Wednesday, September 24, 2014

On U. S. Exceptionalism

The Opinion page of USA Today from September 23, 2014 featured a commentary on the College Board's AP U. S. History exam and its associated framework, or more accurately, on critics thereof. The counterpoint by Jane Robbins of the American Principles Project, entitled "Exam Erases U. S. Exceptionalism", stated "The origins of the framework have been traced to the philosophy that the U. S. is only one nation among many, and not a particularly admirable one at that." In other words, if you can't quote features from U. S. History that illustrate that America is better than other nations, don't say anything. And especially don't be critical.

As for the Curriculum Framework, Robbins urges: "Read it." Which I did. The framework advocates teaching critical thinking skills, based on broad themes of Identity, Economics, Politics and Power, America in the World and American Ideals and Culture, through 9 historical periods ranging from 1491 through the present. It encourages comparison and contrast, and the kind of thinking that is fostered by a liberal education.

So what's wrong with the ideal of U. S. Exceptionalism? Shouldn't everyone enjoy a little nationalism? Be proud of your country and its accomplishments? There are several problems: First, blind belief in American Exceptionalism prevents the viewer from seeing the real problems that every country has, and that need fixing. And to understand a problem, you need to know how you got there, which is what the study of history is all about. Second, the approach to history that Robbins advocates is the blind acceptance of cherry picked facts, which prevents the development of critical thinking skills which Americans desperately need.

And indeed, the deeper fear that conservatives like Robbins have is that students will develop thinking skills, that they will learn to think for themselves, and not accept what Robbins is pushing: dogma and romanticism.

Recalling history, rather than studying it rigorously, involves human memories, which are colored by human emotion. This leads to selective memory and romanticism. When political belief systems are involved, this leads to dogma. Neither have a place in the process of critical examination and thinking necessary for a student's education.

Monday, September 15, 2014

Inequality for All

Over the weekend I watched the film Inequality for All. The movie features former Labor Secretary Robert Reich, Silicon Valley Venture Capitalist Nick Hanaeur and former Conservative Senator Alan Simpson examining the current widening gap between the rich and poor in America, how it came to be, and when it has occurred in the past. They also discuss whether it is a bad thing for America in general and Democracy in particular.

A similar gap between rich and poor formed in the 1920s, just prior to the great depression. A chart of the top 10% richest Americans' share of the economy shows that the top 10% share rose throughout the 1920s to peak at over 50% just prior to the 1929 Stock Market Crash. That share fell steadily through the Great Depression and World War II to about 35% and remained flat at about 35% through the 1940s, 1950s and 1960s. However, it started rising again in the 1970s, until peaking again at about 50% just prior to the start of the Great Recession in 2008. (Source: Capital in the Twenty-First Century, Piketty and Goldhammer).

I have repeatedly heard it said that high marginal taxes inhibit jobs. In other words, if we want to create jobs, we need to cut taxes so that the "job creators" (the wealthy) are free to create jobs. Unfortunately, the facts show otherwise. During the 1940s, 1950s, and 1960s, when Income Inequality was low, and jobs were plentiful, the US had very high marginal tax rates. The following chart illustrates this:

A lot of things were going on after World War II that allowed for full employment in the United States. The US was the only developed country that had an intact economy. The arrangements at Bretton Woods, that put American Dollars into the role of the sole exchange currency, put the US Economy in a position of considerable advantage. The large numbers of union workers helped to give all American workers, union and non-union, a considerable degree of power in wage negotiations.

Finally, something I haven't heard talked about much is the degree to which Americans felt like they were all part of society. America had sent a considerable percentage of its population into the military to fight the war. Many workers had migrated to work in war-time industries, producing good for the war effort. Families worked in "Victory Gardens" to grow food to replace the shortfall from a shortage of farm workers and the purchase of farm goods for the military.

