Techno-Terrorism and you

                  TECHNOLOGY AND TECHNO-TERRORISM
                  By: Thomas V. Sobczak, Ph.D., P.E.

SIGNAL SOFTWARE TECHNO-TERRORISM
 
Malicious code is a premeditated bug in a software routine.  It may result from the misuse of
undocumented features similar to the "Trapdoor" defined below.  Perfectly reasonable logic can
be made to execute out of phase in relation to its intended purpose. Software corruption is a state
of the mind structuring the desired effect. 

DEFINITION OF TERMS
  
Computer viruses -- a software attack the "infects"  computer systems much the same  way as a
biological virus  infects humans.  A virus is a small computer program that appears harmless but,
as part of its operation, "reproduces" by making copies of itself and inserting them into "uninfected"
programs.  This insertion process takes only a fraction of a second,  a normally undetectable delay.
 The infected program will subsequently execute the virus code during its normal processing.  The
virus may cause damage to  programs and data, or  it may be harmless.
 
There are four basic types of "malicious"  software to be concerned about in the computer and
communications security relating to fielded and developing weapon systems.
 
Trapdoors --  Operating system and application  safeguards usually prevent unauthorized
personnel from accessing or modifying programs.   During software development, however, we
usually disengaged or bypassed these built-in security measures.   Programmers often create
entry points into a program for debugging and/or insertion of new code in a convenient, if,
unsecured manner.  We assume that these entry points eliminated  in the final  stages of program
development,  but we sometimes overlook them,  accidentally or intentionally.  They dramatized
a perfect example of a trapdoor in the movie War  Games, where the teen-age hacker enters the
special password "Joshua" and gains unrestricted access to a mainframe  computer in NORAD
headquarters.   Such a mechanism in a computer's operating  system can grant an attacker
unlimited  and virtually undetectable  access to any system resource after  presenting a trivial
control sequence or password. Every operating system has them.

Logic Bombs --  A logic bomb is a program or code fragment that triggers an unauthorized,
malicious act when some predetermined condition occurs.  The most common type is the time
bomb, which we program to trigger an unauthorized or damaging acts long after we position the
bomb.  A logic bomb may check the system date each day until it encounters the defined trigger
date.  It then executes code that carries out its hidden mission.  Because of the built-in delay, a
logic bomb virus is particularly dangerous.  It will infect many generations of backup copies of
software before they discover its existence.
 
Worms -- Systems programmers originally developed Worms to tap unused memory resources
in a network to execute large computer programs.  The worm searches the network for idle
computing resources and  uses them  to execute  a program in small segments.  We create built-in
mechanisms for maintaining the worm, finding free machines, and replicating the program.  Worms
can tie up all the computing resources on a network and essentially shut it down.  "Do-loop"
programs are available to cause the scratch pad memory of a VAX operating using the UNIX
operating system to fill to the point of a perpetual wait-state.  We normally start a worm every  time
we boot the system. The Internet Incursion is a professional example of the worm logic at work.
 
Trojan  Horses --  A Trojan  Horse is a program that looks "normal" but contains harmful code.
Usually adding extra, unauthorized instructions that will be executed in a privileged mode changes
a production program and thus we have access to otherwise unavailable files.  This is the most
commonly used method for software-based frauds and sabotage.
 
UNANTICIPATED LOSS OF TECHNOLOGY: CAUSES AND REMEDIES
                 
The work "hacker" negatively affects those who know only of the media publicized evils propagated
by a very few individuals.  True hackers are the Roger Williams of the twentieth century.  They are
seekers of truth who rebel at the man made encumbrances put in the path of their search for the
"ideal" notion of free access to anything in electronic format.  They are not all bad, yet, in carrying
electronic freedom to the extreme, they menace American technological supremacy.

It could well be that the antecedent of the widespread fear of hacking is fear of our inner self.
Individuals (you and I) given the proper stimuli, typically reach out beyond the system and
accomplish that which exceeds societal norms that govern our every breath.  Hacking exists as
a fact of our everyday lives.  Often we know it by different terms appropriate to the industry in
which we toil. 

Often we all shortcut and manipulate to gain an advantage at home, in school or on the job.  We
seek information to satisfy our needs.  For most of us the limitations of social and ethical behavior
and the patterns we see about us form the basis for that which we consider "doable" without being
criminal.  Others stretch the norm to its limit just short inducing damage by their actions.  Evil doers
go beyond the limit in an attempt to exploit or corrupt for personal gain or ego satisfaction.  They
have no idea of the effect of their actions upon the property of others.

