Cybersecurity as Realpolitik by Dan Geer presented at Black Hat USA 2014

> If a couple of Texas brothers could corner the world silver market,[HB] there is no doubt that the U.S. Government could openly corner the world vulnerability market, that is we buy them all and we make them all public. Simply announce "Show us a competing bid, and we'll give you 10x." Sure, there are some who will say "I hate Americans; I sell only to Ukrainians," but because vulnerability finding is increasingly automation-assisted, the seller who won't sell to the Americans knows that his vulns can be rediscovered in due course by someone who will sell to the Americans who will tell everybody, thus his need to sell his product before it outdates is irresistible. This strategy's usefulness comes from two side effects: (1) that by overpaying we enlarge the talent pool of vulnerability finders and (2) that by making public every single vuln the USG buys we devalue them. Put differently, by overpaying we increase the rate of vuln finding, while by showing everyone what it is that we bought we zero out whatever stockpile of cyber weapons our adversaries have. We don't need intelligence on what weapons our adversaries have if we have something close to a complete inventory of the world's vulns and have shared that with all the affected software suppliers. Source: [LINK] Video: [VIDEO]

Even if you ignore JFK, a good case can be made that the security agencies (probably FVEY?) currently seem to have at least de facto control basically anywhere they want. Exercising that control got a lot easier - and less obvious - as technology became available. Traditional informants and enforcers sometimes get noticed, but JOIN...WHERE user.id=foo across phone location data is very hard to discover. The key part, I think, is that COINTELPRO ended in name only. Worse, as the use of the internet increased, the number of times I've had to consider "JTRIG-style disruption, paid corporate shill, or useful idiot" has increased dramatically. While a "silent coup" is one possibility, I have been liking how Dan Geer's described[1] the high-level picture of our situation as a Cold Civil War . Cold wars are fought by proxy, and there has been a lot of pointer-chasing to trace in the modern political situation. [1] [VIDEO] ( [LINK] )

All it takes is metadata . The "digital exhaust" we leave behind is extremely revealing. I usually use COTRAVELER as my example of how just a few data points (without any PII) can reveal a LOT about your social interactions, but browser history is another powerful data source. I believe this is why Dan Geer, in his incredible talk last year[1], suggested that "privacy" should now be defined as "the effective capacity to misrepresent yourself". To avoid exactly the type of analysis, you need the capability to misrepresent yourself, and you need to regularly be in the habit of use use that capability. Misrepresentation is using disinformation to frustrate data fusion on the part of whomever it is that is watching you. Some of it can be low-tech, such as misrepresentation by paying your therapist in cash under an assumed name. Misrepresentation means arming yourself not at Walmart but in living rooms. Misrepresentation means swapping affinity cards at random with like-minded folks. Misrepresentation means keeping an inventory of misconfigured webservers to proxy through. Misrepresentation means putting a motor-generator between you and the Smart Grid. Misrepresentation means using Tor for no reason at all. Misrepresentation means hiding in plain sight when there is nowhere else to hide. Misrepresentation means having not one digital identity that you cherish, burnish, and protect, but having as many as you can. [1] [VIDEO] [LINK]

From your other posts you seem to have a very good sense of social responsibility, so I'm surprised at this comment. Multiple identities are incredibly important to anybody in a minority that is threatened by their local mainstream culture. Black people in may areas (even today), gay or lesbian people in many parts of the world, and trans people just about anywhere[1] are some obvious examples. There are numerous others, which bring varying amounts of risk if exposed publicly. These people are often forced to put on a facade when in public, to avoid the risk of being fired (only a few of these are protected classes), beaten, or even killed. The internet has created a space where these people can be themselves... as long as it doesn't connect back to their real name and identity. Yes, leaving a job is a good way to avoid a bigoted manager, but that isn't an option for everybody. Your boss isn't the only threat, either: it wasn't that long ago that being openly gay could get you lynched in some areas. This comes down to the basic concept of privacy. I recommend Dan Geer's definition[2] of privacy in light of modern technology: Privacy used to be proportional to that which it is impossible to observe or that which can be observed but not identified. No more -- what is today observable and identifiable kills both privacy as impossible-to-observe and privacy as impossible-to-identify, so what might be an alternative? If you are an optimist or an apparatchik, then your answer will