When America demobilized, a significant fraction of civilians were now veterans (see table below). Perhaps for some period of time, business felt an obligation to "take care" of its workers through good wages. Is it possible that Corporate America, in the post-WW II era, felt that being good corporate citizens towards workers was also an obligation besides maximizing profits?

Size of the military versus US Population:

Year Army Air Force1 Navy Marines Coast Guard2 Total American Population % Military
1939 189,839 125,202 19,432 334,473 130,879,718 0.25%
1940 269,023 160,997 28,345 458,365 132,122,446 0.35%
1941 1,462,315 284,427 54,359 1,801,101 133,402,471 1.35%
1942 3,075,608 640,570 142,613 56,716 3,915,507 134,859,553 2.90%
1943 6,994,472 1,741,750 308,523 151,167 9,195,912 136,739,353 6.73%
1944 7,994,750 2,981,365 475,604 171,749 11,621,468 138,397,345 8.40%
1945 8,267,958 3,380,817 474,680 85,783 12,209,238 139,928,165 8.73%
2001 480,801 353,571 338,671 184,574 1,385,116 285,081,556 0.49%
2007 519,471 337,312 338,671 184,574 1,380,082 301,230,367 0.46%
2011 565,463 333,370 325,123 201,157 1,468,364 311,593,589 0.47%
1. Prior to 1947, existed as the Army Air Corps. 2. Coast Guard listed only as wartime strength.

One of my favorite movies is the 1946 Academy Award Winner Best Years of Our Lives.Fredrich March plays Al Stephenson, the banker placed in charge of administering the GI Loan program in his old bank. At a dinner to honor his return, and promotion, Al gets drunk and talks about a loan application from a vet who wants to buy a farm, but who has no collateral for the loan. Al tells the story of how, during the war, he was ordered to take a hill. " 'But sir, I can't take that hill, I have no collateral.' So I didn't take the hill, and we lost the war." He goes on to tell his bosses, the senior bank officials, that the vets have collateral, their war experiences, and that the bank is going to make the loans based on the vets experience.

One question in my mind, is this: How long will the current level of inequality remain before movements like the Tea Party and Occupy Wall Street recognize the true source of the wealth inequality and seek to overturn it? Will the top 1% make some effort to rebalance the gap before they are force to do so?

Tuesday, September 9, 2014

Blame For Breaches, And Where That Gets Us

American Business is suffering an epidemic of data loss. Today (09/09/2014) it is Home Depot that has suffered the latest breach of credit card data. In mid-December 2013, it was Target. Fortunately, we have new notification laws so that we learn about data breaches. In past times, companies kept their losses secret, for many reasons, but primarily to prevent business revenue loss. To blame is human. Embarrassment and shame for mistakes made is also human, and a little bit is a good thing. It acts as an incentive to do better next time, a motivator to improve. But too much fear/shame is an inhibitor. An RSA Conference 2013 presentation on October 2011 SEC Disclosure Requirements for Risk Factors noted that by requiring registrants to disclose their risk factors and incidents, so that the real incident rate can be determined, business can move beyond the fear/shame cycle to realize that "stuff" happens, and deal with it. Because too much fear/shame is paralyzing. But to return to the blame factor, the onus is almost entirely on the target business to prepare and comply with regulatory and legal requirements. Our current InfoSec model is that a company adopt an InfoSec policy, have management support it, perform a risk analysis to determine what assets to protect from which risk factors using these specific controls and perhaps transferring some risks to third parties, implement those controls and transfer the risks, monitor and repeat periodically, and be in compliance. And take the blame when something fails. That model is way too simplistic. And unrealistic. Simplistic because software always has residual bugs and is exploitable. And all of our InfoSec controls, from firewalls to Intrusion Prevention Systems (IPSs) to Authentication and Authorization Mechanisms are software controlled themselves. And the business of businesses is generally not InfoSec, but their primary business. Our model is unrealistic because the motivator to produce software is not to produce quality software that resists exploits. The primary motivator to produce software is a deadline, whether that is to be the first to ship and thereby capture a market or to meet a client schedule. I'm not saying that people purposely write exploitable code, although some do. I'm saying that, because the primary motivator is not to produce quality code, code is shipped with exploits. David Rice was hired in 2011 as Apple's Global Chief of Security. He has a Masters Degree in Information Warfare Systems Engineering from the Navy Postgraduate School in Monterey, CA. His book Geekonomics: The Real Cost of Insecure Software is about the economic incentives for writing software. His quote of Silicon Valley venture capitalist Guy Kawasaki says it all: "Don't worry, be crappy. Just get your product out there". I'm also not saying that everyone ships bad code, but rather that the incentive is to ship code as soon as possible to capture market share. That is over and above the technical issues of software testing and residual bugs. So, American businesses are asked to work with flawed code. They are asked to protect their businesses with security products that have residual bugs. And they are asked to shoulder the blame when they are, inevitably, exploited. What's wrong with this picture? The biggest flaw is that we don't recognize the flaw. We blame the business. It's time we acknowledge that our software has problems, and that the blame should be shared. Yes, the targets need to follow the model, flawed as it is, or they are grossly negligent. But the software suppliers and the security companies share the blame, because their products harbor the exploits, product liability limitations not withstanding. We need to move beyond our model, tone down the blame game, get over the shame, and start reporting every breach, every exploit, so that we can start to understand the true magnitude of the problem and work to fix it. And move beyond merely blaming the targets.

