teach young programmers how to write secure software. If university departments don’t teach secure programming, we will need professional certifications to substitute, as with medical residencies, CFA exams for financial analysts, and professional societies for engineers and architects.

Vice Admiral Mike McConnell (Booz Allen Hamilton). Sound byte: “If there were a cyber war today, the United States would lose.” Some excellent recommendations for training a new class of software engineers, security professionals, and managers. Don’t be distracted by the salacious and unwarranted assertion at the outset. The rest of the testimony is good, and nobody is better informed than the Admiral.

Dr. James A. Lewis (CSIS). A couple of interesting metaphors. He compares cyberspace to a condominium and to a shopping mall, meaning that the space is all privately owned, and that neighbors have a compelling interest in one another’s behavior. Therefore all should be willing to submit to greater regulation. I’m inclined to agree with Borg’s statement (below) that government regulations are unlikely to keep pace with the rate of innovation. Rather  than ask the government to certify that buildings are safe, wouldn’t we be better off with private certification of a standard of risk, as we currently do with automobiles, houses, and financial management? Computers and especially software are endlessly complicated, and don’t lend themselves well to the same type of governance as broadcast media and airplane safety.

Lewis also makes a crucial overstatement when he says that there are no rules on the Internet or that the Internet is a wild west. Actually many national and state authorities have control over Internet commerce, fraud, and even transborder crimes. At a more fundamental level, Lewis’ lawless vision of the Internet is fundamentally at odds with Internet governance over every layer of the Internet, from the development of hardware standards and Internet protocol, to the assignment of names and numbers, to the software that runs servers and home desktops. Re-read Lessig, and see if you can imagine the Internet truly without rules.

Scott Borg (US-CCU). Focuses on 3 central problems: (1) the conflict is already here; (2) cyber conflict threatens future American prosperity; (3) fixing markets is the key to improving cyber security. I agree with Borg, but then I’m biased.

Rear Admiral James Arden Barnett, Jr., Ret. (FCC). An interesting point of view. I don’t have any problem with DHS assisting the country with situational awareness, but the philosophy of defense is extremely centralized. The greatest specific policy errors of homeland security in the last ten years have been efforts to provide one-size-fits-all information and requirements from a central national office: the national threat level scale, vastly increased expenditures on passenger screening at airports, and advice on creating a safe room for chemical gas attacks inside your home. There are too many computers, and too many businesses to expect that federal marshals can secure their IT infrastructure for them. Effective homeland defense will require businesses and individuals to have cheap, effective, and secure choices to accomplish the things they already know how to do: run their businesses and their households.

Another failed attempt to resurrect deterrence for cyber war

Cyber war creates far more than its share of Maginot strategy. How is it that we can hope to make deterrence work without the three elements that supported it during the nuclear age? McConnell’s article dated this coming Sunday (2/28/10) [sic] outlines three conditions, and then claims that the failure of these conditions isn’t really a problem. It’s a giant problem. Future cyber warriors will not suffer from our empty threats to respond with catastrophic cyber or conventional weapons.

During the Cold War, deterrence was based on a few key elements: attribution (understanding who attacked us), location (knowing where a strike came from), response (being able to respond, even if attacked first) and transparency (the enemy’s knowledge of our capability and intent to counter with massive force).

All three of these conditions fail.

Ethiopia trip

Just a quick note to express public thanks for the hospitality from the Feinstein Center‘s Addis Ababa staff. Fasil Yemane and Hirut Demissie were invaluable in getting me settled into my new digs there, but more importantly, introducing me to all the stakeholders from Ethiopia’s PSNP. No way I could have had that level of access without their assistance.

I gave a short talk to the research staff on my last day there, 5 February 2010. Comments from Director Andrew Catley, Berhanu Admassu, Yacob Akliku, Yosef, and Fletcher’s own John Burns were enormously helpful to my thinking. I am also deeply grateful to stakeholders at the Ministry of Agriculture (DRMFSS), WFP, FAO, USAID, CARE, Save the Children, and Nyala Insurance for their generous contribution of time and subject matter expertise.

