<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: troops]]></title>
    <link>http://securityratty.com/tag/troops</link>
    <description></description>
    <pubDate>Wed, 25 Jun 2008 13:29:25 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Barak Obama Discusses Security Trade-Offs]]></title>
      <link>http://securityratty.com/article/66adeb7e03a72798a66d6a815c8cb26d</link>
      <guid>http://securityratty.com/article/66adeb7e03a72798a66d6a815c8cb26d</guid>
      <description><![CDATA[I generally avoid commenting on election politics -- that's not what this blog is about -- but this comment by Barak Obama is worth discussing: [Q] I have been collecting accounts of your meeting with...]]></description>
      <content:encoded><![CDATA[<p>I generally avoid commenting on election politics -- that's not what this blog is about -- but <a href="http://www.time-blog.com/swampland/2008/10/the_full_obama_interview.html">this comment</a> by Barak Obama is worth discussing:</p>

<blockquote>[Q] I have been collecting accounts of your meeting with David Petraeus in Baghdad. And you had [inaudible] after he had made a really strong pitch [inaudible] for maximum flexibility. A lot of politicians at that moment would have said [inaudible] but from what I hear, you pushed back.

<p>[BO] I did. I remember the conversation, pretty precisely. He made the case for maximum flexibility and I said you know what if I were in your shoes I would be making the exact same argument because your job right now is to succeed in Iraq on as favorable terms as we can get. My job as a potential commander in chief is to view your counsel and your interests through the prism of our overall national security which includes what is happening in Afghanistan, which includes the costs to our image in the middle east, to the continued occupation, which includes the financial costs of our occupation, which includes what it is doing to our military. So I said look, I described in my mind at list an analogous situation where I am sure he has to deal with situations where the commanding officer in [inaudible] says I need more troops here now because I really think I can make progress doing x y and z. That commanding officer is doing his job in Ramadi, but Petraeus's job is to step back and see how does it impact Iraq as a whole. My argument was I have got to do the same thing here. And based on my strong assessment particularly having just come from Afghanistan were going to have to make a different decision. But the point is that hopefully I communicated to the press my complete respect and gratitude to him and Proder who was in the meeting for their outstanding work. Our differences don't necessarily derive from differences in sort of, or my differences with him don't derive from tactical objections to his approach. But rather from a strategic framework that is trying to take into account the challenges to our national security and the fact that we've got finite resources.</blockquote></p>

<p>I have made this general point again and again -- about airline security, about terrorism, about a lot of things -- that the person in charge of the security system can't be the person who decides what resources to devote to that security system.  The analogy I like to use is a company: the VP of marketing wants all the money for marketing, the VP of engineering wants all the money for engineering, and so on; and the CEO has to balance all of those needs and do what's right for the company.  So of course the TSA wants to spend all this money on new airplane security systems; that's their job.  Someone above the TSA has to balance the risks to airlines with the other risks our country faces and allocate budget accordingly.  Security is a trade-off, and that trade-off has to be made by someone with responsibility over all aspects of that trade-off.</p>

<p>I don't think I've ever heard a politician make this point so explicitly.</p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=DBjNM"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=DBjNM" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=WeT5M"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=WeT5M" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Mon, 27 Oct 2008 03:31:12 +0000</pubDate>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/airline security">airline security</category>
      <category domain="http://securityratty.com/tag/national security">national security</category>
      <category domain="http://securityratty.com/tag/security system">security system</category>
      <category domain="http://securityratty.com/tag/strong pitch inaudible">strong pitch inaudible</category>
      <category domain="http://securityratty.com/tag/inaudible">inaudible</category>
      <category domain="http://securityratty.com/tag/job">job</category>
      <category domain="http://securityratty.com/tag/airplane security systems">airplane security systems</category>
      <category domain="http://securityratty.com/tag/maximum flexibility">maximum flexibility</category>
      <source url="http://www.schneier.com/blog/archives/2008/10/barak_obama_dis.html">Barak Obama Discusses Security Trade-Offs</source>
    </item>
    <item>
      <title><![CDATA[Clever Counterterrorism Tactic]]></title>
      <link>http://securityratty.com/article/9b0993eb71be732aed5e6c621525d339</link>
      <guid>http://securityratty.com/article/9b0993eb71be732aed5e6c621525d339</guid>
      <description><![CDATA[Used against the IRA : One of the most interesting operations was the laundry mat [sic]. Having lost many troops and civilians to bombings, the Brits decided they needed to determine who was making...]]></description>
      <content:encoded><![CDATA[<p>Used <a href="http://www.washingtonpost.com/wp-dyn/content/article/2008/10/03/AR2008100301978.html?hpid=opinionsbox1">against the IRA</a>:</p>

<blockquote>One of the most interesting operations was the laundry mat [sic]. Having lost many troops and civilians to bombings, the Brits decided they needed to determine who was making the bombs and where they were being manufactured. One bright fellow recommended they operate a laundry and when asked "what the hell he was talking about," he explained the plan and it was incorporated -- to much success.

<p>The plan was simple: Build a laundry and staff it with locals and a few of their own. The laundry would then send out "color coded" special discount tickets, to the effect of "get two loads for the price of one," etc. The color coding was matched to specific streets and thus when someone brought in their laundry, it was easy to determine the general location from which a city map was coded.</p>

<p>While the laundry was indeed being washed, pressed and dry cleaned, it had one additional cycle -- every garment, sheet, glove, pair of pants, was first sent through an analyzer, located in the basement, that checked for bomb-making residue. The analyzer was disguised as just another piece of the laundry equipment; good OPSEC [operational security]. Within a few weeks, multiple positives had shown up, indicating the ingredients of bomb residue, and intelligence had determined which areas of the city were involved. To narrow their target list, [the laundry] simply sent out more specific coupons [numbered] to all houses in the area, and before long they had good addresses. After confirming addresses, authorities with the SAS teams swooped down on the multiple homes and arrested multiple personnel and confiscated numerous assembled bombs, weapons and ingredients. During the entire operation, no one was injured or killed.</blockquote></p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=1VsTM"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=1VsTM" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=omBpM"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=omBpM" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Mon, 13 Oct 2008 09:22:24 +0000</pubDate>
      <category domain="http://securityratty.com/tag/laundry">laundry</category>
      <category domain="http://securityratty.com/tag/laundry simply">laundry simply</category>
      <category domain="http://securityratty.com/tag/laundry equipment">laundry equipment</category>
      <category domain="http://securityratty.com/tag/laundry mat sic">laundry mat sic</category>
      <category domain="http://securityratty.com/tag/color coded">color coded</category>
      <category domain="http://securityratty.com/tag/coded">coded</category>
      <category domain="http://securityratty.com/tag/bomb residue">bomb residue</category>
      <category domain="http://securityratty.com/tag/opsec operational security">opsec operational security</category>
      <category domain="http://securityratty.com/tag/city">city</category>
      <source url="http://www.schneier.com/blog/archives/2008/10/clever_countert.html">Clever Counterterrorism Tactic</source>
    </item>
    <item>
      <title><![CDATA[UK Ministry of Defense Loses Memory Stick with Military Secrets]]></title>
      <link>http://securityratty.com/article/3a82904dde9fb97309a0ff3ea371ff4e</link>
      <guid>http://securityratty.com/article/3a82904dde9fb97309a0ff3ea371ff4e</guid>
      <description><![CDATA[Oops : The USB stick, outlining training for 70 soldiers from the 3rd Battalion, Yorkshire Regiment, was found on the floor of The Beach in Newquay in May
Times, locations and travel and accommodation...]]></description>
      <content:encoded><![CDATA[<p><a href="http://news.bbc.co.uk/2/hi/uk_news/england/cornwall/7605923.stm">Oops</a>:</p>

<blockquote>The USB stick, outlining training for 70 soldiers from the 3rd Battalion, Yorkshire Regiment, was found on the floor of The Beach in Newquay in May.

