collaboration

Interview with Tim Stevens, author of ubiwar - conflict in n dimensions

Tim Stevens, author of ubiwar, has been kind enough to answer some questions for me concerning cyber conflict in our contemporary virtual space.  Mr. Stevens is a PhD candidate at King's College in London researching institutional responses to cyber threats, particularly in the field of cyber strategy.  His related research interests include the political use of cyberspace, social technologies, violence in virtual worlds, and the nature of the technological accident.  I thought this would be an interesting opportunity to coalesce and discuss our respective areas of study.
 
Q: Do you have any thoughts on how the fusion of social media, location-based technologies, and real-time information may shape the context of cyber conflict in years to come?
 
A: I think your recent post addressed this question very well. My general position is that all things are possible, but most things are improbable. When I started Ubiwar, it was to look at how people exploited technological niches in pursuit of political ends, principally through the application of violence. I see that David Kilcullen has just characterised counterinsurgency as "a battle for adaption...against an enemy who is evolving." This is a position with which I have a great deal of sympathy. As a battle for adaption, it follows for Kilcullen that COIN cannot really be strategic, and scholars of 'change' would generally agree with this. I'm also skeptical of the strategic impact of information technologies - what 'Twitter Revolution'?
 
What I'm getting to is that tactical and operational use of information technologies is a massively adaptive field and people are experimental animals. Humans are hackers, and hacking is one way of achieving success in any environment. ICTs offer myriad opportunities for exploitation by a range of actors for a wide range of strategic ends. The fusion you ask about is what others would call convergence. Technologies converge spatially and temporally, always have done. The difference now is that the temporal element has been reduced to effectively zero, as you point out, which similarly collapses space, resulting what you could call a non-locative cyberspace. If you think of 'cyber' as command-and-control, then we all have the ability to effect change remotely by contesting the connectivity of non-co-located actors in cyberspace. 
 
It is significant that locative technologies are coming to the fore again. It's almost like tieing cyberspace back 'down to earth', although Seymour Goodman wrote years ago that cyberspace 'always touches ground somewhere'. Hardware hasn't gone away, nor has the wetware of the human mind. What I suspect you're referring to is augmented reality and ubiquitous computing. Short answer: it's all ripe for hacking. My personal take is that guys like you look into the technical possibilities, and that's all well and good. I'm more interested in what it actually means. What happens to the body in this space, these spaces? The internet has already had a huge impact on what used to be the relatively solid notion of subjectivity. What happens to identity in cyberspace(s)? The context of cyber conflict is ultimately us - how we internalise cyberspace, or project externally into it, is unknown. I have an idea that cyberspace is not really new anyway - it was born when we became conscious, communicative animals. In that sense, cyber conflict has always been with us, and its psychological vectors remain pretty much the same, if twisted and mutated somewhat. The physiological changes are much more murky and hard to decipher. Some good work has been undertaken on 'presence', for example, but it's early days. This is approximately where my research into violence in virtual worlds is situated.
 
Q: Are their any fundamental aspects of cyber conflict that exist ubiquitously in all cases of cyber conflict?  If these fundamental commonalities do exist, what are they and how could they be used to remedy future cyber conflicts?
 
A: Well, see above. The issue of remediation is interesting though. I think that deterrence in its various forms, for example, is a psychological matrix of cost-benefit analysis, even for actors we don't normally think of as 'rational'. Pre-event deterrence-by-denial dissuades an initial attack. Post-event deterrence-by-denial dissuades future attacks by demonstrating the ability to recover. Deterrence-by-punishment dissuades by plausibly threatening to kick your ass if you try anything funny.
 
But cyber conflicts are not just psychological, any more than other forms of conflict. The physical systems on which cyberspace is 'parasitic', in Albert Borgmann's phrase, are also contested, for example, and are largely what worry SCADA wonks. Martin Libicki's recent RAND report on cyber deterrence mentions the physical, syntactic and semantic layers of cyberspace, and this is a useful way of thinking about the differing layers of contestability. He swiped this idea from linguistics without reference but I'll forgive him for that. This is another reason why I'm not so sure cyberspace is new, which speaks to your 'fundamental aspects' question. How we engage in cyber conflicts throws up a host of weirdness and counter-intuitive possibilities but not all of it is 'new'.
 
Q: You recently posted Neal Stephenson's response to a fascinating questions concerning the protection of hacking tools (in the United States) under the second amendment.  How would you respond to that question?
 
A: Being a cheese-eating surrender-monkey I'm going to be called out whatever I say in response to this. I'm not a priori opposed to the Second Amendment but I do think it's been hijacked somewhat over the years. US gun-control laws are in dire need of review: what's the point in having guns to keep the government in check if all you do is shoot fellow Americans with them? In keeping with almost everyone else - including US citizens - I have to claim ignorance as to what it really means. As to whether it extends to 'hacking tools'-code-I'm with Stephenson here. My default position when it comes to constitutional issues is generally 'do nothing' unless there's a very good case for doing otherwise; I don't think that case exists yet. Of course, we don't even have a written constitution in the UK, so what do I know?
 
