Talk:Lecture 8

From CyberSecurity
Jump to: navigation, search

Biological Epidemics

Chris Fleizach - Recently, scientists in the Maryland decoded the 1918 influenza genome that killed millions of Americans and published the results in Nature. In fact, there was a meeting with national security advisors and the editors to determine if the material should be published at all. In the end, they decided the benefits of open publication outweighed the bio-terrorism risk. Then Bill Joy and Ray Kurzweil came out with a blistering editorial about giving away all the necessary information to bioterrorists to unleash their own flu epidemic. So is it really easy to recreate viruses as long as you know the DNA sequence? This also addresses the same topic that many discussions have touched upon: should there be open access to research material? Richard Muller's article speculating Al Quaeda was behind the anthrax attacks seemed to point they had given up bio-terrorism in some sense. With the flu genome decoded, avian flu being hyped up, what does this mean for America in terms of focus?

Altin Dastmalchi, UCB I think that declassifying information and putting it on the internet is risky but on the other hand could also help the world of science. As scientist, or anyone for that matter shares findings, results, etc, others who are just one process short from a new invention can search and find articles of the same topic and possibly enhance their own projects. So in short, sharing information leads to more scientific success. Furthermore, although i do believe that some terrorist could easily read the information, i also beleive that if they really wanted to get more info on a give topic then they can through some means. I.E. steal it from a lab. So in this case the success out ways the threat.

Anyone else agree?

abc This reminds me of the similar (and very heated) debate over publishing security vulnerabilities. While the two are slightly different (vulns are more directly and easily exploitable), still, there are pros and cons on both sides. I would agree that the benefits of publication outweigh the risk - primarily because this information never will really end up being "secret" in the end anyway. As was said in the lectures last evening, the threat of bioterror is probably not as great as we'd like to think - the dead bodies pile up slower and there are so many unknowns involved in the process. For example, unleashing an agent for which there is no known immunization on a population, that is also highly contagious could end up backfiring by wiping out the terrorists themselves. A plane full of jet fuel not only has more energy than TNT, but it also probably can scare a lot more people when flown into a large urban area like on 9/11...

Marty Lyons, UW Two thoughts on this -- First, the ongoing issue of whether or not keeping material safe by attempting to conceal its contents (or even very existence) rarely works. It may delay the inevitable, but the problem becomes that it only takes one inadvertant or improper release to cause the scheme to fail. We see this repeatedly in any arena without actual penalty -- leaked internal corporate memos, pre-release product photos, and the like. Even in the space where divulging information with penalties -- classified government material being a typical example -- it only takes one release to do serious damage. So the security situation leans one way or the other in terms of enforcement - claim security through concealment without actual penalties for breaking the edict, and get limited security anyway; or maintain strict control with penalties at a massive cost associated with the physical controls and personnel needed to operate in that environment.

Second, the more critical debate is whether we hold society at large at a disadvantage by attempting to control access in these ways. This has recently been brought to the forefront here in the university community, where many campuses have been asked by the federal government to restrict access of some research projects to Americans only. Campus administrators and professors balked at this, for all the obvious and correct reasons, not the least of which was practicality, but more importantly that it changes the very nature of university as centers of scholarship and sharing of knowledge. I'm sure Professor Lazowska has experience with this recently and it would be valuable to hear his opinion on how it has affected the UW.

The Internet as a tool for storage and dissemination of material makes it increasingly problematic to contain information very long. Years ago, we'd have to wait for journals to arrive in the mail, sometimes a year after an author first wrote on a new technical topic. Now the same author can post findings instantly, to be shared with the global research community. Having taken a class here (UW) in Computational Biology (Prof. Ruzzo's CSE 527 -- highly recommended: http://www.cs.washington.edu/education/courses/cse527/CurrentQtr) it's interesting to see that most advances are being done at low cost using non-wet methods, often with clusters of systems. Datasets are shared widely, and the knowledge is built upon. That is the way of science, and is leading to breakthroughs in treatments, new pharmaceuticals, and more. Should we (as the government would request) "contain" that research? Restrict it to Americans only?