Sunday, September 7, 2014

For Lack of Configuration Control

DevOps is a software development methodology that calls for the close integration of software development teams and the operations teams that run their developed software in production. One of software development's dirty secrets is "The Wall", as in "throw it over the wall", the idea that you can develop software without considering operations, and when it doesn't work in production, you can throw it back on development for them to fix. DevOps calls for, among other things, simple, repeatable processes; quality testing; small, frequent releases; and, above all, close collaboration, if not integration, between the development and operations teams. In short, it attempts to change the process of developing software and putting it into production from an artistic to an engineered process. Because DevOps attempts to add engineering discipline to software development, DevOps personnel can learn a great deal from the kinds of problems engineers in other disciplines have encountered, and solved. A Fiery Peace In A Cold War is Neil Sheehan's biography of General Bernard Schriever, the USAF Officer that lead the US ICBM development effort in the 1950s and 1960s. He was appointed to lead Western Development Division, which managed the development of the Thor, Atlas, Titan and Minuteman missile systems. Nominally a native Texan, he was promoted to General in 1961 and commanded Air Force System Command, managing all USAF weapons systems and approximately 40% of the Air Force budget. After the launch of Sputnik in 1959, the US believed itself to be in a "missile gap", behind the Soviet Union. The Air Force's first ICBM, Atlas, was rushed into early deployment, but had major bugs. Most of the bugs were not in the missile system, but in the support systems, for example, the liquid oxygen (LoX) fueling system. One Atlas exploded on the pad during a fueling exercise. Earlier, a Thor missile had exploded four seconds into flight. Subsequent analysis showed that the fueling crew had allowed the LoX hose to be dragged through the sand on the way to the pad, leading to sand contamination of the LoX lines. After instituting a configuration control system, it was discovered that the missile supplier, Convair, was modifying parts at the missile test site in order to get missiles to fly without notifying the assembly line and without making any records of the changes that they were making. The configuration of a successful launch could not be duplicated; the Atlas program was getting random success, as well as random failure. To prevent uncontrolled and undocumented changes, seals and locks were placed on missile compartments and launch equipment cabinets, so that changes would only be made after review by a configuration control board. In my 28 years in IT, I can remember many instances when the looming deadline justified a quick fix and a test. I can also remember the instances where the quick fixes lead me to a point where I could not return to a known, good state. Automation and methodology are the engineering tools necessary to prevent those hubris-induced states that we can get ourselves in by believing we can meet the crisis with our artistic rather than engineering skills.

