Schneier on Security

gordo • January 9, 2015 5:28 AM

Attribution claims, information veracity, and trust climates…

On December 9, 2014, the U.S. Senate Select Committee on Intelligence (SSCI) released its Committee Study of the Central Intelligence Agency’s Detention and Interrogation Program. Ten days later, on December 19th, the FBI, in its Update on Sony Investigation press release said, “the FBI now has enough information to conclude that the North Korean government is responsible for these actions.”

A key point in the SSCI study, as reported by The New York Times, was that the “The C.I.A. misled members of Congress and the White House about the effectiveness and extent of its brutal interrogation techniques.” The news-cycle for this controversial story was strong and still going when the FBI announced its attribution findings on the Sony hack.

When one adds to that a generally accepted cultural lens or norm for assessing information veracity, “trust, but verify,” which entered the American, if not international, lexicon, well before the end of the Cold War, then it should come as no surprise that some might be wary of the FBI’s attribution claim, and want to see harder evidence.

As so, it took less than a month for a disparaging cultural meme to enter the public discourse on the subject. As reported by The Daily Beast, FireEye’s Richard Bejtlich said, “I don’t expect anything the FBI says will persuade Sony truthers” (para. 12).

One hopes that as the heat of the moment recedes, so too, such sentiments, especially those that might be construed as blanket, or broad-brush in tone, and coming from persons in positions of authority and influence within the security community. With regard to Mr. Schneier, I believe he’s struck a proper tone, as has, for example, Marc Rogers, of CloudFare, Inc., and Defcon Communications, who told The Huffington Post that he has the same problems with Norse’s claims that he has with the FBI’s (para. 10).

Looking ahead then, and getting back to the Rid and Buchanan paper, Attributing Cyber Attacks, the title of this thread, we read from the authors’ concluding paragraph that a hope they have is that their text,

“… will help senior leaders in public administration as well as parliament to understand how evidence was generated, to ask better-informed questions, to detect perception bias, and thus to probe and improve the output” (p. 30).

One hope’s, as well, as these kinds of nation-state matters come under U.S. congressional oversight, that Congress and the American people do in fact receive from their government agencies the respect that, at times, seems long overdue.

gordo • January 11, 2015 11:39 PM

Whether one agrees with the first half of the following headline or not, the second half of the headline gets at the underlying issue.

“The Feds Got the Sony Hack Right, But the Way They’re Framing It Is Dangerous”

…the critics accurately state that technical analysis is prone to bias and error, making inherent trust in the government’s theory unwise. The evidence presented so far does not accurately show that North Korea was responsible for the Sony attack. And by its nature, the information security community does not generally accept “because I said so” and “trust us” as adequate answers. Not blindly trusting information is exactly what makes for a good infosec professional. And asking tough questions is an important part of solidifying theories and reaching appropriate conclusions. The FBI should have predicted this response from the community when it decided to publicly attribute while withholding significant portions of the evidence. What the government chose was a middle ground that not only polarized the community but set a bad precedent. More transparency would have strengthened the case and established a higher bar for attribution.

As so, Rid and Buchanan, in Attributing Cyber Attacks</> write: