Truth About Computer Security Hysteria
Mumblings of monkey-men mock moderationGeorge C. Smith, Ph.D., Editor-at-large
Tuesday, 5 June 2001 LOCAL LOS ANGELES TV news anchormen had a great time with the monkey-man of India — an allegedly fierce creature fond of attacking the destitute while they slept. I bet yours did, too. Thanks to a strategically placed news story in the Los Angeles Times and subsequent legs on the Times-Post newswire in May, everyone was laughing it up over this story of queer beans emanating from the subcontinent. "Look at those backward perishers in Gobble-Wallah," was the smug subtext. "They don't know ---- from shinola!"
"Leading Hindu nationalists insisted that the military intelligence agency in Pakistan had sent the monkey-man in a sinister plot to destabilize India. Several members of Parliament demanded that the government send in crack paramilitary units to catch the ape-man."
— from a May 2001 story in the Los Angeles Times on the hysteria surrounding a recent urban legend of India
However, our myths are just as good. We just spackle them over with a snobby, less proletarian techno-veneer. The monkey-man would have been fine for America in the early-70's, around the time of the filming of "The Legend of Boggy Creek," but now that we've invented the Internet, "digital Pearl Harbor" and "information warfare" derivatives are better socio-cultural fits.
So infatuated was I by the tale of the monkey-man of New Delhi I went in search of more news on the Internet and in so doing discovered that one of our special monkey-men had wandered away and merged with the cyber-lore of foreign lands.
It was said in the Los Angeles newspaper that an analysis in the Hindustan Times wrestled with explaining the belief in the monkey-man. Desperation and hard times was what it boiled down to, according to the Times — superstition cooked up by "poor people" driven to aggravation by 10-hour power black-outs and water shortages.
Looking for the Hindustan Times on the Web for further copy, however, got me sidetracked onto another article published by the newspaper. In a piece from the June 8, 2000 edition, journalist Ravi V. Prasad mulled over "cyber-terrorism and the threat to India" in the wake of the KillerRésumé and ILoveYou computer viruses.
Prasad quoted R. James Woolsey, former director of the CIA, as an expert on computer viruses. In the Hindustan Times, Prasad alleged Woolsey had claimed the existence of "an entirely new class of viruses which he termed instructive viruses" during a talk given to a Washington-based think tank.
"An instructive virus can instruct [which would seem inarguable] critical computers to shut down vital infrastructure," went the story.
The Hindustan Times also claimed the National Security Agency had developed a "virus called Blitzkrieg ... based on research in quantum electrodynamics and chaos theory, which can destroy networks of entire nations ... the equivalent of the deadly human Ebola virus..."
"While there is no significant reason to suspect that the US may use Blitzkrieg or instructive viruses against India, we should be on our guard," continued the newspaper.
"Because the monkey-man reportedly attacked only sleeping people in the dead of night, actual sightings were hard to come by."
— "...Sinister Simians Roam," the Los Angeles Times, May 2001
U.S. CYBER-MONKEY-MEN HAVE much in common with the New Delhi species. Sightings of terrorists plotting to douse the lights from the refuge of an offshore cyber-bunker or Russian henchmen downloading precious U.S. Department of Defense intellectual treasure are often cited but occur only in the American equivalent of very dim moonlight: hearsay of classified goings-on or vague but stunningly grandiose mumblings delivered by parties who speak under the shields of secrecy and anonymity. With the case of the NSA Blitzkrieg virus, the legend concerning it was already just about two years old when come upon by the Hindustan Times. In April of 1998, SIGNAL, the magazine organ of the Armed Forces Communications and Electronics Association, a publication notable for jargon-riddled articles on the repeatedly alleged utter supremacy of Department of Defense digital widgetry and a servile regard for the details of Pentagon contracting, ran a cover story on it. Like many news items which take on the proportion of myths, this story concealed a small nugget of truth — in this case, word of a still-in-development piece of commercial computer network security software — within a billowing cloud of grandiloquent, often common-sense-defying huffing and hooting. "A growing echelon of chief technology officers are likening the stealthy [Blitzkrieg] virus to the digital equivalent of Star Wars technology," alleged a sample. Yet another segment of the now mythic story referred to an apparently very excitable but unnamed CIA computer security specialist who claimed Blitzkrieg virus to be "potentially more dangerous than nuclear weapons." Mostly, all the magazine's blustering was aimed at getting the interested to attend an annual high tech conference sponsored by AFCEA. And, in the fullness of time, that was pretty much the end of it. No "Star Wars" computing technology gained supremacy. Despite a great deal of wishful thinking on the subject, no digital "nuclear weapons" appeared. Virus-writers made ILoveYou and Melissa and Kournikova and a few thousand others of no account. Cyber-World Wars were said to be started and stopped, won and lost, lost and won, stalemated, checkmated, fool's-mated and deadlocked. It was Serbia vs. NATO, India vs. Pakistan, Arab vs. Israeli, Chancre Jack China vs. Commie China, Commie China vs. America, Lick-Spittle vs. the Cyber-Pantywaist, cats vs. dogs, a dozen or so I've forgotten, and Me vs. You — you crusty botch of nature! Are you beginning to grasp where your editor is going with this?
