Commissioned work – Page 2

June 18, 2015

Bored of the Big Man

I wrote this article for The Economist, based on my Ugandan trip. It can be seen in the paper here.

THE buildings stormed by Israeli commandos in 1976 still stand on Entebbe airfield. Now they are joined by the occasional C-17 Globemaster of the United States Air Force, part of an American presence trying, among other things, to hunt down the Lord’s Resistance Army. Over the years, Uganda’s allies and foes have chopped and changed.

But one fact stubbornly endures: since independence from Britain in 1962, Uganda has never experienced a peaceful transition of power. In the coming year though, opponents of President Yoweri Museveni think they at last have a chance to unseat him at the ballot box.

In 1986 Uganda’s current ruling party, the National Resistance Movement (NRM), emerged victorious from a protracted civil war that had started with the ousting of Idi Amin in 1979. Mr Museveni, as the NRM’s head, has been president ever since; 80% of Ugandans have known no other leader. Many Ugandans care less about past glories than the frustrations of the present, especially over corruption, jobs and housing. But a divided opposition has provided no plausible alternative and, in any case, removing Mr Museveni through the ballot will be difficult. The NRM is woven into the fabric of Ugandan society and has a long reach. Opposition parties may continue to find it hard to compete against it, even if many Ugandans are no longer enthralled by Mr Museveni. Even so two recent events raise the possibility that an election due next year may offer a change.

On June 9th the main opposition parties and civic leaders came together to form the Democratic Alliance (DA). Similar groupings have emerged before but have failed to dent the NRM. This time lengthy consultations and a wide acceptance that only unity can lead to change have created a more resolute collaboration, says Zac Niringiye, a former Bishop of Kampala. “I do not hate Museveni,” he says, “I love him because he is a human being. But he is the source of all instability and needs to go.”

Another development is the declaration on June 15th by Amama Mbabazi, a former prime minister and chief thorn in Mr Museveni’s side, that he will fight for the NRM’s nomination as presidential candidate in place of Mr Museveni at the party’s convention on October 4th. As a leading NRM figure he hopes to win support from party members thirsting for change. But Mr Museveni knows a thing or two about holding on to power. The NRM is full of bigwigs who owe their positions to the president. Challenging from within the party is a risky strategy.

Should the NRM stick with Uganda’s longstanding president, Mr Mbabazi says he may talk to the DA. But having been at the hub of power so long, he may struggle to win over the anti-NRM vote. Whether he is the man to offer it or not, change is needed, especially at the top.
May 21, 2015

Singing like a bird

IT IS one thing to possess the ability to interfere with the avionic systems onboard an aircraft. It is quite another to announce to the world the intention of practicing such capabilities. But it takes a galactic level of stupidity, hubris or, perhaps, courage to tweet that you are going to do it when you are in seat 3A of United Airlines flight 1607, about to depart from Denver to Chicago. That is exactly what Chris Roberts, a security researcher with One World Labs, did last month:

Find myself on a 737/800, lets see Box-IFE-ICE-SATCOM, ? Shall we start playing with EICAS messages? “PASS OXYGEN ON” Anyone ? 🙂

The tweet in question (above) suggests Mr Roberts intended to interfere with the Engine Indication Crew Alerting System (EICAS), which informs crew when something goes amiss with a plane’s engine. Or perhaps he wanted to deploy the passenger oxygen masks. Unsurprisingly, he is now helping the FBI with their enquiries. His actions have animated the debate about so-called “cyberjacking”—the ability to take control of aircraft remotely, or at least interfere with aircraft systems for malicious gain. How seriously should such claims be taken?

Mr Roberts maintains his intention was to raise awareness of security vulnerabilities. The FBI says Mr Roberts had identified a weakness with the in-flight entertainment (IFE) systems on Boeing 737-800, 737-900, 757-200 and Airbus A-320 aircraft. It is thought he accessed the systems by plugging a laptop into one of the electronic boxes usually found under the seats either side of the aisle. Once connected, Mr Roberts claims to have accessed other systems on the aircraft. He admits to having issued a “CLB”, or climb command, to the thrust management computer on a previous flight, resulting in a “lateral or sideways movement of the plane”.