There's another issue here, one that the military are currently actively exploring, and which the UN are likely to tackle at some point: cyber arms control. My initial response is: how the hell are you going to police that? Code is not amenable to the same forms of physical monitoring and intelligence regimes as kinetic weapons. Code lacks the traditional dimensionality required for control. I should think the implications of that are obvious.
 
Q: When discussing cyber conflict, you appear to become frustrated when the argument centers around hyperbole.  This is absolutely understandable.  What advice would you give to those of us (including myself) on the front lines that sometimes unconsciously fall in to this trap?
 
A: Well, it's pretty simple, actually. Be conscious of who you are. If you lose sight of the bigger picture, then you have little hope of formulating realistic solutions to realistic problems. Planning involves considering worst-case scenarios and formulating strategies for dealing with them. We've had six decades of doing exactly that with nuclear weapons, for example. The problem with doing that is if everything is predicated on the worst-case scenario - including public discourse - the solutions we come up with are just as likely to be the worst ones. It boils down to understanding the effects that one's own actions have, and taking responsibility for them. Perspective's a handy tool and it doesn't just mean looking outwards; it means examining yourself too. Being critical. If cyberspace is as important as everyone says it is, it would be wise for all those involved to think about exactly what it is they're pushing for, and ask if their actions in any way further the interests of the global commons. If it doesn't, then your standpoint may need to be tweaked a bit. And, for the record, I don't think that national interest necessarily trumps all.
 
Q: In a society prone to finger pointing, what is the appropriate response to the nature of technological accidents?
 
A: I have two answers, one practical, the other philosophical. The practical answer would be to find out what went wrong. Sounds simple, right? Not always so. You're right about finger-pointing; everyone's so gee-ed up with their own importance, and too weak to resist the bleating of single-interest groups, that people tend to get fired before anyone even knows what the problem is. By all means hold people to account but count to five before you sack someone just because you need a scapegoat. Some of the problems of technology are 'wicked' ones, and require significant unpacking before action is taken. One of the problems with 'cyber' is that so many people are shouting that cyber defence is moving way too slowly to keep up with the environment that the fingers are pointing even before anything's happened. There are too many people who in one breath are repeating the mantra, 'we.must.all.work.together', whilst tearing strips off anyone who isn't half-as-damn-smart as they are. That's a really good basis for co-operation. Sometimes, of course, shit just happens. Learn from it. Move on.
 
The philosophical argument is slightly different, and there is no right response. There are two people to bear in mind here. One is the 'anarcho-Christian' theorist Paul Virilio, the other Ted Kaczynski, the Unabomber. In different ways, they would both maintain that technology contains within itself the seeds of its own destruction. The technological accident is therefore something inevitable. I always paraphrase this as, 'you invent the car, you get the car crash; invent TV, and you get Fox'. Trite, I know, but you get the point. So, the response to a technological accident in these terms is complex. You can throw your hands up and blame it on the evils of technology in a told-you-so kind of way and go and break up all the spinning Jennies, or you can stop and wonder if technology really is teleological in these terms. Does technology really have an imperative, a drive, a force beyond the control of humankind, or can its trajectory be shaped by humans? Your response really depends on whether you're a hardcore technodeterminist in the first instance, or a social constructivist in the second. Me, I'm somewhere between the two right now, but vacillate daily. Today's metric is 60:40 in favour of determinism. Ask me again tomorrow.
 

The Evolution of Social Media and Relational Modeling

Alternate reality gaming (ARG) is a relatively new trend beginning to gain serious traction.  At its fundamental core, an ARG is simply a communication rich, collaboration environment that coalesces the real world and virtual space.  An alternate reality game bridges the metaphysical disconnects between the two environments.
 
I recently began using foursquare.  The folks over there tout foursquare as 50% friend-finder, 30% social cityguide, 20% nightlife game.  Foursquare provides a virtual world, that interfaces with the real world.  Registered users use Foursquare to connect with friends, update their location ("checking in"), describe what they are doing, and receive points for doing so.  The point system and earning badges (the gaming aspect), provide users incentive to do and try new things.  Additionally, it encourages them to share information.  "You should check out this bar and try their microbrew!"  Users themselves provide knowledge rich information specific to a target location.  The community makes the system more intelligent and capable of meeting profound knowledge management needs.
 
From a security perspective, the question I find myself asking, what utility can be found in this information?  Instead of focusing upon it at a micro-level (privacy, dangers of sharing location, social engineering, phishing, etc) it is far more interesting to look at it from a macro-level.
 