The NSA isn't interested in defensive work these days. As Dan Geer explained[1]: I suggest that the cybersecurity tool-set favors offense these days. Chris Inglis, recently retired NSA Deputy Director, remarked that if we were to score cyber the way we score soccer, the tally would be 462-456 twenty minutes into the game, i.e., all offense. I will take his comment as confirming at the highest level not only the dual use nature of cybersecurity but also confirming that offense is where the innovations that only States can afford is going on. This is a serious problem, not only from the problems intelligence angies with many powers and poor oversight; ignoring defense is going to bite a lot of people in bad ways. We are already seeing the beginnings of this with the escalating impact computer-based attacks are having on their victims. I also recommend considering Jacob Appelbaum's response to this question[2] from the audience - from someone currently working for the NSA. The summary is that we need people doing NSA-style work, but on the defense side, and we need it now. If the NSA isn't doing that, then maybe people that want to actually protect their country should find somewhere else to work that is actually working on defense. [1] [VIDEO] [2] [LINK]

Dan Geer at his important talk at Black Hat: The central dynamic internal to government is, and always has been, that the only way for either the Executive or the Legislature to control the many sub-units of government is by way of how much money they can hand out. [...] Suppose, however, that surveillance becomes too cheap to meter, that is to say too cheap to limit through budgetary processes. Does that lessen the power of the Legislature more, or the power of the Executive more? I think that ever-cheaper surveillance substantially changes the balance of power in favor of the Executive and away from the Legislature. While President Obama was referring to something else when he said "I've Got A Pen And I've Got A Phone," he was speaking to exactly this idea -- things that need no appropriations are outside the system of checks and balances. [VIDEO] [LINK] While Congress has been occupied with infighting and stupid political theater, the Executive branch has been taking a lot of their power. Is it "making war" when Congress is clearly abdicating their responsibilities? It has certainly done more damage to the country than any army has ever accomplished.

Comparing intelligence operations of the past - with or without the help of business - to the current situation is a false equivalence. To quote Cybersecurity as Realpolitik [1] yet again: The central dynamic internal to government is, and always has been, that the only way for either the Executive or the Legislature to control the many sub-units of government is by way of how much money they can hand out. [...] Suppose, however, that surveillance becomes too cheap to meter, that is to say too cheap to limit through budgetary processes. Does that lessen the power of the Legislature more, or the power of the Executive more? I think that ever-cheaper surveillance substantially changes the balance of power in favor of the Executive and away from the Legislature. In the past, there were always fundamental limitations of money or manpower or capability. It's expensive to run a stakeout, and it just wasn't technologically possible to build a database about everybody ; even the relatively simple census took years of work before the invention of Hollerith's Tabulator[2]. Compare that to today, where XKEYSCORE can search most world communications in (approximately?) realtime. Compare the handful of bytes worth of personal information the Census Bureau was able to tabulate about everybody to the still-growing mountain of data (and metadata) that is gathered routinely that we call "analytics". Compare the difficulty of searching for some particular piece of data - even with a fancy elec

It's been a cold civil war for many years. Encryption - and communication technology in general - is a power usable by anybody, not just established institutions. As Dan Geer explains: In other words, [c]onvergence is an inevitable consequence of the very power of cyberspace in and of itself. [I]ncreasingly powerful, location independent technology in the hands of the many will tend to force changes in the distribution of power. In fact, that is the central theme of this essay -- that the power that is growing in the net, per se, will soon surpass the ability of our existing institutions to modify it in any meaningful way, so either the net must be broken up into governable chunks or the net becomes government. It seems to me that the leverage here favors cyberspace whenever and wherever we give cyberspace a monopoly position, which we are doing that blindly and often. In the last couple of years, I've found that institutions that I more or less must use [...] no longer accept paper letter instructions, they each only accept digital delivery of such instructions. This means that each of them has created a critical dependence on an Internet swarming with men in the middle and, which is more, they have doubtlessly given up their own ability to fall back to what worked for a century before. It is that giving up of alternative means that really defines what convergence is and does. It is said that all civil wars are about on whose terms re-unification will occur. I would argue th