Systems of rules frustrate creative minds.  They place creativity at a premium then deny the fact
and achievement of creativity to assure everyone in an organization or project works and acts in
a set range and pattern.  Frustrated people channel their abilities and search for satisfaction in
other directions. One avenue to self satisfaction is hacking.  Hacking is the practical use of pure
deductive logic to achieve the highest level of cognitive fulfillment manipulating an electronic
medium.

Professionalism in any field develops a structure, over time, which defines status within peer
groups.  In a sociological study of humankind from the beginning of time one sees and can identify
evolution of the idea of expertise.  In ancient times everyone could hunt but an elite were known
and respected as HUNTERS.  In our present day world within excess of 150,000,000 million
personal computers available for general use and with half those devices capable of
communication via telephony, we have created a new class called an electronic hobbyist. 

The experts within the hobbyist community, who do not earn their livelihood and/or have no
advanced traditional education in the specific universe of knowledge they research are  pseudo-
professionals we term HACKERS.  Hackers are the research scientists of the applications oriented
user community.  They optimize the potential available to the user community by freely sharing
their research results.  Unfortunately for American technological security, they share too freely.

We accept the "white hat" hacker as a super user working to ease the burden of the"normal" user.
This term originated to differentiate the "in the loop" hobbyist from the "out of the loop" hacker.
Being philosophical, Tom Watson was a super user while Steve Jobs was a hacker when they
conceived the devices that made them famous.  Incidentally, hackers, when they either gain
respectability or get caught tend to become super users in the former case and security
consultants in the latter.

Notice that not everyone who terms himself a "hack" or "hacker" is in truth capable of hacking.  The
super user takes that which exists and manipulates, modifies and integrates components to make
a thing that is better and beneficial.  The "black hat" hacker takes a thought and makes it a new
reality for his own ego satisfaction without consideration of the ethics involved.  In our experience
this person comprises about 5% or less of those calling themselves hackers.  The other 95% are
copyists who transfer the newly created harm from operating system A to operating system B or
Machine C to Machine D.  I call these hackers-helpers.

Copyists do some modification.  Nevertheless, they have not created, only extended or translated.
Be aware that this level within the hacker peer group has a place and does an identifiable function
in the transfer of technology.  It is not the point of this document to discuss the merits of the act.
We attempt to order the setting for that which is occurring daily, i.e., the act of addressing a
computer and its files unauthorized to free the content for public use in the name of emancipation.
 This is compounded by the transfer via trade or sale of that content among users' world wide

Those who do not apply any moral/ethical values to the logic have undertaken the lowest and most
threatening form of hacking which govern their actions.   These egoists exercise perverted logic.
They are comparable to a hunter who wounds an animal and leaves it to trash about to become
savage and hurt the uninvolved.  In real world hacking, this individual starts a project, lays open
his target then drops out before he has cleaned up the chaos created.  He is the developer of logic
and time bombs.  The Trojan gift giver.  The VIRUS contaminator.  He is so proud of himself that
he hides in shadows and tries to shift blame to those who copy his leavings and expand upon them
in innocence or stupidity.  His peers execute his errors and cause damage because, as copyists,
they cannot comprehend the traps inherent in the software code they purloin.  People put at risk
of livelihood and existence from hacking become the victims of a victimless crime. Without proven
intent the culprit escapes with sentences of community service.

Technology transfer is created by those I term, hackers' helpers.  Unknowingly, professional
hackers put forth a plethora of information that allows an amateur to collect, trade and reeks havoc
without realizing the consequences of his actions. Valid professionally prepared technical
information comes available in the hobbyist community from people who satisfy their egos and
insecurities by talking too much or giving away copies of otherwise unattainable documents.
These choice tidbits are a valued reference source in the field of national and industrial espionage.

Security managers, evaluating the effect of hacking upon technological transfer, should look at the
detail and trivia revealed beyond the training, operations and maintenance manuals provided by
system integrators and manufacturers generally available about their workplace.  Notice that in
trying to understand that which he finds, the hacker identifies tangents that open new ideas to
those who seek technology.  Like a lawyer examining a contractual agreement and annotating it
for all possibilities, the hacker identifies every foible and weakness that human nature allows.
Serious researchers can learn a great deal concerning the volume and quality of technological
leavings that are available for the asking.  This vast repository should encourage an appraisal of
the security in place concerning technological data and that security's effect upon unauthorized
transfer.

