Inflammatory Accusations
by Jeff NathanI recently wandered into Ann Arbor’s (and the first ever) Borders Books & Music store where I came upon a magazine titled “Skeptical Inquirer - The Magazine for Science and Reason.” At the bottom of the magazine cover, I read the text “Published by the Committee for the Scientific Investigation of Claims of the Paranormal.” No offense to anyone (hey, I’m an Art Bell listener), but the two don’t exactly jive. The cover story, titled, “CYBERTERRORISM,” was contributed by the infamous Carolyn Meinel, and argues that claims made by the information security industry lead to the creation of the US National Infrastructure Protection Center (NIPC), thereby resulting in the US FBI diverting resources and attention away from counter-terrorism and instead focusing on counter-cyberterrorism.
The reason the article caught my eye is that it is truculent in its absurdity. It essentially argues that Richard Clarke - former Chair of the President’s Critical Infrastructure Protection Board, former special Advisor to the President for Cyber Space Security and former National Coordinator for Security, Infrastructure Protection and Counter-terrorism on the US National Security Council (NSC) - was so cut out of the intelligence loop that he relied upon congressional testimony by L0pht, overly hyped news media reports, and books claiming that the source of a solitary US military defacement was associated with Al Qaeda while he worked towards the creation of the NIPC. While the article is rife with references, some of the references are incomplete (such as missing page numbers within referenced books), others refer to political talking heads and yet others reference the work of individuals whose journalistic credentials are less than ethical.
The crux of the article is a claim that neither policymakers nor infosec professionals followed the scientific method in discussing the dangers of cyber-terrorism. While I firmly believe that policymakers themselves aren’t inclined to follow the scientific method in decision-making, they’re fortunate enough to have advisors and invited speakers that do follow the scientific method. Further, methods used by some of the authors to obtain information referenced by Meinel’s article are anything but scientific, such as the cited Ann Coulter article espousing reasons for pre-9/11 FBI investiation shortcomings. When compared to actual experts on the subject, Ann Coulter’s knowledge of the inner workings of the intelligence community and foreign policy are about as extensive as my knowledge of underwater basket weaving.
Members of the NSC include heads of both the FBI and CIA. The NSC is tasked with advising the President on intelligence issues. To argue that Clarke relied upon news media reports to find evidence to support the creation of the NIPC is also ludicrous. To even argue this is without application of the scientific method as it’s difficult, if not impossible, to measure what Clarke took away from his NSC meetings or from his day-to-day job duties. Given his level of involvement, I find it highly unlikely that media hype played any part in NIPC’s creation.
The first and most inflammatory claim within the article is that the NIPC-allotted budget was improperly spent, and that the budget itself somehow contributed to a lack of resources that ultimately resulted in the FBI failing to investigate the flight school attended by the 9/11 hijackers. Based on the General Accountability Office (GAO) report cited in the article, the article’s author claims that the NIPC’s anti-terrorism spending totaled US$ 4.9 million in 2000, of which $3 million was spent on office supplies. What the article fails to mention is that under the Federal Acquisition Regulation, information technology equipment (i.e. computers, of which the NIPC needed many) falls under the heading “Office Equipment.”
Several paragraphs paraphrase and recount news stories of people discussing the dangers of High Energy Radio Frequency (HERF) and High Power Microwave (HPM) weapons. If anyone in the US government ever gave credence to the threat of a civilian-developed HERF or HPM weapon, I’ll eat a McDonald’s hamburger and a slice of chocolate cake.* Ironically, an important point from the article was completely brushed over; a July 2001 train crash in a Baltimore tunnel that took out part of the routing infrastructure. More on that in a future posting.
Several professionals from the infosec industry are portrayed negatively and mentioned by name in the article - people I’ve worked with such as Mudge. Mudge’s (and by extension L0pht’s) congressional testimony is also discussed, specifically the famous quote in which Mudge talks about crashing the Internet in 30 minutes. Meinel’s claim with respect to testimony and information provided by industry experts is that they didn’t follow the scientific method and that their statements were nothing more than FUD intended to create hysteria. In reality, most skeptical minds consider Mudge’s statements to be much more rooted in fact than fiction. In all likelihood, Mudge was referring to severe, unreleased BGP vulnerabilities. Some five years later BGP was subjected to a thorough analysis in 2003. However, the period between 1998 and 2003 was an enternity in Information Security. Though an Internet scale failure didn’t occur during this time, it has nothing to do with the validity of the threat Mudge described.
The former NIPC is now known as the US Dept. of Homeland Security’s Information Analysis & Infrastructure Protection Directorate (IAIP). The need for IAIP is quite real, and to argue that its creation in some way substantially detracted from the ability of law enforcement to investigate before 9/11 is absurd. Based upon the cited GAO report, the combined 1999 and 2000 NIPC budget was primarily used to fund agents’ salaries, purchase $11.9 million in hardware and software, fund $3.3 million in field squad training and $12 million was used to fund contracts. Among the contracts listed are:
- a foreign counterintelligence investigation (which I personally suspect to be Moonlight Maze)
- InfraGuard
- the development of an early warning system
- research of existing Internet topology
The total FBI budget in 2000 was $3.231 billion. So, ultimately, the article (and by extension Meinel) is arguing that the expenditure of a paltry $28 million or approximately .009% of the FBI’s 2000 budget substantially inhibited FBI investigations before the 9/11 attacks. I sincerely doubt that to be the case. My copy of the 9/11 Commission Report contains neither an entry for IAIP nor NIPC in the appendix. While my search was cursory at best, I didn’t find a single citation made by the 9/11 commission themselves that refers to the IAIP or the NIPC.
* I’m into health and fitness and I don’t eat that junk.
It’s a testimony to your whatever-it-is that you were able to balance a blog post on the fulcrum of a credibility smackdown between Mudge and Carolyn Meinel, “The Happy Hacker”. And when did you work with him?
April 18th, 2006 at 2:38 pm Reply to this comment
Thanks for the comment, Tom. I like to think of the post as having been crafted with the delicate dexterity of Jason Garfield’s ten-ball juggling routine. We both know there wasn’t any actual credibility smackdown within the article. The relative absurdity of the claims made in the article simply caught my eye.
As far as working with Mudge, you interact daily with Dave G. and Window; either of them could have reminded you that I worked for @stake in 2000 and 2001.