> the Senate [is] charged with preventing this from happening. But the Senate was gutted There is a gradual drift over time; most complex systems accumulate errors, imbalances, and unexpected problems over time. However, there is another problem happening right now that I've only seen mentioned[1] by Dan Geer. He suggests that technology has changed the balance of powers: The central dynamic internal to government is, and always has been, that the only way for either the Executive or the Legislature to control the many sub-units of government is by way of how much money they can hand out. ... Suppose, however, that surveillance becomes too cheap to meter, that is to say too cheap to limit through budgetary processes. Does that lessen the power of the Legislature more, or the power of the Executive more? I think that ever-cheaper surveillance substantially changes the balance of power in favor of the Executive and away from the Legislature. While President Obama was referring to something else when he said "I've Got A Pen And I've Got A Phone," he was speaking to exactly this idea -- things that need no appropriations are outside the system of checks and balances. The "power of the purse" doesn't mean much when technology drives prices towards zero. This is made much worse by the "humans need not apply"[2] shift in jobs from humans to automation. [1] [VIDEO] [LINK] [2] [LINK]

As Dan Geer warned[1], technology changed the balance of powers when the cost tends towards zero: The central dynamic internal to government is, and always has been, that the only way for either the Executive or the Legislature to control the many sub-units of government is by way of how much money they can hand out. ... Suppose, however, that surveillance becomes too cheap to meter, that is to say too cheap to limit through budgetary processes. Does that lessen the power of the Legislature more, or the power of the Executive more? I think that ever-cheaper surveillance substantially changes the balance of power in favor of the Executive and away from the Legislature. While President Obama was referring to something else when he said "I've Got A Pen And I've Got A Phone," he was speaking to exactly this idea -- things that need no appropriations are outside the system of checks and balances. The "power of the purse" doesn't mean much when technology drives prices towards zero. [1] [VIDEO] [LINK]

> users in general Blaming users is part of the problem. Yes, they vote with their wallet, but their vote is usually made in ignorance and is often mislead by companies that are so used to dissembling and exaggerating they call such antisocial behavior "best practice". That said, it is true that this is largely a problem with the economic incentives. Capitalism optimizes for businesses that are financially efficient, so the business that sells the lowest quality product they can get away with is "successful". This becomes even worse in software, where quality is harder to see directly. Even the people that write software can have a hard time evaluating "quality". The solution for this situation is simple, but it's basically taboo to talk about it: liability . If you sell software, you need to be liable for any damage it causes when "used normally". For a decent sketch of how this might look, see Dan Geer's explanation[1]. There may be other ways to implement liability. I suggest that the software industry should find a way to implement this as soon as possible, if they want any say in what "liability" means. Yes, this will raise development costs; spending more for better development practices was the goal . [1] [VIDEO]

Y Not - Adventures in Functional Programming by Jim Weirich [LINK] The Coming Civil War over General Purpose Computing by Cory Doctorow [LINK] Cybersecurity as Realpolitik by Dan Geer [VIDEO] [LINK]

More ground is lost in the cold[1] civil war[2] for control of the General Purpose Computer. I hope that everyone choosing to centralize computing power likes the future they are creating. [1] [VIDEO] (sec. 10 - [LINK] ) [2] [LINK]

That's is more or less the model I intended. Specifically, I was referring to one of Dan Geer's extremely important recommendations in "Cybersecurity as Realpolitik"[1]. [1] [VIDEO] ( [LINK] )