Let's Talk About EMP

I have to admit a personal weakness. For some people it's chocolate, for me, it's post-Apocalyptic fiction. It all started back in the early '70s when I was in high school and read Alas Babylon by Pat Frank. Written in 1959 during the Sputnik crisis (when I was one years old) by Pat Frank, it is a post-World War III survival story about a Florida community struggling in the aftermath of the US-USSR one day war. Along with On The Beach, Fail Safe and Dr. Strangelove, Alas Babylon is a classic piece of cold war fiction. It was written in a year when many Americans thought America had fallen behind the Soviets in the technological race for supremacy. America hadn't; Ike knew we hadn't. He knew, from U-2 spy flights, that America had an infinitely greater capacity to destroy the Soviet Union, using SAC, and that the Soviets had no ICBMs. Yet he felt that he couldn't divulge that information, and the "missile gap" helped propel John F. Kennedy into office. So I continue to read post-Apocalyptic fiction. And non-fiction. There's a solid body of stories built around the end of American society due to an EMP event destroying the power grid and everything containing microchips. And it is based on a very real vulnerability of our electricity and electronics dependent society. The question is: How likely is it? Every day, we make decisions based on the probability of risks, whether we realize it or not. Do I buy this house in this neighborhood? Probably based on the risk of crime, among other things. Do I put my 401k into stocks or treasuries? Based on the risk of the stock market declining, versus the (perceived) safety of the US Government. Do I drive over the speed limit? What's the risk of getting a ticket? Do I buy a hide-out in the country? What's the probability of an EMP event destroying the grid? As an Information Security Professional, I decide how to protect a system by listing every knowable threat to the system, attempting to determine the probability of that threat, determining the cost of the control to mitigate that threat, comparing the cost to the value of the asset that is being protected, and rank ordering the controls. The process is called a risk assessment. It's standard practice, whether you are in information security, trying to protect a web site from defacement or in site security, trying to protect a nuclear power plant. So, how about an EMP? First of all, what would cause an EMP event that could cripple American society? What is EMP? What would cause it? What do we know about it? EMP, or electromagnetic pulse, is high energy electromagnetic radiation. Radio, TV, microwave, radar, all are forms of electromagnetic radiation. The devices that detect them, radios, TVs, radar receivers, detect radiation of specific frequencies with very low power. In 1958, and again in 1962, both the US and the USSR tested nuclear devices, atomic and thermonuclear, high in the atmosphere and in outer space. Among other things, the US was trying to determine if they could destroy incoming ICBMs with atomic warheads in flight. Instead, both the US and the USSR discovered EMP. When a nuclear weapon is detonated in the Ionosphere, between 10 and 1000 kilometers above the earth, about 0.1% of the energy yield is released in gamma rays with energy of 1-3 million electron Volts (MeV). The gammas collide with air molecules and strip off free electrons (Compton electrons) with energy of MeV. These electrons spiral around the Earths lines of magnetic force and generate electromagnetic radiation, with frequencies of 15 to 250 MHz. This radiation can then be picked up, or couple, with things made of metal, that act like an antenna. Metal things like electric transmission lines, the power line leading into a home, pipes that may be used as a grounding point. During Operation Starfish Prime, a 1.4 MT warhead was detonated over Johnston Island in the Pacific. The resultant EMP shorted out street lights, power lines, transformers, burglar alarms, and microwave relays in Hawaii, 800 miles away. Also in 1962, during the Soviet K nuclear test, a 300 KT warhead detonated at 290 km altitude fuzed 570 km of overhead telephone wire with 2500 A current, started a fire in a power station, and shut down 1,000 km of buried power cable between Aqmola and Almaty. The risk of damage of our modern society to EMP is much higher, for several reasons. First, our electronic devices built on semiconductors, which use much smaller amounts of power, but which can handle a much smaller