Patriot missile (file image)
Read about cyber terrorism:  "...The attacks were 'the equivalent of bombing a TV station because you don’t like one of the newscasters,' Mikko Hyppönen, chief research officer of the Internet security firm F-Secure, said in a blog post. 'The amount of collateral damage is huge. Millions of users of Twitter, LiveJournal and Facebook have been experiencing problems because of this attack.'”  At right: Some experts have doubts about the missile shield concept, according to the I-BBC.  Where do really big vegetables fit in to nuclear proliferation?




More on fires in Russia here.

Chernobyl, Fires and Radiation
NYTIMES
By ANDREW C. REVKIN
August 11, 2010, 11:27 am

There are some heated headlines out there as fires spring up in the zone contaminated by the Chernobyl nuclear reactor disaster. The reality, according to specialists in environmental risk from fires and radiation, is that any radiation contained in the resulting smoke and other emissions is very unlikely to pose a significant health risk.

This very question came up two years ago when forest experts grew concerned that the rise of uncontrollable wildfires in the region was growing, mainly because foresters could not operate there. In May 2000, hundreds of firefighters fought a big peat fire in the region. Belarus officials concluded there was no rise in radiation levels. In an e-mail exchange at the time, Robert Barish, a health physicist and radiation consultant, sent the following input on radiation risk from forest fires:

With respect to your question, in the case of forest fires, there is remobilization of radioactive materials that have been deposited into the plant material. The risks however, depend strongly on two factors:

First is how much of the deposited material has actually been taken up by the trees/plants themselves. Some studies have shown that there is a competing pathway for other minerals like potassium that lower the concentration of cesium and strontium in the plant material to levels that are significantly lower than they might be otherwise. Also some of the material is leached back into the soil.

The second is the dispersal pattern. It is the latter that leads to a very significant dilution of any radioactivity as it is spread through huge volumes of air, thus significantly reducing its concentration.

A paper from the Ukrainian Institute of Agricultural Radiology showed an estimated inhalation dose of 1/10,000 to 1/100,000 of background levels to firefighters confronting a wildfire near the Chernobyl site:


Forest fires in the territory contaminated as a result of the Chernobyl accident: radioactive aerosol resuspension and exposure of fire-fighters

V. A. Kashparov, S. M. Lundina, A. M. Kadygriba, V. P. Protsaka, S. E. Levtchuka, V. I. Yoschenkoa, V. A. Kashpurb and N. M. Talerko

Journal of Environmental Radioactivity Volume 51, Issue 3, December 2000, Pages 281-298

I’ve sent a fresh query to a group of forest, fire and health researchers to get more input on this question.


Page last updated at 09:44 GMT, Sunday, 5 April 2009 10:44 UK

Global map of nuclear arsenals
Map: Members/Non-members of the NNPT

• All numbers are estimates because exact numbers are top secret.

• Strategic nuclear warheads are designed to target cities, missile locations and military headquarters as part of a strategic plan.

ISRAEL

Israeli authorities have never confirmed or denied the country has nuclear weapons.

NORTH KOREA

The highly secretive state claims it has nuclear weapons, but there is no information in the public domain that proves this.

IRAN

The International Atomic Energy Agency reported in 2003 there had been covert nuclear activity to make fissile material and continues to monitor Tehran's nuclear program.

SYRIA

US officials have claimed it is covertly seeking nuclear weapons.



DEP will require Millstone to study new cooling, discharge methods
DAY
Patricia Daddona
Article published Feb 17, 2010

A hearing officer with the state Department of Environmental Protection today recommended renewing a water discharge permit for Millstone Power Station that requires the owner to take several steps to protect marine life in Long Island Sound.

Under the proposed permit, Dominion Nuclear Connecticut would be allowed to discharge approximately 2.28 billion gallons of water a day into the Sound, according to DEP hearing officer Janice Deshais. The outdated, 12-year-old permit that the company is seeking to renew allows up to 2.7 billion gallons a day. The two reactors typically use about 2.2 billion gallons a day.

Millstone's plants discharge heated water into the Sound as they generate electricity. They also trap and kill marine life at intakes when they suck millions of gallons of water into the plants for cooling.
The new terms of the proposal call for installation by Jan. 1, 2011 of new technology shown to reduce the intake of cooling water by about 40 percent during the spawning season for winter flounder, which typically runs from early April to mid-May.

The permit also requires a detailed assessment by late summer of 2012 of all available technologies,known in a related federal court case as the best technologies available to minimize harm to the environment. Dominion also must study the feasibility of installing fine mesh screens to help prevent the death of winter flounder larvae.

According to DEP, the permit would not be issued unless the company also conducts a detailed study of how to improve the natural reproduction of winter flounder in the Niantic River and actively participates in the Nitrogen Work Group DEP has set up. That group is examining the effects of nitrogen loading on aquatic life and the river.

The terms reached by Deshais are based on an agreement reached in September 2008 between DEP staff, Dominion, and two environmental groups, Connecticut Fund for the Environment, Inc. and Soundkeeper, Inc.

This permit proposal represents the proposed final decision following public hearings in December 2008 on the matter, said DEP Spokesman Dennis Schain.

The commissioner typically makes the final decision, but since former commissioner Gina McCarthy was leaving her post and current Commissioner Amey Marrella had been involved in working out permit provisions as deputy, Marrella cannot be final decision maker, said Schain. Susan Frechette, now deputy commissioner, is charged with making that final decision, he said.

There's no required timetable for the decision, Schain said.




Yucca Mountain’s death just a few steps away - Steve Marcus / FILE

Administration Cannot Drop Bid for Nuclear Waste Dump in Nevada, Panel Finds
NYTIMES
By MATTHEW L. WALD
June 29, 2010

WASHINGTON — In a setback for the Obama administration, a panel of judges at the Nuclear Regulatory Commission ruled on Tuesday that the Energy Department could not withdraw its application to open a nuclear waste dump at Yucca Mountain in Nevada.

Making good on a campaign pledge by President Obama, the Energy Department had formally sought to drop its plan for Yucca Mountain, a volcanic structure about 100 miles from Las Vegas. But states with major accumulations of waste from nuclear weapons production had petitioned to prevent the department from doing so.

In a 47-page decision, the three-member panel of administrative judges said the Energy Department lacked the authority to drop the petition because it would flout a law passed by Congress.

In the Nuclear Waste Policy Act of 1982, Congress directed the Energy Department to file the application and the commission to consider it and “issue a final, merits-based decision approving or disapproving the construction,” the judges said. “Unless Congress directs otherwise, D.O.E. may not single-handedly derail the legislated decision-making process.”

The effect of the decision is unclear for now. Congress would have to appropriate hundreds of millions of dollars a year for the Energy Department to pursue the application. But the president’s budget for next year proposes no money at all; and while some members of the House are eager to appropriate funds, the Senate majority leader, Harry Reid of Nevada, is adamantly opposed to the project.

Yet the decision could keep the application alive long enough for the politics to change.

That would not end the debate over scientific and engineering issues related to the project, which is markedly different from the waste burial strategy being pursued in other countries. Some experts say the geology of the Nevada site, selected by Congress in 1987, is unsuitable. The Energy Department would have to convince the commission that the repository could contain the waste for hundreds of thousands of years.

The three-judge panel noted that the Energy Department was not claiming that Yucca was unsafe or that there was anything wrong with the 86,000-page application, but was saying only that the site was “not a workable option.”

The decision on Tuesday could be overruled by the five-member Nuclear Regulatory Commission itself. The commission is studying the order, said a commission spokesman, Eliot Brenner.

President Obama had promised in his election campaign to drop the Yucca Mountain plans if he were elected. But the states of Washington and South Carolina, with major stores of waste, had petitioned to prevent the Energy Department from withdrawing the application. So did the Nuclear Energy Institute, the industry’s trade association; several counties in Nevada; and the National Association of Regulatory Utility Commissioners, made up of state officials who sit on public service commissions.

The state officials are concerned because the Energy Department’s waste program has been mostly financed by electricity consumers, who pay one-tenth of a cent per kilowatt-hour into a nuclear waste fund. The state commissioners have also asked that payments to the fund be suspended because there is now effectively no program to find a burial spot. About $10 billion has been spent so far.

In announcing his intention to give up on the Yucca Mountain plan, Mr. Obama said he would establish a commission to seek solutions to nuclear waste. But the commission, which began meeting this year, is not looking for alternative sites but considering ways of recycling and reusing some of the waste.

That could reduce the number of repositories needed, but at least one would still be required; national policy still dictates that the waste should eventually be buried.

Stephanie Mueller, an Energy Department spokeswoman, said the agency was “confident that we have the legal authority to withdraw the application for the Yucca Mountain repository.”

“We believe the administrative board’s decision is wrong and believe that the Nuclear Regulatory Commission will reverse that decision,” Ms. Mueller said.

But Steve Kerekes, a spokesman for the Nuclear Energy Institute, said the ruling signaled that the Yucca Mountain licensing effort would continue.

The Obama administration promised Monday it would withdraw the application to open a nuclear waste repository at Yucca Mountain.
Yucca Mountain Sun coverage
By Lisa Mascaro (contact), Stephanie Tavares (contact)
Tuesday, Feb. 2, 2010 | 2 a.m.

Washington — The long and tortured effort to build a national burial ground at Yucca Mountain for highly radioactive waste will be halted once and for all, the Obama administration promised Monday, saying it would withdraw the application to build the project and starve it of funds.