Export Trade Clusters

This post, as with the prior ones on trade clusters, aims to help visualize patterns of trade in the OECD from 50 years of partner trade statistics. The data is rich, meaning we should be able to develop rich intuition by exploring it visually.

These slides follow the method laid out in Jong-Eun Lee, “Two Maps for the World’s Trade Integration,” Applied Economics Letters, 11:4 (2004). All computations were performed in R.

60 minutes covers cyberwar

Steve Kroft of 60 minutes covers cyberwar from the perspective of computer network operations and critical infrastructure. It is a welcome change from the usual fare of robotic weapons, web defacement, and online chat group flame wars. The video and transcript are available at 60 minutes. Well worth the watch.

Unilateral trade clusters using raw import flows

This set of dendrograms, again, is based on raw partner import flows from OECD. The dendrograms show complete linkages (all countries in a cluster exceed the threshold value for mutual trade flows), but the dyad is measured by the greater of the two trade flows.

This gallery shows an annual series of dendrograms using that dataset back to 1993.

Bilateral import clusters using raw trade flows

As promised, here are a new round of dendrograms using OECD trade data as a reciprocal distance measure among countries reporting. In trade, relationships matter, and these dendrograms show which relationships matter the most. Clusters are drawn by complete linkages, using the lesser of the two pairwise trade flows (greater notional distance).

The important thing about these dendrograms, relative to the ones posted the last few days, is that they take the raw trade flows themselves–not normalized for population, or total imports, or GDP–as the unit of analysis. This is actually a much more useful picture of trade than the normalized flows, because is suggests which relationships ought to draw the most water in trade politics.

The cluster algorithm isn’t a perfect way to capture the data; a few outliers can skew the presentation of the data somewhat. But it is the only good way I have seen to present cross sections of country-dyad data at a glance. It’s a very useful tool for presentation of descriptive statistics on international trade.

Unilateral import clusters in international trade

As with yesterday, these graphics depict complete clusterings in international trade, treating the partner country’s share of total home country imports as a raw distance measure. The greater the share, the closer the two countries are. For visual clarity, I have used logarithmic scales; so the scale at left doesn’t have any concrete meaning.

The clusters in this dendrogram indicate complete linkages, meaning that all of the country dyads in each cluster share a unilateral import concentration greater than the threshold value for the cluster. At 100% concentration, no country has a partner providing 100% of imports; so all the countries are separate at the bottom of the scale. At 0% concentration, countries all have at least some trade with one another; so one giant supercluster exists at the top of the scale.

Bilateral import clusters in international trade: insights

Major insights from the dendrograms in the previous post:

1. Among OECD countries, New Zealand and Australia cleave closest to the Pacific alliance: NAFTA, Japan and Korea.
2. Scandinavian countries have undergone a durable shift in trade patterns, away from France and the Iberian peninsula, and toward the British Isles.
3. Greece, Italy, and Turkey constitute a durable trade cluster over many years. In the early 1990s this group traded heavily with the UK and Ireland; now more so with central Europe and Switzerland.
4. Dutch trade patterns oscillate more than other countries; suggesting durable, close ties to some member(s) of both the Scandinavian and Mediterranean clusters.

Bilateral import clusters in international trade

One big problem in the visualization of bilateral statistics is that maps don’t work very well.

Dendrograms give a very attractive and intuitive solution to the problem by dispensing with geographic information altogether. The dendrogram shows how clusters of countries form along a continuum of closeness. For international trade, I’ve presented below a cluster analysis of the OECD by share of total imports sourced from the partner country. Here, the linkages are bilateral, meaning that if countries A and B source 10% and 20% of their total imports from one another (respectively), the A-B partnership would join the same cluster at a threshold of 10% of imports.

At the top of the screen (0% of imports), all countries belong to a single supercluster. At the bottom of the screen (100%), no country sources 100% of its imports from any trade partner. Moving up the screen from the bottom, countries join the same cluster when the lesser of their mutual import shares falls above the threshold value. Technical notes below.

Tomorrow, I will post dendrograms for unilateral linkages (essentially the same as above, but using the greater of the two numbers). The following day, I will post dendrograms using the raw import flows, rather than the share of total imports. Following that, expect images depicting GDP weighted import flows. Next week, I will post the same series of images for imports.