overload. Second, we use many more electronic devices, personally and throughout our society, than were in use in the 1960s. So, that is the risk. What is the threat? Because without a threat, a risk remains and unexploited potential. And here is where I have a problem with some of the people warning of the EMP threat. Not that I doubt the risk. Just the probability of the exploit. For example, Michael Maloof, an advisor to the Congressional EMP Commission, in his book A Nation Forsaken, outlines an attack on the US where a missile is fired off the east coast of the US that lifts a 1 MT warhead to an altitude of 100 miles to detonation just north of Pittsburgh, causing an EMP event that destroys the grid and most electronics throughout the East Coast. This is a scenario that is quite popular in EMP post-Apocalyptic fiction, a missile or missiles from off the East or West Coasts that explodes high over portions of the US, leading to an EMP event that destroys some or all of the US grid and most electronics in the US. As Maloof writes: "All the Sabalo-type's crew needed to do was position the submarine close enough to the East Coast to get a missile with a basic nuclear warhead up and over a good portion of the U.S." My problem with this is that a 1 MT warhead is not a basic nuclear warhead. A basic nuclear warhead is a uranium or plutonium bomb, such as North Korea or Pakistan have, with a yield of 20-40 KT. It takes very sophisticated technology to produce a thermonuclear, or hydrogen, bomb. The Soviet K nuclear device was thermonuclear, at 300 KT. The Starfish Prime device, a 1.4 MT warhead, was also a hydrogen bomb, and it required a Thor missile because it was a W49 and not very miniaturized. It is popular to write of terrorists acquiring MT-class thermonuclear warheads. However, only the US, USSR, China, France and the UK are known to have produced hydrogen bombs of the 100 KT and up yield. Israel, perhaps. India and Pakistan claim to have tested tritium-boosted atomic bombs, but it is doubtful that they have produced warheads with yields of greater than 100 KT. North Korea has only tested basic atomic bombs in the 10-20 KT range. The "size" of the EMP is the amount of gammas converted to Compton electrons. The Starfish Prime event, at 1.4 MT had an output of about 0.1% gamma, or about 1.4 KT of prompt gammas, since about 0.1-0.5% of the warhead yield is converted to gamma radiation, depending on bomb design. So a basic atomic bomb, for example, a 40 KT plutonium implosion device, might generate about 0.04 KT of gammas. Unfortunately, because the US and USSR only had a limited number of atmospheric tests, with specific yields, and the electrical and electronic devices of the era had a certain hardness, compared to today, it is difficult to say what damage the EMP from a basic bomb producing 0.04 KT of gammas would do to our modern society. What is the probability that North Korea or Pakistan would let loose a basic bomb to terrorists? What is the probability that a terrorist organization could acquire a missile capable of lifting that basic bomb to an altitude of 10-100 km above the US from the East or West coast? Or the probability that a nation state that owned the two would attempt to use them in such a way against the US? I would say that the probabilities are very low. What is the cost of attempting to mitigate that threat? The Congressional EMP Commission had recommendations. I didn't find specific costs in the Executive Summary. What would be the estimated loss if such an event were to occur, however small the probability? If such an EMP event was produced, it would eliminate the grid across part of the US for years, simply due to the lead time in procuring the large transformers necessary for high-voltage transmission lines, which have lead times of more than a year. Hurricane Katrina caused an estimated $108B in damage. Loss of the grid for the East Coast for several years would be orders of magnitude greater. Simply the loss of the US Stock Exchanges, in New York and New Jersey, would create $ Trillions in losses. Prudence would dictate that the costs of mitigating such an event would be warranted, no matter the low probability of the event, given the potential loss from such an event. In today's world, the probability of a house fire has become very low. Yet the costs of a house fire are so great, that no prudent homeowner can live without homeowner's insurance. Can we afford not to purchase insurance against an EMP event, no matter how unlikely for it to occur?

