[00:34.160 --> 00:34.880]  Hello, everybody.
[00:36.070 --> 00:36.960]  Hello, everybody.
[00:39.300 --> 00:40.200]  Glad you're all awake.
[00:40.280 --> 00:41.460]  I know I had a hard time waking up.
[00:41.560 --> 00:42.580]  I hope you enjoyed the last panel.
[00:42.940 --> 00:45.160]  Now, without further ado, we're in just a few minutes behind schedule.
[00:46.340 --> 00:49.830]  Ethics and military in the same sentence just seems a little weird, but they'll explain it.
[00:49.920 --> 00:53.190]  This is the Ethics and Military and Civilian Software Development Panel.
[00:53.460 --> 00:55.940]  Let me just introduce our panelists, Sam, Nguyen, and Robert.
[00:56.080 --> 00:56.690]  Let's give a big hand.
[00:56.820 --> 00:57.060]  Thank you.
[01:06.210 --> 01:12.070]  Hey, my name is Sam Nitzberg, and I'm sure you are already well familiar with Winn Schwartau and Robert Steele.
[01:13.510 --> 01:21.090]  Robert Steele's book is Unintelligent Spies and Secrecy in an Open World, and he gave a keynote address back in 94, right here.
[01:21.490 --> 01:26.610]  Winn Schwartau, you might want to be familiar with this document.
[01:27.070 --> 01:31.970]  Cyber Shock, Surviving Hackers, Phreakers, Identity Thieves, Internet Terrorists, and Weapons of Mass Destruction.
[01:32.170 --> 01:32.670]  Disruption.
[01:33.450 --> 01:33.950]  Disruption.
[01:34.870 --> 01:36.350]  A few of you might be in it.
[01:40.590 --> 01:42.970]  Okay, we're going to move off with my little presentation.
[01:43.810 --> 01:44.730]  Next slide, please.
[01:45.370 --> 01:46.530]  There's a nice technical abstract.
[01:47.150 --> 01:53.490]  That number of concomitant ethical considerations between developing military and civilian software are similar, and I shall be examining them.
[01:53.870 --> 01:59.730]  Basically, if you mess up on important things used in civilian world or in the military world, there are great consequences.
[02:00.430 --> 02:04.970]  Likewise, I think there's also a strong responsibility when you develop the systems to do it right.
[02:06.330 --> 02:07.250]  Next slide, please.
[02:08.410 --> 02:10.250]  I'm going to skip the second point for the moment.
[02:10.530 --> 02:14.850]  It's often cheaper in military and civilian worlds to steal technology.
[02:15.150 --> 02:16.410]  That's why there's industrial espionage.
[02:16.890 --> 02:17.930]  That's why there are spies.
[02:18.870 --> 02:19.610]  Next slide, please.
[02:20.850 --> 02:27.550]  Okay, there are some areas of common ground also in how simulations are performed in both military and civilian worlds.
[02:29.550 --> 02:40.950]  When you model traffic flow or stock markets or nuclear arms or military battle bombers, you use the results of those simulations to decide how you're going to implement these items in the future.
[02:41.450 --> 02:45.050]  Based on your military simulations, you will change how you fight battles.
[02:45.750 --> 02:49.650]  Based on your financial simulations, you do affect stock market activity.
[02:49.650 --> 02:52.090]  Again, these are areas of great concern.
[02:52.630 --> 02:57.590]  Irresponsibility in either realm has potentially grave consequences.
[02:57.890 --> 03:00.110]  And there's a great responsibility to do these things properly.
[03:00.490 --> 03:01.210]  Next slide, please.
[03:02.710 --> 03:04.930]  I'm going to be discussing what I call the nature of the beast.
[03:05.390 --> 03:08.690]  Now, most modern systems are built on conventional software products.
[03:08.970 --> 03:16.710]  This has some very serious implications because what seems to be driving the release date is market pressures and effemersies.
[03:16.710 --> 03:24.510]  And for various people who wait until something that is really secure before they buy it, people are not willing to, generally speaking, to pay the price.
[03:24.970 --> 03:25.410]  Next slide.
[03:26.550 --> 03:31.190]  Scientific American, I forget the year, or some time ago, had a nice article on the nature of complexity.
[03:31.750 --> 03:36.730]  And it's been considered that software complexity is the source of errors in systems.
[03:37.190 --> 03:38.050]  I'm going to say no.
[03:39.590 --> 03:42.410]  There are theories, at least, by which defect-free software can be produced.
[03:42.570 --> 03:50.730]  The reason I'm saying I do not believe that software complexity is the fundamental source of errors in systems, because most systems being developed are not what we call an intractable in nature.
[03:50.870 --> 03:52.570]  They're not solving the possible problems.
[03:52.970 --> 03:55.990]  The problems, I think, are too often people do not do the requirements properly.
[03:56.150 --> 03:57.910]  They don't specify systems well enough.
[03:58.190 --> 04:02.130]  Get rid of ambiguities and specifications that lead to security problems and errors.
[04:02.810 --> 04:05.550]  Things are sloppy and in rush, and it shows.
[04:06.250 --> 04:17.270]  If everyone were doing the proper software engineering methods and being extremely careful, we were building every system as a new breed and most complex of its type, then we can talk about software complexity being the source of errors.
[04:17.890 --> 04:20.290]  Unfortunately, I don't think that drives most of them.
[04:20.550 --> 04:21.230]  Next slide, please.
[04:23.110 --> 04:37.590]  When you develop a database, when you develop a graphical interface system, when you develop a file system for an operating system with security features, these will be used by the military and by civilian organizations.
[04:37.890 --> 04:47.430]  When you build a database, it's not you who chooses whether it goes into an administrative managerial database or a hospital for dispensing medications, but whether it's tucked into a military or intelligence platform.
[04:49.370 --> 04:54.370]  What the responsibility is, though, is to do a very good and careful job, so needless harm is not caused.
[04:54.810 --> 04:55.450]  Next slide.
[04:56.170 --> 05:01.710]  Some technologies, I'll mention briefly, where the global positioning system was set up by DOD initially, now hypers can use it.
[05:02.290 --> 05:06.670]  There was a cartoon some time back in the Federal Computer World that showed kids at 11 a.m.
[05:06.670 --> 05:08.430]  standing selling a GPS jamming device.
[05:09.710 --> 05:11.610]  Unfortunately, that wasn't that far from the truth.
[05:12.910 --> 05:16.390]  It's preferable that all systems can be built securely and always from the beginning.
[05:17.310 --> 05:21.430]  The Internet itself, that was brought up DARPA, the Defense and Organic Research Project Agency.
[05:21.890 --> 05:26.630]  I've seen it kind of quizzically referred to as a weapon system that got out of control.
[05:27.230 --> 05:36.430]  It's kind of nice and interesting, though, that's come 180 degrees and people talking about information wanting to be free on the Internet is assumed to be the proper mode of viewing it.
[05:36.710 --> 05:39.650]  What's interesting is it came out of weapons work the same as most computer.
[05:40.830 --> 05:43.370]  The breadth of computing is nestled in military technologies.
[05:43.650 --> 05:47.210]  The first co-breaking machines that were worth mentioning were computers.
[05:47.950 --> 05:49.090]  Colossus was a computer.