<p>Times, locations and travel and accommodation details for the troops were included in files on the device.</blockquote></p>

<p>It's not the first time:</p>

<blockquote>More than 120 USB memory sticks, some containing secret information, have been lost or stolen from the Ministry of Defence since 2004, it was reported earlier this year.

<p>Some 26 of those disappeared this year == including three which contained information classified as "secret", and 19 which were "restricted".</blockquote></p>

<p>I've written about this <a href="http://www.schneier.com/essay-105.html">general problem</a> before: we're storing ever more data in ever smaller devices.</p>

<blockquote>The point is that it's now amazingly easy to lose an enormous amount of information. Twenty years ago, someone could break into my office and copy every customer file, every piece of correspondence, everything about my professional life. Today, all he has to do is steal my computer. Or my portable backup drive. Or my small stack of DVD backups. Furthermore, he could sneak into my office and copy all this data, and I'd never know it.</blockquote>

<p>The solution? <a href="http://www.schneier.com/essay-199.html">Encrypt them</a>.</p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=DEbAL"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=DEbAL" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=lTsJL"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=lTsJL" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Tue, 16 Sep 2008 02:21:30 +0000</pubDate>
      <category domain="http://securityratty.com/tag/secret information">secret information</category>
      <category domain="http://securityratty.com/tag/secret">secret</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/portable backup drive">portable backup drive</category>
      <category domain="http://securityratty.com/tag/usb memory sticks">usb memory sticks</category>
      <category domain="http://securityratty.com/tag/professional life">professional life</category>
      <category domain="http://securityratty.com/tag/3rd battalion">3rd battalion</category>
      <category domain="http://securityratty.com/tag/enormous amount">enormous amount</category>
      <category domain="http://securityratty.com/tag/copy">copy</category>
      <source url="http://www.schneier.com/blog/archives/2008/09/uk_ministry_of.html">UK Ministry of Defense Loses Memory Stick with Military Secrets</source>
    </item>
    <item>
      <title><![CDATA[Cyberattack Against Georgia Preceded Real Attack]]></title>
      <link>http://securityratty.com/article/05aa9f87510a1d42d2691aadc95f19a7</link>
      <guid>http://securityratty.com/article/05aa9f87510a1d42d2691aadc95f19a7</guid>
      <description><![CDATA[This is interesting: Exactly who was behind the cyberattack is not known. The Georgian government blamed Russia for the attacks, but the Russian government said it was not involved. In the end,...]]></description>
      <content:encoded><![CDATA[<p><a href="http://www.nytimes.com/2008/08/13/technology/13cyber.html">This</a> is interesting:</p>

<blockquote>Exactly who was behind the cyberattack is not known. The Georgian government blamed Russia for the attacks, but the Russian government said it was not involved. In the end, Georgia, with a population of just 4.6 million and a relative latecomer to the Internet, saw little effect beyond inaccessibility to many of its government Web sites, which limited the government's ability to spread its message online and to connect with sympathizers around the world during the fighting with Russia.

<p>[...]</p>

<p>In Georgia, media, communications and transportation companies were also attacked, according to security researchers. Shadowserver saw the attack against Georgia spread to computers throughout the government after Russian troops entered the Georgian province of South Ossetia. The National Bank of Georgia's Web site was defaced at one point. Images of 20th-century dictators as well as an image of Georgia's president, Mr. Saakashvili, were placed on the site. "Could this somehow be indirect Russian action? Yes, but considering Russia is past playing nice and uses real bombs, they could have attacked more strategic targets or eliminated the infrastructure kinetically," said Gadi Evron, an Israeli network security expert. "The nature of what's going on isn't clear," he said.</p>

<p>[...]</p>

<p>In addition to D.D.O.S. attacks that crippled Georgia's limited Internet infrastructure, researchers said there was evidence of redirection of Internet traffic through Russian telecommunications firms beginning last weekend. The attacks continued on Tuesday, controlled by software programs that were located in hosting centers controlled by a Russian telecommunications firms. A Russian-language Web site, stopgeorgia.ru, also continued to operate and offer software for download used for D.D.O.S. attacks.</blockquote></p>