And the coup de grace, maybe many years from now: plugging the tunnel into the mountain and sealing inside, forever, not nuclear waste but a giant boring machine that became an icon for the vexed project.

The government has poured $38 billion into the effort, claiming it had found the perfect place to house the Earth’s most dangerous garbage but failing in its effort to prove its case. Now that search will be renewed.

“The administration has determined that Yucca Mountain, Nevada, is not a workable option for a nuclear waste repository and will discontinue its program to construct a repository at the mountain in 2010,” White House in budget documents said.

Marty Malsch, an attorney who has fought the project for years on behalf of Nevada, said if the application withdrawal is approved, “It would mean, effectively, that’s the end of it.”

“Yucca, as Yucca, is dead.”

Energy Secretary Steven Chu emphasized that he will seek the withdrawal “with prejudice” — a legal definition that prohibits the project from being resubmitted later, ending speculation that the project could be revived when a more dump-friendly administration inhabits the White House.

Nevadans who have opposed Yucca Mountain repository since Congress singled it out more than 20 years ago think the endgame is set.

“This is the day we put the Champagne on ice — we’ll pop the cork after the motion is heard and decided,” said Richard Bryan, former Democratic governor and senator who led efforts to stop the dump.

“It’s a great day for the state and a great testament to the state hanging tough and staying the course.”

Former Republican Gov. Kenny Guinn said, “It has been a long time coming.”

But before the Champagne begins to flow, several steps must be taken.

• First, the Energy Department must, within 30 days, submit to the Nuclear Regulatory Commission’s three-judge panel its request to withdraw the application with prejudice.

The panel is reviewing the application to license the waste dump, a painstaking process that began in 2008 and could take at least four years to complete. Citing Obama’s intent pull the plug, the Energy Department asked the panel Monday for a stay in those hearings, “to avoid the unnecessary expenditure of resources,” according to the legal papers.

In a sign of the possible debate, White Pine County indicated in a legal filing it will oppose the motion for the stay. Several other Nevada counties remain neutral or are supportive, according to legal documents.

• Next, the three-judge panel will consider the withdrawal application — a key document that would outline the terms of withdrawal and whether the site could be reconsidered in the future.

The nuclear industry has been the primary champions of the dump, and the Nuclear Energy Institute, the industry’s main lobby, would not say if it plans to challenge the withdrawal application. A spokesman said the withdrawal language will be “of paramount importance,” hinting at the industry’s desire to keep a dump at Yucca Mountain on the back burner.

“The industry does not support the termination of this program, but believes that, if it is going to happen, it should occur in an orderly manner to permit the licensing process to be restarted if ever warranted,” said Marvin Fertel, the institute’s CEO.

• Finally, the panel would issue a ruling that could be appealed, and any decision would be reviewed by the full Nuclear Regulatory Commission.

The commission is made up of political appointees — three Democrats, two Republicans — and is headed by Gregory Jaczko, who specialized in nuclear energy issues on the staff of Senate Majority Leader Harry Reid before being tapped for the job.

Yet even with these final, potentially arduous, steps still to come, those who have fought the dump are confident that if the Obama administration continues on the course it has outlined, a Yucca repository will never exist.

By withdrawing the application, the administration would take the legal action necessary to halt the project — a move with even more teeth than if the energy secretary were to declare the site unsuitable, which had always been an option.

Malsch said that if the energy secretary were to declare the site unsuitable but then fail to pull the license, “you always would have wondered. This makes it clear that changing the mind is out of the question.”

A Yucca dump’s obituary has been written before, but Monday’s developments provided the strongest indications yet that the project is ending.

The Obama administration’s decision was not a complete surprise. As a presidential candidate in 2008, Barack Obama’s campaign told the Las Vegas Sun he would withdraw the application if elected.

Yet the administration did not do so after taking office last year, even as Obama severely cut the Yucca Mountain budget. The federal government appeared hesitant to pull the plug because it faces mounting legal liability for failing to take the waste off nuclear power companies’ hands, as required by law. Already several utilities have successfully sued the government for failing to open a Yucca repository in 1998 as promised.

But over the past several days, Obama sought to assure the nuclear industry he is on its side even as he prepared to deliver a devastating blow to its long-promised dump.

In his State of the Union address last week, Obama welcomed “a new generation of safe, clean nuclear power plants in this country.” And Friday the administration announced the formation of a new commission headed by Lee Hamilton and Brent Scowcroft that will come up with Plan B — alternatives to a dump at Yucca Mountain. Also, Obama’s new budget triples to $54 billion the federal loan guarantees available for financing new nuclear power plants.

With so many sweeteners, the industry’s opposition to a Yucca dump’s demise may be muted.

Reid, who has worked closely with Obama and Chu on Yucca, on Monday thanked Obama “for keeping his word to Nevadans.”

Although the 2011 budget would eliminate the project, it provides at least $55 million for a newly merged office to close the site. Yucca’s staff has been slashed from 1,400 last year to 625 today, with just 127 working in Las Vegas.

The tunnel into the repository has long been closed, with a chain-link fence across the openings.

Bruce Breslow, executive director of the Nevada Agency for Nuclear Projects, which has fought the dump, said the site needs to be remediated and returned to its original condition, as required by law.

The buildings need to be removed, the boring holes that have made Swiss cheese of the mountain top need to be patched up and the entrance tunnels need to be filled “with two giant corks, or however they’re going to do it,” Breslow said.

Eventually, the state also would need to untangle its many lawsuits against the federal government.

Yet while a Yucca dump may be done, Nevada may not be safe from the nation’s nuclear waste.

The new commission promises it will not consider Yucca Mountain as it seeks alternatives, but the rest of Nevada’s desert could be open ground for waste storage or a waste reprocessing facility.

Some members of the Republican political establishment in Nevada have long envisioned a nuclear waste facility in the desert, and several candidates hoping to unseat Reid in the fall election, including Sue Lowden and Danny Tarkanian, want to explore waste reprocessing ideas.

Yet Yucca Mountain as the end destination for the waste would be no more. Even though Yucca Mountain remains in law as the chosen site for the nation’s nuclear waste, without a project application the law is moot, legal experts said.

Democratic Rep. Shelley Berkley said that if the president follows through and pulls the application, it will be “all but impossible for this threat to one day return from the grave.”


We first heard another version of this old saying from former First Selectman Jim Daniel - "the good is the enemy of the better."

In Asia, Obama, Medvedev see nuclear pact progress
YAHOO
By CHARLES HUTZLER, Associated Press Writer
November 15, 2009

SINGAPORE – President Barack Obama said Sunday the United States and Russia would have a replacement treaty on reducing nuclear arms ready for approval by year's end, an announcement designed as an upbeat ending to a summit with Asia-Pacific leaders.

While publicizing progress with Russia on arms control — part of Obama's agenda to advance nuclear disarmament — the president and other leaders bowed to the obvious on climate change. They discussed a compromise agreement for a 192-nation gathering next month in Copenhagen, indirectly admitting that the meeting would not produce a new global treaty to reduce the heat-trapping carbon emissions that are warming the planet.

Nearing the end of his two days in Singapore, Obama also attended a second summit with leaders of the 10 southeast Asian countries that make up the ASEAN group. Obama was the first U.S. president to sit in on the meetings, that included a senior leader of Myanmar — part of a shift in U.S. policy away from isolating the repressive Myanmar military government.

Afterward, White House spokesman Robert Gibbs said Obama told the gathering, Myanmar Gen. Thein Sein included, that his government must free long-detained democracy leader and Nobel laureate Aung San Suu Kyi and other political prisoners.

Obama "brought that up directly with that government," Gibbs said.  While Myanmar ranks high among nations that suppress human rights, a joint statement by the United States and the ASEAN group made no mention of Suu Kyi.

The whirlwind of summitry is part of Obama's first presidential trip to the region. Its emphasis on big issues like climate change, disarmament and the economic crisis is part of Obama's approach to persuade new emerging powers like China — where he headed later Sunday — to share in the burden of managing global challenges.  The change in emphasis has helped Obama shift relations to a more positive footing, away from disputes over human rights and the Chinese military buildup that have unsteadied ties. In Shanghai on Monday, Obama will address an audience of students from several universities and field questions from them and from submissions to the U.S. Embassy's Web site.

Obama and Russian President Dmitry Medvedev met on the sidelines of the Asia-Pacific summit of APEC nations to announced good progress in negotiations on an updated pact to replace the START nuclear arms agreement that expires on Dec. 5.

Sitting, gesturing and leaning toward his Russian counterpart, Obama said the pair discussed a successor to the 1991 Strategic Arms Reduction Treaty and described "excellent progress over the last several months."

"I'm confident that if we work hard and with a sense of urgency, we'll be able to get that done," Obama said, adding technical issues remain.

Medvedev said he hoped negotiators would "finalize the text of the document by December."

Obama and Medvedev agreed in April to reach a new nuclear arms reduction pact to replace and expand upon the one that was signed by former President George H.W. Bush and Soviet leader Michael Gorbachev. 
During a July summit in Moscow, Obama and Medvedev further agreed to cut the number of nuclear warheads each nation possesses to between 1,500 and 1,675 within seven years.  U.S. officials say the two nations now have agreed on the broad outlines of a new treaty, which could be signed during Obama's travels to Europe in early December to accept the Nobel Peace Prize.

It still was not clear if Obama would use that same trip to attend the Copenhagen climate summit, given that any agreement reached on cutting greenhouse gas emissions would serve only as an interim, political document.