[05:50.310 --> 05:57.330]  Early machines at the University of Pennsylvania, I believe, and certainly at the Institute of Against Studies, used for ballistics table computation.
[05:57.650 --> 05:58.530]  These are weapons.
[05:59.390 --> 06:00.150]  Next slide, please.
[06:01.810 --> 06:14.390]  Going back to a big YTK bugaboo issue, the end of the world as we know it, the President's Commission on Critical Infrastructure Protection addressed five areas of grievous and great concern if they were attacked or subverted even by the YTK problem.
[06:14.970 --> 06:18.130]  Information and communications, banking and finance, energy.
[06:19.230 --> 06:21.310]  Physical distribution of vital human services.
[06:21.550 --> 06:24.970]  Kevin Colston, a few of you may know, had the quote that got printed up and wired.
[06:25.070 --> 06:27.390]  If you knew what the experts know, you'd be buying guns too.
[06:27.890 --> 06:29.350]  I'd say that's good advice in general.
[06:29.490 --> 06:33.150]  The problem being that things besides the Y2K bugaboo cause grievous failures.
[06:33.990 --> 06:34.650]  Next slide, please.
[06:36.690 --> 06:38.890]  This was printed, again, at Federal Computer Week.
[06:39.050 --> 06:44.130]  That in order to mitigate the risk of an accidental nuclear exchange, the Pentagon shared information with other countries.
[06:44.790 --> 06:46.010]  They shouldn't have come to that.
[06:46.090 --> 06:51.610]  The problem is, people built systems, they knew about the Y2K problem, and it wasn't known if it was all addressed adequately.
[06:52.270 --> 06:52.710]  Next slide.
[06:53.910 --> 06:58.750]  First in the Y2K issue, as if you haven't heard enough about it, not as a success but as a great failure.
[06:59.330 --> 07:01.890]  As quote, we had a simple problem that was well understood.
[07:02.050 --> 07:03.190]  We had early warning.
[07:03.430 --> 07:06.770]  The first document to address it that I know were in 1984 approximately.
[07:07.210 --> 07:08.250]  I believe that was an IEEE document.
[07:09.030 --> 07:11.810]  I see this as a grievous scientific, managerial, and moral failing.
[07:12.130 --> 07:14.150]  You found out probably the same way I did everything would be okay.
[07:14.450 --> 07:17.010]  You sat around waiting for the TV and the lights to go out.
[07:17.770 --> 07:21.750]  I think it was largely a matter of luck that people scrambled and somehow it all managed to work together.
[07:22.850 --> 07:25.070]  I think whatever money was done on mitigation was well spent.
[07:25.290 --> 07:26.830]  It just shouldn't have gotten a decade earlier.
[07:27.790 --> 07:28.370]  Next slide.
[07:28.370 --> 07:32.350]  Now, on the subject of professionalism, I've got a few thoughts.
[07:32.630 --> 07:35.810]  Some people talk about licensing as a solution to any of these problems.
[07:35.910 --> 07:36.950]  I personally don't see it as a solution.
[07:37.350 --> 07:39.510]  But I will mention something in passing.
[07:40.370 --> 07:41.830]  Orvers and hairdressers need licenses.
[07:42.390 --> 07:43.450]  Because they work on your hair.
[07:43.670 --> 07:45.210]  If they mess up, they might get a bad hair to you.
[07:46.330 --> 07:49.050]  Similar engineers build bridges and if they fall well, people might get hurt.
[07:50.210 --> 07:55.630]  Prostitutes who are lawful typically do regular medical testing and have to abide by what's called safe practices.
[07:57.530 --> 08:06.150]  Now, software engineers design and construct medical diagnostic equipment, medical dosing systems that give you computer controlled x-ray doses.
[08:07.050 --> 08:18.750]  They build air traffic control systems, strategic nuclear arm systems, software components of anti-aircraft and missile systems like the Patriot, aeronautified by wire systems, such as those using the Space Shuttle, stealth fighter and bomber aircraft,
[08:19.310 --> 08:20.530]  and automotive computer systems.
[08:21.090 --> 08:22.470]  I'm getting my car fixed this weekend.
[08:22.710 --> 08:25.010]  I'm painfully aware of the cost of having a computer system fixed.
[08:27.490 --> 08:29.990]  Programmers build all these things, including banking and financial systems.
[08:30.170 --> 08:30.970]  They don't need licenses.
[08:31.330 --> 08:32.350]  See, they can't hurt anybody.
[08:34.310 --> 08:36.590]  Now, regarding warranty issues, next slide please.
[08:37.750 --> 08:38.350]  Thank you.
[08:39.370 --> 08:44.190]  This is not too atypical an item here, this warranty.
[08:44.590 --> 08:45.970]  Let's see some of the things this one says.
[08:47.230 --> 08:52.750]  They wanted the diskettes on which the program is furnished to be black of color and square shape under normal use for a period of 90 days from the date of purchase.
[08:53.190 --> 08:54.970]  I don't know what happens after 90 days of the shape.
[08:55.630 --> 08:58.170]  A good colleague of mine mentioned this is false.
[08:58.770 --> 09:00.850]  Diskettes are not square, they are generally rectangular.
[09:04.390 --> 09:07.470]  If you lose a million dollars because this messes up, it's you without except a million.
[09:07.690 --> 09:08.190]  Not then.
[09:08.450 --> 09:10.770]  If you don't like it too bad, they reserve the right to do nothing.
[09:11.870 --> 09:15.110]  They don't want to this clamor at all, but the orders insisted, and we tried to ignore them.
[09:16.410 --> 09:19.130]  And the big thing is that you pay for software updates.
[09:19.230 --> 09:22.590]  Even if the software doesn't kill or hurt anyone, you have to pay for it when things go bad.
[09:22.790 --> 09:31.830]  I'll mention briefly USCITA, which I still haven't figured out how to pronounce, which would make it legal to make software as bad as you want, and people are bound by the use of shrink-wraps.
[09:31.930 --> 09:34.270]  It winds up that you're not purchasing software nearly so much as renting it.
[09:34.450 --> 09:38.210]  If it doesn't do the job, that's okay, because one ever promised it would do a job confidently anyway.
[09:39.670 --> 09:40.530]  Next slide, please.
[09:42.010 --> 09:45.070]  Okay, a friend of mine down in Australia, Emma Rooksby, is a philosopher.
[09:45.450 --> 09:46.690]  I believe it's University of Queensland.
[09:47.170 --> 09:50.510]  And I'm going to give her a quote, which I think addresses this issue of licensing rather nicely.
[09:50.810 --> 09:55.310]  And not just licensing, but how we view and develop software in general, and what we do with our computers.
[09:57.010 --> 09:58.270]  You'll bear with me, it's a long quote.
[09:58.890 --> 10:14.350]  Ultimately, though, as professionals with particular roles and responsibilities, carrying out practical tasks, the ramifications of which are often profoundly unclear, the source of guidance that many normative ethical theories provide us also depends on our social knowledge of what it is that we are doing,
[10:14.650 --> 10:23.890]  on our understandings of the possible impacts of the projects we undertake, and our ability to integrate abstract ethical theories with the apparently more practical decisions of the workplace.
[10:23.890 --> 10:25.770]  Now, this is the key.