<p>Welcome to 21st century warfare.</p>

<blockquote>"It costs about 4 cents per machine," Mr. Woodcock said. "You could fund an entire cyberwarfare campaign for the cost of replacing a tank tread, so you would be foolish not to."</blockquote><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=FRnMDK"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=FRnMDK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=O8aHKK"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=O8aHKK" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Mon, 18 Aug 2008 09:11:09 +0000</pubDate>
      <category domain="http://securityratty.com/tag/georgia">georgia</category>
      <category domain="http://securityratty.com/tag/indirect russian action">indirect russian action</category>
      <category domain="http://securityratty.com/tag/russian">russian</category>
      <category domain="http://securityratty.com/tag/georgian government">georgian government</category>
      <category domain="http://securityratty.com/tag/government">government</category>
      <category domain="http://securityratty.com/tag/russian troops">russian troops</category>
      <category domain="http://securityratty.com/tag/spread">spread</category>
      <category domain="http://securityratty.com/tag/georgia spread">georgia spread</category>
      <category domain="http://securityratty.com/tag/government web sites">government web sites</category>
      <source url="http://www.schneier.com/blog/archives/2008/08/cyberattack_aga.html">Cyberattack Against Georgia Preceded Real Attack</source>
    </item>
    <item>
      <title><![CDATA[How I became a soldier in the Georgia-Russia cyberwar.]]></title>
      <link>http://securityratty.com/article/cb0690279b2cb6030191ba8c0c9a09d8</link>
      <guid>http://securityratty.com/article/cb0690279b2cb6030191ba8c0c9a09d8</guid>
      <description><![CDATA[As Russian and Georgian troops fight on the ground, there's a parallel war happening in cyberspace. In recent weeks, Georgia's government Web sites have been besieged by denial-of-service attacks and...]]></description>
      <content:encoded><![CDATA[As Russian and Georgian troops fight on the ground, there's a parallel war happening in cyberspace. In recent weeks, Georgia's government Web sites have been besieged by denial-of-service attacks and acts of vandalism. Just like in traditional warfare, there's a lot of confusion about what's going on in this technological battle—nobody seems to kno]]></content:encoded>
      <pubDate>Fri, 15 Aug 2008 04:20:15 +0000</pubDate>
      <category domain="http://securityratty.com/tag/georgian troops fight">georgian troops fight</category>
      <category domain="http://securityratty.com/tag/government web sites">government web sites</category>
      <category domain="http://securityratty.com/tag/traditional warfare">traditional warfare</category>
      <category domain="http://securityratty.com/tag/parallel war">parallel war</category>
      <category domain="http://securityratty.com/tag/technological battlenobody">technological battlenobody</category>
      <category domain="http://securityratty.com/tag/recent weeks">recent weeks</category>
      <category domain="http://securityratty.com/tag/georgia">georgia</category>
      <category domain="http://securityratty.com/tag/cyberspace">cyberspace</category>
      <category domain="http://securityratty.com/tag/lot">lot</category>
      <source url="http://digg.com/security/How_I_became_a_soldier_in_the_Georgia_Russia_cyberwar">How I became a soldier in the Georgia-Russia cyberwar.</source>
    </item>
    <item>
      <title><![CDATA[Did the U.S. Prep Georgia for War With Russia?]]></title>
      <link>http://securityratty.com/article/3491d2997d9633680fc1b45e0d3c17ba</link>
      <guid>http://securityratty.com/article/3491d2997d9633680fc1b45e0d3c17ba</guid>
      <description><![CDATA[The United States isn't exactly a detached observer in Russia's war with Georgia. The American military has been training and equipping Georgian troops for...]]></description>
      <content:encoded><![CDATA[The United States isn't exactly a detached observer in Russia's war with Georgia. The American military has been training and equipping Georgian troops for years.<br style="clear: both;"/>
      <a href="http://www.pheedo.com/click.phdo?s=f914d07461fb9e85dc29a341dad83623"><img alt="" style="border: 0;" border="0" src="http://www.pheedo.com/img.phdo?s=f914d07461fb9e85dc29a341dad83623"/></a>
  <img src="http://www.pheedo.com/feeds/tracker.php?i=f914d07461fb9e85dc29a341dad83623" style="display: none;" border="0" height="1" width="1" alt=""/><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=0tpdDK"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=0tpdDK" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=Xk4VGk"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=Xk4VGk" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=5ZRUBk"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=5ZRUBk" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=9oj3yK"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=9oj3yK" border="0"></img></a>
 <a href="http://feeds.wired.com/~f/wired/politics/security?a=tnRUoK"><img src="http://feeds.wired.com/~f/wired/politics/security?i=tnRUoK" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=X3Nv2k"><img src="http://feeds.wired.com/~f/wired/politics/security?i=X3Nv2k" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=1vmQrk"><img src="http://feeds.wired.com/~f/wired/politics/security?i=1vmQrk" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=WrrqMK"><img src="http://feeds.wired.com/~f/wired/politics/security?i=WrrqMK" border="0"></img></a> </div><img src="http://feeds.feedburner.com/~r/wired/politics/privacy/~4/361272798" height="1" width="1"/><img src="http://feeds.wired.com/~r/wired/politics/security/~4/361272799" height="1" width="1"/>]]></content:encoded>
      <pubDate>Sun, 10 Aug 2008 14:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/russia">russia</category>
      <category domain="http://securityratty.com/tag/american military">american military</category>
      <category domain="http://securityratty.com/tag/georgia">georgia</category>
      <category domain="http://securityratty.com/tag/georgian troops">georgian troops</category>
      <category domain="http://securityratty.com/tag/war">war</category>
      <category domain="http://securityratty.com/tag/observer">observer</category>
      <source url="http://feeds.wired.com/~r/wired/politics/security/~3/361272799/did-us-military.html">Did the U.S. Prep Georgia for War With Russia?</source>
    </item>
    <item>
      <title><![CDATA[Italians Use Soldiers to Prevent Crime]]></title>
      <link>http://securityratty.com/article/c78f1c770359cb273d03943d7dec2ab0</link>
      <guid>http://securityratty.com/article/c78f1c770359cb273d03943d7dec2ab0</guid>
      <description><![CDATA[Interesting : Soldiers were deployed throughout Italy on Monday to embassies, subway and railway stations, as part of broader government measures to fight violent crime here for which illegal...]]></description>
      <content:encoded><![CDATA[<p><a href="http://www.nytimes.com/2008/08/05/world/europe/05italy.html">Interesting</a>:</p>

<blockquote>Soldiers were deployed throughout Italy on Monday to embassies, subway and railway stations, as part of broader government measures to fight violent crime here for which illegal immigrants are broadly blamed.

<p>[...]</p>

<p>The conservative government of Silvio Berlusconi won elections in April while promising to crack down on petty crime and illegal immigrants. The new patrols of soldiers, who are not empowered to make arrests, do not seem aimed only at illegal immigrants, though the patrols were deployed to centers where illegal immigrants are housed. </p>

<p>“Security is something concrete,” Mr. La Russa said on Monday. The troops, he said, will be a “deterrent to criminals.”</blockquote></p>

<p>That reminds me of one of my favorite logical fallacies: "We must do something.  This is something. Therefore, we must do it."  It does seem largely to be a demonstration of "doing something" by the Berlusconi government.  The legitimate police, of course, think it's a terrible idea.</p>

<blockquote>“You need to be specially trained to carry out some kinds of controls,” Nicola Tanzi, the secretary of a trade union that represents Italian police officers. “Soldiers just aren’t qualified.”

<p>He also questioned whether the $93.6 million that will be spent for the extra deployment, called Operation Safe Streets, might not have been better used to increase the budgets for Italy’s police and military.</blockquote></p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=lUII6K"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=lUII6K" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=lLsCCK"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=lLsCCK" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Tue, 05 Aug 2008 02:36:44 +0000</pubDate>
      <category domain="http://securityratty.com/tag/illegal immigrants">illegal immigrants</category>
      <category domain="http://securityratty.com/tag/soldiers">soldiers</category>
      <category domain="http://securityratty.com/tag/police">police</category>
      <category domain="http://securityratty.com/tag/broader government measures">broader government measures</category>
      <category domain="http://securityratty.com/tag/italys police">italys police</category>
      <category domain="http://securityratty.com/tag/favorite logical fallacies">favorite logical fallacies</category>
      <category domain="http://securityratty.com/tag/operation safe streets">operation safe streets</category>
      <category domain="http://securityratty.com/tag/fight violent crime">fight violent crime</category>
      <category domain="http://securityratty.com/tag/silvio berlusconi">silvio berlusconi</category>
      <source url="http://www.schneier.com/blog/archives/2008/08/italians_use_so.html">Italians Use Soldiers to Prevent Crime</source>
    </item>
    <item>
      <title><![CDATA[U.S. Arms Dealer Tests Legal Bounds in Middle East Arms Bazaar]]></title>
      <link>http://securityratty.com/article/a494b708fadf3d4f453c6495d8064dc2</link>
      <guid>http://securityratty.com/article/a494b708fadf3d4f453c6495d8064dc2</guid>
      <description><![CDATA[Former congressman Curt Weldon is helping broker deals between Russian and Ukranian weapons suppliers and the Iraqi and Libyan governments as part of his new job with a private American defense...]]></description>
      <content:encoded><![CDATA[<p>
Former congressman Curt Weldon is helping broker deals between Russian and Ukranian weapons suppliers and the Iraqi and Libyan governments as part of his new job with a private American defense consulting firm, Wired.com has learned. 
</p>

<p>
Weldon, who is currently being investigated by the FBI over alleged corruption during his time in office, visited Libya in March to discuss a possible military deal, according to a letter describing the trip from Weldon to <a href="http://www.ds-pa.com/">Defense Solutions</a> CEO Timothy Ringgold. In May, Weldon, together with Ringgold and another company representative, traveled to Moscow to discuss working with Russia's weapons-export agency on arms sales to the Middle East.
</p>

<p>
Both trips were part of the company's effort to tap into the growing -- and often legally murky -- market for selling weapons from former Eastern Bloc countries to the Middle East and Afghanistan.
</p>



<div id="embed" style="margin: 0px 0px 15px 15px; float: right; width: 250px; height: auto;">

<img src="http://www.wired.com/images/article/full/2008/07/weldon_350px.jpg" width="250px" alt="Curt Weldon">

<div id="caption">

Ex-Rep. Curt Weldon, R-Penn., is helping broker deals between Russian weapons suppliers and the Iraqi and Libyan governments through his company, Defense Solutions.<br />
<em>Photo: H. Rumph Jr/AP</em>