"There was an assessment by the leaders that it is unrealistic to expect a full internationally, legally binding agreement could be negotiated between now and Copenhagen which starts in 22 days," said Michael Froman, Obama's deputy national security adviser for international economic matters.

The prime minister of Denmark, Lars Loekke Rasmussen, the U.N.-sponsored climate conference's chairman, flew overnight to Singapore to present a proposal shifting the goal of the meeting to a "politically binding" agreement, in hopes of breathing life into the struggling process.  A fully binding legal agreement would be left to a second meeting next year in Mexico City, Froman said.

Obama backed the approach, cautioning the group not to let the "perfect be the enemy of the good," Froman said.

A major bill dealing with energy and climate in the U.S. Senate, a domestic priority of Obama's, is bogged down with scant hope of completion by next month. That would leave Obama little to show in Copenhagen.

During his Asia trip, which continued later Sunday to China, Obama also pushed for continued pressure on Iran and its nuclear program. Appearing with Medvedev, Obama said "we are now running out of time."

"Unfortunately, so far it appears Iran has been unable to say yes," to the proposal on uranium reprocessing, Obama said.

Medvedev continued: "We are prepared to work further and I hope our joint work will reach a positive result. In case we fail, other options remain on the table." He has said further sanctions against Iran were possible if it did not open its nuclear program to inspections to prove it was not trying to build a bomb.

The five permanent members of the U.N. Security Council — the U.S., Britain, France, Russia and China — along with Germany have engaged Iran on its nuclear program, most recently with a deal for it to ship enriched uranium to Russia for further processing as fuel for an aging reactor used for medical treatments.  The United States and its allies believe Iran is using it's nuclear program as a cover for building a bomb. Tehran says it only wants to build nuclear reactors to generate electricity.

Obama wrapped his official schedule in Singapore late Sunday afternoon by meeting with Indonesia's Susilo Bambang Yudhoyono, president of the world's largest Muslim nation and Obama's home as a boy. Obama said he was excited about the prospect of improving relations with Indonesia and repeated his plan to visit next year.

He said, however, the schedule would depend on his family; he wanted to plan a trip with "Michelle and the girls so they can take a look at some of my old haunts."


Page last updated at 16:39 GMT, Thursday, 17 September 2009 17:39 UK
US missile rethink a huge shift
By Paul Reynolds, World affairs correspondent BBC News website

The decision by the Obama administration to drop plans to base an anti-ballistic missile defence system in Poland and the Czech Republic is a huge shift in American foreign and defence policy.

There are several immediate implications. First, it is a major signal, which has followed a number of others, that the United States is adopting a far more cautious and flexible foreign policy under President Obama than it did under President Bush.

President Bush was determined on the European-based system and agreements had been reached with Poland to base 10 anti-missile interceptors there and with the Czechs for them to house the system's radar.

President Obama ordered a review when he came into office. He has now been told that Iran is concentrating less on long-range ballistic missiles that might one day reach the United States and more on shorter range one that could reach parts of Europe.

This has given him a technological reason to change and he will use this to fend off criticism that he has given in to Moscow. He was careful to say that his military chiefs agreed with him.

Relations with Moscow

The second effect will be on US relations with Russia. Here the picture will be mixed. The Russians will be pleased and therefore relations will be eased. The Russians had claimed the system might be a threat to them, though the US said it would not. The US felt that the Russians were simply making an excuse to meddle in the affairs of their near neighbours.

But the Russians might also feel triumphant and conclude that their tough approach is one that brings respect and results.

The US might hope for spin-offs from more relaxed relations - in that the Russians might be more willing to agree to increased sanctions against Iran and might show greater flexibility in nuclear weapons and anti missile talks. But neither is certain.

Third, this indicates that the Obama team is looking closely at the claims for technology. The experts have been having some doubts about the whole shield system.

Shorter range anti-missiles have proved promising. Perhaps this means he will also be looking sceptically at claims that Iran is developing an actual nuclear weapon. That could mean a reluctance to attack Iranian nuclear plants without rock-solid information, though this would not necessarily stop the Israelis from doing so.

Not that the president wishes to be seen as soft on Iran. He states that his new proposals will be smarter and better in countering any threat from Iranian missiles.

Hardliners 'let down'

Fourth, the Polish and Czech governments might have mixed feelings. They had invested considerable capital in agreeing to the system. Some hardliners in Eastern Europe might feel let down.

Others might be relieved. There will be debates about the long-term US commitment to Europe. That is why the president mentioned Nato's article 5 in his announcement - an attack on one will still be an attack on all.

Fifth, on the military side, this heralds a shift of emphasis in the whole US anti-missile defence strategy. It is not an end to it but it is a change to it.

The emphasis will now be on regional and shorter-range defence. The Israeli example might be a good one. The US is co-operating with the Israelis on the Arrow anti-missile missile and on a shorter range missile interceptor known as David's Sling.

Such methods will now come to the fore. And the existing Aegis ship-based defence, already deployed near Japan, will also have renewed importance.





Attacking the edges of secure Internet traffic
YAHOO
By JORDAN ROBERTSON, AP Technology Writer
Fri Jul 30, 12:51 am ET

LAS VEGAS – Researchers have uncovered new ways that criminals can spy on Internet users even if they're using secure connections to banks, online retailers or other sensitive Web sites.

The attacks demonstrated at the Black Hat conference here show how determined hackers can sniff around the edges of encrypted Internet traffic to pick up clues about what their targets are up to.

It's like tapping a telephone conversation and hearing muffled voices that hint at the tone of the conversation.

The problem lies in the way Web browsers handle Secure Sockets Layer, or SSL, encryption technology, according to Robert Hansen and Josh Sokol, who spoke to a packed room of several hundred security experts.

Encryption forms a kind of tunnel between a browser and a website's servers. It scrambles data so it's indecipherable to prying eyes.

SSL is widely used on sites trafficking in sensitive information, such as credit card numbers, and its presence is shown as a padlock in the browser's address bar.

SSL is a widely attacked technology, but the approach by Hansen and Sokol wasn't to break it. They wanted to see instead what they could learn from what are essentially the breadcrumbs from people's secure Internet surfing that browsers leave behind and that skilled hackers can follow.

Their attacks would yield all sorts of information. It could be relatively minor, such as browser settings or the number of Web pages visited. It could be quite substantial, including whether someone is vulnerable to having the "cookies" that store usernames and passwords misappropriated by hackers to log into secure sites.

Hansen said all major browsers are affected by at least some of the issues.

"This points to a larger problem — we need to reconsider how we do electronic commerce," he said in an interview before the conference, an annual gathering devoted to exposing the latest computer-security vulnerabilities.

For the average Internet user, the research reinforces the importance of being careful on public Wi-Fi networks, where an attacker could plant himself in a position to look at your traffic. For the attacks to work, the attacker must first have access to the victim's network.

Hansen and Sokol outlined two dozen problems they found. They acknowledged attacks using those weaknesses would be hard to pull off.

The vulnerabilities arise out of the fact people can surf the Internet with multiple tabs open in their browsers at the same time, and that unsecured traffic in one tab can affect secure traffic in another tab, said Hansen, chief executive of consulting firm SecTheory. Sokol is a security manager at National Instruments Corp.

Their talk isn't the first time researchers have looked at ways to scour secure Internet traffic for clues about what's happening behind the curtain of encryption. It does expand on existing research in key ways, though.

"Nobody's getting hacked with this tomorrow, but it's innovative research," said Jon Miller, an SSL expert who wasn't involved in the research.

Miller, director of Accuvant Labs, praised Hansen and Sokol for taking a different approach to attacking SSL.

"Everybody's knocking on the front door, and this is, 'let's take a look at the windows,'" he said. "I never would have thought about doing something like this in a million years. I would have thought it would be a waste of time. It's neat because it's a little different."

Another popular talk at Black Hat concerned a new attack affecting potentially millions of home routers. The attack could be used to launch the kinds of attacks described by Hansen and Sokol.

Researcher Craig Heffner examined 30 different types of home routers from companies including Actiontec Electronics Inc. and Cisco Systems Inc.'s Linksys and found that more than half of them were vulnerable to his attack.

He tricked Web browsers that use those routers into letting him access administrative menus that only the routers' owners should be able to see. Heffner said the vulnerability is in the browsers and illustrates a larger security problem involving how browsers determine that the sites they visit are trustworthy.

The caveat is he has to first trick someone into visiting a malicious site, and it helps if the victim hasn't changed the router's default password.

Still: "Once you're on the router, you're invisible — you can do all kinds of things," such as controlling where the victim goes on the Internet, Heffner said.


US unveils plan to make online transactions safer
YAHOO
By LOLITA C. BALDOR, Associated Press Writer
26 June 2010

WASHINGTON – In the murky world of the Internet, how do you ever really know who you're talking to, who you're buying from or if your bank can actually tell it's you when you log in to pay a bill?

Amid growing instances of identity theft, bank account breaches and sophisticated Internet scams, the government is looking for ways to make those transactions in cyberspace more secure.  But officials must tread carefully, as efforts to create identity cards, personal certificates or other systems of identifiers raise privacy worries and fears of Big Brother tracking its citizens online.  In a draft plan released Friday, the White House laid out an argument for a yet-undeveloped, voluntary identification system and set up a website to gather input from experts and everyday Internet users on how it should be structured.

The website was already getting votes, snipes and suggestions Friday afternoon — underscoring the incendiary nature of any discussion of Internet regulation or formal structure.

