We Need a Manhattan Project for Cybersecurity

The use of the term "Manhattan Project" is a bit unfortunate. If there was such a program, most would not know about it -- those that did would be forbidden to talk about it. In other words, if there were a "Manhattan Project for Cybersecurity" -- it would look like NSAs Bluffdale facility, and would have as much publicity and official comment on what it was, who was working there and on what.

Security is different from offensive capability -- I don't think the best way to secure infrastructure is through threat of mutual assured destruction -- if anything, being the worlds prime nuclear power (and conventional weapons power) -- the USA already have "assured destruction" covered. Sure, a country wide blackout would be devastating, but so would dropping a few terra-tons worth of nukes on the offender.

I think what's needed in terms of "cybersecurity" is more openness, better education and perhaps most important: better and more correct incentives. There's a huge gap between what is available (secure coding, secure systems, best practices (or even half-decent practices)) -- and what we see companies, governments and organizations do. I also think it is absurd to promote the Sony hack as a threat to national security -- talk about hyperbole. Some personal data and a little intellectual property was leaked. It pales in comparison to the allegations of commercial secrets stolen by the NSA on behalf of US industry, for example.

I think the challenge here is that one definition of success here would be the prevention of unauthorized access to data by all parties, and that would of necessity, include the government.

The reason you need to protect data from nation-states is that there are enemy nation-states trying to get it, and there is no physical barrier between the data and them, so the only answer is to protect it from all nation-states, even the one where it is located.

The reason it has to be authorized is because data access is a 'rights' sort of thing (akin to property) and the processes that we put in place which insert a due process between data and a government agency need to be just as strong at the ones between property and a government agency.

For me, that is why the metaphor of a 'Manhattan' project doesn't work for me. If this effort were the Manhatten project we would be building a nuclear bomb that the people could use against any government but that the governments could not control. And well they would never sign up for that because they have nothing to gain from it.

I would much prefer to call the effort a 'Magna Carta' effort that forces the monarch in power to submit to the data privacy demands of the subjects.

We already have one. Look at the NSA's budget. Look at the money being shoveled into Microsoft/Google/Apple. All the people in position to fix things are positively flush with cash.

And off in the corner, a few non-paid developers of F/OSS are creating better security products than all the above combined. Manhattan-style money throwing is not the answer.

And I take issue with the article's depiction of the Manhattan Project. "Those working on the Manhattan Project were dead serious about the threat before them." ... um ya well the vast majority of those working on it had absolutely no idea of what the project was all about. They all operated within a disconnected web of secrecy, not the best model for security imho.

The author "has served as a street police officer, senior adviser to Interpol and futurist-in-residence with the FBI. " He isn't a security professional. And his twitter feed doesn't give the impression of someone with any deep understanding beyond headlines and talking points.

We have one: http://www.darpa.mil/cybergrandchallenge/

This might be unrelated. But I'm curious if the new US Digital Service has any good projects related to cybersecurity? There was a posting a few days ago for this new initiative https://news.ycombinator.com/item?id=8988819

I don't know what you'd formally call this. It's not really an agency and I'm not sure how it's funded. I'm curious if something like this could spearhead this kind of project.

On the one hand, yes, computer security is a disaster in urgent need of reform. On the other, "a true national cyber-defense capability, one that could detect and respond to threats against our national critical infrastructures in real time" sounds like a proposal to arrogate root access to all of the 'critical' computers at once, to some one central group. Am I imagining things?

my healthcare provider (Anthem) was just hacked, so my SS number and other identifying details are probably being traded on some Russian web site right now.

Anthem did not encrypt the data which was stolen.

Sony did not show any signs of basic competence in its data security either.

a Manhattan Project is useful if you have a really tight deadline, a very specific and achievable goal, and the problem you face is one where the technology you want does not exist yet.

but everybody in technology knows that the technology exists, and the problem is widespread incompetence and indifference.

the solution for that is not a Manhattan Project. it is class-action lawsuits.

think how fucked up this situation is. everybody in infosec knows that Anthem and Sony were ridiculous and 100% at fault in their negligence. yet people who get their info on this from the mainstream media have probably never even heard that point of view.

so you get utterly uninformed commentators who think that Anthem and Sony must employ geniuses of the first caliber, and that we need to take the "new" and "unprecedented" step of classified crypto research.

Security is not one project. It is every project that faces the world. A "Manhattan Project" isn't a useful analogy or approach to the security problem.

The problems we have are:

1. High capability attackers (states, corporations) have a high motivation to compromise privacy and security and low motivation to improve privacy and security for users.

2. The tools relied on by users for security and privacy are often built by people with very limited resources (GnuPG, OpenSSL, nearly every other Open Source thing in the world).

Fixing security online requires audits and maintenance across a huge spectrum of projects, and historically there has been very little funding for such things. It's almost dumb luck that we have tools that are as good as they are, and we shouldn't be surprised by bugs like Heartbleed and Ghost and others. They're what happens when there is very little profit in maintaining core infrastructure.