Experts in the intelligence community will tell you that 95% of everything seems to get classified, but in reality 20% should be. Most of the information was otherwise available in the open source literature and represents little *new* knowledge. I suspect that attempting to restrict information on biological work will have the same detrimental effect on research it always does. Good, smart people working for the benefit of all will get so frustrated as to move into other directions. And maybe the smart person who could cure cancer will go do something else. Like the over-classification issue, we can't let the small risk of this information being misused outweigh the dramatic benefits of informations sharing.

What can the government do to combat CBNR attacks?

I found it interesting that both speakers saw the main role of security policy not in implementing particular defenses or managing terrorism response units with particular capabilites, but in espionage and police work. I guess that this is because there are such a wide range of methods possible to use for CBNR attacks, it might be asking to much to try to educate the public (as in the nuclear fallout shelters and school trainings that happened during the cold war) or to plan responses to every possible crises situation (as Katrina response has proved). Since there are such a wide range of attacks, the most important thing in preventing the attacks, according to the speakers tonight, were that the individuals who are a threat be identified, and we find out from spying on them what methods their groups see as good means to attack. In the biological realm, I can imagine that there are a very wide range of possible pathogens, and the one that becomes an attack will probably not depend on too much more than what substances those groups will have access to, or which ones fit particularly well with an over-looked opportunity in the U.S. food system, etc. So maybe the cheapest and most effective way to defend ourselves against the right pathogen is to be at the terrorists' ear. This view would definitely simplify the role of DHS (maybe making it more able to be successful as a government beaurocracy). Should the DHS leave biological weapons to the CDC and nuclear defense to the DOD? --Jameel 01:37, 20 October 2005 (PDT)

Jeff Davis 19:38, 20 Rocktober 2005 (PDT) It is a slippery slope. I don't want the government spying on me.

I too found it interesting that all the speakers continually placed tremendous emphasis on having trained police forces in order to combat terrorism. This makes it seem as though we should be spending more money on training and recruitment of human capital, rather than other areas of homeland defense. The size of our country makes it utterly impossible to defend as a whole, so maybe it isn't worth spending all the money and just taking our chances?? Katie

Brian McGuire I haven't seen any proof that what has been done so far has prevented terrorist attacks in the US so perhaps doing nothing would have had the same effect. I think it might be the case that increased public awareness would be enough to prevent much of what the homeland security department is spending money to protect us from. I think further educating the public about these issues would have a greater pay off. I hope that they prove me wrong though and manage to thwart the next major attack in the US.

Fuel Oil

--Dennis Galvin 11:26, 20 October 2005 (PDT)

Thinking aloud here: If the fuel capacity of a Transcontinental 767 is 90770 liters or 23980 US gallons (767-200ER spec), I'm not getting a warm fuzzy feeling about the amount of fuel rolling around on surface streets of our major cities. The tanks can hold say 60000 liters (tank mfr). Seems a lot of damage could be done with a suicide style crash into a large occupied downtown building. Trucks are notoriously easier to drive than a plane is to fly, so is it not conceivable a full fuel tanker could be taken over at a highway rest stop and we can have another terrorist act with large repercussions?

--Chris DuPuis 14:47, 20 October 2005 (PDT) Yes, I would agree that fuel trucks are a cause for concern. But a ship would be even more dangerous, given the larger carrying capacity. The 1918 explosion of a ship carrying explosives in Halifax, NS leveled 2 square kilometers of the city.

link

That explosion was caused by approx. 200,000 tons of TNT. A ship carrying refined gasoline or natural gas could be equally dangerous.

--Jeff Davis 19:17, 20 Octobor 2005 (PDT) This is another area where early detection and prevention would be the main defense. This document discusses the implications for the trucking industry. It talks about adding background checks, GPS tracking, driver authentication measures, etc.