"The technology that has brought many benefits to our society and has empowered us to do so much has also empowered those who are driven to cause harm," said White House cyber coordinator Howard Schmidt in a blog posting Friday outlining the need for better security online.

The plan, he said, envisions a future in which people would be able to get a secure identifier — such as a smart identity card or a digital certificate — from a variety of service providers. Customers could then use the card or identifier to prove who they are as they make their online transactions.

"Digital authentication has been the holy grail of Internet security policy since the early '90s," said James Lewis, cyber security expert and senior fellow at the Washington-based Center for Strategic and International Studies. This latest effort, he said, has a better chance of succeeding than previous tries, "but we need to see how much opposition it runs into and whether people will actually use it even if it gets deployed."

Ari Schwartz, vice president at the Center for Democracy and Technology, said the unfettered openness of the Internet is what allowed it to grow and prosper but also created security gaps that need to be addressed. But any move to improve identity systems raises many concerns.

"The whole thing is very difficult to do and privacy is one of the more difficult pieces of it," said Schwartz, adding that the system has to balance efforts to maintain privacy while still finding out enough about someone to ensure his identity.

The government, he said, is correct to try to plan ways to move toward better security, rather than letting it just happen with no coordination.

But cyber security experts also argued that the technologies for creating such identifiers already exist and are already used in different ways by businesses, particularly banks.

"The vision they put forth is already realized and commercially available," said Roger Thornton, a cyber security expert and chief technology officer for California-based Fortify Software.

He noted that banks already use sophisticated fingerprinting processes to identify a customer who signs in. The system knows if a customer is using a different computer and will often require additional identification if that computer has not been used for the banking website before.

But many companies don't bother with the more expensive or complex identification systems.

So, said Thornton, "the opportunity is there to make things more interoperable and more uniform."

The draft plan is part of an administration effort to promote cyber security both within the government and among society as a whole. Lawmakers have introduced a number of bills aimed at furthering those goals, and the White House plan was met with initial support from one of the authors of Senate computer security legislation.


The White House Blog:  The National Strategy for Trusted Identities in Cyberspace
Posted by Howard A. Schmidt on June 25, 2010 at 02:00 PM EDT

Cyberspace has become an indispensible component of everyday life for all Americans.  We have all witnessed how the application and use of this technology has increased exponentially over the years. Cyberspace includes the networks in our homes, businesses, schools, and our Nation’s critical infrastructure.  It is where we exchange information, buy and sell products and services, and enable many other types of transactions across a wide range of sectors. But not all components of this technology have kept up with the pace of growth.  Privacy and security require greater emphasis moving forward; and because of this, the technology that has brought many benefits to our society and has empowered us to do so much -- has also empowered those who are driven to cause harm. 

Today, I am pleased to announce the latest step in moving our Nation forward in securing our cyberspace with the release of the draft National Strategy for Trusted Identities in Cyberspace (NSTIC).  This first draft of NSTIC was developed in collaboration with key government agencies, business leaders and privacy advocates. What has emerged is a blueprint to reduce cybersecurity vulnerabilities and improve online privacy protections through the use of trusted digital identities.

The NSTIC, which is in response to one of the near term action items in the President’s Cyberspace Policy Review, calls for the creation of an online environment, or an Identity Ecosystem as we refer to it in the strategy, where individuals and organizations can complete online transactions with confidence, trusting the identities of each other and the identities of the infrastructure that the transaction runs on. For example, no longer should individuals have to remember an ever-expanding and potentially insecure list of usernames and passwords to login into various online services. Through the strategy we seek to enable a future where individuals can voluntarily choose to obtain a secure, interoperable, and privacy-enhancing credential (e.g., a smart identity card, a digital certificate on their cell phone, etc) from a variety of service providers – both public and private – to authenticate themselves online for different types of transactions (e.g., online banking, accessing electronic health records, sending email, etc.). Another key concept in the strategy is that the Identity Ecosystem is user-centric – that means you, as a user, will be able to have more control of the private information you use to authenticate yourself on-line, and generally will not have to reveal more than is necessary to do so.

The Department of Homeland Security (DHS), a key partner in the development of the strategy, has posted the draft NSTIC at www.nstic.ideascale.com. Over the next three weeks (through July 19th), DHS will be collecting comments from any interested members of the general public on the strategy. I encourage you to go to this website, submit an idea for the strategy, comment on someone else’s idea, or vote on an idea. Your input is valuable to the ultimate success of this document. The NSTIC will be finalized later this fall.

Thank you for your input!

Howard A. Schmidt is the Cybersecurity Coordinator and Special Assistant to the President



White House sees no cyber attack on Wall Street
YAHOO
By DANIEL WAGNER, AP Business Writer
Sun May 9, 12:45 pm ET

WASHINGTON – The White House's homeland security and counterterrorism adviser says there is no evidence that a cyber attack was behind the chaos that shook Wall Street last Thursday.

John Brennan told "Fox News Sunday" that officials have uncovered no links suggesting that cyber attacks caused turbulence that sent the Dow Jones industrials plunging almost 1,000 points before staging a partial recovery at the end of the day.

The market already was weak because of the spreading European debt crisis. Some have speculated that a typographical error might have triggered the massive computerized sell-off.

Regulators and market officials are scouring millions of trades to understand what caused the volatility. The Securities and Exchange Commission and the Commodity Futures Trading Commission are relying on self-regulatory offices at the New York Stock Exchange and elsewhere to help them identify questionable trades.

In a joint statement Friday, the SEC and CFTC identified one possible cause for Thursday's plunge: Conflicting trading rules for different markets.

Markets generally write and enforce their own varying rules, under the oversight of the SEC and CFTC.

The SEC will meet Monday with representatives from major exchanges, according to Joe Ratterman, CEO of BATS Global Markets, one of the largest U.S. trading networks. Ratterman said Friday that SEC officials called him at his Kansas City, Mo., office late Thursday and again on Friday seeking information on the unusual trading. BATS had to cancel 540 trades.

New York Stock Exchange Euronext CEO Duncan Niederauer told CNBC on Friday that his exchange canceled 4,000 trades. Nasdaq declined to give a number. Direct Edge, the third-largest U.S. exchange, reviewed some of the 10 million trades made Thursday and found 2,000 that had to be canceled.

Nasdaq OMX Group and NYSE Euronext in a joint statement Sunday said they are committed to working closely with each other, the Securities and Exchange Commission and other regulators to determine the cause of Thursday's market plunge and develop effective ways to make the markets more stable.




Obama to Name Chief of Cybersecurity

NYTIMES
By JOHN MARKOFF
December 22, 2009

Nearly seven months after highlighting the vulnerability of banking, energy and communications systems to Internet attacks, the White House on Tuesday is expected to name a technology industry veteran to coordinate competing efforts to improve the nation’s cybersecurity in both military and civilian life.

The decision to appoint Howard A. Schmidt, an industry executive with government experience who served as a cybersecurity adviser in the Bush administration and who also has a military and law enforcement background, is seen as a compromise between factions. Government officials and industry executives say there has been a behind-the-scenes dispute over whether strict new regulations are necessary to protect the network that increasingly weaves together the vast majority of the world’s computers.

Mr. Schmidt will report to the National Security Council — not both to the council and to the National Economic Council, as previously planned, an administration official said on Monday. Mr. Schmidt will also “have regular access to the president,” said the official, who spoke on the condition of anonymity because he had not been authorized to talk publicly about the appointment.

Cybersecurity has taken on new urgency this year in the face of a growing range of cyberattacks and reports of vulnerabilities in business and military computing systems. Indeed, at the May 29 announcement of his administration’s decision to create the position of cybersecurity coordinator, Mr. Obama described how during his presidential campaign computer intruders had “gained access to e-mails and a range of campaign files, from policy position papers to travel plans.”

“It was,” he said, “a powerful reminder: in this information age, one of your greatest strengths — in our case, our ability to communicate to a wide range of supporters through the Internet — could also be one of your greatest vulnerabilities.”

After reviewing the nation’s cybersecurity preparedness, the White House said it would create the position of cybersecurity coordinator to harmonize the nation’s various efforts to “deter, prevent, detect and defend” against cyberattacks.

The administration’s decision to appoint Mr. Schmidt was slowed by a tug of war among political, military, intelligence and business interests, said people with direct knowledge of the selection process. Industry officials, for example, have expressed concern that new regulations would dampen innovation.

In recent months the administration has been criticized by lawmakers and others for not moving more quickly to fill the position. Experts on the issue had questioned how effective a cybercoordinator could be if forced to report to two governmental councils without direct access to the president.

“I’ve come away with a strong sense that Vivek Kundra, chief information officer, and Aneesh Chopra, the chief technology officer, and participants at the N.S.C. are aligned on this effort,” said Vinton Cerf, a co-author of the original Internet standards who has been consulted by the administration in choosing a “cyberczar.”

The White House official also said that criticisms that the administration had been frozen on cybersecurity policies while waiting for the appointment of a cybersecurity chief were inaccurate, citing a range of initiatives now under way at various agencies to improve cybersecurity. In November the White House met with a Russian delegation of cybersecurity officials in an effort to build cooperation on international law enforcement issues.

One significant difference in the Obama administration’s approach to cybersecurity and that of the previous administration has been the degree of secrecy about strategy and policy issues. In the Bush administration, cybersecurity decisions were made in a highly classified fashion. What remains unclear, however, is how the new administration will balance cybersecurity decisions between military and civilian organizations.