> technology is going to make mass surveillance relatively easy > a la Gestapo In 2013 Tom Scott made an incredibly prescient sketch of our grim surveillance-state future. It absolutely terrifying . [LINK] It's terrifying because it's the power of Stasi-style informants modernized into a simple Uber-like app. No more scary clandestine meetings, now you can inform on your friends, family, and neighbors with one click from the comfort of your own home. Similar to the "social credit" system, Tom's "Oversight" could work, because they both efficiently incentivize close peers against each other. "You should stop spending time with your friend John. I heard him talking like a dissident recently... that could damage your Social Credit rating!" > enters with their phone Which is exactly why I follow Dan Geer's advice[1] and don't carry around a tracking device. He's been trying to warn us for years[2], and we still aren't listening[3]. [1] [LINK] [2] [VIDEO] (transcript: [LINK] ) [3] [LINK] (transcript: [LINK] )

> Obfuscation may be our best digital weapon. From Dan Geer's talk "Cybersecurity as Realpolitik" (which everyone should hear[1]/read[2]): >> There are so many technologies now that power observation and identification of the individual at a distance. They may not yet be in your pocket or on your dashboard or embedded in all your smoke detectors, but that is only a matter of time. Your digital exhaust is unique hence it identifies. Pooling everyone's digital exhaust also characterizes how you differ from normal. Privacy used to be proportional to that which it is impossible to observe or that which can be observed but not identified. No more -- what is today observable and identifiable kills both privacy as impossible-to-observe and privacy as impossible-to-identify, so what might be an alternative? If you are an optimist or an apparatchik, then your answer will tend toward rules of data procedure administered by a government you trust or control. If you are a pessimist or a hacker/maker, then your answer will tend towards the operational, and your definition of a state of privacy will be my definition: the effective capacity to misrepresent yourself . >> Misrepresentation is using disinformation to frustrate data fusion on the part of whomever it is that is watching you. Some of it can be low-tech, such as misrepresentation by paying your therapist in cash under an assumed name. Misrepresentation means arming yourself not at Walmart but in living rooms. Misrepresentation mea

> What regulation are people proposing that would prevent compilation and sale of this kind of data Liability! (with the option of avoiding that liability by explicitly not allowing yourself access to content/personal-data, aka a common carrier ) As Dan Geer said in my previous [2] (section 2, "Net neutrality"): Hello, Uncle Sam here. You can charge whatever you like based on the contents of what you are carrying, but you are responsible for that content if it is hurtful; inspecting brings with it a responsibility for what you learn. -or- You can enjoy common carrier protections at all times, but you can neither inspect nor act on the contents of what you are carrying and can only charge for carriage itself. Bits are bits. Choose wisely. No refunds or exchanges at this window. While he was talking about ISP spying, the general principle can be adapted easily. Inspection (or building databases of the results of other people's inspections) must be tied to liability for the problems and negative externalities produced by that inspection (or database). Obviously this is a high-level description that ignores the messy details that are important in any actual plan. There is room for negotiation and modification. The goal is to create a situation that disincentives creating tomorrow's problems, just like we do for other types of hazardous technology. Data and spyware needs to be seen as toxic that requires special handling, storage, and disposal procedures. > This is very informativ

> Obfuscation may be our best digital weapon. From Dan Geer's portentous talk "Cybersecurity as Realpolitik" [1][2]: >> Privacy used to be proportional to that which it is impossible to observe or that which can be observed but not identified. No more -- what is today observable and identifiable kills both privacy as impossible-to-observe and privacy as impossible-to-identify, so what might be an alternative? If you are an optimist or an apparatchik, then your answer will tend toward rules of data procedure administered by a government you trust or control. If you are a pessimist or a hacker/maker, then your answer will tend towards the operational, and your definition of a state of privacy will be my definition: the effective capacity to misrepresent yourself . [1] [VIDEO] [2] [LINK]

Dan Geer (CISO at In-Q-Tel, the CIA’s private investment arm) gave a BlackHat talk that advocated for this, among other things. [VIDEO]