What if we could solve the airplane threat and the trucking threat with technology? Commercial airplanes and commercial trucks have one thing in common: their intended destination is known in advance. Why not build them so that the route is pre-programmed by a central tracking station or air traffic control and any deviation from that route must be authorized by someone other than the driver/pilot. Trucks could refuse to start if GPS detects they've strayed to far off their course. Airplanes are more difficult since you can't just land them, but they could refuse to change their course until approved by air traffic control.

--Gmusick 17:14, 23 October 2005 (PDT) Just a small point about a ship full of fuel. It wouldn't be nearly as bad as the explosives because fuel cannot release as much energy as quickly as TNT or nitroglycerin or what have you.

As for the trucks, I have occassionally wondered since 9/11 how bad it would be if a tanker truck was hijacked here in Seattle, driven under the convention center on I-5 and detonated with a relatively small amount of explosives. The loss of life would be minimal, but the economic damage would be tremendous especially if it caused serious structural damage. And if an adversary could simultaneously pull that off on the viaduct or the Battery Street tunnel...bad news. Essentially all north-south commerce in the greater Seattle area would be brought to a halt.

--liebling MARSEC is the Maritme Security protocol which has its own levels much like the department of homeland security. My dad works on an oil tanker and occasionally they have fighter escorts into the port along with the (now more typically seen) USCG escorts.

--Dennis Galvin 17:33, 25 October 2005 (PDT) I very much like the concept of the technological solutions. They are certainly bandied about in the Homeland Security Implications for the Truck and School Bus Industry paper (which Jeff provided a reference to: http://www.internationaldelivers.com/assets/pdf/homelandsecurity.pdf). Unlike the airline industry there are phenomenally more fuel vectors to secure, so cost will be an overriding concern. There is nothing to say fuel is the only possible hazardous cargo, and it doesn't have to be a tanker -- ammonium nitrate with a little fuel in a fiberglass sided semi-trailer. One of my concerns with everything branded with "Homeland Security" (tm) is everything seems to be a multi-step process with the first steps taking a long time to implement (e.g. Transport Worker Identification Credential Program just finished a prototype phase, but there appears to be little word on when it will become mandatory: http://www.tsa.gov/public/interapp/editorial/editorial_multi_image_with_table_0218.xml). The technologically more complex, but more reassuring, solutions seem a long way off. The costs of the technological solutions when deployed over the entire commercial vehicle fleet would be quite high now.

Marty Lyons, UW - As I recall in talking to my firefighter friends, it's quite difficult for fuel in a contained liquid state to actual "blow up". If you used the vessel itself as a container and put an ignition source inside the tank itself, you might have success. The higher risk for fuels such as gasoline is when they are vented off in a gas, which is easily ignitable. Cars rolling down hillsides and blowing up in fireballs only happens in the movies -- cars go off roadways quite often, and the principal concern is getting the people out without additional harm, not that the car will explode.

Concern over attacks from vehicles on the roadways is understandable, but from a defense standpoint, extraordinarily difficult to enforce. Bruce Schneier on his Crypto-Gram mailing list [1] once made the point that the only way to defend against another 9/11 takeover of an aircraft is "to strap the passengers into their seats naked for the duration of the flight" (I'm paraphrasing but I think that's close to his quote). It's a good point, and he elaborates on it well in some of his writing. The point being that nearly ANYTHING can be considered a weapon (and of course, is not even needed -- with minimal training, you can kill someone with your bare hands effectively), and at some point you have to use the statistics of what percentage of the population will really attempt to do harm.

If we were to hypothetically try to make fuel trucks safe, where do you enforce? Bond the drivers? Might help, but in the same way the Homeland Security "Trusted Flier" program will only ADD security risks, it doesn't help [2]. Do you restrict the roads the trucks can use? What happens when a large truck is forced onto another street (traffic jam, breakdown) - do you arrest the driver? Do you situate gas stations in only "approved" locations in "safe" places in the city?

