The Daily Parker

Politics, Weather, Photography, and the Dog

You don't have to be a super-spy to know this

I found myself actually shocked at one piece of testimony in yesterday's impeachment hearing:

A U.S. ambassador’s cellphone call to President Trump from a restaurant in the capital of Ukraine this summer was a stunning breach of security, exposing the conversation to surveillance by foreign intelligence services, including Russia’s, former U.S. officials said.

The call — in which Trump’s remarks were overheard by a U.S. Embassy staffer in Kyiv — was disclosed Wednesday by the acting U.S. ambassador to Ukraine, William B. Taylor Jr.

“The security ramifications are insane — using an open cellphone to communicate with the president of the United States,” said Larry Pfeiffer, a former senior director of the White House Situation Room and a former chief of staff to the CIA director. “In a country that is so wired with Russian intelligence, you can almost take it to the bank that the Russians were listening in on the call.”

Republicans, who used to bang the drum on security issues so loudly you could barely make out the words they were actually saying, do not seem to have noticed this event. Which shocks me even more.

Things to read on my flight Friday

I realized this morning that I've missed almost the entire season of The Good Place because I don't seem to have enough time to watch TV. I also don't have enough time until Friday to read all of these pieces that have crossed my desk only today:

And now, I must finish correlating two analyses of 1.48 million data points using similar but not identical algorithms. It's as much fun as it sounds.

Backfield in motion






Things to think about while running a 31-minute calculation

While my work computer chews through slightly more than a million calculations in a unit test (which I don't run in CI, in case you (a) were wondering and (b) know what that means), I have a moment to catch up:

The first 30-minute calculation is done, and now I'm on to the second one. Then I can resume writing software instead of testing it.

Lunchtime links

I'm surprised I ate anything today, after this past weekend. I'm less surprised I haven't yet consumed all of these:

Is it nap time yet?

Lunch links

A few good reads today:

Haven't decided what to eat for lunch yet...

Not a slow news day

Let's see, where to begin?


The myth of "consumer" security systems

Bruce Schneier takes apart Attorney General Bill Barr's proposal to weaken civilian computer security:

The Department of Justice wants access to encrypted consumer devices but promises not to infiltrate business products or affect critical infrastructure. Yet that's not possible, because there is no longer any difference between those categories of devices. Consumer devices are critical infrastructure. They affect national security. And it would be foolish to weaken them, even at the request of law enforcement.

The thing is, that distinction between military and consumer products largely doesn't exist. All of those "consumer products" Barr wants access to are used by government officials -- heads of state, legislators, judges, military commanders and everyone else -- worldwide. They're used by election officials, police at all levels, nuclear power plant operators, CEOs and human rights activists. They're critical to national security as well as personal security.

Barr can't weaken consumer systems without also weakening commercial, government, and military systems. There's one world, one network, and one answer. As a matter of policy, the nation has to decide which takes precedence: offense or defense. If security is deliberately weakened, it will be weakened for everybody. And if security is strengthened, it is strengthened for everybody. It's time to accept the fact that these systems are too critical to society to weaken. Everyone will be more secure with stronger encryption, even if it means the bad guys get to use that encryption as well.

Schneier doesn't say it explicitly, but this is one more example of how Barr and other Republicans of his generation haven't caught up to the rest of the world.

How to combat influence operations

Bruce Schneier has an eight-step plan—though he recognizes Step 1 might not be possible:

Since the 2016 US presidential election, there have been an endless series of ideas about how countries can defend themselves. It's time to pull those together into a comprehensive approach to defending the public sphere and the institutions of democracy.

Influence operations don't come out of nowhere. They exploit a series of predictable weaknesses -- and fixing those holes should be the first step in fighting them. In cybersecurity, this is known as a "kill chain." That can work in fighting influence operations, too­ -- laying out the steps of an attack and building the taxonomy of countermeasures.

Step 1: Find the cracks in the fabric of society­ -- the social, demographic, economic, and ethnic divisions. For campaigns that just try to weaken collective trust in government's institutions, lots of cracks will do. But for influence operations that are more directly focused on a particular policy outcome, only those related to that issue will be effective.

Countermeasures: There will always be open disagreements in a democratic society, but one defense is to shore up the institutions that make that society possible. Elsewhere I have written about the "common political knowledge" necessary for democracies to function. That shared knowledge has to be strengthened, thereby making it harder to exploit the inevitable cracks. It needs to be made unacceptable -- or at least costly -- for domestic actors to use these same disinformation techniques in their own rhetoric and political maneuvering, and to highlight and encourage cooperation when politicians honestly work across party lines. The public must learn to become reflexively suspicious of information that makes them angry at fellow citizens. These cracks can't be entirely sealed, as they emerge from the diversity that makes democracies strong, but they can be made harder to exploit. Much of the work in "norms" falls here, although this is essentially an unfixable problem. This makes the countermeasures in the later steps even more important.

Also unfortunately, most of the countermeasures require informed and conscientious political leaders. Good luck with that.

A Harlequin hacker romance?

Via Bruce Schneier, this is literally* a thing:

The book opens with Massimo working in his combination laboratory and server farm; we know it's ironclad because of the required thumbprint and biometrics scan, but we also know it's classy because it's in an old wine cellar beneath his family villa outside Milan. Plus, he has three screens, so you know he's a serious cybersecurity hacker man.

Nat is a 20-something who lives a poverty-driven boho life. Massimo—who is Mr. Cyber—is, in her eyes, a "sleek, lean, sex-on-legs stud" who looks nothing like the stereotypical tech billionaire. And the chemistry between them ignites as he drags her back to his server room and tells her to do some... penetration testing.

She demurs.

Six chapters in. I am convinced that this book was written by a Harlequin Markov bot.

I may not add this to my book list just now. But at least I know it's out there...

*Yah, sorry. That's "literally" twice.