back to article Bruce Schneier: We're sleepwalking towards digital disaster and are too dumb to stop

Security guru Bruce Schneier has issued a stark warning to the RSA 2016 conference – get smart or face a whole world of trouble. The level of interconnectedness of the world's technology is increasing daily, he said, and is becoming a world-sized web – which he acknowledged was a horrible term – made up of sensors, distributed …

Page:

  1. Anonymous Coward
    Anonymous Coward

    It's gonna be difficult...

    ...telling people that they can't have a cheap internet connected aircon.

    "I do not believe regulators alone are up to the task – we all need to get involved."

    That isn't going to work. Whilst a few people and companies who understand it will get together, there will always be those retailers and importers who don't give a damn and will sell the cheapest what-not anyway, thinking that it'll never be their problem. And because we have 'free trade' there's not a lot anyone can do about it.

    It needs a serious re-think of the whole thing (trade, network design, identity management, regulations).

    The only thing that can actually force an improvement in the situation is changes in the laws. But laws only come about as a result of legislators getting their act together on this matter. They don't really understand the problem (not their fault, not many of them have engineering backgrounds), and it will only be after some severe event that they will be fully motivated to act.

    It's one thing to get some research money out of the government, but it's a whole other thing to persuade them to ban importation of non-compliant goods from abroad, decide what 'compliant' means anyway, throw away large chunks of the Internet as we know it, implant all the world's people with ID chips at birth and mandate basic system designs rules.

    1. Anonymous Coward
      Anonymous Coward

      Re: It's gonna be difficult...

      A number of UK eBay suppliers sell wireless door chimes that are on 315mhz rather than 433mhz. IIRC the former is not a legal use in the UK.

      1. harmjschoonhoven
        Headmaster

        Re: It's gonna be difficult...

        A number of UK eBay suppliers sell wireless door chimes that are on 315mhz MHz rather than 433mhz MHz. IIRC the former is not a legal use in the UK.

        FTFY.

    2. Anonymous Coward
      Anonymous Coward

      @AC - Re: It's gonna be difficult...

      Actually those retailers and importers are right, it's not their problem. They're doing business, they're not a charity to care for something that is non-profit related.

      1. bazza Silver badge

        Re: @AC - It's gonna be difficult...

        "Actually those retailers and importers are right, it's not their problem. They're doing business, they're not a charity to care for something that is non-profit related."

        Er, it is their problem if they get caught doing it. The trouble is that the trade arrangements we have these days assume that manufacturers and traders are trustworthy, but there's very little going on to check up on them. With no real chance of being caught, the greedier types get away with it. A CE badge is meant to mean something but in practice it doesn't.

        Looking at the debacle over hoverboards one wonders whether anyone anywhere cares about product standards compliance at all.

        1. Measurer

          Re: @AC - It's gonna be difficult...

          I do.... (the poor Machinery electrical engineer whimpers from under the weighty tomes of EN 13849-1, EN 62061 and EN 61508).

    3. gnufrontier

      Re: It's gonna be difficult...

      Laws do not protect you from law breakers and there is a certain percentage of those based on population size when things are going well and a larger percentage when things are going not so well.

      One may as well be sacrificing virgins to the moon god for all the good laws are going to do for you.

      Why is that the belief persists that a rule written on a piece of paper has some kind of magic power over all human beings ? We are talking about rules written by humans here and not some narrative about an omniscient and omnipotent being that hands out rules written on stone which aren't followed either by the way.

      If that is what you are wrapping yourself in to keep out the chill then be prepared to shiver under that ragged blanket.

      1. Anonymous Coward
        Anonymous Coward

        Re: It's gonna be difficult...

        "Why is that the belief persists that a rule written on a piece of paper has some kind of magic power over all human beings ? We are talking about rules written by humans here and not some narrative about an omniscient and omnipotent being that hands out rules written on stone which aren't followed either by the way."

        Because, in case you didn't know, there's people whose job it is to prevent bad things happening. They're called the Police.