</div> 

</div>

<p>
The Russians want to sell weapons to Iraq directly, but "must go slow on Iraq because of political reasons" and want to work with an "intermediary" like Defense Solutions, CEO Ringgold subsequently wrote to colleagues. "They have not spoken with any American company that can offer the quid pro quo that we can or that has the connections in Russia that we have," he boasted.
</p>



<p>
A few years ago, an American company proposing to sell weapons to Libya might have triggered a congressional hearing. So, too, would have a proposal to conduct arms deals with Russia, which the United States has accused of selling high-tech weapons to Syria and Iran. 
</p>

<p>However, U.S. government efforts to rapidly equip countries like Afghanistan and Iraq -- which have largely Soviet-origin weapons -- have created legal ambiguities and loopholes in export controls that didn't exist in years past and given rise to a new class of arms trade middlemen. So, even though both Libya and the Russian arms export agency are on official U.S. blacklists, government officials and analysts involved in weapons sales say the rules have become unclear as the push to equip allies in the global war on terror has blazed new but uncertain legal ground. 
</p>




<p>
Eagerly stepping into that virgin territory is <a href="http://www.ds-pa.com/">Defense Solutions</a>, a Pennsylvania-based company that is carving out a small but lucrative niche in a new international arms bazaar. The firm boasts as its advisors a number of influential Washington insiders, such as retired General Barry McCaffrey, the former White House drug czar.
</p>

<p>
Helping the firm make key connections is Curt Weldon, a former Republican congressman from Pennsylvania at the center of an FBI investigation into alleged conflicts of interest during his time in office.  Weldon, now a key executive at Defense Solutions, is working with the company to set up these weapons deals.
</p>

<div id="embed" style="margin: 0px 0px 15px 15px; float: right; width: 350px; height: auto;">

<img src="http://www.wired.com/images/article/full/2008/07/btr_60_350px.jpg" alt="">

<div id="caption">

Defense Solutions has also proposed refurbishing Libya's BTR-60 armored personnel carriers, according to a sales proposal seen by Wired.com. Defense Solutions denies drafting a sales proposal to Libya.

</div> 

</div>

<p>
It's an unusual, if not an entirely unexpected chapter for Weldon, whose time in office included frequent trips to Russia. As an influential member of the House Armed Services Committee, Weldon pushed for multibillion-dollar defense programs, like ballistic missile defense, and earned a reputation as a foreign policy gadfly, boasting of his contacts with officials in nations labeled by the administration as "rogue states" such as Libya and North Korea. Weldon's wild claims about a 9/11 cover-up and his sensationalist book warning of an Iranian terror plot, sometimes earned him official scorn and public ridicule, but it was accusations that he steered contracts to Eastern European businesses linked to his daughter's lobbying firm that drew the government's attention.
</p>


<!--pagebreak-->
<p>
Weldon was voted out of office in 2006 just weeks after the FBI raided his daughter's home, and that of one of her associates.
</p>

<p>
Weldon did not respond to e-mails and phone requests to be interviewed or comment for this article. But in a 2006 interview, before the FBI probe was public, Weldon spoke enthusiastically about setting up a "front company" to work with the Russian arms agency, Rosoboronexport. Weldon hoped this company could sell weapons to the Middle East, and other regions, particularly to countries where the U.S. has strained relations. He claimed the director of Rosoboronexport approached him to work with "an American company that would act as a front for weapons these nations want to buy."
</p>

<p>
Weldon called the proposal an "unbelievable offer."
</p>

<p>
The administration, he acknowledged at the time, did not welcome the idea of an American company selling Russian weapons to potentially unfriendly countries. But two years later, Weldon, now a private citizen and chief strategic officer for Defense Solutions, appears to be working on precisely that sort of deal. And whether illegal or not, Defense Solutions' business represents a new phenomenon in the international arms trade business.
</p>

<p>
In years past arms brokers -- firms or individuals who serve as middlemen to facilitate weapons sales between countries -- were largely the stuff of spy thrillers. Unlike traditional American defense companies, like Lockheed Martin or Boeing, which typically sell weapons directly to NATO countries or other governments regarded as friendly to the United States, brokers are often small outfits run by people with sometimes questionable experience and reputations they will sell to anyone. One of the most infamous arms brokers, a Russian named <a href="http://en.wikipedia.org/wiki/Victor_Bout">Viktor Bout</a>, is charged by the United States, United Nations, Interpol and others of funneling arms to terrorists and rebels around the world. He was recently arrested in Thailand. The United States is requesting his extradition on charges of supplying arms to a terrorist organization.
</p>

<div id="embed" style="margin: 0px 0px 15px 15px; float: right; width: 350px; height: auto;">

<img src="http://www.wired.com/images/article/full/2008/07/bmp_1_350px.jpg" alt="" />

<div id="caption">

Two Marines lower the trim vane on the front of an Iraqi BMP-1 mechanized infantry combat vehicle that was captured during Operation Desert Storm. The American defense consulting firm Defense Solutions has proposed refurbishing Libya's aging fleet of BMP-1s. Defense Solutions denies drafting a sales proposal to Libya.

</div> 

</div>

<p>
But ironically, Iraq has fueled a new market for these professional middlemen; the United States is funneling billions of dollars into modernizing Iraq's army so that the country's government can fend for itself after coalition troops withdraw. And Iraq's largely Soviet-equipped military is a natural market for Eastern European countries brimming with old or out-of-date equipment they would like to unload. The middlemen, in these cases, serve a key role by allowing the U.S. government to do business with an American company, which in turn buys equipment from Eastern Bloc countries in deals worth hundreds of millions of dollars, much of it financed with U.S. taxpayer dollars.
</p>

<p>
One of Defense Solutions' sales -- a deal to sell Hungarian-owed T-72 tanks to Iraq in 2005 -- was typical of these new foreign military sales. But on the more questionable side is the company's plans to work with Rosoboronexport, which is barred from doing business with the U.S. government, and Libya, which is still on the State Department's arms embargo list. 
</p>

<p>
The Eastern European-Middle East arms-brokering business, while in some cases sanctioned by the U.S. government, has run into problems, including outright corruption and quality. Defense contractor Dale Stoffel, the president of Wye Oak Technology, and another American were gunned down in Iraq in December 2004 after Stoffel alleged that the Iraqi Ministry of Defense was involved in a kickback scheme. Like Defense Solutions, the company Stoffel worked for was refurbishing the Iraq's army Eastern Bloc equipment.
</p>

<p>
Another problem is quality. Weapons from the former Soviet Bloc, which the U.S. military euphemistically calls "nonstandard equipment," have been flagged as substandard, acknowledges Brigadier General Charles Luckey, who is in charge of security assistance at <a href="http://www.mnstci.iraq.centcom.mil/">Multi-National Security Transition Command-Iraq</a>. In an interview from Iraq, Brigadier General Luckey said: "One of the frustrating things about buying nonstandard [weapons], is that I'm the guy who has to deal with the fact that some broker I've never heard of allowed weapons to get to Iraq before they were inspected."
</p>

<div id="embed" style="margin: 0px 0px 15px 15px; float: right; width: 350px; height: auto;">

<img src="http://www.wired.com/images/article/full/2008/07/tank_350px.jpg" alt="" />

<div id="caption">

Defense Solutions is carving a new niche in the arms trade, selling Soviet-made weapons to Middle Eastern countries like Afghanistan and Iraq. Defense Solutions sold Hungarian-owed T-72 tanks to Iraq in 2005.