We just need the government to contribute more to FOSS projects. They are clear public goods with huge economic impact but the funding sucks. That is what happens to private public goods - no one wants to pay for them but everyone uses them. That is why we have taxes.

It seems to me like the bulk of "security research" these days is vulnerability discovery. This is certainly important. However, more profound solutions like capability-based operating systems (e.g. CoyotOS), and in general forward-thinking projects that aim to provide comprehensive foundations for secure systems seem to be left behind and neglected in favor of continuing the present rat race of applying band-aids and bug hunting our existing cruft.

Unfortunately, a "Manhattan Project" for cybersecurity wouldn't really work because the problem is a highly multi-tiered one without a clear end goal, with a lot of individual bits and pieces that are visible and have potential to be refined or started anew.

I think the analogy completely falls down. The Manhattan project was about a technical breakthrough, a big step forward that hadn't happened before.

Where is the analogue in crypto and security? There is no unsolved holy grail. Frankly, we have all the technical tools we need to make the web an extremely secure place.

What we are lacking instead is general investment in FOSS tools, regulations that hold a company responsible for leaking user data and encourage corporate prioritization of security, and national education about security risks and basic Internet dos and donts (phishing etc).

All of this is doable. And none of this will happen. At least, none of this will happen until consumers and buyers start caring more about security than about the newest and shiniest feature.

The idea that there is a magical technological improvement that will solve all (or "most", or even just "more than two") is about as plausible as the heralded arrival of the singularity.

The solution is to harden a bunch of stuff. Clearly, the ideal solution is to just remake it with security in mind, but that still leaves a ton of ground to cover.

> This Manhattan Project would help generate the associated tools we need to protect ourselves, including more robust, secure, and privacy-enhanced operating systems.

That's a nice thought, and I agree with it. Too bad the current and likely future administration as well as all the "cybersecurity" guys in the government right now support the exact opposite of that - because "terrorists". Just 2 weeks from now Obama is likely to announce policy to introduce backdoors in tech products. Yay "cybersecurity"!

No, we don't, not only because "cyber" is bullshit anyhow, but in particular because security is not a product. Security is a property of systems that has to be built in, and security usually is lacking because people don't care, that cannot be fixed with a magic security device.

It's about as sensible as suggesting a Manhattan Project for Mindliteracy--but I would suggest that teaching people to read and calling it just that might be more effective than trying to build a mindliteracy bomb against mindilliteracy.

Back when the U.S. Was accusing China of widespread corporate espionage, I wondered why the U.S. didn't have a major effort to harden common OSs.

Then Snowden came out, and we learned the U.S. government is doing the opposite, trying to keep all systems readily exploitable.

Surely the defense and intelligence departments already have hardened versions of OSs. As taxpayers, we actually own that software. We should all have access. Where's the EFF on this one?

The last government guy who said that was Amit Yoran, Homeland Security's first head of cybersecurity. He made statements some people didn't like, including stating that Microsoft Windows was the biggest problem around. His replacement was a lobbyist for Cisco who could be relied on not to rock the boat.

Technically, this is quite do-able. I think we'll see it on the server side in a few years.

What credentials this guy has for anyone to listen to him on topics of cyber security? Did he build some impressive secure software or protected some large networks? Looking at his bio or his twitter feed, I don't get the impression that he is an expert in this topic.

1. Relying on any form of secret is unsustainable. Credit Card, Social Security, Password, PIN, Secret Key. Information wants to be free, and it will. Secrets must be kept secret at ALL time. With the coming death of privacy, keeping a secret will be ridiculously complicated and expensive. Secrets make a system fragile.

2. We need fewer systems. Having each bank, each hospital, each government, each shop, each school, each business build their own custom systems and application by default is a huge mistake. Custom shouldn't be the default, it should be last resort. The existence of these custom systems is the very cause of all the inefficiencies, fragmentation, bugs, increasing demand for programmers, etc. That's some Tower of Babel shit all over again.

3. We need a common language. A language that makes sense to use in the 21st century. A language that help us think, a language that's computer assisted. Text? What a goddamn joke.

4. We don't know yet what an identity is. Am I one person? Can I play the role of two people? Can two people act as one person? Can a robot or an API have their own identity? In a future that's going be a lot like a distributed semantic marketplace, what we need is not security. What we need is accountability. Identity and fraud is what must be solved.

5. You tinfoil hat people should really take a step back and consider your paranoia. Privacy is not a good thing. At best, it's a necessary evil (temporarily). Browsing behind 7 proxies, encrypting the air your breath, praying Lord Snowden, demonizing the government you keep wanting to get bigger (you know, welfare and free stuff). Guess what, you're missing the entire point. If anything, your focus on these insignificant symptoms give the disease the opportunity to grow. You're the reason you might be right at the end. You're self-fulfilling prophets.

Sheeps be disagreeing.

> Last month President Obama acknowledged “no foreign nation, no hacker* , should be able to shut down our networks, steal our trade secrets or invade the privacy of American families.”

* Present company excluded.

I'd rather we had a clean energy Manhattan project...