Schneier on Security

Clive Robinson • October 15, 2015 9:42 AM

The Op-Ed starts with the wrong assumptions,

Cyberweapons, by contrast, can be as simple as a few inexpensively acquired lines of code. They are available to state and non-state actors and can be hard to distinguish from benign online activity.

They are not lines of “code” but the more general “information” likewise they are not “weapons” but “instructions”.

This is a general mistake many –including those who should know better– make, and thus their thinking almost immediately goes astray.

Neither “information” or “instructions” have any kind of physical actuality except when impressed or encoded onto physical objects for storage, transmission or processing.

Not understanding this and the implications that transpire from it, means you can not effectively deal with the effects let alone legislate or form treaties that will be effective.

The majority of legislation is about physical objects constrained by the laws of nature and how we humans and other physical objects interact. It also assumes a “controlling mind” that can be traced by evidence and prosecuted against in some way, and importantly locality.

It can easily be demonstrated that information is not constrained by the laws of nature and as such can be endlessly impressed onto any kind of physical object at will the only energy required being that to impress the information onto the object. Thus as is usually the case with malware etc the energy for the copying of information and endless replication is at the expense not of the attacker but the defender.

Thus to an attacker the only expense is that of collecting the information to form the instructions and make the primary instruction set and make the initial transmission of that set.

That set is then endlessly duplicated not by the attackers resources but by the resources of others including those of the defenders.

Imagine for a moment I give you a recipe book, you photocopy out a recipe, then go and buy the ingredients, follow the instructions and the end result is a cake. Has any crime been committed? Probably not, even if it has, then by whom?

This is where the law looks for intent but to establish this it has to have evidence of some form, often primary evidence is not available, so circumstantial evidence is used and this is at the very least viewpoint specific.

So if the cake you make poisons somebody are you guilty or is somebody else. You have to look at the evidence of what the poison is and how it got into the cake and then make a judgement call. If the poison is say arsenic then that should not be in a cake at any time thus judgement would normally say it’s a premeditated act thus you go looking for the source of the poison and the controlling mind.

However what if instead of a cake it’s a bean salad and the poison is found to be an alkaloid plant poison in the beans that have not been prepared properly. The judgement you now have to make is was there actually a controlling mind or due to insufficient information an unfortunate set of circumstances that inadvertently caused a poisoning. Do you go a step further and say that the recipe was lacking in information which is quite likely, and then try to say I was a controlling mind that gave you a standard recipe, knowing that you lacked the knowledge to make the extra steps before making the salad?

This is the problem with information and establishing a crime has been committed and exactly by whom. You can not legislate against the partial giving or partial withholding of information because there are too many loop holes that can be exploited. Which get worse when there is one or more intermediary points.

That is if I’ve loaned you a recipe book do I actually have reason to know you will only photocopy the recipe and not the earlier part that tells you how to prepare the beans correctly? What if I don’t give you the book but instead the catalogue reference for it in your local library? How about I give the reference not to you but your mother?…

These are the distancing steps you take for deniable actions, which state level operators do all the time.

We have already seen this with North Korea and Sony Picture Entertainments, where the US acted as illegal investigator, biased prosecutor, biased judge and biased jury to pass sentence. We are told to take it on faith that there is evidence, but for National Security reasons we can not be told…

We were also told the same for Iraqi WMD and detainees at Gitmo. Much of which has been shown to be at best serious mistakes at worst deliberate attempts to deceive for profit and other forms of corruption.

Knowing the deaths that resulted, do you really think any kind of legislation or treaty will stop this from being done again in the future?

The way to stop this is firstly make our systems much much more secure, secondly treat things as criminal activity not military activity, thirdly come up with an impartial international court and investigators with real authority and let them do the job without political interference. That way hopefully things will not go kinetic.