Encryption Is Not the Answer to Security Problems

I just read Cyber Fail: Why can't the government keep hackers out? Because the public is afraid of letting it, an article in the new Foreign Policy National Security channel. I've Tweeted on Mr Arquilla's articles before, but this new one published today offers a solution to security problems that just won't work.Consider these excerpts:

Back in President Bill Clinton's first term, the "clipper chip" concept was all about improving the security of private communications. Americans were to enjoy the routine ability to send strongly encoded messages to each other that criminals and snoops would not be able to hack, making cyberspace a lot safer.

I see two errors in this section. First, having lived through that time, and having read Steven Levy's excellent book Crypto: How the Code Rebels Beat the Government Saving Privacy in the Digital Age, I disagree with Mr Arquilla's statement. The Clipper Chip was the government's last attempt to keep tight control of encryption, not "improve the security of private communications."

Second, Mr Arquilla implies that encryption = "making cyberspace a lot safer." That fallacy appears later in the article.

Sadly, industry leaders have never emphasized the value of strong crypto sufficiently either. There are many reasons for this neglect -- the most likely being that encouraging ubiquitous use of strong crypto could weaken sales of the firewalls and anti-viral products that form so much of the cybersecurity business model.

Here is my key issue with this article. An enterprise could encrypt every single piece of information at rest or in transit, andintruders would still win.

The fundamental reality of cryptography in the enterprise is that users and applications must be able to access data in unencrypted form in order to use it.

In other words, if a user can access data, so can an intruder.

Cryptography certainly frustrates some bad guys, such as amateurs who eavesdrop on encrypted communications, or thieves who swipe mobile devices, or intruders who remove encrypted files without bothering to obtain the material necessary to decrypt it.

However, cryptography will not stop your Web app from suffering SQL injection, nor will it keep Java from being exploited by a client-side attack.

The article concludes in part by saying:

But ways ahead do exist. There is a regulatory role: to mandate better security from the chip-level out -- something that Sen. Joseph Lieberman's Cybersecurity Act would only have made voluntary.

This sounds like an advertisement for a chip maker. I've heard their lobbyists use the same terms on Capitol Hill. "Mandating security" at the "chip level" would be as effective as FISMA -- a waste of time.

Mr Arquilla does make a few points I agree with, such as:

[W]e should treat cybersecurity as a foreign-policy issue, not just a domestic one. For if countries, and even some networks, can find a way to agree to norms that discourage cyberwar-making against civilian infrastructure -- much as the many countries that can make chemical and biological weapons have signed conventions against doing so -- then it is just possible that the brave new virtual world will be a little less conflict prone.

However, do not be fooled into thinking that encryption is the answer to our security problems.

Teaching robots new tricks without programming

A test subject teaches the PR2 robot how to fold a t-shirt through demonstration

Image Gallery (2 images)

Don't believe what the sci-fi movies tell you. When it comes to understanding our world, robots are stupid. Like computers, robots only do what we program them to do. And that's a big problem if we're ever going to realize the dream of practical robot helpers for the masses. Wouldn't it be great if anyone could teach a robot to perform a task, like they would a child? Well, that's precisely what Maya Cakmak has been working on at Willow Garage.

Cakmak, a researcher from Georgia Tech, spent the summer creating a user-friendly system that teaches the PR2 robot simple tasks. The kicker is that it doesn't require any traditional programming skills whatsoever – it works by physically guiding the robot's arms while giving it verbal commands.

After inviting regular people to give it a try, she found that with few instructions they were able to teach the PR2 how to retrieve medicine from a cabinet and fold a t-shirt. Such tasks may be easy for us, but for a robot they are very difficult. That's why most scientists don't take the threat of a robopocalypse very seriously just yet – they know how difficult it is to get a robot to do anything even remotely useful.

Test subjects were provided instructions on how to teach the robot similar to what you'd expect when buying a sophisticated appliance

Teaching by demonstration isn't going to replace traditional programming, because robots will still require some degree of common sense to function properly in our uncertain world.

For example, Rethink Robotics' new industrial robot, Baxter, uses a combination of the two. This allows anyone to quickly and easily program the robot to perform manipulation tasks on a production line, like picking up an object over here and moving it over there. This is made possible in part because Baxter uses its own artificial intelligence too, like image processing software, to pinpoint the exact positions of widgets placed randomly in front of it.

The potential for Cakmak's system would multiply as data is shared across a network of robots. In theory, you could eventually have software routines capable of folding any type of clothing, or loading any type of cookware into a dishwasher. However, some local instruction would still be required as each household is unique and no amount of advance programming can account for all the little differences in layout (the precise location of a sock drawer, for example).

But while we wait for robots to gain the artificial intelligence to carry out various household chores by themselves with nothing more than a verbal command, Cakmak's approach could help robots become truly flexible household helpers.

Check out version 1.0 of Cakmak's system in the video below.

Source: Willow Garage