Let us set the prospective by understanding that the chief weakness of technological insecurity are
you and I, i.e., users, analysts, and supervisors of technology.  The sound of their own voices
impresses humans.  They obtain ego satisfaction when listened to by those whose audience swells
their ego. To be listened to some people talk shop.  They invite unauthorized access by making
the information available so inviting as to be irresistible as the flame is to the moth.  Without
attempting to be a psychic one can relish the effect of good booze and leading questions after an
egotist has suggested the places to frequent to talk or listen to "shop talk" or secrets. 

More than 90% of the dial up telephone numbers, ID codes and passwords allowing access to
computers interdicted daily are given freely in the spirit of conspiratorial camaraderie. Ten percent
of the telephone numbers are located by telephone dialers and complementary password hackers
operated by the evil few.  These numbers soon find their way into the public domain.  Those
protecting technologies do not listen to the chatter from the national "we" nor do they monitor the
technologies in our media as do the transfer specialists of foreign nations.  Targeting the sources
of technology is as easy as using INFOTRACK at your local library followed by Cybersurfing those
keywords on the INTERNET.  Sobczak has categorized BBS/repositories  by a self developed
quality rating system.  Professionals, either with degrees or age experience, frequent the upper
end BBS.  The special interest groups are of a quality rivaled only by post graduate seminars.  

Most sensitive information is obtained using someone else's phone lines and computer so as not
to be caught. All the collectors need do is ask or pay a friend to download one file.  As a note,
copyists by their immature nature are destructive as a substitute for creative manipulation of the
hacked system.   At the intermediate level, i.e., those interested in no particular technology, collect
ID's and passwords are which saved and traded to those with similar interests. 

As Ph.D.'s specialize so do hackers.   If you attain the super user privilege in the proper
environment information is passed about freely.  The so-called INTERNET WORM, the Satellite
maneuvering scheme, Microwave signal saturation, Bell Labs optical computer  and the like can
be found and defined down to the breadboard and schematic specific level.  Determining the mass
of technology available will quickly make you aware of just how little technologists care about that
which they create and/or use daily.

Sobczak research shows, with a probability greater than 80%, that few trusted systems are
unbeatable.  Since people interface on computing, they are and will remain the weak link to secure
technology.  We have followed hackers whose sole goal in life is to defeat the NSA Rainbow
Series.  Their upset stems from an implied insult to those without degrees in higher education by
the specification of educational criteria for the suitable testing to achieve the various levels of
trustworthiness acceptable to the NSA.  We have known hackers who abhor capitalism and
therefore target the stock exchanges, brokerages and banks.  Each to his own mind set and
mission; each functioning at odds with the system.  Some being paid enormous bribes so as not
to share their successes.

Diversity of purpose is what makes hacking dangerous. Randomness concerning place and degree
of risk makes awareness of clandestine technological transfer an imperative.  We read about
Berkeley and Lawrence Livermore problems and never read about Langley, Kirtland AFB or the
VAX cluster at SAM.  All have been or remain opened to browsers.

NO ONE CARES

The ability of individuals to enter and traverse the military and contractor communications networks
from anywhere in the telephone connected world do to the absence of coordinating agency
responsibility, compounded by minimal safeguards, leads to a conclusion that American
intelligence has failed to either identify or place credence in the ability of hackers to transfer
protected technologies.  This is an intelligence failure.  That which should be secure, always, is not.

Failure within Federal intelligence agencies occurs as to perspective, mentality and perception.
They misplace the significance of the problem of technological loss.  We condition Americans to
look for spies and master criminals doing immoral deeds in traditional places.  They are not
accustomed to "little Joey Jones," the kid next door functioning as a high tech James Bond clone.
Tradition tells us that children who stay at home and mind their parents are good children. They
also collect and trade technology.  The 414 group in Milwaukee is a reasonable example of youth
gone bad.

In our contacts with youthful hackers obtained ninety percent (90%) of our collection (174,000,000
bytes of technologically oriented text ranging from ASPJ to Zenith communications protocols for
MILNET).  These individuals do not grasp the  potential for corruption offered by the data they
collect, trade and manipulate.  Usually the technology selected is secondary to the challenge of
"beating the system."  To set the record straight those in the 15-19 years of age group espouse
the Kiddie Show (juvenile ego expression) and Anarchy ( How to Nuke your school) type sites.
There are exceptions that prove the rule, however.

