PITAC co-chair Lazowska on cybersecurity

For two years, University of Washington computer science professor Ed Lazowska served as co-chair of the Presidential Information Technology Advisory Committee. His two-year term ended in June 2005, and in a recent interview in CIO Magazine, he's got some things to say. There's so much juicy material in this interview that anyone even vaguely interested in national security or computer science should read it all, but some excerpts follow...

Lazowska doesn't pull any punches when discussing the Bush administration's approach to the issue. "In my opinion," he says, "this administration does not value science, engineering, advanced education and research as much as it should-as much as the future health of the nation requires."

...

We see some of the effects of cybervulnerabilities on a daily basis on the front page of our newspapers: phishing attacks, pharming attacks, denial-of-service attacks and large-scale disclosure of credit card information. Even phishing attacks, which seem easy to dismiss as a gullibility problem, arise from the basic design of the protocols we use today, which make it impossible to determine the source of a network communication with certainty.

The public, and most CIOs, do not see many activities that are even more threatening. The nation's IT infrastructure is now central to the life of all other elements of the nation's critical infrastructure: the electric power grid, the air traffic control network, the financial system and so on. If you wanted to go after the electric power grid-even the physical elements of the electric power grid-then a cyberattack would surely be the most effective method. It's also worth noting that the vast majority of the military's hardware and software comes from commercial vendors. PITAC was told that 85 percent of the computing equipment used in Iraq was straight commercial. So the military itself is arguably about as vulnerable to a cyberattack as the civilian sector.

Now, the problem is that you can't suddenly decide that you want something like security and expect to be able to buy it, because the technology doesn't necessarily exist. Almost no IT company looks ahead more than one or two product cycles. And historically in IT, those ideas comes from research programs that the federal government underwrites. Just think about e-commerce: You need the Internet, Web browsers, encryption for secure credit card transactions and a high-performance database for back-end systems. The ideas that underlie all of these can trace their roots to federally funded R&D programs.

That's how this relates to the R&D agenda. Long-range R&D has always been the role of the national government. And the trend, despite repeated denials from the White House to the Department of Defense, has decreased funding for R&D. And of the R&D that does get funded, more and more of it is on the development side as opposed to longer-range research, which is where the big payoffs are in the long term. That's a more fundamental problem that CIOs aren't responsible for.

...

PITAC found that the government is currently failing to fulfill this responsibility. (The word failing was edited out of our report, but it was the committee's finding.)

Of course, given the Bush administration's track record, it's hardly surprising that they're failing here, but it's yet another data point. I also find their editing of the PITAC report pretty shameful; but, again, s.o.p. for the Bush gang.

Incidentally, in September 2005, PITAC's functions were absorbed into PCAST. However, I don't have the inside baseball on whether this means that IT concerns will be taken more seriously (because PCAST is a more important council) or less seriously (because IT will get buried in the millions of other things on PCAST's plate). My guess is that much will depend on the dynamics of the PCAST committee and its leadership.

For more about the state of cybersecurity in general, you might want to see Lazowska's 12/02/04 lecture from Lazowska's course last year on public policy and IT (note that the slides alone won't give you the full impact; you really want slides and video together).

---

UPDATE 7 Oct.: Regarding the merger of PITAC and PCAST, the Computing Research Association blog, which is more clued in than I am, has similar questions. However, they think that, on balance, "the positives outweigh the negatives", so maybe things are looking up for IT policy in the US.

Academic Job Search, Chapter 0: Scanning for openings

So, this week, at the behest of my advisor (who finally gave me the kick in the ass I urgently needed), I finally began in earnest the terrifying task of searching for an academic job.

The first phase is, of course, compiling a list of places to apply to. For computer scientists, this means searching the ACM and the CRA, plus the usual places for other disciplines: The Chronicle and Higheredjobs.com. For good measure, I also went to US News & World Report's college rankings --- not because I cared much about the rankings themselves, but because I wanted a good long list of institutions --- and did a brute-force scan through about 200 colleges and universities, searching for "faculty openings", "job opportunities", "human resources", etc. on each school's website. The brute-force scan didn't yield any leads beyond those posted on the jobs sites, but it did give me some context against which to evaluate the institutions that did post offers.

Then, tonight, as recommended by every graduate or soon-to-be-graduate in our program that I've ever talked to, I compiled my grand spreadsheet of institutions and openings. Conclusion: anxiety ahoy.

