Schneier on Security

Clive Robinson • May 10, 2025 1:44 PM

@ ALL,

From time to time I mention that “ICT Sec” has foundations in the standard infrastructure we all rely on. That is the supply of power, water, and communications.

I also point out that when “power” goes down so does water and communications shortly there after. Worse it causes a latch-up effect where both power and water need communications to be brought back up in a reasonable time period.

So anything that effects power in a major way is going to be a serious event. Around 60million in South West Europe discovered this awkward fact a few days back.

But that was due as far as we can tell due to “safety systems” tripping and cascading without actual damage.

However we know from the Victorian era that the earth can get hit by significant solar “Coronal Mass Ejections”(CMEs) the worst recorded being the Carrington Event of Sep 1859,

https://en.wikipedia.org/wiki/Carrington_Event

A time when there was little infrastructure and electrical communications was by hand telegraphy and chemical batteries.

A century and a half later, the situation is very different in certain Western Cities survival will not be possible if the power stays out for more than a week because not only will water not come in nor will food or the power to cook it, oh and sewage won’t get removed.

As a “little” hint as to what that means have a read up on a refuse removal stoppage due to strike action and political stupidity. That started at the begining of the year and effects over a million people and is now oft called the “Birmingham bin strike” the photos are quite graphic but unsurprising.

So imagine what will happen if the power grid goes down and can not be brought back up for months if not a year or more?

Well a full on CME / Carrington Event is very likely to “destroy the grid” if it is above ground.

The probability of a CME doing this is fairly obviously related to the frequency of CMEs and of their effective power and duration.

All of which are apparently getting worse according to this Scientific American article,

https://www.scientificamerican.com/article/stronger-solar-activity-cycles-may-be-in-the-suns-forecast/

As the article points out, humans have short memories and thus poor long term planning, and… as far as solar activity is concerned we’ve had it quiet for most of the past decade or so.

So consider what that means as far as “maintenance costs” and “shareholder value” and executive bonuses…

Clive Robinson • May 11, 2025 5:54 AM

@ Dancing on thin ice,

“Can this be part of the motive for someone with an AI company to have unfettered access to higher quality government data?”

The answer to that pivots on the notion of “quality”… Government databases are not known to be “high quality” especially those that have the purpose of getting money into the treasury.

It’s why the DOGiE “official reason” to go after it of looking for fraud and inefficiencies etc is almost –but not quite– believable as a “cover story”.

Why do I say “cover story” well from what has been whispered all that data is on it’s way to Palantir(an organisation I’ve rung bells about since before the Cambridge Analytica scare). Basically it’s to go in their “intelligence systems” to be sold back to Federal Government Agencies, Nation and State Government Agencies, and any organisation that employes the equivalent of intelligence analysts, detectives, or data analysts.

The Palantir idea being to get others to type in active intelligence/data and process it and repackage it by AI and similar.

Palantir use the “Drug Pusher” business model where the product starts off being inexpensive, but as dependency rises so does the cost. The twist Palantir are adding is three fold. Firstly you have to use their systems and snything typed in automatically becomes Palantir’s. Secondly they want to ensure the detectives and data analysts are in effect “sacked” and Palantir then slurps up the equivalent of those sacked wages and other costs as Palantir income/profit, jacking prices up as the number of investigators/analysts drops. Thirdly they will repackage data input into their systems and up sell it to those further up the investigative tree.

So police reports become reports for the state level agencies that in turn get augmented and pushed up to the higher levels of Government.

All to be done by Palantir’s in house analysts and “expert systems”

It does not take much imagination to see how older AI systems would be attractive to Palantir, but not so much the current LLM and ML systems. Which unfortunately “soft bullshit” for as high as 45% of the time, and it’s getting worse as I mentioned just a day or two back, and it’s an inherent fundamental of LLMs built by Transformer type ML.

Clive Robinson • May 13, 2025 3:41 AM

@ fib,

My earlier reply to you appears to have been “lost in the machine”…

But moving on, you note,

“Burying power lines is dismissed as “too expensive.” But compare that cost to the consequences of grid collapse in extreme weather, cyberattacks, or even solar storms — the stakes are existential. High-impact, low-frequency events are easy to ignore until they’re not.”

Some would also question “existential” but it’s not. In domestic usage something like 8/10ths of the electrical power is used “to move heat around”. That is

1, Heating / cooling of air
2, Cooking / refrigeration of food
3, Heating of water for cleanliness

Of the remaining 2/10ths modern lighting takes a small fraction and mechanical items like vacuum cleaners not much more (most energy in cloths / dish washers is heating water, and air for drying).

With an increasing consumption on what is modern gizzmos such as “entertainment” which is increasingly by electronic processing and communications of some form.

So when “the power goes out” many people are going to be in trouble as ordinary people in Texas found out the hard way and folks in California found out repeatedly every time the wind got up a little.