Monday, September 1, 2014

Was the Cold War all a Misunderstanding? And What About Ukraine

For all of my life, which started in 1958, the depths of the cold war, it has been an article of faith that the USSR was bent on global conquest, and only the containment of the West, led by the US, preserved the fate of the free world. According to this view, Stalin was second only to Hitler in desire for lebensraum. It was this view, articulated by George Kennan to Truman, and the resulting Truman doctrine, that started the cold war and produced the nuclear arms race. But how true was this interpretation? And if we misinterpreted the USSR and Stalin, and spent the cold war and almost 50 years and uncounted trillions of dollars, what does that say about our ability to interpret the current situation in Ukraine, or our relationship with China? I am currently reading A Fiery Peace in a Cold War, Neil Sheehan's biography of Bernard Schriever. Bernard Schriever, who also hailed from San Antonio, was an Army Air Corps officer in World War II who went on in the post-war Air Force to manage the development of the US ICBM forces, which had a very rocky development. In describing the transition from ally to enemy that occurred immediately after the war, Sheehan describes the view of the world that Stalin held, as has been determined by Russian historians Vladislav Zubok and Constantine Pleshakov, who sifted through Soviet archives that became available in 1991 after the collapse of the Soviet Union. That world view and associated territorial aims are different from that which I was told all my life. Stalin was a monster. He slaughtered millions of his own people, through paranoia and sadism. But he was not an expansionist monster in the likeness of Hitler.Stalin believed the post-war world would be multipolar, with Germany and Japan regaining their strength. He believed in the triumph of Socialism-Communism, but not through conquest. Rather, he believed that the Capitalist countries, such as the US and Great Britain, would eventually compete with each other over markets and colonies. He wanted control in Eastern Europe as a buffer with Germany. In Asia, he wanted the return of southern Sakhalin that Russia lost to Japan in 1904. He wanted to control access to the Mediterranean through the Turkish straits, and he wanted to stay in Northern Iran. He had no intention of invading Western Europe, the dash to the Channel through Fulda that every American Army officer would anguish over for the next 50 years. On February 9, 1946 Stalin gave his first major speech following the end of WW II. In it, he called for a return in economic development to the prewar emphasis with three five-year plans. In his speech, he praised the anti-fascist coalition of the Soviet Union, Great Britain, America, and freedom loving peoples. George Kennan, the US charge d'affaires, responded by sending the long telegram, which set into dogma an interpretation that became the doctrinal basis for containment. I remember reading the long telegram. I remember it being quoted as reality. The long telegram stated that coexistence between the USSR and the US was impossible. Kennan saw the USSR as "committed fanatically to the belief that with US there can be no permanent modus vivendi, that it is desirable and necessary that the internal harmony of our society be disrupted, our traditional way of life destroyed, the international authority of our state be broken if Soviet power is to be secured." The long telegram argued that the Soviet Union was highly sensitive to the logic of force, and would withdraw when faced therewith. The long telegram was accepted eagerly and was widely read. George Kennan returned from Moscow and was given his own State Department planning section. His reputation was made. Meanwhile, with demobilization the US relied on its sole possession of the atomic bomb, and estimates that the USSR would take decades to produce their own. The work of the atomic spies, Klaus Fuchs and Ted Hall, would ensure that the Soviets would detonate their first atomic bomb, a copy of "Fat Man", in 1949. This became the threat driving the super, the H-bomb, and the cold war arms race was really on in earnest. If the world view outlined by the two Russian historians is true, if Stalin was not bent on world conquest, if Kennan misunderstood Stalin's Marxist-Leninist rhetoric, is it possible that the cold war didn't have to happen? Or at least not in the way it did? If we were able to misunderstand Stalin and send our country into 50 years of competition and spending for weapons of mass destruction, what does that say for our ability to understand Russia today? In America, we have this belief that we have the one true way for everything in life, that God made us unique, gave us something special. We have a tendency to travel the world and insist that everyone else be like us, become us. Yet as Americans, what's the one most important thing we want? We want to be left alone, to do things the way we want, to live our life the way we choose. Isn't it time we treated the world and other countries the way we want to be treated ourselves?