Currently, there are only a dozen-odd postings that seem like the general sort of job I'm looking for; and by "general sort" I believe I'm casting a pretty wide net (for example, I'm being fairly permissive about geography --- basically, only the Deep South is excluded). If, out of this year's national crop of Ph.D.'s, even a dozen candidates have better resumes than me, plus career objectives remotely resembling mine, then... well, I'd rather not dwell on it, though I do have backup plans.

Anyway. The amount of time and labor involved in this process is exhausting, but more exhausting than that is the simple psychological load of feeling your future career hanging in the balance.

On the other hand, this anxiety's arguably irrational, because 95% of the factors determining your future career options have already been set in stone by the time application season of your final year comes around. The only remaining X-factors are current market conditions and your skill at selling yourself. But the former's out of your control, and the latter can only help you so much (though, I suppose, it could torpedo your chances if you're grotesquely bad; but that seems unlikely for most candidates --- it's hard to accumulate a decent C.V. in the first place if you're that bad at communicating). So really, you should just work hard on your application, and accept what comes with a sort of fatalistic calm.

On the bright side, at least I've found a few openings that could be exciting, if I were to get those offers. My idea of the ideal job is unusual enough that, for the past year or so, I've almost been convinced that there wouldn't be anything even remotely resembling it. At least it's good to know that the probability of getting a decent position is greater than zero, even though it's hard to tell whether the increment's infinitesimal or substantial.

Dissecting terrorism

Ed Lazowska, Steve Maurer, Stefan Savage, and Geoff Voelker are once again running a multi-institutional course on public policy and technology. This term's focus is on cybersecurity, but the first few weeks have basically focused on terrorism and security more generally.

Just like last year's offering, there's an online lecture archive with PowerPoints and videos, or synchronized video/slides using WebViewer.

Anyway, I just got home from this evening's lecture (which isn't entirely online yet, but will be soon), and it bears watching. Delivered tag-team style by Gary Ackerman and Jeffrey Bale of the Center for Nonproliferation Studies, the lecture was an unusually clear-eyed and (relatively) apolitical look at the definition of terrorism, the notion of "weapons of mass destruction", the motivations and deterrability of various styles of terrorist groups, and the likelihood of the various kinds and scales of terrorists attacks using non-conventional weapons. The lecture was sobering and occasionally darkly comic, as such discussions tend to be --- there's something inherently Strangelovian about weighing the probabilities of greater or lesser disasters. The overall message I came away with was: preventing devastating terrorist attacks is vastly complex, and can't be reduced to a simple formula.

Which makes me pretty worried, because America's current political discourse ain't exactly nimble when grappling with complicated issues.

Authors Guild demonstrates technological illiteracy

The Authors Guild is suing Google for attempting to innova--- er, for copyright infringement. If you've been reading this blog for a while, you already know my opinion on the subject. I hereby call for all Authors Guild members either to denounce the actions of their organization, or to stop using all web search engines, or confess to being complete hypocrites. Those are the only options.

---

UPDATE 22 Sept.: As usual, Lawrence Lessig says it better than I could.

A brief note on "free will"

Every conceivable behavior is either deterministic, or random, or some combination of the two. Neither determinism nor randomness can possibly qualify as free will --- intuitively, neither a clock's gears nor a pair of dice possess free will --- and therefore the very concept of free will is philosophically incoherent.

To elaborate slightly, behavior either follows a set of predictable rules, or it does not. If behavior follows a set of predictable rules, then those rules constitute a deterministic algorithm, which clearly lacks free will. If behavior does not follow a set of predictable rules, then it is a random process, which clearly also lacks free will. In practice, most nontrivial behaviors must be modeled by a combination of deterministic and random elements, but combining the two into a randomized algorithm doesn't produce free will either.

Incidentally, all known physical processes --- or, in other words, all possible computing devices in the universe, including human neurons --- can be modeled using some combination of deterministic and stochastic processes. So, even if free will could conceivably exist, actual human beings certainly would not possess it. However, I believe that the very concept of free will is incoherent, an argument that does not depend on properties of our physical universe.

If you disagree with this analysis, it can only be because you misunderstand algorithms, or you misunderstand randomness, or you do not understand how these two combine, or you are defining free will in some tendentious fashion. This seems to be the case, for example, for most of the philosophical positions described in the Wikipedia entry on free will. Notably, none of the pro-free-will arguments that I've ever seen manage to distinguish human decision-making from, say, a program that repeatedly generates a random array, and then sorts that array using an implementation of quicksort that selects a random pivot on each recursion. If you believe that quicksort with a random pivot possesses free will, I suggest that you've redefined free will away to the point of uselessness.

Now, given that free will is philosophically incoherent, I'm not surprised that definitions of free will turn out to be useless, but still, it's sort of sad. Just give up already!