</div> 

</div>


<p>
In one high-profile case, Iraqi officials alleged that a corrupt firm sold them $400 million in shoddy helicopters from Poland. More recently, a company led by a 21-year-old and a former masseur was offered a U.S. government contract worth nearly $300 million to sell ammunition to Afghanistan. The ammunition turned out to be outdated and of dubious origin and several people connected with the company have been indicted. A congressional investigation concluded that the company, which was on a State Department watch list, was able to take advantage of regulatory loopholes by using middlemen.
</p>

<p>
For those concerned about illicit arms trade, this new wave of weapons deals is rife with the potential for corruption and abuse, but for companies eager to pursue markets once regarded as dubious, it represents a lucrative business opportunity.  The problem in these cases, according to those familiar with arms sales, is that it's no longer clear what's legal and what's not.
</p>
<!--pagebreak-->
<p>
Rachel Stohl, an expert on international arms trade and a senior analyst at Center for Defense Information, says that in many ways, the rush to equip Iraq has led the United States to throw caution to the wind. She points to a report by the Government Accountability Office last year that found that some 190,000 weapons sold to Iraq have gone missing. "I think the reality is we won't know, until way after the fact, about all of these irregularities with the Iraq weapons provision program," she said. "We were providing them all these assault rifles that have gone missing. Why? They were not following the standard procedures that were in place."
</p>

<p>
But Iraq and Afghanistan aren't the only markets available to arms brokers like Defense Solutions. The gradual normalization of relations with Libya opens another door into a quasi-legal area of sales. 
</p>

<p>
Like Iraq, Libya has a substantial arsenal of Soviet-origin military weapons, offering a potential market for brokers working with Russia and other former Soviet states. But even when there's not an outright ban, sales to the Middle East are often fraught with controversy, particularly to countries like Libya, which was under international sanction for more than a decade. Even as sanctions against it have been lifted, European companies proposing to sell arms to Libya have faced steep criticism, particularly since the country is still ruled by dictator Muammar Gaddafi, who took power in a military coup in 1969. 
</p>

<p>
While the United States lifted Libya's "state sponsor of terrorism" designation in 2006, other restrictions, such as on the sale of arms, remain in place. A State Department spokesperson confirmed that exports of "lethal munitions" to Libya, such as tanks or related equipment, are still banned, although sales of nonlethal equipment are now allowed on a case-by-case basis.
</p>

<p>
In late March, Weldon traveled to Libya for a weeklong trip at the invitation of the <a href="http://gdf.org.ly/index.php?lang=ar&Page=101&lang=en">Gaddafi Foundation</a>, a group run by the son of Libya's leader, and the chairman of Libya's foreign affairs committee, according to <a href="http://blog.wired.com/defense/files/libya_trip_report.doc">the report he sent to Defense Solutions</a> (.pdf), a copy of which was obtained by Wired.com. The trip reports states: "Agreement reached for Weldon to quickly return to Libya for meetings with son [of Libyan leader Gaddafi] Morti regarding defense and security cooperation."
</p>

<p>
A document dated April 16, just two weeks after Weldon's trip, outlines Defense Solutions' proposal to Libya to refurbish the country's fleet of armored vehicles, including its T-72 tanks, BMP-1 infantry fighting vehicles, and BTR-60 armored personnel carriers. A copy of the sales proposal, also provided to Wired.com, is on Defense Solutions' letterhead, appears to bear the signature of company CEO Timothy Ringgold, and is addressed to Libya's defense procurement council. "Defense Solutions is committed to delivering a full end-to-end solution to its clients," the proposal states. "Besides refurbishing these vehicles, we are capable of providing a full logistics support package, including a two year supply of spare parts, maintenance and repair services, and operator, maintenance, and repair training."
</p>

<p>
In an interview with Wired.com, Ringgold admitted that he's interested in doing business in Libya and confirms receiving Weldon's trip report from Libya, but denies drafting or signing an arms-sale proposal. "I've never made such a document to Libya," Ringgold insisted, after being read the proposal, and told that his signature is on it.
</p>

<p>
In addition to the Libyan arms-deal document, Wired.com has also reviewed copies of e-mails from Ringgold discussing the Libyan deal.
</p>

<p>
While Ringgold denies proposing an arms sale to Libya, he is open about speaking with Rosoboronexport, which has been on a U.S. government sanctions list since 2006, after the Russian state agency allegedly violated the Iran and Syria Nonproliferation Act. An April e-mail provided to Wired.com describes Ringgold, Weldon and Stephan Minikes, a senior advisor to Defense Solutions and a former ambassador, meeting with Rosoboronexport. The conversations included a number of potential deals, including supplying Mi-17 helicopters to Afghanistan and spare parts for Iraq's infantry fighting vehicles. Ringgold wrote to colleagues following the visit, describing the meetings as a "spectacular success," saying the Russian agency "has the ability to undercut all cost proposals from brokers."
</p>

<p>
Ringgold confirmed those discussions and said that his company has sought to do business with Rosoboronexport. Asked whether Ringgold considers his dealings with Russia to be legal, he argued that U.S. companies could work with Rosoboronexport on a "case-by-case" basis. "The particular purpose of the meeting we had -- and I want to be crystal clear -- was in response to a U.S. government requirement," he said.
</p>

<p>
A number of officials at the State Department and in the Pentagon, when contacted for this article, could not say whether working with Rosoboronexport is legal or not. A Pentagon spokeswoman said she was familiar with the issue, but deferred the question to the State Department. When asked about Rosoboronexport's status on the blacklist, John Herzberg, a State Department spokesman replied: "What's on there is on there."
</p>

<p>
Asked whether, given the ban, there was any way a company could legally work with Rosoboronexport, as Ringgold suggested, Herzberg provided an equivocal answer. "At the stage of the process we're at, I'm unable to give you an answer," he said. "You can try elsewhere in government, and maybe they'll be braver than me."
</p>

<p>
In an interview from Iraq, General Luckey conceded it was a murky area, but said, "My understanding is they are currently on our no-go list." 
</p>

<p>
The confusion over debarred parties has even led the U.S. government into its own legal tangles, according to Jim McAleese, a Washington attorney who specializes in government contracting and foreign military sales. Because the Russian government violated U.S. nonproliferation laws, even NASA had to go to Congress to ensure it could work with Russia on Soyuz flights to the international space station. "What I'm warning you about is, don't be surprised by the confusion," McAleese said. "There are a whole bunch of different statutes that were adopted piecemeal and were never intended to be reconciled."
</p>

<p>
But it's the very ambiguity of the law that troubles those who monitor export control. "It's highly unusual to do anything with the Russians, particularly Rosoboronexport," said Scott Jones, director of Export Control Programs at the <a href="http://www.uga.edu/cits/">Center for International Trade and Security</a> at the University of Georgia. 
</p>

<p>
Legal or not, reputable American companies simply don't want to work with banned entities, Jones said, for fear of risking their reputations and business. "Even if it's not an outright prohibition, most companies don't want to put themselves in a liability situation that has really bad PR … and they stay away from it," Jones said. "But if that's your business, pimping out arms from the U.S. or Russia, that's the way it works, and you push as much as possible."
</p>

<p>
Finding any U.S. defense company working with the Russian government at this point would be "remarkable," Jones added.
</p>

<p>
In the meantime, the future for Weldon is unclear. The FBI investigation continues and Weldon's former chief of staff recently pleaded guilty to a conspiracy charge and is cooperating with the government, notes Melanie Sloan, the executive director of <a href="http://www.citizensforethics.org/">Citizens for Responsibility and Ethics in Washington</a>, which filed a complaint against Weldon in 2004. Sloan speculated that Weldon may be charged with "honest service fraud" for misusing his office for personal gain. "It's an easier standard than bribery," she said. "I wouldn't be surprised [if he's charged] with bribery, but I think it will be honest services fraud."
</p>