"One man who claimed that he had looked the monkey-man straight in the eye said the beast immediately turned into a cat and ran away."
— from the Los Angeles Times
If one takes the wide-angle view, it becomes painfully obvious that it doesn't really matter if the songs we sing to each other are based on nothing at all. If enough believe the myths have merit then subsequent public discussions and national policy can and does arise as a response to them.
In this specific case, empty-headed talk — tales of monkey-men — of U.S. origin about network blitzkriegs and instructive viruses is taken as an indication, by a foreign country's Washington Post, that the American military has taken a lead in development of cyber-weapons and that it might be rational to think about devising balancing forces.
IRONICALLY, THIS IS not the view from the cyber-trouble front typically presented in the American mainstream. Instead, the US-centric view, which in and of itself is a rather selective myth, is best explained in connection with the Department of Defense buzz-term — "asymmetric threat." Invoked ad nauseum since the middle of the past decade by Pentagon-wonks, "asymmetric threats" are "weapons [like 'instructive viruses'] and tactics that relatively weak enemies ... use to foil [U.S.] technological supremacy." Or, for another common example, they can be explained as features of "a war where [the adversary] will strive to fight electronically" instead of irrationally attacking the U.S. military head on. Always in accompaniment is the vaguely-defined received wisdom that such menaces arise more or less spontaneously in foreign powers or agencies crazy-mad bent on attacking America in the future. The heretical idea that an "asymmetric threat" might not actually be so, that it might just be a sign of symmetry — a refection or reaction stemming from a perception that the U.S. military has an aggressive interest in the same type of offensive warfighting — is not entertained. In other words, the myth of the asymmetric cyber-threat will generally appear in our national news media as a reported condition in which American infrastructure is always said to be the target of foreign operations or plans in development. And it will present in a vacuum in which examples from the foreign perspective (of which there are now, unsurprisingly, quite a few) are excluded. One never expects to see mention of an article from the New Delhi (or any foreign capital's) newspaper suggesting the need for cyber-war agencies as a response to a presumed corresponding and quite possibly precedent American build-up. The exception to the rule is one in which such an article is filtered through a government, military or private sector source who paraphrases only the portion where information warfare agencies are recommended — not the context in which it is delivered.
"If he's a monkey, I'm ready for him."
|— a New Delhi man "now in the monkey management business" waiting and hoping for a call to take on the monkey-man However, this is not all bad news! Rampant confusion and mass insanity can be good for the economy. The multiplication of monkey-men myths creates job stimulus. Professionals recruited to prevent "instructive viruses" or network Blitzkriegers can be thought of as our more technologically informed variety of monkey-man managers. Indeed, they can spawn even more jobs and goods, creating "synergies" with strategic forecasting services or threat warning and information sharing networks. Anyone can get in the game, from federal agencies like the National Infrastructure Protection Center or the National Security Council to the private sector. Better still, the work is inexpensive and can turn a substantial profit upon mark-up prior to delivery of the finished product. You see, the dirty little secret of monkey-man prediction is that it is the technological equivalent of unskilled labor. That is, unless you consider daily Web-surfing and the collection of electronic gossip tasks requiring scholarly rigor.|