[10:26.890 --> 10:36.210]  Just as no code of ethics guarantees ethical behavior, no normative ethics can repel assent or assure its own appropriate application.
[10:37.910 --> 10:41.910]  I see this issue of ethical practice licensing is sort of related, but they don't have to be.
[10:43.050 --> 10:45.490]  But I believe that her sentiments apply very nicely to both.
[10:47.670 --> 10:50.290]  I will very briefly mention open and closed systems.
[10:50.430 --> 10:51.450]  Let's see if I have that slide next.
[10:54.700 --> 10:56.500]  Okay, actually, I'll get to close systems in a second.
[10:56.920 --> 11:02.700]  The issues I see are that problems addressed may be resolved with proper foresight and systems design, development, and maintenance.
[11:03.300 --> 11:04.500]  Most systems are not hard.
[11:05.880 --> 11:17.640]  Software workers and managers must properly, must be properly aware of the intricacies in developing, building, and maintaining systems, including large and complex ones, and they must be painfully aware of the consequences of failure.
[11:21.060 --> 11:21.940]  Next slide, please.
[11:22.380 --> 11:30.820]  Regarding issues of closed and open systems, which is a very popular subject to debate and discussion, it is true that closed software systems do identify proper security, integrity, and analysis.
[11:31.400 --> 11:37.580]  However, I will mention that I've received a discussion that if you have open systems, they're intrinsically secure to be fixed.
[11:37.880 --> 11:41.500]  I will say that if you have open systems, they do benefit from software engineering methodologies.
[11:41.960 --> 11:52.380]  People usually don't do big collaborative works requiring that the specifications for systems are right, that there's no ambiguity present, that everyone understands what things mean before they build them back.
[11:52.560 --> 11:54.600]  It's going to cause a lot of failures in software, I believe, also.
[11:55.360 --> 11:58.540]  I think that you could do that even in open projects and there could be great gains.
[11:58.980 --> 12:04.900]  But people have to want, even in the open source world, to sit down and do the software engineering work up front.
[12:05.800 --> 12:07.180]  And now I'm going to wrap up.
[12:07.680 --> 12:08.460]  Next slide, please.
[12:12.000 --> 12:19.180]  My conclusion is that ethical concerns and considerations cannot be decoupled from software analysis, planning, and execution.
[12:19.800 --> 12:25.660]  Most of the challenges facing either the current military or the good software developer are not new, and certainly not totally new.
[12:26.020 --> 12:35.980]  While technologies and mechanisms specific to any particular application may be unique, what is of increasing importance and consequence is that software developers have an underlying humanistic philosophy in which they perform their tasks.
[12:36.520 --> 12:48.920]  The fundamentally sticky problem in software development continues to be that developers must understand both the nature of their work and the consequences of their potential failures and take steps to ensure that their projects lead to safe and highly successful deployment.
[12:49.780 --> 12:50.620]  Next slide, please.
[12:51.880 --> 12:52.300]  Thank you.
[12:56.960 --> 12:59.200]  And I'll yield to...
[12:59.200 --> 12:59.440]  When?
[13:00.580 --> 13:01.380]  Mr. Winsch.
[13:02.000 --> 13:04.020]  And if you want to beat, it's by number one on.
[13:05.780 --> 13:09.680]  I lost my voice a couple days ago from talking too much.
[13:09.760 --> 13:13.200]  My wife is quite happy about it, but you're going to have to suffer, I think, for a couple of minutes.
[13:15.360 --> 13:20.920]  Unlike Sam, I'm going to say some things, hopefully, that will get him fired on Monday.
[13:21.760 --> 13:23.180]  Because he has a day job.
[13:23.740 --> 13:25.460]  And he has a day job he can't tell you about.
[13:25.680 --> 13:30.080]  And I can say things he can't say because I live in an unclassified world.
[13:30.580 --> 13:35.080]  And he may or may not live in an unclassified world, but I can't say, neither can he.
[13:35.840 --> 13:37.040]  May I say something?
[13:37.240 --> 13:38.240]  Just for one second.
[13:38.520 --> 13:39.500]  And here comes the disclaimer.
[13:40.600 --> 13:41.800]  Something I'm going to say up front.
[13:41.900 --> 13:47.540]  I'm going to make one request of the Apocalypse room into the media that I'm representing myself on this day.
[13:47.900 --> 13:50.060]  And you mentioned my discussion this day.
[13:50.140 --> 13:55.540]  I will request that you indicate that I'm not representing a firm organization, but myself a software professional.
[13:55.860 --> 13:56.860]  Thank you, and I'm sorry to interrupt you.
[13:57.040 --> 13:58.040]  No, that's quite all right.
[13:58.300 --> 13:59.740]  Now we see where he's coming from.
[14:01.220 --> 14:03.540]  I'm going to look at ethics from a slightly different angle.
[14:04.420 --> 14:07.460]  Military and ethics, actually, they do have a great deal in common.
[14:07.460 --> 14:09.740]  But the problem that we face here in the U.S.
[14:09.800 --> 14:14.160]  from an ethical standpoint in the military is whose ethics are we going to go by?
[14:15.060 --> 14:16.680]  Are we going to go by the U.S.
[14:16.760 --> 14:22.320]  sets of rules that make us so comfortable, warm, fuzzy, mom apple pie?
[14:28.740 --> 14:35.780]  Or are we going to go by the far eastern sets of rules by different countries where an entirely different set of ethics and business rules apply?
[14:36.020 --> 14:38.060]  Whose rules are we going to use?
[14:38.600 --> 14:46.020]  And this presents an awful lot of problems to the military and the civilian support community to the military of our behavior.
[14:46.260 --> 14:47.420]  How do we behave?
[14:48.100 --> 14:52.140]  Well, let's look at how the military has behaved with certain software over the years.
[14:52.440 --> 14:55.480]  And these are the things that may get him in trouble on Monday, which I dearly hope.
[14:57.140 --> 14:59.560]  Back in the early 1970s, when Poland went
[15:02.640 --> 15:05.200]  to war, Poland wanted a new telephone switch.
[15:05.860 --> 15:09.020]  So there was really only one place to buy a telephone switch at that time.
[15:09.100 --> 15:10.420]  That was to call up AT&T.
[15:10.560 --> 15:14.080]  So AT&T calls the State Department and says, hey, we've got to sell the switch to Poland.
[15:14.080 --> 15:17.920]  The State Department, surprisingly enough, says, no problem.
[15:18.360 --> 15:19.380]  Sell it to them.
[15:19.500 --> 15:23.500]  However, please, put this inside the switch.
[15:24.220 --> 15:24.380]  The
[15:29.040 --> 15:31.800]  Russians came marching through Poland to invade Western Europe.
[15:31.800 --> 15:37.880]  We could shut down remotely the entire communications infrastructure of Poland and hopefully thwart some of their advances.
[15:38.680 --> 15:39.320]  The U.S.
[15:39.400 --> 15:42.220]  has been doing similar types of things with other export devices.
[15:42.480 --> 15:48.260]  And currently, the biggie that you would hear about, if the government were talking or if Sam were talking about this, would be North Korea.
[15:49.060 --> 15:51.640]  Big stings we hear all about, the stuff going in North Korea.
[15:51.640 --> 15:53.640]  They're not supposed to have AS-400s.
[15:53.720 --> 15:54.960]  It's embargo technology.