In May the administration’s cybersecurity review was not specific about transforming the administration’s goals into practical realities. At the time Mr. Obama did not explain how he planned to go about resolving the running turf wars among the Pentagon, the National Security Agency, the Department of Homeland Security and other agencies over the conduct of defensive and offensive cyberoperations.

Mr. Schmidt is the chief executive officer of the Information Security Forum, a nonprofit computer security trade association based in London. He has served as chief information security officer at eBay and chief security officer at Microsoft. In the Bush administration, he was the vice chairman of the president’s Critical Infrastructure Protection Board and a special adviser for cyberspace security.

He also served in the Air Force and the Army in computer security roles and led a computer forensics team for the Federal Bureau of Investigation at the National Drug Intelligence Center.

----------------------


Schmidt talked here (not in the story below).

ISF Panelists Spar Over Security vs. Anonymity
By Renay San Miguel
TechNewsWorld
Part of the ECT News Network
11/03/09 11:08 AM PT

Can the Web's big-time masters of malware really be tracked down? How risky is cloud computing to network security? And what challenges await the Obama administration's plans to lock down the nation's electronic infrastructure -- while at the same time creating a "smart grid?"

Left to right: Howard Schmidt, Mary Ann Davidson, Greg Garcia, Bruce Schneier and Alexander Seger

An experienced panel of computer security experts representing industry, governments and law enforcement batted around possible answers to those questions Monday during a "guru fireside" session that was a highlight of the Information Security Forum's 20th World Congress. Some 500 ISF members are in Vancouver, British Columbia, this week for keynote speeches and sessions focusing on the latest trends in information security.

The "guru" panel included Mary Ann Davidson, chief security officer for Oracle (Nasdaq: ORCL); Bruce Schneier, an oft-quoted cryptologist and author; Greg Garcia of Garcia Strategies, who was the first U.S. Assistant Secretary for Cybersecurity and Communications under former Pres. George W. Bush; and Alexander Seger, head of the economic crime division of the 47-member Council of Europe. ISF president/CEO Howard A. Schmidt, a former Microsoft (Nasdaq: MSFT) security executive and the nation's first cybersecurity czar immediately after the Sept. 11 attacks, hosted the panel.

Schneier, chief technology officer for BT Counterpane Security, is known to speak his mind regarding issues of privacy, government regulation of networks and law enforcement techniques. He's written extensively on those subjects for The New York Times, the Guardian, Forbes and Wired. So it probably came as no surprise to the other panelists, and the audience, when he challenged Seger's contention that law enforcement officials need legislation and regulatory weapons to help them track down large-scale hackers and identity thieves.

"I'm sorry, but you're not going to be able to track attacks," Schneier said. "I would like it to be different, but you can't do it."

"You can, Bruce, but it's very hard to do," interjected Garcia.

"You cannot take a [data] bit and backtrack it to where it came from," Schneier maintained. "You don't know who's in front of the keyboard sending it out there. You cannot do it, a bit does not have location specificity. It's a bit. It's not that you can't have identification. Banks work great, corporate networks work great. But you cannot make a system that doesn't have anonymity."

Web Anonymity, 'Smart Grid' Risks

All the panelists were asked to give their take on present trends in cybersecurity and technology overall, and Schneier's emphasis on anonymity with Garcia and Seger was a continuation of his thesis that anonymity is not inherently bad, but trying to punish anonymity in the search for Web safety is dangerous. "You make it harder for the naive or the innocent to do things, and no harder for criminals or the determined," he said. "That isn't to say you can't have identity. You can build a network with different degrees of working well -- bank accounts, Facebook accounts, you can have different levels of identity, but you're not making anonymity go away."

Closed platforms, Schneier added, will be the rule -- which opens up a world of focusing on services rather than devices -- and the government would have more clout if it cleaned up its own networks and used its buying power to demand better products from vendors. "If big government comes out with a contract for a secure laptop or a firewall or database or OS, and has a list of security requirements, then the contract will be big enough that vendors will need to meet those requirements and produce more secure products."

Moving health and medical records online concern both Schneier and Davidson, and Davidson added that "smart grid" plans are another potential risk. "Figure out what problem you're trying to solve before you throw technology at it," she said. "Now we want to put everybody's house on the grid without thinking about the neighborhood kid knocking you off the grid, or being subject to attacks. I don't think people understand the risk they're exposing us to by doing that. "

Medical records online could also pose threats by hackers changing those records or using them to blackmail the innocent.

"Not that I think we should stop all progress, but my concerns are that we are coming up the awareness curve to some degree that this is infrastructure that needs to be both defensive and self-defending, which is a different construct than what we have now," Davidson said.

Cybersecurity Is Not a Red/Blue Issue

The good news in Washington, D.C., is that cybersecurity does not appear to be a partisan political issue, Garcia said. The Obama administration has basically affirmed the strategy Download Free eBook - The Edge of Success: 9 Building Blocks to Double Your Sales that he and others in the Bush administration had worked on to place network/infrastructure protection on a higher level of priority. "Now it is incumbent upon this administration take that strategy, which is on pretty firm conceptual footing, and now turn it into something that is operational, executable and well-organized," Garcia said. "That's what's lacking now. We were not well organized in the Bush administration because we had too much mission creep from other organizations involved," including various aspects of the military, the intelligence community and the State Department.

Whoever ends up with the job of White House-level cybersecurity adviser -- promised by President Obama -- will need to lay out the roles and responsibilities for those agencies with a stake in network protection.

The picture is cloudier regarding the enterprise, Garcia said. Hackers and cybercriminals are becoming more sophisticated in their use of technology, and some companies still aren't taking network security seriously. "They are doing risk assessments and saying they'll consider a cyberattack as a cost of doing business. I think that's potentially dangerous thinking," he said.

Also potentially dangerous: relying on cloud computing for protecting personal and corporate data without first asking a lot of questions regarding security, Davidson said. "It's not about whether somebody does a service for you, that's a business decision. But when something is important to you and you hand it off, you still need to answer basic questions -- 'where is my data? who has access to it?' And if you cannot answer those questions, this whole idea of the cloud, 'just trust us,' is silly."


---------------------



FROM THE INTERNET:  Cyber Conference Focuses on Protecting Company Assets

The practice of surfing the Web from your work terminal may come to an end, according to cyber security expert Howard A. Schmidt.

Schmidt, the former head of online security for Microsoft and eBay, explained that many companies are mistakenly confident about the security of their computer networks and the proprietary information they hold.

"Firewalls and anti-virus packages are great first steps, but we’re finding tremendous vulnerabilities in software and firmware," he said in a keynote speech on Jan. 7 at the International Conference on Cyber Security at Fordham. "Instead of enjoying the benefit of a new piece of software, we have to install it and then watch it."

To stem the tide of hackers and other cyber criminals who want to commit economic espionage, Schmidt suggested that industries foster closer relationships with the federal government.

"Workplaces are designed to be open environments, and the general consensus is that when the government gets involved it will make things more difficult," he said. "But that’s not the case."

Schmidt said that the government can help protect the assets of corporations by crafting cyber crime laws and working with other nations to standardize those laws around the globe, as well as using law enforcement officers to track cyber criminals across national borders.

Corporations also must take more responsibility for their own online security, he said, which may lead to the restriction or outright end of personal Web surfing at work. The practice has been tolerated, if not outright encouraged, by companies thus far.

"We’re starting to see the security implications of allowing someone unfettered access to the Web from within the network," he said, "and we’re beginning to hear complaints, like, 'You took away my outlet for watching baseball games while I work.' But like government systems, it’s difficult to allow that access and still maintain the level of security that’s necessary.'

Schmidt, the current president of the Information Security Forum, was chairman of cyberspace security for the White House and chief security strategist in the Department of Homeland Security...

Fordham University, NYC
1/09

------------------------
FROM THE INTERNET:  Did the Weston Police officers study with him at U. N.H.?
Western International University Graduation 2007- Sean's (r.) video

Commencement speaker (l.), 2007, Western International University, and the following information comes from the video taken by Sean's family of that graduation ceremony.  Schmidt addresses, live, the graduates about how he got his college degree in his 30's and his master's in his 40's from the University of Phoenix.  The e-graduation speakers, via the Internet, were, among others, Senator John McCain, Governor Janet Napolitano of Arizona.

Howard A. Schmidt CISSP, CISM
President & CEO R & H Security Consulting LLC
Former Chair of President Bush’s Critical Infrastructure Protection Board and
Special Adviser for Cyberspace Security for the White House

Howard A. Schmidt has had a long distinguished career in defense, law enforcement and corporate security spanning almost 40 years. He has served as Vice President and Chief Information Security Officer and Chief Security Strategist for online auction giant eBay. He most recently served in the position of Chief Security Strategist for the US CERT Partners Program for the National Cyber Security Division, Department of Homeland Security.

He retired from the White House after 31 years of public service in local and federal government. He was appointed by President Bush as the Vice Chair of the President’s Critical Infrastructure Protection Board and as the Special Adviser for Cyberspace Security for the White House in December 2001. He assumed the role as the Chair in January 2003 until his retirement in May 2003.

Prior to the White House, Howard was chief security officer for Microsoft Corp., where his duties included CISO, CSO and forming and directing the Trustworthy Computing Security Strategies Group.

Before Microsoft, Mr. Schmidt was a supervisory special agent and director of the Air Force Office of Special Investigations (AFOSI) Computer Forensic Lab and Computer Crime and Information Warfare Division. While there, he established the first dedicated computer forensic lab in the government.