There are just FAR too many vulnerable points to protect. We have to be realistic that a) it is not physically possible in an open society to attempt to protect them all and b) who would want to?

Obligatory silly example: Seattle Harbor Patrol will show up if you leave your boat parked "too close" to the pontoon supports of the WA-520 bridge across Lake Washington. But you can rent a canoe from the University waterfront activites center, get in with your backpack, and sit next to the pontoons in the nature preserve. If you knew the cops would show up in one place, wouldn't you do the obvious and rent the canoe?

Ted Zuvich - I've often thought that you could do the same thing with a dumptruck full of large rocks. Go through Seattle, drive over one of the many I-5 overpasses, and simply dump your load of rocks over the side into the busy I5 traffic. For maximum effect, you'd probably want to do it at 1-2 in the afternoon, when Seattle I5 traffic is actually moving. Or maybe 7-9 PM at night, when there's still lots of traffic but its moving at pretty good clip. If you had a getaway car waiting for you, the driver of the truck might even get away with it.

Spreading a highly contagious disease

--Parvez Anandam 00:32, 21 October 2005 (PDT): Possibly one of the simplest ways to spread a contagious disease is to infect several people with it and make sure they get into contact with as many others as possible. Now, to die a protracted and painful death is certainly not a glamorous end for a terrorist; few would choose it willingly. However, there is some evidence that certain terrorist organizations will lie to their members about the nature of their mission. It is plausible then that members of such organizations would subject themselves to injections if they believed, for example, that they were receiving a vaccination of some kind and that their mission was some concocted one. I worry about the possibility of a dozen odd terrorists being injected (voluntarily or otherwise) with a highly contagious disease before they board an international flight to a target city. On landing, they would merely have to wander about in crowded places over the next few days to infect people with the disease. I'm not sure how to bound the number of ensuing fatalities but a couple of hundred deaths does not seem unreasonable.

--Pravin Mittal

I agree with you that for terrorists, it would be easier to get volunteers who will be willing to to get self-infect themselves to carry out such dastardly act. But there remain couple of problems which these terroist may have:

1) They need to find viral/bacterial agents which are easily communicable from human to human through air just being at the small distance.

2) Incubation period needs to be at least 2-3 days for it to show symptons so that it can spread to wide area before detection. If not, first few victims will acts as "canaries of coal mine" who will quarantined to control the pandemic.

2) Even they cross the first two hurdles, I think the biggest hurdle may be their ability to contain such epidemic to limited geographical location. Their goal is to make political statement by intimidating public or coercing government of particular government (Maurer). For example, Al-Qaeeda tries to carry out such attack on New York but as there are numerous daily flights connecting New York to Pakistan there is a possibility an infected person (which in turn infect all his/her co-passengers) boards such flight. The scope of the spread within few days will be worldwide irrespective where country/city is launched? Millions of innocent people will die in each and every country actually more so in countries highly populated counteries like Pakistan, Afghanistan where they may not have enough vaccination or advance health care system does not exists. Reason it will backfire and cause more harm where they have popular support deter these kinds of attacks.

--Pravin Mittal

--Naseef 16:08, 22 October 2005 (PDT)

--Imran Ali 10:47, 25 October 2005 (PDT) For point 2, I would agree that a terrorist may potentially cause a global outbreak of a disease rather than infecting a small population of people. However, I found some articles on the Web relating to populations that have genetic predispositions to developing disease. Could a terrorist somehow engineer a disease that would target a small segment of a population? It may be unlikely given that the disease would have to be contagious and be easily transmitted, but the possibility may exist. The following article, [3], states: "Asian Americans are also at increased risk of hepatitis B virus infection due to high HBV infection levels in their communities, but Asian American children 4-14 years old are likely not to be protected against hepatitis B virus infection (MDH survey data, 1999)."