[15:54.960 --> 15:56.080]  It's not supposed to go there.
[15:56.340 --> 15:57.420]  Where are they getting it?
[15:57.420 --> 16:03.520]  They're getting the AS-400s for their missile control systems through India, through a deal with IBM slash India.
[16:03.820 --> 16:07.680]  And there are certain hunks of software sitting in there that give the U.S.
[16:07.760 --> 16:11.820]  a very strategic advantage in case North Korea starts acting like a bad guy.
[16:12.600 --> 16:19.360]  Ethically, on the other hand, North Korea, according to the FBI, is the country that has implanted more Trojan horses in commercial U.S.
[16:19.720 --> 16:21.400]  systems than any other country around the world.
[16:21.680 --> 16:27.780]  So we have this ethical dilemma that also revolves around the issue of posse comitatis, which is the U.S.
[16:27.860 --> 16:31.480]  law that says the military cannot do anything here in the U.S.
[16:32.020 --> 16:33.120]  because it's against the law.
[16:33.220 --> 16:34.740]  This was passed after the Civil War.
[16:35.720 --> 16:37.220]  So the problem is then,
[16:40.420 --> 16:43.580]  ethically, well, we're faced with even more problems.
[16:43.740 --> 16:50.360]  When you start looking at the quote-unquote, hey-you phenomenon, the hey-you phenomenon affects the military as much as it does the commercial sector.
[16:50.960 --> 16:57.800]  If you're sitting at a water cooler, and you're talking to somebody, and somebody, a boss comes by and says, hey, you, you know how to run Word, don't you?
[16:58.220 --> 16:58.940]  Yeah, I can use Word.
[16:59.140 --> 17:01.740]  Okay, would you be the systems and security administrator, please?
[17:02.940 --> 17:04.180]  It's the hey-you phenomenon.
[17:04.640 --> 17:17.140]  But even compounding that more, and to be not politically correct, because that's not what I get generally hired to do, when we look at the systems administrators of the support systems for the global infrastructure of the U.S.
[17:17.300 --> 17:19.560]  military, who is running the systems.
[17:20.600 --> 17:26.120]  It's not even so bad to hate you guys as it is foreign nationals, non-U.S.
[17:26.620 --> 17:31.440]  citizens, running the mission-critical support unclassified systems around the world.
[17:32.300 --> 17:39.740]  What this ends up with us facing, and I'm sure Robert will touch on this as well, is no country in its right mind is going to come after the U.S.
[17:39.740 --> 17:40.760]  with a whole bunch of missiles.
[17:40.960 --> 17:41.880]  It's not going to happen.
[17:42.000 --> 17:46.200]  Nobody's going to start flying planes into San Francisco Harbor, bringing submarines up the Hudson River.
[17:46.340 --> 17:47.120]  It's not going to happen.
[17:47.840 --> 17:53.200]  What they're going to talk about and what they're going to be looking at is doing is what is called the rear echelon attack.
[17:53.860 --> 18:05.640]  And the rear echelon attack is going after the toilet paper, the marching orders, the food, all of the bits and pieces that enable the warfighter or the peacekeeper to do their job on whatever particular mission that may be.
[18:10.240 --> 18:11.260]  Poorly protected.
[18:11.760 --> 18:12.800]  Very, very weak.
[18:12.900 --> 18:15.980]  And former four-star General John Sheehan said the same thing.
[18:16.160 --> 18:22.620]  He says, the rear echelon attack is today's modern version of the Battle of the Atlantic, which is what the German U-boats did.
[18:22.880 --> 18:27.740]  German U-boats were attacking the shipping lanes in the North Atlantic so that the soldiers couldn't fight.
[18:27.760 --> 18:33.440]  The same type of situation is existing right now in the unclassified support systems for the military.
[18:33.760 --> 18:37.900]  We don't have answers on how to do all of this and still remain politically correct.
[18:38.260 --> 18:43.840]  The last issue is all software is legal, as you probably know from the recent Supreme Court announcements.
[18:44.520 --> 18:47.580]  This also means that all software is legal for the U.S.
[18:47.620 --> 18:47.780]  military.
[18:49.500 --> 18:52.600]  They are developing some fabulous offensive software.
[18:52.940 --> 18:55.220]  The question is, when do they use it?
[18:55.300 --> 18:56.300]  When can they use it?
[18:56.420 --> 18:57.120]  Should they use it?
[18:57.200 --> 18:59.520]  These become some of the ethical questions that we're talking about.
[18:59.520 --> 19:07.600]  And ultimately the issue of, what is the distinction between military offensive software and vigilantism in the private sector?
[19:08.000 --> 19:17.880]  If and when the cops will not support a particular organization or individual when a crime has been committed against them, the cops won't do it should you do it on your own.
[19:18.380 --> 19:22.950]  If hacked electronically, quote-unquote, into...
[19:27.690 --> 19:29.710]  Well, they have responded with offensive software.
[19:29.890 --> 19:31.050]  They have done it domestically.
[19:40.190 --> 19:42.250]  In order to meet current law.
[19:42.570 --> 19:45.050]  Is that an appropriate ethical response?
[19:45.430 --> 19:51.550]  These are some of the questions that are involved with the use of software, application of an offense and defense.
[19:51.870 --> 19:56.510]  And when we get to the question and answer period, hopefully we'll get some of your thoughts and we can address some of those issues.
[19:56.510 --> 19:57.230]  Thanks a lot.
[19:57.350 --> 19:57.730]  Here's Robert.
[20:10.510 --> 20:15.120]  This is what I looked like in 1994 when we had a light show and it was really cool.
[20:16.660 --> 20:18.080]  Seventy pounds lighter, I guess.
[20:20.470 --> 20:21.800]  I'm glad to be here.
[20:22.200 --> 20:24.160]  And I'm glad that you're in this room.
[20:25.990 --> 20:32.340]  Because ethics is not some highfalutin concept that academics can talk about.
[20:32.720 --> 20:37.600]  It actually matters at the end of the day in terms of whether your children have a good life.
[20:37.950 --> 20:40.040]  And most of you, I hope, will have children.
[20:41.300 --> 20:42.620]  It goes back to Pogo.
[20:43.700 --> 20:45.010]  We have met the enemy.
[20:45.720 --> 20:46.820]  And he is us.
[20:46.820 --> 20:49.240]  Bill Gates is a threat.
[20:49.600 --> 20:54.600]  Not just to national security, but to national competitiveness.
[20:54.930 --> 20:56.970]  His stuff shits.
[20:57.800 --> 21:08.160]  And what that really means at the end of the day is that American productivity, gold-collar, knowledge-worker productivity, sucks.
[21:08.680 --> 21:11.540]  Because he's an asshole about his APIs.
[21:13.200 --> 21:14.010]  Alright?
[21:14.010 --> 21:16.470]  That's what ethics is about.
[21:17.240 --> 21:22.100]  It's about making this country not just safe, but productive.
[21:23.300 --> 21:24.760]  Stupid is rising.
[21:25.540 --> 21:29.680]  The idiots that used to flip hamburgers are now selling at Circuit City.
[21:30.560 --> 21:33.720]  We have a major employment crisis in this country.
[21:34.410 --> 21:36.410]  Smart people are in short supply.