Before AFOSI, Mr. Schmidt was with the FBI at the National Drug Intelligence Center, where he headed the Computer Exploitation Team. He is recognized as one of the pioneers in the field of computer forensics and computer evidence collection. Before working at the FBI, Mr. Schmidt was a city police officer from 1983 to 1994 for the Chandler Police Department in Arizona.

Mr. Schmidt served with the U.S. Air Force in various roles from 1967 to 1983, both in active duty and in the civil service. He had served in the Arizona Air National Guard from 1989 until 1998 when he transferred to the U.S. Army Reserves as a Special Agent, Criminal Investigation Division where he continues to serve. He has testified as an expert witness in federal and military courts in the areas of computer crime, computer forensics and Internet crime.

Mr. Schmidt had also served as the international president of the Information Systems Security Association (ISSA) and the first president of the Information Technology Information Sharing and Analysis Center (IT-ISAC). He is a former executive board member of the International Organization of Computer Evidence, and served as the co-chairman of the Federal Computer Investigations Committee. He is a member of the American Academy of Forensic Scientists. He serves as an advisory board member for the Technical Research Institute of the National White Collar Crime Center, and was a distinguished special lecturer at the University of New Haven, Conn., teaching a graduate certificate course in forensic computing.

He served as an augmented member to the President’s Committee of Advisors on Science and Technology in the formation of an Institute for Information Infrastructure Protection. He has testified before congressional committees on computer security and cyber crime, and has been instrumental in the creation of public and private partnerships and information-sharing initiatives. He is regularly featured on CNN, CNBC, Fox TV as well as a number of local media outlets talking about cyber-security. He is a co-author of the Black Book on Corporate Security.

Mr. Schmidt has been appointed to the Information Security Privacy Advisory Board (ISPAB) to advise the National Institute of Standards and Technology (NIST), the Secretary of Commerce and the Director of the Office of Management and Budget on information security and privacy issues pertaining to Federal Government information systems, including thorough review of proposed standards and guidelines developed by NIST.

Howard holds board positions on a number of corporate boards in both an advisory and director positions and recently has assumed the role as Chairman of the Board for Electronics Lifestyle Integration (ELI).

Mr. Schmidt holds a bachelor’s degree in business administration (BSBA) and a master’s degree in organizational management (MAOM) from the University of Phoenix. He also holds an Honorary Doctorate degree in Humane Letters. Howard is an Adjunct Professor at GA Tech with the GTISC.

2006

US cyber-security tsar steps down
I-BBC
Page last updated at 09:24 GMT, Tuesday, 4 August 2009 10:24 UK

The White House's acting cyber-security tsar has resigned from her post, according to the Wall Street Journal.

Melissa Hathaway told the paper she was leaving for "personal reasons" and would return to the private sector.

The former strategist was appointed as acting national cyber-adviser in February and was expected to be offered the post of full time.

President Barack Obama has said that cyber-security is a high priority for his administration.

In May, the President announced plans for securing American computer networks against cyber attacks.

In recent years, US government and military bodies have reported attempts to infiltrate systems by hackers.

He announced the creation of a cyber-security office in the White House, and said he would personally appoint a "cyber-tsar".

Ms Hathaway was widely regarded as the person to fill that post after taking on the role as acting senior director for cyberspace for the National Security and Homeland Security Councils in February.

In April she completed a review of cyber-security for the Obama administration.

At the time, Ms Hathaway said the job ahead was "a marathon, not a sprint."

Her successor has not yet been named by the White House.




Melissa Hathaway tackles cybersecurity Mission Impossible
The Last Watchdog
Posted on | April 25, 2009

There was no way Melissa Hathaway was going to steal Pres. Obama’s thunder at the RSA Conference on security in San Francisco last week. Expectations ran high that Hathaway would divulge details from the exhaustive 60-day review of cybersecurity policy she just recently delivered to senior White House officials.

But her report remains under review by Obama. Hathaway, nonetheless, gamely took to the stage Wednesday afternoon, April 22, in front of several thousand tech industry executives, software engineers, computer scientists, analysts and reporters at the RSA Conference on security. The audience arrived early to jockey for good seats. Compensating, somewhat, for the meager steak she would deliver, Hathaway opened with some Hollywood sizzle.

As Hathaway arrived at the podium, the theme from Mission Impossible blared over the over PA.

Dum; dum, dum, dum. Dum; dum, dum, dum . . .

Hathaway stepped back and looked up at the giant video screens. Images appeared correlating to instructions from a disembodied voice:

Good afternoon Melissa Hathaway. The digital infrastructure shown here supports critical public services and is vital to the global economy . . . Criminals, terrorists and foreign adversaries have devised plans to use flaws in the infrastructure to hold the economy hostage, disrupt our government and threaten public safety. Your mission, Melissa, should you decide to accept it, is to assemble a team of experts, engage every possible stakeholder group and devise a strategy to work together for the common good . . . Please begin immediately. This Blackberry will self destruct in 60 days. Good luck.

Beginning of the beginning

melissahathaway_cropAfter joking about which of her three Blackberries might blow up, Hathaway for the next 30 minutes stood stiff behind the podium, reading word-for-word from her prepared statement, which you can see here. She did call for  “a White House organizational structure that can effectively address cyberspace-related issues, ” and noted that her recommendations to the president include  “an action plan,” derived from 40 meetings with “stakeholder groups” and a review of more than 100 reports.

“When the report is made public you will see that there is a lot of work for us to do together and an ambitious action plan to accomplish our goals,” she said. “Sixty days’ work is just the beginning of the beginning.”

She concluded by issuing a rallying cry for a “holistic approach” to stemming rising cyber threats. “We need to sow the seeds for a national dialogue, nurture them, even see them in our dreams, to help this critical conversation grow,” she said.

Hathaway, who is 40, has two sons, 8 and 9. She took no questions from the audience.

As the crowd filed out of the massive main auditorium at Moscone Convention Center, I definitely heard some grumbling about lack of substance in her speech. But protocals  tied Hathaway’s hands. I spoke to three Hathaway admirers who’ve actually worked with her. One was Rod Beckstrom, who resigned last month as a top cybersecurity official in the Department of Homeland Security. Beckstrom credited Hathaway for delivering a “very professional speech,” noting that he was encouraged by the “values of collaboration that were espoused, particularly working with international partners, which I think is critical.”

Beckstrom, who resigned in protest to being marginalized by the National Security Agency, received a small measure of vindication when NSA Director Lt. Gen. Keith B. Alexander said in an earlier RSA keynote that the NSA does not want to run cybersecurity for the U.S. government.

“It was nice to see the messaging changing,” say Beckstrom.

Familiar themes

Another Hathaway fan: Dennis P. Gilbert, a principal from  Booz Allen Hamilton’s Herndon, Virg. offices. Hathaway spent 15 years at Booz Allen building her reputation as a management consultant with an uncanny knack for getting military and intelligence policy wonks to collaborate. Gilbert told me he first encountered Hathaway in 1999 when he was was an Air Force Lt. Col., and Hathaway was an up-and-coming consultant on information warfare.

Gilbert recalls Hathaway as “resilient and determined” — and a political agnostic. To this day, he says, he doesn’t know if she’s a Democrat or Republican. “We worked with combatant commanders, and all the joint forces commanders, and with a lot of the special agencies to come up with our recommendations. And basically all of them were implemented, and a lot of them turned into programs that are funded today, 10 years later,” says Gilbert.

The projects Gilbert and Hathaway tackled generally involved integrating massive amounts of data from multiple sources and turning the data into something useful. “One of the things we looked at was second and third order of effects, the notion that everything was connected through the Internet, and when you do something, everything is affected,” recalled Gilbert. “We looked at what the ripple effect would be across the DoD, across government, maybe even across the private sector.”

Sound familiar? “Ten years ago we found everything is integrated, beyond sometimes what we even understood,” says Gilbert . “We had to look at things holistically to solve the problem. You can see how those types of themes are in the problem set that we have today. Everything is interconnected. I definitely see the parallel.”

Yoda of cybersecurity

The skills Hathaway demonstrated in getting bull-headed  military brass and intelligence officials to play nice ultimately  got her called up to the big leagues of presidential politics. In March 2007, she was recruited to do the grunt work of marshaling support for President Bush’s then-top secret Comprehensive National Cyber Security Initiative. This required getting  big bureaucracies and the military branches to buy into Bush’s secretive $30 billion plan to keep foreign cyberspies from continuing to  clean out government databases.

Meanwhile, in the same time frame, but on a separate track, a bi-partisan collection of 60 tech industry executives, military officials and a handful of lawmakers formed a special commission to hammer out a consensus view of what U.S. cybersecurity policy should look like. The commission, convened by the Center for Strategic and International Studies (CSIS), ultimately delivered this stack of recommendations, titled “Securing Cyberspace for the 44th President,” to Obama last December. The CSIS report has since been downloaded more than 35,000 times.

Hathaway became and something of  an ad hoc member of the CSIS commission; she debriefed the commissioners regularly about what  Bush was up to, and continued doing so as Obama’s  go-to cybersecurity expert.   CSIS commissioner, Tom Kellermann, has worked closely with Hathaway over the course of the past year and a half.

After hearing Hathaway’s Mission Impossible keynote at RSA, Kellermann,  Vice-President of Security Awareness at Core Security Techonologies, had this to say:  “I have utmost faith in her holistic vision and I have utmost faith in her leadership style.”