Now consider what is really in danger is “transformers” in essence large lumps of soft iron with lots of copper wire wound around them. A CME can easily melt the copper winding at which point the transformer ceases to work and is little more than a near immovable lump of scrap. However they are not “off the shelf” components, they are nearly all bespoke, with lead-times measured in months if not years.

Lets say 50% of the US grid goes down and 10% of the transformers get burnt out… How long do you think it would be before things return to normal? There are various estimates but they really don’t matter because any major area like NYC would be little more than a refugee camp within two to three weeks and mostly uninhabitable. Likewise no work could be done by significantly over 9/10ths of the working population without power… If it happened at peek summer or winter the death rate from the heat or cold would be 2/10ths from the mainly old and infirm.

Then there is disease and pestilence which could be over 9/10ths of the population within 50days.

All of course assuming that water and food can be got in, and sewage out which is unlikely. There are some “model” outputs that suggest 95% of the population would be dead within a year.

However actual “refugee camps” set up after devastating natural disasters suggest the death tolls will be less. But… usually such camps contain people who are more likely to survive simply because their normal standard of living is very much less energy dependent thus they have the necessary skills to survive, that have been effectively lost in the first world where city living now far outnumbers rural living.

Clive Robinson • May 14, 2025 5:01 AM

@ lurker, ALL,

Spot the corporate PR platitude of

“… the data theft did not include useable payment or card details, or any account passwords.”

So what. The Personal details are enough to do way more damage.

It appears to be a now standard PR trick, to say “but they did not get XXX” with the implication “we are the good guys showing restraint” when in fact they are not.

Look at what has been lost and ask two questions of each type,

1, Why were they keeping it?
2, How much damage can be done with it?

Then go roast the PR people and do rather more than “hold their feet to the fire”. Likewise the execs and C-suits hiding behind them.

Back last century I got upset with some of my relatives for posting a detailed family tree onto a personal web page that included my details.

I pointed out that they had not asked my permission and told them to take it down because it was not just a threat to the living, but also those who were nolonger with us. Because over in Utah there were a group of “religious types” grabbing peoples details and using them not just to build detailed records but to baptize people into “their faith”.

Of course these “religious types” have to pay for their systems and “Church Donations” would not be sufficient… Therefore logically they must be making money with the data one way or another.

When NSA Blufdale happened and one snippit that dropped out was that the people in the area were the “right sort” politically and technically… Who basically had been working for the “religious types”,

https://archive.sltrib.com/article.php?id=56472070&itype=CMSID

But back last century cyber-criminals whilst having “technical smarts” were not very good at “monetisation” of their ill gotten data gains. I had an argument with Richard Clayton over at the UK Cambridge Computer Labs over this, as I assumed they would either “partner up”, “be taken over” by other criminals who had the smarts, or they would “wise up”. In the end all three happened one way or the other.

What I did not see was “criminal governments” turning them into waged civil servants in part because crypto-coins were not really a thing. Even though the signs were there I did not think about Russia and North Korea using them for “balance of payments” activities.

But the point is the US now has DOGiE aligned with Palantir grabbing every piece of personal data there is, no matter what legislation and regulation might say.

They would not be grabbing it if the did not see value in it.

So the same is true for less official cyber-crooks, they would not grab it unless it had value to them.

Something our host @Bruce talked about when he noted that “Data Is a Toxic Asset, So Why Not Throw It Out?”

My view is to not let “my data” be collected to be someone elses “Toxic Asset” without my consent, which I don’t give.

Clive Robinson • May 15, 2025 5:40 AM

@ Bruce, ALL,

I suspect this ruling in Europe will be big news over the next few days as most of Big Tech and MSM and similar will be critically effected,

“Google, Microsoft, Amazon, X, and the entire tracking-based advertising industry rely on the “Transparency & Consent Framework” (TCF) to obtain “consent” for data processing. This evening [14 May] the Belgian Court of Appeal ruled that the TCF is illegal. “

https://www.iccl.ie/digital-data/eu-ruling-tracking-based-advertising-by-google-microsoft-amazon-x-across-europe-has-no-legal-basis/

You will see the hand of Dr Ryan behind the action so a hat tip in that direction.

I guess we are going to have to wait for the screaming and writhing of those hit by this as they look for loop holes to try to get back the data flows.

And Yes, whilst the “Irish Council for Civil Liberties” might look like an odd site to go to, whilst there are other more mainstream links that present the story they are on sites that are very much part of such now unlawful tracking…

Clive Robinson • May 15, 2025 7:57 AM

@ ResearcherZero,

A person who was a regular poster on subjects involving “the bank of mom and dad” and similar noted a point that I will summarize,

The neo-con / self entitled viewpoint is,

“If you are not working for their profit then you are robbing them of their god given rights.”

Thus “kill them off” is their follow on thought as the resources required to keep you and a whole load of others alive are not going into their pockets.

I could go on but I suspect the post would “vanish into the machine”.