[21:37.410 --> 21:37.970]  Alright?
[21:38.280 --> 21:39.160]  You guys...
[21:39.160 --> 21:42.220]  I listened with great interest to the thing this morning.
[21:42.600 --> 21:46.450]  I'm the guy that stood up here in 94 and said hackers are a national resource.
[21:47.280 --> 21:55.580]  I'm the guy that has been saying for years that Shirley Turkle's book, My Second Self, is the story on hackers as pushing the edge of the envelope.
[21:55.930 --> 22:00.300]  I'm the guy that said in 94 that you should be doing what my friends in Dead Cow are doing.
[22:00.540 --> 22:03.120]  Which is pointing out these problems.
[22:04.620 --> 22:08.960]  Opening up people's eyes to what's wrong with our systems.
[22:08.960 --> 22:13.080]  Wired Magazine, my friend Kevin Kelly commissioned me to do an article.
[22:13.740 --> 22:21.040]  And the working title was, Is the communications and computing industry criminally negligent or just plain stupid?
[22:22.390 --> 22:24.580]  It turns out they're really smart.
[22:24.930 --> 22:28.930]  They're not criminally negligent because there is no law against being an asshole.
[22:30.300 --> 22:41.560]  And as a result, we have a whole shitload of complex systems with really rotten, rotten software that's undocumented that is done by unlicensed people.
[22:41.820 --> 22:44.000]  Some of them on drugs, the rest of them ignorant.
[22:46.480 --> 22:48.320]  We're not referring to anyone in this room of course.
[22:48.340 --> 22:50.180]  This is really a problem.
[22:51.220 --> 22:52.930]  Now why is it a problem?
[22:53.410 --> 22:54.660]  Why does it matter?
[22:55.020 --> 22:56.680]  There's a couple of reasons why it matters.
[22:57.720 --> 23:01.340]  First off, we're no longer in the agricultural age.
[23:01.500 --> 23:02.950]  We're no longer in the industrial age.
[23:03.600 --> 23:07.120]  We're in the digital age where it's either on or off.
[23:07.320 --> 23:09.580]  It either works or it's fucked.
[23:11.080 --> 23:11.640]  Alright?
[23:12.020 --> 23:13.220]  There is no in between.
[23:14.740 --> 23:21.430]  Bill Gates, in his little mind someplace, understands that he better start moving his money offshore.
[23:22.140 --> 23:24.240]  Because it's going to crash on him soon.
[23:24.940 --> 23:27.460]  We really need to think through.
[23:27.820 --> 23:32.580]  Do we want a digital economy that does not degrade gracefully?
[23:33.280 --> 23:37.910]  The Federal Reserve has gone from 12 regional computers to one.
[23:39.540 --> 23:39.860]  Three?
[23:40.640 --> 23:43.040]  Well, that's a hot backup, a cold backup.
[23:43.180 --> 23:44.080]  We all know they don't work.
[23:44.080 --> 23:44.720]  Okay?
[23:45.160 --> 23:52.680]  The bottom line is, the Fed is down to where, if they go out for 15 minutes, that's a trillion dollar write-off.
[23:52.890 --> 23:55.540]  You will never replicate those transactions.
[23:55.860 --> 23:59.390]  You will never do forensics at the Federal Reserve level.
[24:00.660 --> 24:05.340]  Charles Carroll wrote an excellent book called Normal Accidents Living with High Risk Technology.
[24:06.120 --> 24:17.950]  And you know this better than I, but for the sake of the Feds in the audience, and the media, and anybody else here that worries about stock prices crashing, simple systems have single points of failure.
[24:18.540 --> 24:20.660]  They're easy to diagnose and fix.
[24:21.450 --> 24:29.620]  Complex systems have multiple points of failure that interact in strange ways, very difficult to diagnose, really tough to fix.
[24:29.980 --> 24:33.720]  Particularly when every fucking helpline says, oh no, that's a Microsoft problem.
[24:33.720 --> 24:34.740]  That's not HP.
[24:35.100 --> 24:35.980]  That's not Dell.
[24:36.120 --> 24:36.780]  That's not Sun.
[24:37.300 --> 24:40.890]  That's Microsoft interacting in strange ways with our system.
[24:41.780 --> 24:48.980]  We are in an environment of a constellation of complex systems.
[24:49.480 --> 24:58.680]  With all kinds of organizational and legal and ethnic and cultural and intellectual boundaries that we're not able to cross.
[24:59.540 --> 25:00.960]  So what is ethics?
[25:01.390 --> 25:02.950]  Why is ethics important?
[25:04.540 --> 25:07.840]  Ethics is about building for the common good.
[25:09.160 --> 25:12.450]  Ethics is about establishing due diligence standards.
[25:13.200 --> 25:18.180]  So that when you buy a car, the bolts on the wheels are actually screwed on.
[25:18.820 --> 25:21.360]  Bill Gates is selling computers without wheels.
[25:22.000 --> 25:23.300]  They crashed a lot.
[25:23.910 --> 25:24.480]  Okay?
[25:24.720 --> 25:29.800]  And unfortunately, he is the 9,000 pound gorilla that's fucking up the American economy.
[25:29.800 --> 25:32.780]  And he's having a negative impact on the rest of the world.
[25:33.620 --> 25:35.020]  Other than that, I like the guy.
[25:37.680 --> 25:39.390]  This is about the common good.
[25:39.890 --> 25:42.430]  Now who's responsible for the common good?
[25:42.720 --> 25:44.140]  There are two answers to that.
[25:44.430 --> 25:45.450]  The first is you.
[25:45.660 --> 25:47.700]  And the second answer is your government.
[25:48.420 --> 25:57.080]  The reason that all of these people who talk about stateless international relations and multinational corporations running the world and all that, that's a scary thought.
[25:57.800 --> 26:00.450]  Governments exist for one simple reason.
[26:00.930 --> 26:04.500]  To deal with what are called external diseconomies.
[26:04.500 --> 26:18.340]  They exist to deal with things that Bill Gates doesn't give a rat's ass about, but that are really, really important to our national security and our national competitiveness and to your livelihood and to the future of our children.
[26:21.060 --> 26:22.390]  So what does that mean?
[26:23.960 --> 26:40.060]  It means that as we move into a network economy, where every individual is more important than any organization at large, we have to create a network ethics that is institutionalized by law.
[26:42.100 --> 26:46.390]  I'm really blown away at the difference between this conference and 1994.
[26:47.410 --> 26:49.410]  My God, it starts on time.
[26:49.560 --> 26:50.890]  That's a major hack in itself.
[26:52.020 --> 26:52.780]  You know?
[26:53.020 --> 26:54.740]  You've got a program manual.
[26:54.980 --> 26:59.280]  You've got a fantastic range of mainstream as well as radical speakers.
[26:59.450 --> 27:00.950]  You've come of age.
[27:02.360 --> 27:09.450]  It's not selling out to make the system work for your benefit and the benefit of your friends.
[27:10.460 --> 27:17.080]  And so I say to you, keep on doing what you're doing, but as physicians are tasked, do no harm.
[27:17.780 --> 27:19.240]  But enlighten people.
[27:19.640 --> 27:22.980]  Because from what you do will come network ethics.
[27:23.240 --> 27:23.600]  Thank you.