A paradigm shift in social media is coming in which the real world and virtual space interact together as a singular entity.  This entity is comprised of three fundamental components; people, location, and knowledge.  These three components lay the foundation for a dynamic, living, breathing system that evolves over time.  The system evolves around how these components are built and structured around each other.  It is somewhat analogous to an iterative mathematical process in which operators and operands are used to create complex equations and theorems over time.  These complex equations and theorems can then be used as the foundation for future equations and theorems...and so on, and so on.
 
What is most interesting are the relationships that form between people, location, and knowledge.  These relationships build around each other to create profoundly rich links and ties that essentially act as the system's DNA.
 
With all of this information, security folks could create models to uncover interesting relationships between individuals, location, and the knowledge associated with them.  One could then simulate potential outcomes by incorporating variables into the model.  This would enable security professionals to predict future relationships between individuals and their locations and thus reveal common threat indicators and patterns.  These models used for exploring existing relationships and simulating future relationships (based on variable inputs) would, with hope, provide cogent foresight for law enforcement.
 

How to Leverage Virtual Worlds to Improve Security

I recently began reading Beautiful Security: Leading Security Experts Explain How Think, in particular chapter 9, Tomorrow's Security Cogs and Levers by Andy Oram and John Viega.  The chapter is a great read for any information security professional and thus far my favorite in the book.  To develop some context, the chapter begins with...
 
Information security is not just about technology. It is about people, processes, and
technology, in that order—or more accurately, about connecting people, processes, and
technology together so that humans and entire systems can make informed decisions. It
may at first seem rather odd to start a chapter in a book about the future of security
management technology with a statement that puts the role of technology firmly in third
place, but I felt it was important to put that stake in the ground to provide context for the
rest of this chapter.

 
Oram and Viega go on to discuss two different types of security people; builders and breakers.  Builders are the optimists.  Despite recognizing the profound seriousness of security vulnerabilities and dangers we face today, there is still room for encouragement.  Breakers, as you can imagine, are the pessimists.  "You wonder when listening to some of them, why the Internet hasn't totally collapsed already and why any of us have money left unpilfered in our bank accounts" (Oram & Viega). 
 
Despite drastically different mentalities, there is one simple truth: with innovation, when benefits outweigh drawbacks, innovation almost always succeed.  Builders understand this.  They understand that new technology, with significant benefits, will move forward and inescapably reveal new security issues.  Unlike breakers, who at times can be intimidated by change, builders look to see how novel technologies can be leveraged to improve security.  
 
Every few years the next big thing comes along and polarizes security people into these two philosophical camps (Oram & Viega).  We are currently seeing it with Web 2.0 (social networking, wikis, social bookmarking, etc) and roars are beginning to escalate concerning cloud computing.  Inevitably we will see the same with virtual worlds.  This got me thinking.  Wouldn't it be interesting to look at ways in which virtual worlds could improve security?  Here are a couple quick ones off the top of my head.....
 
1) Dramatically improve communication in real-time
 
The ability to quickly communicate amongst the masses in real-time is very powerful.  Twitter has recently made this more apparent than ever.  Virtual worlds take real-time communication to a whole new level, incorporating both social context and environmental relevance.  These components will improve the clarity of information dissemination and mitigate ambiguity commonly seen in text based communications.
 
2) Fertile ground for innovative, small businesses to cheaply and more effectively produce novel security solutions
 
Virtual worlds provide an ideal space for small businesses to form and produce a wide-ranging set of assorted security solutions.  This idea encompasses two components.  First, virtual worlds provide a cheap environment to bring together intelligent individuals from all over the world.  As a result, many effective small businesses will ubiquitously spawn.  Second, these small businesses will have concentrated focuses.  They will become experts and have an esoteric understanding of individual security components few others will understand.  Instead of devising and implementing large, bulky security solutions, enterprise organizations will have a selection of small, more modular components (supplied by small businesses providing in depth, esoteric knowledge) that can be amended to enterprise specific requirements.
 
3) Provide a neutral site for rich communication between diverse organizations (government agencies, contractors, private businesses, public organizations, etc) to discuss security
 
A virtual world has the ability to provide an environment, organizationally agnostic, enabled for rich communication amongst a diverse set of organizations with varying goals.  What I mean essentially is a neutral virtual environment to bring different groups together, deter motivational bias, and avoid turf battles.  Let me once again reiterate, they have the ability to do so.  This does not mean a single organization with private property, masked as public, holding information exchanges with additional organizations is in fact a "neutral" site.
 
These simply are just a few thoughts off of the top of my head.  I am sure there are many more.  Notice that all leverage the power of collaboration and communication, characteristics virtual environments are best suited to facilitate. 
 
Finally, understanding a conscientious builder mentality can be a driving force in devising secure, innovative solutions with advanced technologies.  We should not be scared of what is on the horizon, but rather embrace it, and mold it to our needs and requirements.
 

Syndicate content