<p>
Ringgold insists that he and Weldon are on the right side of the law. "Everything we do is in strict compliance with international and U.S. law and we operate only in the best interests of the U.S. government," he said. "I didn't serve 30 years in the United States Army to throw that away on a whim."
</p>

<p>
Asked if Weldon is still working for the company, Ringgold replied: "Absolutely, proudly so." 
</p><br style="clear: both;"/>
  <img alt="" style="border: 0; height:1px; width:1px;" border="0" src="http://www.pheedo.com/img.phdo?i=3c1b81ed8ecb441b359b5fd6e6dec750" height="1" width="1"/>
<img src="http://www.pheedo.com/feeds/tracker.php?i=3c1b81ed8ecb441b359b5fd6e6dec750" style="display: none;" border="0" height="1" width="1" alt=""/><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=f5EjSJ"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=f5EjSJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=zYmkhj"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=zYmkhj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=S9Ojfj"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=S9Ojfj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=xPEQRJ"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=xPEQRJ" border="0"></img></a>
 <a href="http://feeds.wired.com/~f/wired/politics/security?a=OTsesJ"><img src="http://feeds.wired.com/~f/wired/politics/security?i=OTsesJ" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=wFj1Jj"><img src="http://feeds.wired.com/~f/wired/politics/security?i=wFj1Jj" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=OExjrj"><img src="http://feeds.wired.com/~f/wired/politics/security?i=OExjrj" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=DKk6TJ"><img src="http://feeds.wired.com/~f/wired/politics/security?i=DKk6TJ" border="0"></img></a> </div><img src="http://feeds.feedburner.com/~r/wired/politics/privacy/~4/326164069" height="1" width="1"/><img src="http://feeds.wired.com/~r/wired/politics/security/~4/326164070" height="1" width="1"/>]]></content:encoded>
      <pubDate>Thu, 03 Jul 2008 18:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/arms brokers">arms brokers</category>
      <category domain="http://securityratty.com/tag/brokers">brokers</category>
      <category domain="http://securityratty.com/tag/infamous arms brokers">infamous arms brokers</category>
      <category domain="http://securityratty.com/tag/defense">defense</category>
      <category domain="http://securityratty.com/tag/firm defense solutions">firm defense solutions</category>
      <category domain="http://securityratty.com/tag/arms">arms</category>
      <category domain="http://securityratty.com/tag/arms trade">arms trade</category>
      <category domain="http://securityratty.com/tag/international arms trade">international arms trade</category>
      <category domain="http://securityratty.com/tag/russian weapons suppliers">russian weapons suppliers</category>
      <source url="http://feeds.wired.com/~r/wired/politics/security/~3/326164070/defense_solutions">U.S. Arms Dealer Tests Legal Bounds in Middle East Arms Bazaar</source>
    </item>
    <item>
      <title><![CDATA[U.S. Satellites Snooping on Iraqi Army]]></title>
      <link>http://securityratty.com/article/c71ef91ac49869cf535dcbfa33222e18</link>
      <guid>http://securityratty.com/article/c71ef91ac49869cf535dcbfa33222e18</guid>
      <description><![CDATA[U.S. spy satellites are watching, to make sure Iraqi troops are where they say they'll be. But that doesn't mean American forces don't trust their new Iraqi counterparts, a military source...]]></description>
      <content:encoded><![CDATA[U.S. spy satellites are watching, to make sure Iraqi troops are where they say they'll be. But that doesn't mean American forces don't trust their new Iraqi counterparts, a military source swears.<br style="clear: both;"/>
      <a href="http://www.pheedo.com/click.phdo?s=8ddf081d5ce02dd9c549eb77ec898baa"><img alt="" style="border: 0;" border="0" src="http://www.pheedo.com/img.phdo?s=8ddf081d5ce02dd9c549eb77ec898baa"/></a>
  <img src="http://www.pheedo.com/feeds/tracker.php?i=8ddf081d5ce02dd9c549eb77ec898baa" style="display: none;" border="0" height="1" width="1" alt=""/><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=Y512LJ"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=Y512LJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=WPcOKj"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=WPcOKj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=yvoVRj"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=yvoVRj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=EfnPgJ"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=EfnPgJ" border="0"></img></a>
 <a href="http://feeds.wired.com/~f/wired/politics/security?a=mYUrMJ"><img src="http://feeds.wired.com/~f/wired/politics/security?i=mYUrMJ" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=lZT5Rj"><img src="http://feeds.wired.com/~f/wired/politics/security?i=lZT5Rj" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=um76qj"><img src="http://feeds.wired.com/~f/wired/politics/security?i=um76qj" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=kj8KQJ"><img src="http://feeds.wired.com/~f/wired/politics/security?i=kj8KQJ" border="0"></img></a> </div><img src="http://feeds.feedburner.com/~r/wired/politics/privacy/~4/325217205" height="1" width="1"/><img src="http://feeds.wired.com/~r/wired/politics/security/~4/325217208" height="1" width="1"/>]]></content:encoded>
      <pubDate>Wed, 02 Jul 2008 14:55:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/military source swears">military source swears</category>
      <category domain="http://securityratty.com/tag/spy satellites">spy satellites</category>
      <category domain="http://securityratty.com/tag/american forces">american forces</category>
      <category domain="http://securityratty.com/tag/iraqi troops">iraqi troops</category>
      <category domain="http://securityratty.com/tag/iraqi counterparts">iraqi counterparts</category>
      <category domain="http://securityratty.com/tag/trust">trust</category>
      <source url="http://feeds.wired.com/~r/wired/politics/security/~3/325217208/us-sats-spying.html">U.S. Satellites Snooping on Iraqi Army</source>
    </item>
    <item>
      <title><![CDATA[Mashup of the Titans]]></title>
      <link>http://securityratty.com/article/6289294023616c0d4219941919c976a5</link>
      <guid>http://securityratty.com/article/6289294023616c0d4219941919c976a5</guid>
      <description><![CDATA[Information Security - an Oxymoron for the information age

Always the beautiful answer who asks a more beautiful question. e. e. cummings
or why i am with Gelernter