        There's whole laws with words like "conspiracy to commit" in them. They are there so that if a jury is sure that the evidence indicates that an individual was planning an illegal act, they can be locked up before they do it, not afterwards.

        If you don't have laws like that you'd have the absurd situation where it would be illegal to prevent someone carry out a burglary, terrorist attack, fraud, etc.

      2. Nigel 11

        Re: It's gonna be difficult...

        Laws do not protect you from law breakers

        Depends on what sort of laws.

        Laws that criminalize (say) ignoring safety and financial regulations will work, if the penalty is stiff enough. Nobody in VW would have authorized the cheat devices if the penalty once discovered was certain to be jail time. Bankers would probably not have created the recent financial crisis, if the penalty would have involved sequestration of all personal wealth howsoever acquired on top of certain jail time. They saw it as "heads I win, tails you lose" and in many cases they were not actually breaking the then-existing law, just working in dark grey zones of arguable legality but total amorality.

        And of course, laws and regulations that impose safety or financial regulations are in general followed by the law-abiding majority, at least if people can see that there is a modicum of sense behind them. So company accounts are audited, electrical products and cars are rarely unsafe, food no longer contains untested and undisclosed additives.

        In case you are bristling about unwarranted regulations, there needs to be a mechanism for striking down regulations that have outlived their usefulness (and a lot of EU nonsense that had no useful purpose in the first place. In what way will reducing the maximum power of a kettle save energy? The amount of energy needed to raise the temperature of a litre of water from A to B is a physical constant. Worse, if it takes longer to boil, more energy will leak out of the kettle. Idiots! )

        1. Richard Simpson

          Re: It's gonna be difficult...

          Can you explain exactly where you saw the regulation about reducing the power of kettles. An actual link would be useful. Last time (it was about a year ago) there was an EU study into proposed energy saving measures I took the trouble to look at the bit about kettles. It proposed two solutions:

          1) Better insulation.

          2) Far more effective 'auto switch off when it boils' mechanism that work promptly when the kettle is new and don't get steadily less effective as it ages.

          Both struck me as being quite sensible. Of course, you are going to ask me for a link to the study I am referencing and that could take a while to find.

      3. Anonymous Blowhard

        Re: It's gonna be difficult...

        "Laws do not protect you from law breakers"

        No they are intended to establish a framework for society to get on with things.

        I think the legal context that's being discussed here isn't the "make hacking illegal" type of law, it's more like "make system suppliers more liable for their products so they'll make them better".

        We already do this with lots of safety critical equipment containing software (cars, planes ships etc.) so there's no reason we can't legislate for certain kinds of systems to follow similar guidelines.

        OK, as an example, you might put the price of electricity up by a small amount, but you'd be doing this with the aim of making the electricity supply more robust.

        Also, if this is a defence issue, then divert part of the defence budget to securing critical systems; maybe spend less on spying on the public in a vain attempt to anticipate an attack, and spend more on securing systems so an attack is harder to accomplish and can do less real-world damage.

      4. Kurt Meyer

        Re: It's gonna be difficult...

        @gnufrontier

        I'll confess that I completely failed to spot your suggested alternative.

      5. Anonymous Coward
        Anonymous Coward

        Re: It's gonna be difficult...

        "One may as well be sacrificing virgins to the moon god for all the good laws are going to do for you."

        Law creates the concepts of 'property' and 'ownership' which have some advantages in terms of encouraging sustained activity towards long-term goals.

        In other words: you won't get much done if you spend all your time protecting what you fondly imagine to be 'yours'.

        1. Triggerfish

          Re: It's gonna be difficult... 315Mhz

          Hi just curious what is 315Mhz used for? Did have a google but could not see anything quickly that explained it.

          Did find an interesting thread though about cheap firing systems for fireworks on a UK forum from ebay that also use 315Mhz. Does that mean there are going to be some surprised* people in November.

          *possibly briefly

      6. Paul 195

        Re: It's gonna be difficult...