--Hema 08:07, 26 October 2005 (PDT)

An installation of biowatch sensors in port of entry airports could atleast help in quartining infected people and reduce the spread of the virus to the cities. Is anyone aware if biowatch sensors in airports are already in place  ? During the SARS outbreak the Asian and Middle East airports used a Thermal imaging device. The thermal camera that can 'spot' Sars; it includes a finely tuned infra-red camera used to quickly scan passengers and identify any with even the slightest hint of a fever. Some airports still use such cameras although the Sars threat has abated. Similar technologies could be used to identify and pinpoint possible terrorists who are already infected with the virus.

Marty Lyons, UW - Parvez said: "I worry about the possibility of a dozen odd terrorists being injected (voluntarily or otherwise) with a highly contagious disease before they board an international flight to a target city. On landing, they would merely have to wander about in crowded places over the next few days to infect people with the disease."

I'd imagine a more likely scenario to ensure success would be to fly someone as far and as often as possible. Rather than get off the plan in New York (just as an example), you fly (wherever) - New York. New York-Los Angeles. LAX - Denver. Denver-Chicago. Chicago-Miami. In those four US-based flights, it's likely you'd spread a pathogen throughout the whole country in a matter of days.

Ted Zuvich - If I was a terrorist bioweapon mastermind in this situation, I wouldn't bother with volunteers in this situation. Take your terrorist cadre, get them to volunteer for some normal, well-thought out but fictitioius mission that involves travelling around a lot, and before they leave give them a "booster shot" of antibiotics because you are concerned about their health and don't want them to get sick while they are on this important mission. Then you have a guy that has no idea what he's carrying, wandering around spreading whatver horrible bioweapon disease you injected him with. No need for volunteers.


Mark Ihimoyan - These kind of attacks are certainly and by far the most dangerous. However looking at it more closely, I think the effectiveness of such an attack will be grossly undermined by the inability of the carrier to live for a long time with the disease in his/her system. I would suppose that before the perpetrators of such an attack will not be able to go far with their plans before the laws of nature catch up with them. In addition attacks like this could definitely be localized and contained to prevent further spread once it is detected.

Things we can do to be prepared if there is bomb attack

--Naseef 16:09, 22 October 2005 (PDT) Both the speakers spoke that vigilance, police work, alertness from us is really instumental in combatting terrorism in its own way. Although prevention is always better than cure, there are few things we could do to minimize the aftermath of a bomb attack. It might be very difficult not to panic in such situations, however going though an drill where one mocks a situtation of a bomb attack would really help to handle such situations better and minimize the effect.

My top picks of things we could do to be prepared would be: 1: Know the community disaster plan. Most of the time the city would have had a disaster plan in place. This can be easily found from the fire department or from the city website. 2: Get to know the hospitals around your community. It is also a good idea to look into the hospitals in the neighboring cities. 3: Study the area where we live and look for alternative routes to get out of the disaster area real quick. 4: Read some websites that provide good info on some backup plans. These are the ones that I try to read when i get time. http://www.redcross.org/preparedness/cdc_english/CDC.asp http://www.redcross.org/services/disaster/0,1082,0_589_,00.html http://www.bt.cdc.gov/


Preventing detonation of a stolen nuclear weapon by using Permissive Action Links (PALs)

--Jeff Bilger 14:09, 25 October 2005 (PDT) During the last lecture, it was noted that a terrorist organization could buy or steal a nuclear weapon. If this did indeed occur, would they be able to detonate the device? Some research on the Internet revelated that U.S. developed nuclear bombs have several levels of security built in to the triggering/detonation devices to ensure that a stolen bomb can not be detonated. link.

Although it seems that Russia's nuclear arsenal has less adequate locking mechanisms. link

Rob Anderson I suspect that for uranium-based bombs, the 'security measures' will offer little protections. U-235 bombs are very straightforward to make. It would be easy to imagine (carefully) slicing the bomb in half, just to get at the uranium, and building your own bomb.