This is a mashup of Saltzer &amp;...]]></description>
      <content:encoded><![CDATA[<div>Information Security - an Oxymoron for the information age</div><br /><div>“Always the beautiful answer who asks a more beautiful question.” e. e. cummings</div><div>...or why i am with Gelernter</div><br /><div>This is a mashup of Saltzer &amp; Schroeder&#39;s famous <a href="http://www.cs.virginia.edu/~evans/cs551/saltzer/">information security principles</a> with David Gelernter&#39;s <a href="http://www.edge.org/documents/archive/edge70.html">Manifesto</a>.</div><br /><div>The premise of this mashup is to examine the paper by Saltzer and Schroeder which was written in 1975 and serves as the basis for most information security programs against the Gelernter&#39;s manifesto as to where computing is actually going. Each of the eight principles in Saltzer and Schroeder&#39;s paper is listed in order, and followed by select excerpts of Gelernter&#39;s manifesto. This comparison is to examine theoretical information security principles vis a vis the actual utility of modern information systems. I will not make an attempt to reconcile theory and practice, but will point out where the two schools of thought agree. In fairness, Saltzer and Schroeder&#39;s paper was written 25 years before Gelernter&#39;s, however Saltzer and Schroeder&#39;s principles dominate the thinking about information security to this day and so its important to view them side by side with Gelernter&#39;s thinking on the direction of computing.</div><br /><div style="color: #bf5f00; ">Saltzer and Schroeder:</div><div>&quot;a) Economy of mechanism: Keep the design as simple and small as possible. This well-known principle applies to any aspect of a system, but it deserves emphasis for protection mechanisms for this reason: design and implementation errors that result in unwanted access paths will not be noticed during normal use (since normal use usually does not include attempts to exercise improper access paths). As a result, techniques such as line-by-line inspection of software and physical examination of hardware that implements protection mechanisms are necessary. For such techniques to be successful, a small and simple design is essential.&quot;</div><br /><div style="color: #0060bf; ">Gelernter:</div><div>&quot;9. The computing future is based on &quot;cyberbodies&quot; — self-contained, neatly-ordered, beautifully-laid-out collections of information, like immaculate giant gardens.&quot;</div><br /><div><span style="color: #00bf00; ">Conclusion(gp):</span>&#0160;So far, so good</div><br /><div>**</div><br /><div><span style="color: #bf5f00; ">Saltzer and Schroeder:</span><br /></div><div>&quot;b) Fail-safe defaults: Base access decisions on permission rather than exclusion. This principle, suggested by E. Glaser in 1965,8 means that the default situation is lack of access, and the protection scheme identifies conditions under which access is permitted. The alternative, in which mechanisms attempt to identify conditions under which access should be refused, presents the wrong psychological base for secure system design. A conservative design must be based on arguments why objects should be accessible, rather than why they should not. In a large system some objects will be inadequately considered, so a default of lack of permission is safer. A design or implementation mistake in a mechanism that gives explicit permission tends to fail by refusing permission, a safe situation, since it will be quickly detected. On the other hand, a design or implementation mistake in a mechanism that explicitly excludes access tends to fail by allowing access, a failure which may go unnoticed in normal use. This principle applies both to the outward appearance of the protection mechanism and to its underlying implementation.&quot;</div><br /><div><span style="color: #00bf00; ">Conclusion(gp):</span>&#0160;A conservative design principle that puts the object&#39;s owner in control of permissions. This makes a lot of sense from the object point of view, but does little to address the use case in which it executes.</div><br /><div>**</div><br /><div><span style="color: #bf5f00; ">Saltzer and Schroeder:</span><br /></div><div>&quot;c) Complete mediation: Every access to every object must be checked for authority. This principle, when systematically applied, is the primary underpinning of the protection system. It forces a system-wide view of access control, which in addition to normal operation includes initialization, recovery, shutdown, and maintenance. It implies that a foolproof method of identifying the source of every request must be devised. It also requires that proposals to gain performance by remembering the result of an authority check be examined skeptically. If a change in authority occurs, such remembered results must be systematically updated.&quot;</div><br /><div><span style="color: #0060bf; ">Gelernter:</span><br /></div><div>&quot;8. The software systems we depend on most today are operating systems (Unix, the Macintosh OS, Windows et. al.) and browsers (Internet Explorer, Netscape Communicator...). Operating systems are connectors that fasten users to computers; they attach to the computer at one end, the user at the other. Browsers fasten users to remote computers, to &quot;servers&quot; on the internet.</div><br /><div>Today&#39;s operating systems and browsers are obsolete because people no longer want to be connected to computers — near ones OR remote ones. (They probably never did). They want to be connected to information. In the future, people are connected to cyberbodies; cyberbodies drift in the computational cosmos — also known as the Swarm, the Cybersphere.</div><br /><div>13. Any well-designed next-generation electronic gadget will come with a ``Disable Omniscience&#39;&#39; button.</div><br /><div>17. A cyberbody can be replicated or distributed over many computers; can inhabit many computers at the same time. If the Cybersphere&#39;s computers are tiles in a paved courtyard, a cyberbody is a cloud&#39;s drifting shadow covering many tiles simultaneously.</div><br /><div>20. If a million people use a Web site simultaneously, doesn&#39;t that mean that we must have a heavy-duty remote server to keep them all happy? No; we could move the site onto a million desktops and use the internet for coordination. The &quot;site&quot; is like a military unit in the field, the general moving with his troops (or like a hockey team in constant swarming motion). (We used essentially this technique to build the first tuple space implementations. They seemed to depend on a shared server, but the server was an illusion; there was no server, just a swarm of clients.) Could Amazon.com be an itinerant horde instead of a fixed Central Command Post? Yes.&quot;</div><br /><div><span style="color: #00bf00; ">Conclusion(gp):</span>&#0160;Complete mediation provides the underpinning for Saltzer and Schroeder&#39;s system, but does not appear to scale to the desired itinerant horde at least in common interpretation.</div><br /><div>**</div><br /><div><span style="color: #bf5f00; ">Saltzer and Schroeder:</span><br /></div><div>&quot;d) Open design: The design should not be secret. The mechanisms should not depend on the ignorance of potential attackers, but rather on the possession of specific, more easily protected, keys or passwords. This decoupling of protection mechanisms from protection keys permits the mechanisms to be examined by many reviewers without concern that the review may itself compromise the safeguards. In addition, any skeptical user may be allowed to convince himself that the system he is about to use is adequate for his purpose. Finally, it is simply not realistic to attempt to maintain secrecy for any system which receives wide distribution.&quot;</div><br /><div><span style="color: #00bf00; ">Conclusion(gp):</span>&#0160;both seem to agree, hard to get the itinerant horde moving in a swarm without open standards.</div><br /><div>**</div><br /><div><span style="color: #bf5f00; ">Saltzer and Schroeder:</span><br /></div><div>&quot;e) Separation of privilege: Where feasible, a protection mechanism that requires two keys to unlock it is more robust and flexible than one that allows access to the presenter of only a single key. The relevance of this observation to computer systems was pointed out by R. Needham in 1973. The reason is that, once the mechanism is locked, the two keys can be physically separated and distinct programs, organizations, or individuals made responsible for them. From then on, no single accident, deception, or breach of trust is sufficient to compromise the protected information. This principle is often used in bank safe-deposit boxes. It is also at work in the defense system that fires a nuclear weapon only if two different people both give the correct command. In a computer system, separated keys apply to any situation in which two or more conditions must be met before access should be permitted. For example, systems providing user-extendible protected data types usually depend on separation of privilege for their implementation.&quot;</div><br /><div><span style="color: #0060bf; ">Gelernter:</span><br /></div><div>&quot;37. Elements stored in a mind do not have names and are not organized into folders; are retrieved not by name or folder but by contents. (Hear a voice, think of a face: you&#39;ve retrieved a memory that contains the voice as one component.) You can see everything in your memory from the standpoint of past, present and future. Using a file cabinet, you classify information when you put it in; minds classify information when it is taken out. (Yesterday afternoon at four you stood with Natasha on Fifth Avenue in the rain — as you might recall when you are thinking about &quot;Fifth Avenue,&quot; &quot;rain,&quot; &quot;Natasha&quot; or many other things. But you attached no such labels to the memory when you acquired it. The classification happened retrospectively.)