[27:32.590 --> 27:34.790]  And now we have some type of questions.
[27:35.110 --> 27:36.630]  So, jump in.
[27:40.190 --> 27:42.810]  The young man in the blue box t-shirt.
[27:42.950 --> 27:43.810]  They're all young men.
[27:44.870 --> 27:49.330]  The one running the blue box t-shirt and the third row across from me, seeing chest off to the left.
[27:51.490 --> 27:54.030]  Yeah, this is for you and Robert.
[27:54.330 --> 27:55.810]  Who do you think should manage...
[27:56.330 --> 27:58.190]  Like you were talking before about complex systems.
[27:58.470 --> 28:02.570]  Who do you think should manage complex systems such as APIs and OSs?
[28:02.790 --> 28:05.850]  Should it be the managers that know what the clients want?
[28:05.850 --> 28:11.170]  Or should it be the code writers who actually type out the code and don't get around to ask about deadlines?
[28:13.870 --> 28:14.810]  I'll give mine first.
[28:14.930 --> 28:21.310]  First, operating systems are an example of a type of intricate system.
[28:21.410 --> 28:23.850]  In most cases, they're not really referred to as the complex systems.
[28:24.150 --> 28:25.070]  They can be.
[28:25.770 --> 28:26.610]  It's a matter of thinking.
[28:26.750 --> 28:27.990]  I certainly don't put it down to a programmer.
[28:27.990 --> 28:34.690]  One thing I advocate, although it does impact your software release dates, is that you first figure out what a system you should do.
[28:34.790 --> 28:36.110]  You do your upfront software requirements.
[28:36.450 --> 28:37.210]  You build specifications.
[28:37.710 --> 28:39.130]  Exactly what is this going to do and preferably...
[28:39.610 --> 28:42.410]  Not necessarily a true formal model, but some kind of mathematical model.
[28:42.410 --> 28:43.810]  Make sure there aren't ambiguities present.
[28:44.070 --> 28:50.230]  So you find what files and systems such that another set to be secure is pretty ambiguous.
[28:50.230 --> 28:56.510]  Where you remove some of the discretion where it needs to be opened in a weak or strong fashion.
[28:56.870 --> 28:57.890]  You define what strong is.
[28:59.370 --> 28:59.810]  Um...
[28:59.810 --> 29:00.350]  The managers...
[29:01.310 --> 29:06.990]  A lot of them are hands and managers, but I believe in not having all software run through a linear process.
[29:07.390 --> 29:14.470]  You have to have this oversight and responsibility teams where people are signing off, that they've done the studies, and that certain criteria are met.
[29:14.550 --> 29:17.430]  There are books on how to produce software through these regimented programs.
[29:17.430 --> 29:23.030]  How to review code manually to walk through and read and make sure that certain real bad practices aren't there.
[29:23.330 --> 29:28.390]  To make sure that you've covered the big stupid sources of errors that get in there by negligence.
[29:28.650 --> 29:33.110]  I feel that 90 to 95% of all the security problems can be addressed through some forethought.
[29:35.030 --> 29:35.430]  Um...
[29:35.430 --> 29:37.590]  That often takes multiple teams, not just managers.
[29:37.830 --> 29:42.470]  The one or two individuals who is probably on the line if they screw up and don't get the quality right.
[29:42.690 --> 29:47.270]  Unfortunately, a big part of it is on the hands of the customers who are buying stuff that...
[29:47.270 --> 29:48.510]  but also superiorly knowing.
[29:49.770 --> 29:50.170]  Um...
[29:50.170 --> 29:50.850]  I'll look for an end.
[29:52.010 --> 29:52.410]  Um...
[29:52.410 --> 29:53.290]  On complex systems...
[29:53.290 --> 29:58.910]  Some of the work that's being done now is going to kind of change the way we look at complex systems, uh...
[29:58.910 --> 29:59.430]  for two reasons.
[29:59.590 --> 30:02.250]  One, we're starting to understand chaos theory a little bit more.
[30:03.250 --> 30:07.910]  Complexification and starting to understand how the mathematics will apply to real-world systems.
[30:08.170 --> 30:09.730]  And we're just kind of at the leading edge of that.
[30:09.810 --> 30:14.510]  And if you're interested, the Santa Fe Institute down in New Mexico has done some fabulous research in that area.
[30:14.510 --> 30:28.350]  The second thing that's coming out at Sandia National Laboratory, it's just announced a couple, three weeks ago, and there's some similar stuff coming out at Los Alamos and Oak Ridge, is autonomous agents without any central authority to be distributed through certain types of networks.
[30:29.850 --> 30:35.090]  The inherent management agents of the network without having to involve individuals.
[30:35.590 --> 30:41.890]  Now, whether that's good or bad is another issue, but they are producing the software, and that's others are introducing beta testing on it now.
[30:42.170 --> 30:42.570]  Boo!
[30:44.650 --> 30:44.950]  Bad!
[30:45.990 --> 30:47.610]  How are they using this?
[30:47.610 --> 30:48.830]  Hang on, hang on.
[30:48.930 --> 30:50.870]  We'll get into all that cool techy shit in a minute.
[30:51.270 --> 30:53.030]  Let me just answer the question.
[30:55.370 --> 30:58.030]  Nobody should be allowed to control standards.
[30:59.310 --> 31:15.150]  I believe that Vint Cerf set up the right model with the internet standards committees, where really smart people came together on a voluntary basis, and they produced standards that worked, that were adaptable, adaptable, scalable, migratable, all of that cool shit.
[31:15.550 --> 31:15.870]  Okay?
[31:16.390 --> 31:26.210]  Now, where we have a problem in the United States, and my friend Sam has done a very good job of pointing it out, is it's legal to sell software that is shit.
[31:27.610 --> 31:29.070]  That has to change.
[31:29.070 --> 31:50.550]  We need to have legislation that establishes standards of due diligence, just like we have fiduciary standards, just like we have good business practice standards, and industry has to be held accountable for what is now legal actions that undermine your productivity and security.
[31:50.690 --> 31:52.990]  APIs is a classic example.
[31:53.230 --> 32:02.050]  Bill Gates has to put his APIs up front and not move them, not change them, stabilize them, document them, the whole bit.
[32:02.290 --> 32:04.870]  How are you going to do that if the industry drives the law?
[32:05.950 --> 32:09.690]  That's a very good point, and we can get into that.
[32:09.770 --> 32:15.870]  I don't want to take any more time, but I think the bottom line here is that people have to illustrate these vulnerabilities.
[32:16.350 --> 32:18.310]  And what has not happened to date...
[32:18.310 --> 32:21.190]  You know, America is a very rich and powerful country.
[32:21.810 --> 32:24.930]  It can survive a lot of incompetence in Washington.
[32:24.930 --> 32:28.090]  It's getting to the point where it doesn't matter who's president.
[32:28.890 --> 32:29.030]  Okay?
[32:29.390 --> 32:35.890]  But the bottom line here is that we are moving into an era where it really does matter if software sucks.
[32:36.810 --> 32:40.810]  And that's where you guys are doing a national global service.
[32:40.810 --> 32:55.270]  Our friends from the Netherlands and from Germany, you have to educate the American and other international publics, and it's hard to do, on why it's important to worry about software standards, why it's important to worry about software reliability.