        "Laws do not protect you from lawbreakers"? The laws on their own might not, but you back those laws up with enforcement, so that they are more than just rules written on a piece of paper. If you are sure laws make no difference, try living somewhere like Somalia where government has effectively broken down. Good legislation (yes, there is bad legislation too) demonstrably makes our lives safer and better. And we aren't just talking about protection from criminals, legislation on things like safety standards clearly protects everyone by making it possible to take dangerous products off the market and fine the people selling them. This model has been working reasonably well for a long time now, and is one reason why you stand a good chance of not being electrocuted by your toaster.

    4. John H Woods

      Re: It's gonna be difficult...

      AC says: "not their fault, not many of them have engineering backgrounds"

      Sorry but I disagree entirely. Most engineers, if tasked with learning relevant parts of national law; company procedures; business modelling; or technology currently outwith our experience, would simply settle down to learn what they could about it. Where they still didn't understand, they would identify someone who could advise, and ask them.

      Nobody is asking legislators to know about Yagi antennas, microwave propagation, packet level protocols, database schemas, etc. Not having an engineering background must not be considered a be-all-and-end-all excuse for refusing to come to grips with matters for which one is responsible. We expect legislators to be able to consider medicolegal affairs without having a medical (or legal) background; social affairs without psychological qualifications; transport and infrastructure without civil engineering knowledge.

      It is perfectly reasonable to expect legislators to be able to learn, to be able to consult, to be able to listen. The apparent fact that many of them can't means that they are unfit for their roles; no excuses.

      PS: and yes, I would say the same applies to managers.

  2. Destroy All Monsters Silver badge
    Holmes

    Vernor Vinge wrote about this

    Takeover of crappy IoT civilization from orbiting alien spaceship via leet haxx.

    No problemo!

    1. Rich 11 Silver badge

      Re: Vernor Vinge wrote about this

      And presumably the aliens will use their equivalent of a Mac to do so.

      1. DropBear

        Re: Vernor Vinge wrote about this

        "And presumably the aliens will use their equivalent of a Mac to do so."

        They'll use whatever they have at hand - historical documents like Independence Day taught us that viruses (and animated GIFs) transcend petty, fluffy stuff like hardware architectures and instructions sets. You could easily hack a Nest if you wanted with nothing but an alien comm badge, surely...

  3. Scoular

    Do governments care anyway

    Or are they likely to be happy to have another way to gather information on their own people whilst also exposing them to attack by others. Politicians are woefully ignorant and happy to stay that way as it lets them hold absurd beliefs comfortably.

    I suspect governments want systems as leaky as possible in the belief that if they only have a little more information all problems will be solved. Those iPhones for example.

  4. Salts

    Hmmm...

    UK Politicians please take note

    "Historically we are bad at defending against threats and very good at panicking about them," he said. "Panic is more dangerous to liberty than the threats themselves."

    1. Destroy All Monsters Silver badge

      Re: Hmmm...

      Those "panics" are generally skillfully engineered.

      1. Anonymous Coward
        Anonymous Coward

        Re: Hmmm...

        Those "panics" are generally skillfully engineered.

        Given the (thankfully) low rate of successful terrorist attacks in the UK, exactly what 'panics' are you referring to?

        If you're referring to the new snooper's charter, you could hardly accuse them of putting it to Parliament in the teeth of a mass panic. Fortunately there isn't one happening at the moment. At least they're asking MPs to consider (if only briefly) the matter with clear-ish heads instead of exploiting the inevitable reactionism that would prevail in the aftermath of an atrocity such as Paris suffered recently.

        1. Graham Marsden

          @AC - Re: Hmmm...

          > exactly what 'panics' are you referring to?

          The sort being engineered by the Sir Humphreys of this world.

          Damnit, man, don't you know we're facing Padeo/Terror/Drug/Crime-ageddon and the only way to deal with them is to snoop on everyone's internet activity!

          1. Anonymous Coward
            Anonymous Coward

            Re: @AC - Hmmm...