Kellerman says that the appointment of a cabinet-level cybersecurity adviser to lead the holistic charge, appears to still be on the table, despite Obama already having named a White House CTO and CSO.

What’s more, Kellermann believes the White House is giving Hathaway serious consideration  as a darkhorse candidate for the nation’s top cybersecurity job; she’s said to be vying against two, and possibly three, longtime Beltway power brokers. If it were up to Kellermann,  Hathaway would be the  slam dunk choice  for cybersecurity czar.


Melissa Hathaway Challenged by Cyber Security
Defensetech.org
Kevin Coleman
February 9, 2009

As part of President Obama’s cyber security plan, the White House is planning on announcing that Melissa Hathaway, the current top cyber security adviser, will oversee a 60-day review of federal cyber security efforts. Insiders have stated that after this assignment, she will likely be offered the position of cyber czar. Hathaway serves as the cyber coordination executive at the office of the Director of National Intelligence (DNI) and was senior adviser to former Director of National Intelligence Mike McConnell. She is also as chair on the National Cyber Study Group, as well as a senior-level interagency body that played a lead role in the development of President Bush's Comprehensive National Cyber security Initiative.

Hathaway has her work cut out for her. Researchers recently concluded the average number of unique new infected sites grew from 100,000-200,000 a day to 200,000-300,000 a day and this trend is expected to continue for the foreseeable future. In addition, the world recently witnessed the third cyber attack against a country (Kyrgyzstan). Many cyber security experts have stated that the threat of attack by traditional artillery and nuclear warfare has been replaced by cyber attacks aimed at Internet targets for gathering intelligence and disrupting communications. "We are in a new age of warfare," stated one cyber Intelligence analyst I talked with on the subject. She went on to say that "cyber attacks are likely to proceed any conventional attack or at least done in coordination with a conventional or nuclear attack."

Can the United States defend our networks against cyber-attack? That was just one of the many questions President Obama's pick for CIA Director Leon Panetta was asked in his confirmation hearings. It is clear Hathaway will have her hands full. The United States is by far the most reliant on computer technology and the internet, as such it faces so many challenges securing cyber space and defend and protect the country against cyber attacks. Hathaway is a firm believer that government and the private sector must join together to address this national security threat. She is well aware that threats to government systems stem from both technology and from the policies, practices and procedures that govern how people use that technology.



Cyberwar: U.S. Weighs Risks of Civilian Harm in Cyberwarfare
NYTIMES
By JOHN MARKOFF and THOM SHANKER
August 2, 2009

It would have been the most far-reaching case of computer sabotage in history. In 2003, the Pentagon and American intelligence agencies made plans for a cyberattack to freeze billions of dollars in the bank accounts of Saddam Hussein and cripple his government’s financial system before the United States invaded Iraq. He would have no money for war supplies. No money to pay troops.

“We knew we could pull it off — we had the tools,” said one senior official who worked at the Pentagon when the highly classified plan was developed.

But the attack never got the green light. Bush administration officials worried that the effects would not be limited to Iraq but instead create worldwide financial havoc, spreading across the Middle East to Europe and perhaps to the United States.

Fears of such collateral damage are at the heart of the debate as the Obama administration and its Pentagon leadership struggle to develop rules and tactics for carrying out attacks in cyberspace.

While the Bush administration seriously studied computer-network attacks, the Obama administration is the first to elevate cybersecurity — both defending American computer networks and attacking those of adversaries — to the level of a White House director, whose appointment is expected in coming weeks.

But senior White House officials remain so concerned about the risks of unintended harm to civilians and damage to civilian infrastructure in an attack on computer networks that they decline any official comment on the topic. And senior Defense Department officials and military officers directly involved in planning for the Pentagon’s new “cyber command” acknowledge that the risk of collateral damage is one of their chief concerns.

“We are deeply concerned about the second- and third-order effects of certain types of computer network operations, as well as about laws of war that require attacks be proportional to the threat,” said one senior officer.

This officer, who like others spoke on the condition of anonymity because of the classified nature of the work, also acknowledged that these concerns had restrained the military from carrying out a number of proposed missions. “In some ways, we are self-deterred today because we really haven’t answered that yet in the world of cyber,” the officer said.

In interviews over recent weeks, a number of current and retired White House officials, Pentagon civilians and military officers disclosed details of classified missions — some only considered and some put into action — that illustrate why this issue is so difficult.

Although the digital attack on Iraq’s financial system was not carried out, the American military and its partners in the intelligence agencies did receive approval to degrade Iraq’s military and government communications systems in the early hours of the war in 2003. And that attack did produce collateral damage.

Besides blowing up cellphone towers and communications grids, the offensive included electronic jamming and digital attacks against Iraq’s telephone networks. American officials also contacted international communications companies that provided satellite phone and cellphone coverage to Iraq to alert them to possible jamming and ask their assistance in turning off certain channels.

Officials now acknowledge that the communications offensive temporarily disrupted telephone service in countries around Iraq that shared its cellphone and satellite telephone systems. That limited damage was deemed acceptable by the Bush administration.

Another such event took place in the late 1990s, according to a former military researcher. The American military attacked a Serbian telecommunications network and accidentally affected the Intelsat satellite communications system, whose service was hampered for several days.

These missions, which remain highly classified, are being scrutinized today as the Obama administration and the Pentagon move into new arenas of cyberoperations. Few details have been reported previously; mention of the proposal for a digital offensive against Iraq’s financial and banking systems appeared with little notice on Newsmax.com, a news Web site, in 2003.

The government concerns evoke those at the dawn of the nuclear era, when questions of military effectiveness, legality and morality were raised about radiation spreading to civilians far beyond any zone of combat.

“If you don’t know the consequences of a counterstrike against innocent third parties, it makes it very difficult to authorize one,” said James Lewis, a cyberwarfare specialist at the Center for Strategic and International Studies in Washington.

But some military strategists argue that these uncertainties have led to excess caution on the part of Pentagon planners.

“Policy makers are tremendously sensitive to collateral damage by virtual weapons, but not nearly sensitive enough to damage by kinetic” — conventional — “weapons,” said John Arquilla, an expert in military strategy at the Naval Postgraduate School in Monterey, Calif. “The cyberwarriors are held back by extremely restrictive rules of engagement.”

Despite analogies that have been drawn between biological weapons and cyberweapons, Mr. Arquilla argues that “cyberweapons are disruptive and not destructive.”

That view is challenged by some legal and technical experts.

“It’s virtually certain that there will be unintended consequences,” said Herbert Lin, a senior scientist at the National Research Council and author of a recent report on offensive cyberwarfare. “If you don’t know what a computer you attack is doing, you could do something bad.”

Mark Seiden, a Silicon Valley computer security specialist who was a co-author of the National Research Council report, said, “The chances are very high that you will inevitably hit civilian targets — the worst-case scenario is taking out a hospital which is sharing a network with some other agency.”

And while such attacks are unlikely to leave smoking craters, electronic attacks on communications networks and data centers could have broader, life-threatening consequences where power grids and critical infrastructure like water treatment plants are increasingly controlled by computer networks.

Over the centuries, rules governing combat have been drawn together in customary practice as well as official legal documents, like the Geneva Conventions and the United Nations charter. These laws govern when it is legitimate to go to war, and set rules for how any conflict may be waged. Two traditional military limits now are being applied to cyberwar: proportionality, which is a rule that, in layman’s terms, argues that if you slap me, I cannot blow up your house; and collateral damage, which requires militaries to limit civilian deaths and injuries.

“Cyberwar is problematic from the point of view of the laws of war,” said Jack L. Goldsmith, a professor at Harvard Law School. “The U.N. charter basically says that a nation cannot use force against the territorial integrity or political independence of any other nation. But what kinds of cyberattacks count as force is a hard question, because force is not clearly defined.”




Sunk by N. Korea during maneuvers by U.S/S. Korea ships.

Abnormal radiation detected near Korean border
YAHOO
By HYUNG-JIN KIM, Associated Press Writer
21 June 2010

SEOUL, South Korea – Abnormally high radiation levels were detected near the border between the two Koreas days after North Korea claimed to have mastered a complex technology key to manufacturing a hydrogen bomb, Seoul said Monday.

The Science Ministry said its investigation ruled out a nuclear test by North Korea, but failed to determine the source of the radiation. It said there was no evidence of a strong earthquake, which follows an atomic explosion.

On May 12, North Korea claimed its scientists succeeded in creating a nuclear fusion reaction — a technology necessary to manufacture a hydrogen bomb. In its announcement, the North did not say how it would use the technology, only calling it a "breakthrough toward the development of new energy."

South Korean experts doubted the North actually made such a breakthrough. Scientists around the world have been experimenting with fusion for decades, but it has yet to be developed into a viable energy alternative.

On May 15, however, the atmospheric concentration of xenon — an inert gas released after a nuclear explosion or and radioactive leakage from a nuclear power plant — on the South Korean side their shared border was found to be eight times higher than normal, according to South Korea's Science Ministry.

South Korea subsequently looked for signs of a powerful, artificially induced earthquake. Experts, however, found no signs of a such a quake in North Korea, a ministry statement said.

"We determined that there was no possibility of an underground nuclear test," it said. The ministry said the gas is not harmful.

While any fusion test would have registered seismic activity, according to nuclear expert Whang Joo-ho of South Korea's Kyung Hee University, the presence of xenon could also have come from a leak.