[32:55.930 --> 33:02.990]  Because the bottom line is, at the end of the day, everything else about your life depends on software being trusted.
[33:03.830 --> 33:06.350]  Right, and reliability is the key word.
[33:06.570 --> 33:09.750]  I'd like to get one question.
[33:09.750 --> 33:21.250]  So, when we saw this law-of-part bullshit, I clearly agree when you say Microsoft is something, but they have brakes, and those brakes fall out.
[33:21.830 --> 33:22.710]  That's special too.
[33:23.830 --> 33:39.970]  So, if any company would sell cars like that, they would be taking into liability, and that would be a high price to pay for them, so people would stop selling their cars, and buying their cars, and, yeah, there would be a coming big question, like saying,
[33:40.090 --> 33:41.430]  hey, what are you doing here?
[33:42.110 --> 33:42.270]  And,
[33:45.620 --> 33:49.820]  yeah, I mean, here's even a Microsoft presentation on this panel.
[33:51.760 --> 34:02.000]  People seem to act like Microsoft software fall from heaven, and it's there, and they have to deal with it, as if there were not alternatives.
[34:02.400 --> 34:20.080]  So, I don't understand why Microsoft software is within this community here, and I'd like to ask you on the panel, if liability as a topic for people making laws would be the key idea to change their actual business?
[34:21.780 --> 34:23.520]  Liability is very important.
[34:23.700 --> 34:26.830]  I never thought I'd say we need more lawyers, but this is it.
[34:26.950 --> 34:28.080]  This is the big new one.
[34:28.240 --> 34:29.240]  And you're not going to say it.
[34:31.240 --> 34:32.600]  All right, I won't say it.
[34:34.520 --> 34:39.720]  Liability is the issue, but the other thing is Bill Gates is an accident in a lot of ways.
[34:41.600 --> 34:48.120]  He's the guy that didn't tell IBM to piss off when they said they wouldn't sign a non-disclosure agreement.
[34:48.260 --> 34:51.930]  And he was number two on the operating system.
[34:52.460 --> 34:53.020]  Okay?
[34:53.220 --> 35:01.830]  He was runner-up, but then he became a marketing monolith, and he ran it through the system at a time when people weren't smart enough to know better.
[35:02.180 --> 35:02.410]  Okay.
[35:02.580 --> 35:03.790]  Now we're at a tipping point.
[35:03.980 --> 35:08.620]  Now we're at a tipping point where it matters if your Microsoft products stink.
[35:09.460 --> 35:17.160]  It matters if my PowerPoint slides explode my Word document just after I've written an 80-page business plan for $5 million.
[35:17.700 --> 35:18.930]  This pisses me off.
[35:19.330 --> 35:23.480]  It also wastes three days of my time, which is priced at roughly $9,000.
[35:24.390 --> 35:29.180]  I've just lost $9,000 because of Bill Gates' lousy software.
[35:29.460 --> 35:30.850]  So now it's up to you guys.
[35:31.000 --> 35:32.600]  You need to illustrate this thing.
[35:32.680 --> 35:34.260]  You need to be friendly with the media.
[35:34.260 --> 35:37.890]  I think Emmanuel has done a wonderful job of being media friendly.
[35:38.120 --> 35:44.830]  And I hope you guys will all not play the role of people that have been victimized or people that are doing anything illegal.
[35:45.100 --> 35:55.950]  Play the role of holy grail crusaders who are simply trying to educate the public as to the ethics that is lacking in the communications and computing industry.
[35:56.840 --> 36:00.260]  One thing I will mention, though, is I did have my backup presentation ready.
[36:02.320 --> 36:06.930]  And in terms of lost productivity, yes, Kinko's charged me quite a sum of money to do this.
[36:08.500 --> 36:09.910]  What did you do to create it?
[36:11.080 --> 36:13.040]  Yell it out!
[36:13.280 --> 36:13.620]  Yell it out!
[36:14.880 --> 36:15.780]  Okay, next please.
[36:16.260 --> 36:17.220]  I believe the man up here...
[36:17.220 --> 36:20.280]  Okay, I'll tell you, I'll take if you may, the random white shirt back there.
[36:20.480 --> 36:23.100]  And then this gentleman right here with the camo pants has a question also.
[36:23.820 --> 36:25.450]  Y'all are talking about how...
[36:25.450 --> 36:26.080]  How...
[36:26.720 --> 36:27.620]  Please speak up.
[36:28.140 --> 36:35.200]  Y'all are talking about how easy it, how you think that computer systems and routers and all the software is a place of insecurity.
[36:35.640 --> 36:38.660]  If I was a terrorist, I'm not going to go after a computer system.
[36:38.760 --> 36:40.980]  That requires too much time, too much information.
[36:41.720 --> 36:44.320]  I'm going to do something, I'm going to go after power and water.
[36:44.780 --> 36:46.430]  Power is horribly insecure.
[36:47.040 --> 36:47.840]  So is water.
[36:48.520 --> 36:50.340]  You take those down, you shut down a city.
[36:51.480 --> 36:51.880]  And...
[36:51.880 --> 36:54.200]  Or for another one, you take that traffic.
[36:55.120 --> 36:55.860]  Another easy one.
[36:55.930 --> 37:00.380]  You can block down two interstates with a couple of junkers, and you shut down a major route in and a half of the city.
[37:00.800 --> 37:03.120]  I believe Wynn will be very happy to respond to this question.
[37:03.260 --> 37:06.220]  Yeah, but should we get water to that bill?
[37:06.430 --> 37:09.460]  Because if you want to get terrorism, that's another topic.
[37:09.620 --> 37:12.320]  We're talking about technology falling out without terrorism.
[37:12.320 --> 37:19.720]  I agree, the question's a little off topic, but there's still computer systems behind all those things, and it depends upon your objectives.
[37:20.140 --> 37:34.040]  I think it's a little off topic, the ethical issues of how critical infrastructures are defined, and which ones require, whether legally or legislatively have to be protected, is one of the ethical issues we're dealing with here.
[37:34.040 --> 37:34.800]  ...action
[37:46.320 --> 37:50.740]  center versus what is occurring in some of our European countries.
[37:51.020 --> 37:59.240]  There are different views of what constitutes credit, and I've stolen his term over the years, is graceful degradation.
[37:59.680 --> 38:08.740]  How do we gracefully degrade ethically, legally, operationally, from the current state of operation when things screw up?
[38:08.740 --> 38:09.520]  What do we do?
[38:09.680 --> 38:10.300]  How do we do it?
[38:10.440 --> 38:17.840]  I was in Paris last summer, and I was trying to buy a Diet Coke for my kids, and what happens on the big menu screen up there?
[38:18.060 --> 38:18.940]  There's an N.T.
[38:19.060 --> 38:19.300]  error.
[38:21.120 --> 38:25.220]  I couldn't pay my Diet Coke until they rebooted N.T.
[38:25.320 --> 38:26.900]  at the fast food restaurant in Paris.
[38:27.520 --> 38:30.160]  They had no mechanism for fallback.
[38:30.400 --> 38:36.360]  So when you talk about terrorists and power and all that stuff, there are some manual backup systems.
[38:36.360 --> 38:44.060]  I'm not sure how they all work, but those are some of the issues that we really need to be dealing with, is how to survive acts of man and just mention the acts of God.