            "The sort being engineered by the Sir Humphreys of this world.

            Damnit, man, don't you know we're facing Padeo/Terror/Drug/Crime-ageddon and the only way to deal with them is to snoop on everyone's internet activity!"

            I'm not sure how much of a 'geddon it is yet, but I think we'd all prefer there to be less of that kind of thing going on.

            Besides, if they're beginning to panic over it then maybe we should start worrying... Sir Humphrey probably has a T shirt with "if you see me running for the hills, try to keep up" on the back.

            1. Charlie Clark Silver badge
              FAIL

              Re: @AC - Hmmm...

              I'm not sure how much of a 'geddon it is yet, but I think we'd all prefer there to be less of that kind of thing going on.

              This is straight from the major! Where's the Monty Python icon?

              10 points to your team for demonstrating an appropriate response to engineered panic! Have a copy of the Brass Eye Paedophilia Special for your troubles. Better order some filing cabinets for your kids!

            2. dajames Silver badge

              Re: @AC - Hmmm...

              Sir Humphrey probably has a T shirt with "if you see me running for the hills, try to keep up" on the back.

              Sir Humphrey in a T shirt? That certainly could be taken as a sign of the end of civilization as we know it!

          2. KeithR

            Re: @AC - Hmmm...

            "The sort being engineered by the Sir Humphreys of this world.

            Damnit, man, don't you know we're facing Padeo/Terror/Drug/Crime-ageddon and the only way to deal with them is to snoop on everyone's internet activity!"

            You seem to be confusing Civil Servants with the Daily Mail.

            They're not the same.

            1. Graham Marsden

              @KeithR - Re: @AC - Hmmm...

              > You seem to be confusing Civil Servants with the Daily Mail. They're not the same.

              No, but the DM et al can be counted on to uncritically repeat press releases or stories from "sources" and add their own -ageddon spin to them...

            2. Anonymous Coward
              Flame

              Re: @AC - Hmmm...

              No, the Senior Civil Service is to a man (v few women) Daily Mailites

        2. Eddy Ito

          Re: Hmmm...

          exactly what 'panics' are you referring to?

          Now there's a problem. People don't even know when they're supposed to panic even after we've put all these fancy schemes in place. I mean it's right there at the top right corner of the page. Let me save you the time "Current UK threat level: SEVERE". Those of us on the other side of the pond it's here and enjoy your "Elevated Condition (Yellow)" day.

          Perhaps we'll have to have a nice talk with the two agencies about instituting a nice 300x100 animated GIF that flashes the days threat level. Yes, that'll be much better.

        3. Anonymous Coward
          Anonymous Coward

          Re: you could hardly accuse them of putting it to Parliament in the teeth of a mass panic

          No. But you could easily accuse them of putting it to parliament whilst the government is in the throes of a euro-sceptic split, large proportions of the press are claiming that economic migrants are after our jobs and a mentalist is heading towards the white house. They've definitely tried to minimise the amount of scrutiny it's getting....

      2. Anonymous Coward
        Anonymous Coward

        Re: Hmmm...

        See: disaster capitalism

      3. LDS Silver badge

        Re: Hmmm...

        No, they are not. They are not so skillful. But they are good at exploiting situations.

      4. amanfromMars 1 Silver badge

        Hmmm... Sow the Seed, Reap the Whirlwind?

        Those "panics" are generally skillfully engineered. .... DestroyAllMonsters

        Ideally be they skilfully engineered, DAM, but generally they be nothing short of a catastrophe in planning/foresight and afterthought ........ http://www.zerohedge.com/news/2016-03-02/striking-admission-former-bank-england-head-european-depression-was-deliberate-act

        And to imagine and realise that media and governments hang on to and laud their every uttered word as if scared and gospel, tells you everything you need to know about the depth and spread of the absurdity and insanity.