Industry experts are sceptical of such claims but admit it is theoretically possible. As the data bus for the IFE is not also used for communications or flight systems, at best Mr Roberts may have seen interference between the two systems, says David Stupples, professor of electronics and radio systems at City University in London. Data packets travelling on copper wires (common in older aircraft) may allow some messages to be seen, but probably only the meta-data, such as the origin and destination of the message, rather than the content itself, which is encrypted. The fibre optic architecture of modern aircraft will not suffer similarly. And anyway, to change an aircraft’s direction Mr Roberts would have had to persuade it that he was the satellite navigation system. That entails spoofing the signals from up to 16 satellites at a time; a tall order suggests Mr Stupples.

There is no room for complacency, however. Last month, the United States Government Accountability Office (GAO) raised concerns over plans to replace the current radar-based air-traffic control with one based on satellite navigation and automation. In a report, it warned that with increased reliance on the internet “unauthorised individuals might access and compromise aircraft avionics systems” and that cyber-based threats present “significant security control weaknesses”.

The industry is acting. Airbus, for example, is working with Cranfield University in Britain to mitigate the risk. One idea is to have a preset “safe state” for each stage of flight, which the aircraft will adopt in the event of system anomalies being discovered. (In the recent Germanwings tragedy, such a system might have decided that descending over mountainous terrain with no immediate airfield available was so odd as to be countermanded.) Another solution is for all flight safety systems to be triplicated and operated on a “voting” system, meaning any malicious software would need to affect at least two systems.

All of which points to how difficult the concept of cyberjacking is. Industry experts and the GAO report suggest the threat of a disgruntled employee infecting the aircraft systems prior to flight (say, during routine maintenance) is more likely. The possibility of hackers taking control of aircraft, while real, should not be overblown. But for one man it has already been costly. Twelve days after his initial tweet, Mr Roberts followed it with one reading:

United have cancelled ALL my trips…and my daughters…and no refund on the Air Miles..goodbye 100,000 Miles so it seems…

This post was commissioned by The Economist
May 3, 2015

Walking on water

IN 1983 Christo surrounded 11 islands in Biscayne Bay, off Miami, with 600,000 square metres (6.5m square feet) of luminous pink fabric. The installation, called “Surrounded Islands”, was completely removed after two weeks. On one morning of its brief existence an elderly woman entered the project’s main office. She was livid. “It looks like you’ve emptied a bottle of Pepto-Bismol into the bay!” she raged. That afternoon an elderly man walked in and asked who was responsible for the project. After the morning’s experience Christo was nervous, but still introduced himself. “It’s fantastic,” the man said. “It looks like you’ve emptied a bottle of Pepto-Bismol into the bay!”

Christo, born Christo Javacheff in Bulgaria, delights in the story. He marvels at art’s ability to provoke such emotion and at how perceptions can differ so markedly. He hopes his latest project, “The Floating Piers”, which is planned for a 16-day stint next summer, on Lake Iseo in northern Italy, will stir similar passions.

“The Floating Piers” will be a series of golden walkways connecting Sulzano on the mainland to the islands of Monte Isola and San Paolo. Christo says his intention is to create a beautiful, temporary work of art. Temporariness is important to him, he says, for containing an aesthetic quality he calls the “presence of the missing”.

The project will be Christo’s first big work for ten years, and the first since the death of his wife and collaborator, Jeanne-Claude in 2009. Built of 200,000 specially designed polyethylene cubes normally used in the yachting industry for pontoons, the 16 metre-wide piers will float on the lake. Fastened to the lake floor every 50m, with anchors up to 90m deep and some weighing 7 tons, it is an ambitious vision. Sloping, unfenced sides will allow boats to ride up onto the piers so promenaders can alight. The cubes will be covered with 70,000 square metres of fabric: three kilometres of yellow road will move on the water; another 1.5km will flow through the tight pedestrian streets in Sulzano and Peschiera Maraglio. The contrast of the gentle fluidity on the water and the sturdy presence of the land will be sexy, says the artist.

The project is expected to cost $10m, which Christo will fund through the sales of sketches of the plans, scale models and past works. He does not balk at the cost. “These projects are our children,” he says. “Do you have a budget for your children?” He refuses commissions and sponsorship so as to remain in control.