Since the wind was blowing from north to south when the xenon was detected, a Science Ministry official said the gas could not have originated from any nuclear power plants in South Korea.

But the official — speaking on condition of anonymity, citing department policy — said the xenon could have come from Russia or China. Whang agreed, saying a nuclear test or radioactive leakage would be the only reasons that could explain the atmospheric concentration of xenon reported by the ministry.

A Vienna-based United Nations agency, however, said no signs of increased radioactivity were detected last month along the Korean border.

"We have not registered anything that would raise any suspicion," said Kirsten Haupt, a spokeswoman for the Comprehensive Test Ban Treaty Organization, a U.N. agency that looks for signs of nuclear testing worldwide.

Earlier Monday, South Korea's mass-circulation Chosun Ilbo newspaper reported that North Korea may have conducted a small-sized nuclear test, citing the abnormal radioactivity. The paper cited an atomic expert it did not identify.

North Korea — which is believed to have enough weaponized plutonium for at least a half-dozen nuclear weapons, conducted two underground nuclear tests in 2006 and 2009, drawing international condemnation and U.N. sanctions.

The news of the detected radiation comes as tension is running high on the Korean peninsula over the deadly sinking of a South Korean warship blamed on a North Korean torpedo attack. North Korea flatly denies the allegation and has warned any punishment would trigger war, as the U.N. Security Council reviews Seoul's request for action over the sinking.


NK Test, US Treaty OK Could Set Off Chain Reaction
NYTIMES
By THE ASSOCIATED PRESS
May 26, 2009Filed at 1:43 p.m. ET

WASHINGTON (AP) -- A decade after its defeat on the Senate floor, the treaty to ban all atomic bomb tests has found new life in the age of Obama, and at a time of renewed nuclear defiance by North Korea.

Monday's bomb test by the Pyongyang government ''underlines the urgency of the entry into force of the (treaty) and the necessity of putting an end to all nuclear explosions for all time,'' said the pact's chief booster, Tibor Toth, who heads the U.N.-affiliated Comprehensive Test Ban Treaty Organization.

In the coming months in Washington -- and in other key capitals -- leaders will make cold strategic calculations as they weigh military balances and the future role of doomsday weapons in deciding whether to ratify the CTBT. Passage in the Senate this time around may set dominoes toppling from Beijing to New Delhi and beyond, Toth said.

''The U.S. example will be defining,'' he told The Associated Press in an interview at his Vienna headquarters.

Negotiated in the 1990s, the treaty specified 44 nuclear-capable states -- from Algeria to Vietnam -- that must give full formal approval before it can take effect, putting the power of international law and the U.N. Security Council behind the ban. All but nine of those have ratified, along with the governing bodies of 113 other nations.

Besides the U.S., the holdouts among the 44 are China, Egypt, India, Indonesia, Iran, Israel, North Korea and Pakistan.

Although earlier treaties outlawed all but underground nuclear blasts under 150 kilotons -- equivalent to 150,000 tons of TNT -- this one would impose a blanket ban on any test anywhere, with compliance overseen by Toth's agency.

It would end an era in which eight nations exploded 2,054 nuclear bombs in the air, under water and below ground, from the mushroom cloud of July 16, 1945, at Alamogordo, N.M., and the U.S. bombings of Hiroshima and Nagasaki, to North Korea's underground blast on Monday, its second test, estimated at a yield of a few kilotons.

The tests helped weapon designers build ever more compact, durable and finely tuned bombs. Ending testing would put a cap on developing new weapons, halting proliferation to more states and giving nuclear-armed states more confidence to negotiate deep reductions, treaty proponents say.

President Barack Obama endorsed this view in an agenda-setting speech in Prague, Czech Republic, on April 5, when he said he would ''aggressively'' pursue Senate ratification. A vote may come next year, after a lobbying campaign to win the required two-thirds Senate majority.

Republicans controlled the upper house in 1999 when the pact was rejected 51-48 on a largely party-line vote. The debate focused on whether the treaty's monitoring system could detect clandestine nuclear blasts, and whether the U.S. arsenal would remain safe and reliable without tests.

Much has changed since then: The monitoring system has grown into a $1 billion, high-tech worldwide network, and the U.S. weapons stockpile has been certified reliable annually since the 1990s, as the U.S. and four other original nuclear powers -- Russia, Britain, France and China -- have observed testing moratoriums.

The Senate has changed as well, with a 60-vote Democratic majority likely, just seven short of two-thirds. Meanwhile, some influential Republican voices have shifted to support the treaty, including former secretaries of state Henry A. Kissinger and George P. Shultz. Sen. John McCain, R-Ariz., said during his 2008 presidential campaign the treaty deserved ''another look.''

''The climate is different and that's important,'' former Democratic Sen. Sam Nunn, a leading arms-control advocate, told the AP. ''The fact the president has made this a top priority means it's going to get a lot more attention from the American public than it did the last time.''

And more attention from the rest of the world.

''If the U.S. keeps its promise to push for ratification of the CTBT, it will serve as a catalyst for similar action by other states,'' Indonesia's U.N. ambassador, Marty Natalegawa, said May 5 at a disarmament conference in New York.

Toth said Indonesia, which has no nuclear weapons, is one holdout showing ''positive signs'' on ratification. Another is a big one: China.

''China supports early entry into force of the CTBT,'' Beijing's arms control chief, Cheng Jingye, told the same U.N. conference.

It has been clear since 1999 that China withheld ratification because the U.S. did. Toth said the Chinese now are ''closely following developments in Washington'' and assure him they are preparing to ratify.

If the U.S. Senate accedes, Obama pledges a diplomatic effort to bring other governments aboard. Nuclear-armed India is a likely target, since a recent U.S.-Indian civilian nuclear agreement gives Washington added leverage with New Delhi.

The Indians' chief nuclear envoy, Shyam Saran, told the AP his country wants to see broad movement toward abolition of nuclear arms before committing to a test ban. Some analysts believe, however, that a CTBT ratification by China, the Asian rival whose bomb motivated India to build its own, might induce the Indian ''domino'' to follow suit.

And what about next-door Pakistan, with at least 40 nuclear warheads, to traditional enemy India's 50 or more?

''Our response (on CTBT) depends very much on the position taken by India,'' Zamir Akram, Pakistani ambassador to the Conference on Disarmament in Geneva, told the AP.

In the Middle East, nuclear-armed Israel is known to have backed off early ratification only because the U.S. did. Accession to this major nuclear agreement might help lift the global embargo on civilian nuclear trade with Israel. Egypt might then logically follow.

If Iran, accused of harboring plans for nuclear bombs, or North Korea, with rudimentary weapons, remained holdouts, they would face ever-growing isolation and international pressure to join.

Toth indicated he wouldn't be surprised by a North Korean ratification, if Pyongyang sees all of the ''P-5'' -- the original nuclear powers -- behind the treaty and no longer demanding that North Korea accept restrictions that they don't.

On the other hand, analysts say, a repeat failure to ratify in Washington could send dominoes tumbling in the other direction. China might feel a need to resume testing to perfect bombs for multiple-warhead missiles, to match U.S. capabilities. A testing chain reaction among nations might ensue.

''What the nuclear powers do, in fact, does affect the decisions of other countries,'' veteran U.S. arms negotiator James Goodby told a nonproliferation conference in Washington last month. ''And testing is perhaps the most visible of nuclear weapons activities.''

------

EDITOR'S NOTE -- Charles J. Hanley has been reporting on nuclear arms control since 1983.



Restart of Big Particle Collider Now November
By THE ASSOCIATED PRESS
Filed at 11:06 a.m. ET

July 30, 2009


GENEVA (AP) -- Repairs to two small helium leaks in the world's largest atom smasher will delay the restart of the giant machine another month until November, a spokesman for the operator said Thursday.

James Gillies said an additional setback to the timing could result if some other problem is found, but the European Organization for Nuclear Research is taking pains to make sure it avoids another major shutdown like the electrical failure of Sept. 19.

''Essentially what's happening is we're proceeding with extreme caution,'' Gillies told The Associated Press. ''We have to be absolutely certain that when we switch on this time, it stays switched on.''

The organization, which is known as CERN, has nearly finished examining the 10,000 electrical interconnections like the one that failed in September. Originally CERN said it expected to start test collisions in April, but that start up date has been pushed back several times already, most recently to October.

''Decisions will be taken as to whether there are more that need repairing or not within the next couple of weeks, and when we know that, we will be in a position to be a little bit more definitive about what we plan to do for the rest of the year,'' Gillies said.

If a November start holds, it will still take until December for the accelerator in a 17-mile (27-kilometer) circular tunnel under the Swiss-French border to start producing collisions of subatomic particles.

Only then will physicists be able to probe deeper into the makeup of matter.

They hope the fragments that come off the collisions will show on a tiny scale what happened one-trillionth of a second after the so-called Big Bang, which many scientists theorize was the massive explosion that formed the universe. The theory holds that the universe was rapidly cooling at that stage and matter was changing quickly.

The leaks currently being repaired were found in the system that uses liquid helium to bring the temperature inside the accelerator to near absolute zero, colder than outer space.

That low temperature makes it possible to use the massive superconducting electromagnets that control the beams of particles that will fly in both directions around the accelerator at near the speed of light until the scientists make them collide.

CERN expects repairs and additional safety systems to cost about 40 million Swiss francs ($37 million) over the course of several years, covered by the organization's budget. The overall Large Hadron Collider project cost $10 billion.