        Madness and mayhem is the norm in their shell end game and it is beautifully destroying them at an exponential rate these cloudy days, and there is nothing to be done about it with Remote IT Command and Virtual Space Control without Creative Cyber Command and AI Control in Virtual Machine Systems ....... and quite whether such is to be made readily available to corrupt and perverted systems to save such systems admins and exclusive executive elites is ...... well, at least a gazillion dollar question, for it will be expensive and not at all cheap.

  5. asdf

    bravo

    >"Historically we are bad at defending against threats and very good at panicking about them," he said. "Panic is more dangerous to liberty than the threats themselves."

    I tend to think of Bruce more as a hack but bravo for saying this. Of course IIRC Heinlein said something similar many decades ago but that is remarkably often the case. Also calls to mind that asshat of the first order Tommy Franks saying if we had another terrorist attack we might have to get rid of the constitution.

    1. Lapun Mankimasta

      Re: another terrorist attack we might have to get rid of the constitution

      So? If I don't get the milk on my cornflakes exactly the right temperature and colour, we WILL have to get rid of the constipation - oops, I meant constitution. Terrorist attacks are nothing compared to getting milk on cornflakes exactly right. Even Silicone Valley agrees - a decade ago there was an ad on Slashdot with a couple of Silicone Valleyites complaining about "Warm Balls" - oops, that's meant to read "Warm Bawls" ... truly tragic, judging from their expressions!

    2. Charlie Clark Silver badge

      Re: bravo

      And Benjamin Franklin said "He who would trade liberty for some temporary security, deserves neither liberty nor security".

      I'm sure Cicero and Socrates said something similar. And yet…

      1. DropBear
        Facepalm

        Re: bravo

        "And Benjamin Franklin said..."

        Heeeeey, that was supposed to be a warning, not a sentence...!

  6. allthecoolshortnamesweretaken

    "...and it will only be after some severe event that they will be fully motivated to act..."

    As usual, because sadly such is human nature. Every safety regulation, every law, etc. was written because at one point something went wrong and did so with a large enough impact to provoke a something-must-be-done-about-it reaction.

    So, what will be the event that will wake up enough people to this problem?

    1. asdf

      Hacks aside at some point we are due for another Carrington event and if it seriously screwed up 1860ish technology it will screw us over like no rogue nation can. Its is already possible for our electrical grid to be shutdown for up to 18 months (by destroying right infrastructure). The lights being on are not as certain a thing as the sun rising like some may believe.

      1. Sir Runcible Spoon
        Black Helicopters

        If we assume that nothing will happen until there is a disaster, and that legislation will be rushed through with all sorts of unintended* consequences, then perhaps the sensible thing to do would be to draft up some legislation now and present it to the knee-jerkers later.

        Of course, that this has already happened should tell you a lot about the power behind the throne.

        *yeah, right.

      2. Nigel 11

        we are due for another Carrington event and if it seriously screwed up 1860ish technology it will screw us over like no rogue nation can.

        Wrong.

        The threat is that a Carrington event induces what is effectively a high-power DC signal in transmission lines. It's worst for long ones, over 100km, with low impedance.

        Back then data-transmission used copper wire and DC coupling to make a telegraph. The wires glowed erd-hot and shocked the operators and in places burned out. Today, long-distance datacomms is optical fibre. Telephone wires are rarely if ever long enough to get affected and I don't think a telephone offers a low-impedance path these days. Things have moved on since the days of bakelite boxes with electromechanical ringers.

        The greater threat is to the power grid which is intended to carry 50 or 60 Hz AC. The power transformers through which it is coupled cannot cope with high power DC inputs and might burst into flames. Back in the 1950s we were terribly vulnerable(*) because the threat was not well known and there would have neen absolutely no advance warning.

        Today, we have satellites watching the sun and so electricity utilities have an early-warning system. (about 15 minutes, but a lot better than nothing). Also the threat is understood and I hope that there are last-resort protection systems in place on the transformers connecting the long grid cables to monitor DC currents and internal temperature, that will disconnect from the grid if necessary to save the transformer.