A Harvard Business School report from 2006, looking at the way Christo and Jeanne-Claude fund their work, cited “illiquidity, uncertain valuations and faddishness” as reasons banks often avoid lending for arts. For “The Gates” (2005), which went up in New York’s Central Park, Bank Leu, then a subsidiary of Credit Suisse, provided Christo with a credit facility of $10m, and held $60m-worth of his works as collateral. In return, Christo paid an annual fee of $10,000, 1% of the unused credit, and 1% plus LIBOR (the rate banks charge for lending to other banks) of the credit used. Such a business model is rarely seen in the art world, but its unconventionality was in keeping with the work. And it certainly delivered: the estimated 4m visitors who saw “The Gates” brought in around $250m for New York City. It is a lesson not lost on the Italian government.

It took only a year to get permission for “The Floating Piers”; some of Christo’s projects have needed decades. “Wrapped Reichstag” (1995), which covered the German parliament building in silver fabric for two weeks, took 24 years to come to fruition. It was only made possible when the-then Chancellor, Helmut Kohl, horrified at the concept, put the decision to a vote in the Reichstag. He lost.

Operating at a scale that will inevitably draw opposition from some aggrieved party, political or otherwise, is one thing. To do it repeatedly, viewing the conflict and frustration as part of the art, invites the suggestion that Christo actually enjoys the confrontation. He denies it. But when asked about Jeanne-Claude, he says she was “a ferocious critic, and I miss this all the time.”

This article was commissioned by The Economist
April 20, 2015

Dirty rotten scoundrels

To be remembered as a truly sinister villain it’s all in the marketing. A memorable name is a must; preferably ironic or cropped from the rarely frequented areas of the keyboard and even better when combined with the definite article or an umlaut. Angel Eyes, The Mekon and Keyser Söze all fit the bill nicely. Even Sauron has a nice ring to it.

So I was disappointed to read that the biggest zero-day villain in 2014 was called CVE-2013-7331. Hmmmm, can’t quite hear James Bond saying “that’s a Smith and Wesson, CVE-2013-7331, and you’ve had your six.”

Zero-day attacks are aimed at operating system or software vulnerabilities for which there is no remedy when they first strike; i.e. the community of internet security vendors has had ‘zero days’ to prepare a response. They have given rise to an alarmingly competitive culture among cybercriminals. For example, each month hackers race to be the first to compromise Microsoft’s regular security updates on Patch Tuesday (the second Tuesday in each month). Security experts have even coined the term ‘Zero-day Wednesday’ as a result, as this internet security company notes.

But in Symantec’s annual internet security report, released this month, 24 zero-day attacks made 2014 the worst year on record for internet vulnerability. (The chief villain named above had 2013 in the Common Vulnerabilities and Exposure designation as it was discovered in 2013 but not disclosed to the public until the following year.) In total, Symantec says the top five zero-day attacks took 295 days to patch, with the average being 59 days. That means a lot of systems were exposed for a very long time. The cat-and-mouse nature of Patch Tuesday and Zero-day Wednesday is, therefore, no laughing matter.

Possibly of greater concern though, is that many cybercriminals have seemingly adjusted their tactics in light of automated patch deployments. In keeping with these days of austerity, Symantec suggests hackers have gone back to basics: attacking networks not for immediate effect, but to gather intelligence for future exploitation. To do so they are increasingly looking for vulnerabilities in old software (that may have been reused in new applications) and at the very architecture of the internet itself.

What does the internet look like? Opinions vary, from President Obama’s recent description of “the wild, wild West” to the oft-mentioned ‘super highway’. But my favourite analogy comes from The Baffler which compares the internet to a hot tub: “A hot tub, after all, is shared with friends and strangers, whose warm water swirls around you, lulling you into complacency while silently transmitting disease”.

So, not an impenetrable fortress then, where all one needs do is occasionally replace a few bricks and keep the drawbridge in the upright position. Many like to think of the internet as a coherent and secure entity. Look at how we talk of ‘downloading’ from or ‘uploading’ to the internet, as if it hovers over us like an omnipotent safety blanket. But the reality is different.

Craig Rice, Head of Security at the Payments Council, which represents the payments industry in the UK, sees the internet as an architectural hodge-podge. He describes an ecosystem growing incrementally with no overall design, control or predictable direction. Rather than bricks, it is better to think of it as having been made from wool he says, and therefore very easy for malicious actors to find ways through and around patches. As Tim Gallo of Symantec says: “We need to better understand that the fabric of the internet is riddled with holes.”