&quot;</div><br /><div><span style="color: #00bf00; ">Conclusion(gp):</span>&#0160;Information Security models tend to look at things statically through information classification lenses, but its how information is used that makes it valuable. In practice this is how information security theory breaks down in the face of reality - what does an access control matrix look like for a mashup? What does it look like for a data mining app?</div><br /><div>**</div><br /><div><span style="color: #bf5f00; ">Saltzer and Schroeder:</span><br /></div><div>&quot;f) Least privilege: Every program and every user of the system should operate using the least set of privileges necessary to complete the job. Primarily, this principle limits the damage that can result from an accident or error. It also reduces the number of potential interactions among privileged programs to the minimum for correct operation, so that unintentional, unwanted, or improper uses of privilege are less likely to occur. Thus, if a question arises related to misuse of a privilege, the number of programs that must be audited is minimized. Put another way, if a mechanism can provide &quot;firewalls,&quot; the principle of least privilege provides a rationale for where to install the firewalls. The military security rule of &quot;need-to-know&quot; is an example of this principle.&quot;</div><br /><div><span style="color: #0060bf; ">Gelernter:</span><br /></div><div>&quot;28. Metaphors have a profound effect on computing: the file-cabinet metaphor traps us in a &quot;passive&quot; instead of &quot;active&quot; view of information management that is fundamentally wrong for computers.</div><br /><div>29. The rigid file and directory system you are stuck with on your Mac or PC was designed by programmers for programmers — and is still a good system for programmers. It is no good for non-programmers. It never was, and was never intended to be.</div><br /><div>30. If you have three pet dogs, give them names. If you have 10,000 head of cattle, don&#39;t bother. Nowadays the idea of giving a name to every file on your computer is ridiculous.&quot;</div><br /><div><span style="color: #00bf00; ">Conclusion(gp):</span>&#0160;Least Privilege is the point where the practical matter of applying Saltzer and Schroeder&#39;s principles breaks down in modern systems. Its a deployment issue, and a matter of insufficient models and modes.</div><br /><div>**</div><br /><div><span style="color: #bf5f00; ">Saltzer and Schroeder:</span><br /></div><div>&quot;g) Least common mechanism: Minimize the amount of mechanism common to more than one user and depended on by all users [28]. Every shared mechanism (especially one involving shared variables) represents a potential information path between users and must be designed with great care to be sure it does not unintentionally compromise security. Further, any mechanism serving all users must be certified to the satisfaction of every user, a job presumably harder than satisfying only one or a few users. For example, given the choice of implementing a new function as a supervisor procedure shared by all users or as a library procedure that can be handled as though it were the user&#39;s own, choose the latter course. Then, if one or a few users are not satisfied with the level of certification of the function, they can provide a substitute or not use it at all. Either way, they can avoid being harmed by a mistake in it.&quot;</div><br /><div><span style="color: #0060bf; ">Gelernter:</span><br /></div><div>&quot;6. Miniaturization was the big theme in the first age of computers: rising power, falling prices, computers for everybody. Theme of the Second Age now approaching: computing transcends computers. Information travels through a sea of anonymous, interchangeable computers like a breeze through tall grass. A dekstop computer is a scooped-out hole in the beach where information from the Cybersphere wells up like seawater.</div><br /><div>16. The future is dense with computers. They will hang around everywhere in lush growths like Spanish moss. They will swarm like locusts. But a swarm is not merely a big crowd. The individuals in the swarm lose their identities. The computers that make up this global swarm will blend together into the seamless substance of the Cybersphere. Within the swarm, individual computers will be as anonymous as molecules of air.</div><br /><div>55. Software can solve hard problems in two ways: by algorithm or by making connections — by delivering the problem to exactly the right human problem-solver. The second technique is just as powerful as the first, but so far we have ignored it.</div><br /><div>56. Lifestreams and microcosms are the two most important cyberbody types; they relate to each other as a single musical line relates to a single chord. The stream is a &quot;moment in space,&quot; the microcosm a moment in time.&quot;</div><br /><div>**</div><br /><div><span style="color: #bf5f00; ">Saltzer and Schroeder:</span><br /></div><div>&quot;h) Psychological acceptability: It is essential that the human interface be designed for ease of use, so that users routinely and automatically apply the protection mechanisms correctly. Also, to the extent that the user&#39;s mental image of his protection goals matches the mechanisms he must use, mistakes will be minimized. If he must translate his image of his protection needs into a radically different specification language, he will make errors.&quot;</div><br /><div><span style="color: #0060bf; ">Gelernter:</span><br /></div><div>&quot;7. &quot;The network is the computer&quot; — yes; but we&#39;re less interested in computers all the time. The real topic in astronomy is the cosmos, not telescopes. The real topic in computing is the Cybersphere and the cyberstructures in it, not the computers we use as telescopes and tuners.</div><br /><div>27. Modern computing is based on an analogy between computers and file cabinets that is fundamentally wrong and affects nearly every move we make. (We store &quot;files&quot; on disks, write &quot;records,&quot; organize files into &quot;folders&quot; — file-cabinet language.) Computers are fundamentally unlike file cabinets because they can take action.</div><br /><div>31. Our standard policy on file names has far-reaching consequences: doesn&#39;t merely force us to make up names where no name is called for; also imposes strong limits on our handling of an important class of documents — ones that arrive from the outside world. A newly-arrived email message (for example) can&#39;t stand on its own as a separate document — can&#39;t show up alongside other files in searches, sit by itself on the desktop, be opened or printed independently; it has no name, so it must be buried on arrival inside some existing file (the mail file) that does have a name. The same holds for incoming photos and faxes, Web bookmarks, scanned images...</div><br /><div>32. You shouldn&#39;t have to put files in directories. The directories should reach out and take them. If a file belongs in six directories, all six should reach out and grab it automatically, simultaneously.</div><br /><div>33. A file should be allowed to have no name, one name or many names. Many files should be allowed to share one name. A file should be allowed to be in no directory, one directory, or many directories. Many files should be allowed to share one directory. Of these eight possibilities, only three are legal and the other five are banned — for no good reason.</div><br /><div>53. Your car, your school, your company and yourself are all one-track vehicles moving forward through time, and they will each leave a stream-shaped cyberbody (like an aircraft&#39;s contrail) behind them as they go. These vapor-trails of crystallized experience will represent our first concrete answer to a hard question: what is a company, a university, any sort of ongoing organization or institution, if its staff and customers and owners can all change, its buildings be bulldozed, its site relocated — what&#39;s left? What is it? The answer: a lifestream in cyberspace.&quot;</div><br /><br /><div>**</div><div style="color: #00bf00; ">Conclusion(gp):</div><br /><div>The Saltzer and Schroeder principles of Open Design and Economy of Mechanism hold up well in the face of modern computing realities, and to a certain extent Fail Safe Defaults does as well; however if we information security people are to be effective we need to re-think the other principles.</div><br /><div>**</div><br /><div>Last word:&#0160;<span style="color: #0060bf; ">Gelernter:</span></div><div>We&#39;ll know the system is working when a butterfly wanders into the in-box and (a few wingbeats later) flutters out — and in that brief interval the system has transcribed the creature&#39;s appearance and analyzed its way of moving, and the real butterfly leaves a shadow-butterfly behind. Some time soon afterward you&#39;ll be examining some tedious electronic document and a cyber-butterfly will appear at the bottom left corner of your screen (maybe a Hamearis lucina) and pause there, briefly hiding the text (and showing its neatly-folded rusty-chocolate wings like Victorian paisley, with orange eyespots) — and moments later will have crossed the screen and be gone.</div>]]></content:encoded>
      <pubDate>Wed, 25 Jun 2008 13:29:25 +0000</pubDate>
      <category domain="http://securityratty.com/tag/protection mechanisms">protection mechanisms</category>
      <category domain="http://securityratty.com/tag/protection mechanisms correctly">protection mechanisms correctly</category>
      <category domain="http://securityratty.com/tag/information security">information security</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/implements protection mechanisms">implements protection mechanisms</category>
      <category domain="http://securityratty.com/tag/information travels">information travels</category>
      <category domain="http://securityratty.com/tag/information security people">information security people</category>
      <category domain="http://securityratty.com/tag/protection">protection</category>
      <category domain="http://securityratty.com/tag/potential information path">potential information path</category>
      <source url="http://1raindrop.typepad.com/1_raindrop/2008/06/mashup-of-the-titans.html">Mashup of the Titans</source>
    </item>
  </channel>
</rss>