We make estimations of age, sex and goals using common sense.  Sobczak has by experience
constructed comments and questions that generate an age-oriented response.  Hobbyists be they
super user or hacker must have the last word in a transmission. Their response is a reasonable
indicator of the personality of the person with whom we are dealing.  As hackers use fictional
names called "handles" it requires time, patience and the collection of a large amount of trivia to
establish an estimate concerning age and programming skill level. 

Statistically by counting commas, periods, words before a comma, word after a comma and the
like, I create an opinion of what aptitude can be assigned to what "handle."  Sophisticated electro-
spies use many "handles."  Bayesian analysis of their discussions and exchanges will suggest
those that we group as one.  A technology collector from Chicago uses a dozen handles.  He was
easy to follow as his interest is only focused on DOE in sites near major laboratories.  He looked
for contacts who would trade and discuss information about any aspect of nuclear science.  Others
are a bit more difficult to track. Sometime copyists confuse the situation by using the handles of
acknowledged super users and hackers to perpetrate corruption.  The original LEX LUTHOR has
two dastardly clones.  They cause him to be blamed for their attacks.

There are few analysts in government or industry with whom to share knowledge of misplaced
technology.  People who are involved in warning about intelligence losses are invisible.  They orient
intelligence in the domestic environment primarily to illegal access.  No agency officially evaluates
the contents of hacked computers against the technologies withheld from transfer.  Due to this
non-evaluation we discover neither failures nor successes.  A survey of government-sponsored
DBMS identifies a void caused by this lack of indicators.  Methods to track restricted transfer has
never been acknowledged as a counter intelligence function.

To those addressing the frequency of occurrence of technology transfer, your perspective is as
good as mine.  Both remain flawed until a reasonable statistical base is available under the control
of a designated coordinating point of contact. Right now no one in any intelligence agency takes
responsibility for the technology that is stolen daily.

The rationale of intelligence organizations is a Business School mentality.  They organize it in a
predictable and patterned manner.  Those seeking information need only understand actions that
arouse protector interest and plan their collection campaign around them.  Security emphasis is
placed on access control rather than upon the technology being protected.  For every secure file
cabinet with verification by two signatures there exists a quantity of unprotected data files and
willing proponents of information sharing.  Hackers know how to browse in computers.  They have
taught copyists to do so as well. 

Information collectors use hackers and copyists to learn if the information they seek exists and the
places frequented by the possessors of that information.  To rape the knowledge base of
AFSC/ASD  local chat-sites say "hangout" at the O-Club on the hill above building 52 in Area B
Friday afternoons or spend liberally at the Chapter III in Fairborn Wednesday evenings and
Saturday afternoons.  Everyone has a "hot button."  Triggering an individual's ego causes a torrent
of trivia to flow.  Collection and structure of information open the doors to more sophisticated
technology.

When we successfully transfer technology violating law, intelligence agencies reorganize to
conform to "CYA." Rules of engagement do not change.  Intelligence agencies do not trust each
other.  Worse they do not trust divisions and branches in their own organization.  Dealing with
NSA, for example, is dealing with Jell-O.  When you pull your finger out of the mold, it returns to
its original shape. Laxity is further confused by the liberal Lawmakers and Jurists, who, in the
interest of freedom, handcuff the mechanism to protect technology.

Possession of knowledge that is sensitive or illegal to possess is not a crime.  Use of that
information is criminal if an enforcement agency can prove it was you who used it with the intent
to do wrong.  As a collector of knowledge one can freely amass volumes of information.
Information can be collated, sorted, analyzed and restructured to produce new information.  If you
save your knowledge on an INTERNET or ARPANET device, you seemingly are not violating any
rules. In a quick packet burst that new information can be moved worldwide without prejudicing the
sender.  If the transmission is identified the responsibility for protecting the information will most
likely be shifted (the Jell-O syndrome) rather than take action to change the procedures to stop
information losses.

The B-School mentality of lessons learned and case studies produce a vast amount of knowledge
about the structure of intelligence.  For $65 one may purchase a list of all unclassified Federal
Databases from the NTIS, Springfield VA.  A search of bibliographic sources will greatly help those
searching for technology.  Voids can be filled by using the freedom of information act prerogatives
available to any citizen.  The collections of all DOD and Service colleges and specialized schools
are yours for the asking.  If one is organized, related questions are asked by unrelated individuals.
If one researches the sources of information, you will find upwards of two hundred sources in
literature available from the small business officer at any installation or base without really trying.