Lecture 8

Professor Muller, of the states currently possessing nuclear weapons, which have thermo-nuclear capability?

Professor Muller, are there any other seriously considered views (i.e. opposing/differing) regarding cancer and radiation other than the linear hypothesis?

Professor Muller, what are your thoughts on tactical nuclear weapons and depleted uranium weapons -- are they capable of providing effects significantly greater than or different than conventinal weapons?

Mr. Fitch, of known biological weapons, which is the most deadly?

Mr. Fitch, does the United States still maintain the bio-weapons it produced prior to Nixon's 1969 moratorium or have they been destroyed? Was that moratorium put in place by executive order or via another instrument?

Mr. Fitch, Dean Nacht, Professor Maurer, given that the USSR had massive stockpiles of nuclear weapons, do we have any indication of what their motivating factor/drive was to continue on with such a huge biological weapons program (i.e. to develop as an alternative to nukes because cheaper, not as detectable, etc. or we they working on them because they believed that we or one of our allies were and they were studying them for counter-abilities sake)?

Mr. Fitch, were the bio-weapons created by the USSR destroyed or are they still being maintained by Russia? Has Russia continued on where the USSR left off with respect to designing such weapons? Is there a fear, similar to the one surrounding nuclear materials, that former-USSR bio-weapons will be stolen and/or purchased by terrorist organizations? Are there any "rogue states" out there that have been able to approach the USSR program, or that are actively attempting to?

Daryl - Have there ever been EMP attacks to disguise another that follows it? Is their usefulness exaggerated greatly in movies? Or can they cause major disruption?

Ecological Attack – Is the US undefended when it comes to an ecological attack?

Avichal 17:12, 25 October 2005 (PDT) In our assigned reading [4] an example is given of how the introduction of rabbits in Australia has spiraled into a looming problem for them. While that example may be a bit extreme, US is already suffering from infestation of foreign plants, animals and disease agents by seemingly natural means. About a fourth of this country's agricultural gross national product is lost each year to foreign plant pests and the costs of controlling them [5]. What if terrorist organizations realize this as an opportunity and specifically target the US ecosystem. Well, I agree it doesn’t have the impact of flying a plane into a building. But how long can we rely on our assumptions about current and future terrorist groups.

It was mentioned in the class that a cryptographic method fails or is broken when an assumption it makes is no longer valid. You can stretch that argument and say that Sep 11 attacks occurred because of many assumptions that US had which were invalid.

If you are taking an international flight to US, you would fill out a form asking about fruits, vegetables, plants etc. And upon departing sometimes you are simply asked by a person whether you are carrying any of those items. I doubt if there any serious checks for such items on the departing or arriving airport. Ecological attacks could be a low cost and low risk means of causing significant economic damage to the US and maybe someone might actually consider it someday.


Marty Lyons, UW -- Infecting the wheat crop in Washington, Montana, Kansas, Colorado, and the Dakotas would be devastating. Other targets which would cause grave damage include corn in Iowa, Kansas, Nebraska, and the midwest. Also soybeans (food, fuel, secondary products). See USDA for some statistics: [6]

Planning a sea-born terrorism attack

--Khaled Sedky 03:22, 26 October 2005 (PDT) There is an interesting article linked at [7]and is intended as an illustration of the use of technology against highly technological societies, and the security impacts that need to be addressed in decision-making about the use and logistics of such technologies. The article addresses the potential attack on tankers for natural gas known and LNG tankers that are floating around in public ports in the U.S. and the devistating results of such an attack on that port and it gives a resemblence between such a explosion result in a devestation simillar to that caused by a neuclear weapon without the neuclear fall out. I guess this is another exploration of none traditional attacks and how it could cause sever damage with proper planning. In general I think it is alarming to have such tankers floating in public ports and they should be deported to ports where there is little impact on human lives and infra structures if someone thought of such an attack.