Game over? Not quite. All the villains listed above eventually came a cropper, even the nattily titled CVE-2013-7331 was patched after 204 days. There are some easily implemented measures to prepare for and mitigate attacks. For example, the United States Cyber Consequences Unit offers some simple advice on laptop security when travelling abroad, so as to minimise exposure overseas and lessen the risk of bringing home a nasty.

The starting point is to consider our own exposure. What does our network look like? How big is the fixed infrastructure, let alone mobile devices? Are we using software that is no longer supported? How will we know when we’ve been breached and who should we then call? The governments of the United States and United Kingdom recently announced a series of cyber war games to test each other’s defences. Perhaps it’s better to hear the scary news from a friend before You Know Who comes calling.

This post was commissioned by XQ Digital Resilience
March 14, 2015

High Noon for cyber complacency

Imagine standing next to a railway track and seeing a runaway carriage hurtling down the line towards a group of ten workers. Oblivious to the danger, they will certainly be killed unless the train is diverted onto another track. Luckily, next to you is the lever controlling a set of points that can make this happen. But on the adjacent line is a single worker, also unaware of the danger, who will die as a result of your action. Do you intervene, thereby condemning the individual but saving the greater number of workers? Or allow fate to run its course and kill the ten?

This ethical dilemma is widely used to generate debate about morals, priorities and personal responsibility. Although not an exact analogy, I was reminded of it when reading the report by the UK’s Intelligence and Security Committee (ISC) of Parliament titled ‘Privacy and Security: A modern and transparent legal framework’, released on March 12^th.

The report followed an 18-month inquiry, launched following the revelations by Edward Snowden, the former contractor for America’s National Security Agency and now living in exile in Russia. It found the UK intelligence agencies act lawfully and said the bulk collection of data by the government is neither mass surveillance nor a threat to individual privacy. Civil libertarians vehemently disagreed (so too commentators – scroll down at this Guardian link), with Shami Chakrabarti, director of Liberty, describing the ISC as “a simple mouthpiece for the spooks”.

But the ethical debate around cyber security and privacy is an interesting one. The report included exchanges between the ISC and representatives of three groups: Liberty, Justice and Big Brother watch. They suggested that terror attacks were “the price you pay to live in a free society”. It was at this point I found myself next to the train tracks with the control lever in my hand.

But the report also criticised the government’s cyber architecture. Piecemeal growth and sticking-plaster problem solving has led to a complicated and unfathomable legal and technical framework. Mistakes had been made, with consequences for individuals, and an accompanying document, the Report of the Interception of Communications Commissioner said that one employee of GCHQ (Britain’s cyber intelligence agency) had been sacked for unauthorised use of the systems.

The difficulty, as Professor John Naughton, a Cambridge University fellow, told the committee, is that the government essentially has to ask the public to “trust us”. But in the cyber security business, life is rarely that easy.

Who, exactly, should owners and operators of cyber networks trust? I can change a tyre on my car and could probably fill the screen wash after a Google-search and a bit of practice, but I rely on, and trust, the garage for an annual service. Where are the garages in cyber space? And where are the Haynes manuals?

A recent article in Forbes suggests we should not listen to those proclaiming “trust us” in cyber space and that the responsibility instead lies with us. There are no magic fixes, no silver-bullets, but there are, perhaps a few snake oil-salesmen for those unable or unwilling to take responsibility for their own systems. Rather than relying on external cyber security standards or products, it is the process by which a healthy and well-protected online presence is achieved that is important. Every business and every system is different. Sure, there are similarities and overlaps in some areas, but holistic security solutions cannot be outsourced. That process of taking ownership and thinking about cyber security starts with the CEO.

And CEO’s don’t get much bigger than President Obama. Speaking at the White House Cybersecurity Summit at Stanford University on February 13^th he said: “it is one of the great paradoxes of our time that the very technologies that empower us to do great good can also be used to undermine us and inflict great harm.”

There are many challenges in cyberspace: ethical, technical and legal to name just three. But the route to credible solutions starts with ownership and leadership. “The cyber world is sort of the wild, wild West,” suggested President Obama, “and to some degree, we’re asked to be the sheriff.”

This post was commissioned by XQ Digital Resilience.