Paradoxes in perception further guarantee failure in protecting technology.  Some examples are:

     a.  Developing rules by which to protect technology provides a false sense of security.  The
more secure a person feels about his data, the more freely will he give it away.  Since only those
with a need know, those who know have a need.

     b. Too sensitive warning systems increase the number of false alarms.  Join the boy who
cried wolf.  A straightforward protector becomes the villain when he follows the rules.  People follow
the path of least resistance.  They will hide the truth so as not to be inconvenienced.

     c. Preconceptions of what a hacker does and how he behaves abound.  In the real world
the salesman who asks you about your opinion of his competitor's product and your reason for
believing that, he is hacking.  How can we reduce preconceptions when we all preconceive?

CONTRIBUTING TO A TECHNOLOGY DRAIN

Intellectual error in the security community abounds.  The most prominent source of error is the
failure to propagate and instill computer security literacy in their users.  Times have changed the
design of spying but the collection mechanism is the same.  Several factors contribute to hacker
success.

     a. It is no longer a hard copy world.  The ambiguity of evidence causes reasonable doubt.
We do not sensitize analysts to the jargon of hacking.  Analysts tend to be complex people looking
for more complexity. Ignoring unanticipated oversimplifications is easy.  "Look at all those trees.
Do you suppose there is a forest near by?"

     b. In the world of hacking and hobbyists, information overload and affectation with
insignificant detail is the rule.  In place of guessing based upon statistical analysis of a few
meaningful facts, one must peel away layer upon layer of trivia while establishing the trend or the
path being followed.  An oxymoron should exist for a person involved in technology hacking.   We
could term him an inexact authority on any and no subject.

     c. In a world of free speakers comprehending the nuances of certifiable probability from a
range of possibilities is nearly impossible.  An ambivalence of judgement by experts is
characteristic.  While hedging is counterproductive, it is a way to CYA.  CYA is natural to the usual
routine.

     d. As was mentioned earlier, changes to organization formally erode the ability to find
transfers.  About the time when an analyst can recognize a difference or pattern, he is no longer
assigned to the task.

HACKING BACK

Taking actions to protect technology from the threat of loss to espionage is possible.  The success
rate increases drastically if you:

     1. Assume the worse is happening to your technology today.  Begin an awareness
campaign anchored in something real that individuals involved in producing and using technology
can comprehend.  Choose an approach or mechanism that has meaning to those involved.

        Retain an objective outsider to tell you about your technology.  A trained individual will
illustrate most secrets in nine of ten cases from a completely unexpected perspective.  He will tell
you where your secrets are resident.  He will provide hacker handles and the sites they frequent
to steal your technology.  He will suggest watering places and hang outs that should be monitored
or off limits to your technological staff.  He can suggest who is leaking your secrets just short of
the point of violating their civil rights.  Most importantly he will tell you who is after your secrets.

     2. Create a technology advocate. Take a believer and educate him or her to both sides of
the problem.  Use him as a sounding board so we do not turn your good intentions and goals
against you.  Be sure to choose someone you consider in the image of Caesar's wife, i.e., above
reproach.   LISTEN TO HIM OR HER.

     3. Do not manage the news. 

     4. Evaluate "need to know" about your technologies and consolidate the universe of users.
In many operations most uninvolved management are no more than status seekers who open you
to risk.  Many a hacker has signed on as the CEO because he knew that security was not ready
to challenge the old man in spite of his repeated screw-ups.  The ASAF in the secure Pentagon
was the victim. His staff can tell you about this weakness.

     5. Do not be afraid to listen to the troops.  Take the good with the bad BUT be a devil's
advocate.  Who, when, where, why, and how are really friends whose names should be used.
There are no secrets among team players with a need to know.  If your most trusted employee
refuses to be open concerning securing access to technology, he is not to be trusted.

     6. Sanctions are a reasonable method to reduce technology loss.  Firing and prosecution
set the tone for just how serious you are concerning technology security.

     7. Make explicit rather than unconscious decisions.  Things can be different from that which
they seem.  Count to a hundred, if need be, before you act.  Act based on fact or reasonable
verified (multi-source) suspicion.

     Finally, and most importantly trust in yourself.  Think straight and respond rather than react.
American technology is the backbone to our national economy.  We must value it in light of its
worth.  Technology losses occur when individuals forget their responsibility to their nation, the
employer and, what is most important, themselves.  No man in his right mind accepts his pay then
tosses it out the window to let it scatter and be lost.  Technology is your pay check, treat it with
equal respect.