        So the result ought to be somewhere between a controlled shutdown of the national grids, and a cascading power failure caused by automatic protection systems triggering in an unplanned manner. A blackout is no fun, but it has happened several times (for other reasons such as carbonized squirrels) on the USA Eastern seaboard. Civilisation didn't collapse. A few hours to a day later when the event is over, they'll reconnect the grid to the power stations.

        Move on a couple more decades, and the long-distance AC electricity grid will start to go the same way as the telegraph. It's more efficient to transmit power as high-voltage DC, and the technology of AC-DC-AC conversion is rapidly falling in cost. What was once impossible, then too expensive to use except on submarine grid links, will soon become the norm for any long-distance grid link. With a DC link, a Carrington event would just either add or subtract a small amount of energy compared to what is being transmitted. There would then no longer be a need to create a short-term blackout to save civilisation.

        (*) I'd speculate, not actually on the edge of losing 20th century civilisation. The big transformers would have different times to catastrophic failure. As soon as the first one or two exploded all hell would have broken loose with the AC power they were transmitting, and ordinary AC overload protection systems would have cut in creating a cascade failure blackout but saving enough of the grid for life to go on fairly normally th next day. I'm glad it was never put to the test, though!

        1. Anonymous Coward
          Anonymous Coward

          Or we could just really worry about a nearby (ish) magnetar.....

          1. asdf

            Actually the next thing to really fug over the US will probably be Mount Rainier. The Yellowstone caldera has been a bit too quiet the last half million years as well.

        2. asdf

          Yeah the grid may be ok except for the short term but if it took out a good portion of the satellites including say GPS that might actually be more disruptive. I just know our susceptibility to EMP (what massive solar flare would basically be) is greater today than any time in the past. If we got hit by a Carrington level event I have a strong feeling that people won't be comparing its effects to that piddly blackout in 2003. Civilization ender no but without much recent historical precedent either.

  7. John 104
    Stop

    Stop Now

    Stop saying World-Sized Web. Now. Seriously. It's awful. We already have the World Wide Web, I think that is a sufficient descriptor.

  8. Graham Marsden

    "The problem is in the design..."

    Whilst I don't disagree with Bruce Schneier, when he says this and "People are fairly good at predicting where technology is going, but have a very poor record at predicting the knock-on social effects", surely the problem is that nobody knows (or *can* know) where this stuff is going.

    History is littered with innumerable examples of a technology with one purpose having a completely unexpected effect on something which you'd have thought was totally unconnected, yet, because of that effect, the world has changed.

    Yes, of course, we should design security and safety into such systems, but predicting what they may lead to is another matter entirely.

    1. Ole Juul

      Re: "The problem is in the design..."

      Yes indeed, history is littered with innumerable examples. So when Schneier says:

      For example, everyone understood that the invention of the car allowed humans to travel farther and faster than before, but no one predicted the rise of suburban living and the consequent issues that caused.

      he is not quite accurate. I've seen examples of high density (for the time) neighbourhoods constructed by developers just "outside" town because the bicycle made it attractive to live further out and work "downtown". It's not really a matter of examples, but rather the will to look at them.

    2. dan1980

      Re: "The problem is in the design..."

      Perhaps another point to note is that both governments and companies find panic a very useful tool to further their ends (increased powers/profile and profits respectively).

      History is also littered with governments and politicians that have created, amplified or seized panic (or all three) to obtain more control over the populace or to further their political aspiriations, as it is with companies that have done exactly the same to push a product.

      The recent Ebola meltdown in the US is a good example of both.

      Both sides exploited the scare to present themselves as tough and able to protect the people - for example the detestable detainment of a nurse by Chris Christie; to push their agendas - e.g. border control and immigration; or to simply bash their opponents - declaring, for instance, as the Dems did, that Rep cuts have harmed the CDC and make the US more vulnerable.

      On the commercial front, Lysol purchased the top ad-spot on Google for searches on 'Ebola' in order to hock its disinfectant products.

Page:

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Biting the hand that feeds IT © 1998–2022