Great question, Charley! Before I answer it, let me stress that while the “inside experts” claim they DO know the true scope of your question … I insist they DON’T know the true scope. Extraordinary claims require extraordinary evidence, which we lack. The inside experts tell the public they can’t divulge the truth because Osama bin Laden will use the knowledge to destroy the United States. Everything the public does know, overwhelmingly points to hyperbole and hysteria. So the skeptics say “stop crying wolf” and the inside experts say “we’re Cassandras, you just wait and see.”

So. How much does it cost? Skeptical expert Bruce Schneier describes the cost as a “terrorism tax,” similar to the Cold War tax although much more directly extracted from every American’s pocketbook.

I myself engage in hyperbole when I say “I honestly believe the cyber-terror tax exceeds its return on investment.” Why, then, would I let the inside experts turn on me to demand “what evidence supports your belief”? Because I can then respond “well, you’re the only one here who can give our audience the evidence they need to disbelieve me. But you won’t cough up any evidence for scrutiny, will you?”

Still, it doesn’t answer your question. So let’s make a (somewhat invalid) comparison. “Rob, did we spend too much on the Y2K hysteria?” The answer is “businessmen spent the right amount, but if they spent it in fear, then they spent the right amount for the wrong reason.” A college-level logic course will teach you that, given a chocie, you’d rather spend the wrong amount for the right reason, than spend the right amount for the wrong reason. Terrorism of any sort is simply a matter of risk; the money you spend to mitigate it (repeat “mitigate”) is essentially an insurance bet. (Professional poker players understand this logic as the “expected value of a hand.” Pros would rather lose a hand for the right reason than win a hand for the wrong reason.)

So, the answer to your question. The computer security industrial complex doesn’t mitigate cyber-terror in a logical manner. We’re spending money “wrong,” and that’s not right.

::Should we be paying more attention to it,
::not necessarily through fear mongering,
::but rather through indepth and accurate
::analysis and understanding?

Yes. And I think the government should do it. Sadly, their research remains highly overclassified even by the government’s own admission.

But it’s even worse than most experts realize, and we can expose it with a simple observation. We know the U.S. military analyzes the attacks it gets each day — knowledge that remains completely out of reach to airmen & soldiers who would use the info to defend their home networks. It’s valid to assume major intelligence agencies both friendly (e.g. Israel) and hostile (e.g. North Korea) target the home networks of career officers & sergeants who habitually take FOUO and (yes!) classified info home to work on it after duty hours. Military analysis would at least yield a realtime blackhole list, yet the knowledge goes to waste on home networks where it would prove particularly useful.

I forget who once said “analysis that cannot be obtained is analysis that does not exist.” The military’s (public) release of a realtime blackhole list would do wonders in the realm of information protection. But they don’t release it … so it doesn’t exist for those who could benefit from it.

Crud. Did I just say “we do analysis wrong”?

…Did I answer both of your questions, Charley?

-Charley Brown

Audio Engineering Schools

Latest Hip Hop Music

It is really sad that after 10-15 years, our top government intelligence officials have FAILED when it comes to compiling and understand cyber-security data. One would think the government could reach out to the most intelligent cyber-security experts to compile data that can help them better understand cyber-threats and the security measures that can be take at the least expense to the public. I’m not holding my breath.

-Charley Brown

Audio Engineering Schools

Latest Hip Hop Music

Justin, creator of:

Registry Cleaner Reviews

Dog Training

Banking existed before Jesus dissed the moneychangers. Now, suddenly, Smith wants to make people earn the privilege to use banking services because the Internet made it too “dangerous.” In Smith’s utopia, you either get a “license to compute” or you don’t compute. If your credit score is below 600, then congratulations! You get to hide your cash under the mattress.

In Smith’s utopia, you’d need a license to compute before you can place your digital income in the hands of, say, Bernie Madoff. Smith wants the government to determine if you’re competent enough to shovel your life savings into a $50 billion ponzi scheme.

Okay, you get the point. It’s almost always a bad analogy when an expert uses the “driver’s license” analogy in a computer security discussion. Don’t fall for this computer security hype; demand a solid analogy.

Don’t forget the cat tranquilizers!

I hope to hear more of your insights!