[38:44.260 --> 38:45.480]  We've got the hurricane thing down.
[38:45.720 --> 38:46.340]  Hang on a second.
[38:46.420 --> 38:47.660]  There are two key points I want to make here.
[38:47.780 --> 38:50.500]  First off, the question is on topic in this sense.
[38:51.620 --> 39:06.340]  The communications and computing industry in the United States is giving not just terrorists, but criminals who are smart enough to not brag about what they do, and information vandals, people who are very, very angry, they're giving them a wide-open door.
[39:06.700 --> 39:09.320]  The information industry is out of control.
[39:09.700 --> 39:10.940]  Now, a couple of comments.
[39:11.540 --> 39:18.920]  Mish Covey and I had a wonderful debate in terms of which were our hackers a national resource or pathological scum.
[39:18.920 --> 39:21.400]  And it ended up in a draw.
[39:21.840 --> 39:35.260]  But Mish is someone I really respect, and he's got a pie chart in his book which shows that 50% of computer-related errors are from data entry problems associated with bad design.
[39:35.960 --> 39:40.820]  And other 20% come from a lack of backup, fire and water damage.
[39:40.820 --> 39:47.440]  And there are an awful lot of people in this town and other places whose idea of a backup is the magnetic tapes in the same room as the system.
[39:47.980 --> 39:48.420]  Okay?
[39:48.860 --> 39:53.480]  And then 10% were from dishonest individuals who sold out.
[39:53.620 --> 39:57.700]  They were authorized users doing unauthorized things.
[39:57.920 --> 40:01.080]  10% is disgruntled individuals seeking revenge.
[40:01.360 --> 40:03.780]  Authorized users doing unauthorized things.
[40:04.300 --> 40:08.860]  5% were from viruses, and the last 5% was from outside attack.
[40:09.140 --> 40:11.600]  So I say this to put it in perspective.
[40:11.600 --> 40:14.080]  We have met the enemy, and he is us.
[40:14.900 --> 40:21.000]  What I'd like to do, we're running short on time, I would like to take two questions.
[40:21.220 --> 40:27.580]  One from the gentleman sitting right in front of me, and one from the person sitting at the most extreme distance back from me in direct line.
[40:27.580 --> 40:30.840]  Maybe we'll try to give each question and answer about two minutes.
[40:31.800 --> 40:33.260]  Okay, I understand...
[40:33.260 --> 40:33.940]  Speak loudly, please.
[40:34.120 --> 40:37.980]  I understand what you're saying about the need for some type of control.
[40:38.680 --> 40:39.220]  Thank you.
[40:39.360 --> 40:40.080]  Systems like that.
[40:40.440 --> 40:46.080]  But I'm an embedded programmer for Datascope, and we do medical stuff, and we're regulated by the FDA.
[40:46.900 --> 40:50.300]  And let me just say that they are really a bunch of idiots.
[40:50.740 --> 40:57.040]  I mean, a lot of the requirements are contradictory to other ones, and if you follow one of their guidelines, it contradicts with the other.
[40:57.040 --> 41:04.540]  So if the government isn't going to be able to regulate itself and to enforce these coding practices, then who can we get to do it?
[41:06.020 --> 41:07.580]  One of the issues that I have...
[41:07.580 --> 41:22.920]  When I stood up to Marine Corps Intelligence Center, which I had a budget for about 100 people, and the Secretary of the Navy in his infinite wisdom told me that I couldn't hire anybody above the rank of GS-9 without his direct personal approval.
[41:23.920 --> 41:31.500]  What you have is a government that is running on 1950s laws and 1950s concepts of personnel functionality.
[41:32.140 --> 41:34.580]  You have a government that is largely ignorant.
[41:34.900 --> 41:46.340]  There is a huge, huge gap, and of course, Hacker Crackdown by Bruce Sterling on the gap between what the Secret Service really understood, which was nothing, and what you guys understood about this stuff.
[41:47.820 --> 41:49.960]  It's going to take a quarter century.
[41:50.420 --> 42:05.040]  It is going to take 25 years, but ultimately what we're going to have is a very small government that serves primarily as a coordinator to harness distributed intelligence around the nation, and that's the core of my book.
[42:06.480 --> 42:14.840]  You guys are going to be in charge, and you're going to do peer reviews, and you're going to judge yourselves, and it's going to be real obvious who knows their stuff and who doesn't.
[42:15.040 --> 42:20.240]  And out of that will come a form of virtual standard making and so on.
[42:20.240 --> 42:22.700]  But right now, I will say you are dead on target.
[42:23.040 --> 42:36.940]  The government is not only three to six years behind on software patents, on understanding software, on regulating software, all this stuff, but they're probably 10 to 15 years away from having fully competent people.
[42:37.340 --> 42:40.420]  So this is a long road that we're going down.
[42:42.180 --> 42:42.520]  Okay.
[42:43.060 --> 42:46.920]  I was advised that we have a little more time, actually, than I thought originally.
[42:47.140 --> 42:50.840]  And I will take a question from the man directly in line from me way back.
[42:51.000 --> 42:52.400]  I'm going to ask for this to be glad to be so welcome here.
[42:52.600 --> 42:52.920]  Thank you.
[42:53.740 --> 42:54.060]  All right.
[42:54.400 --> 42:59.400]  Should competition take care of all this?
[43:04.100 --> 43:08.120]  Well, there are quite a few construction firms, and there is some competition between them.
[43:08.940 --> 43:16.260]  But there are very stringent restrictions on who can put up a bridge and what's involved before you can put up a bridge.
[43:17.100 --> 43:17.420]  That's right.
[43:17.420 --> 43:17.980]  There's competition.
[43:18.200 --> 43:22.380]  You can't give me five million dollars and then me and 20 of my buddies go and build a bridge.
[43:23.240 --> 43:24.920]  If you have a million to do it, I'll take it.
[43:25.120 --> 43:26.000]  And I'll do what I can.
[43:26.580 --> 43:28.900]  I won't be the number one man to cross it with my Jeep.
[43:31.400 --> 43:32.520]  Anyone has anything to add?
[43:32.640 --> 43:34.820]  Yeah, I'm going to argue that one, Sam.
[43:35.000 --> 43:36.560]  You haven't lived in New York in a whole long time.
[43:36.740 --> 43:37.060]  Okay.
[43:38.440 --> 43:43.120]  The highways have potholes the following day because they were built by the lowest bidder.
[43:43.680 --> 43:50.120]  The Mexican concrete slabs in Southern California destroyed 200,000 homes with level 3 earthquakes.
[43:50.600 --> 43:51.820]  Lowest bidder problem.
[43:51.820 --> 44:00.500]  The competition issue, one could argue that there is a free open competition because Microsoft only has 93% of the market.
[44:01.000 --> 44:02.540]  It's that free competition.
[44:02.840 --> 44:06.360]  That's what Congress is trying to decide and the Supreme Court and all that.
[44:06.480 --> 44:08.000]  They're trying to figure that one out right now.
[44:08.640 --> 44:15.050]  But competition becomes very different when we look at it at the global level.
[44:15.630 --> 44:21.930]  Over in Europe, the private sector and the government can work together in profit-making endeavors.
[44:21.930 --> 44:23.010]  Look at Airbus.
[44:23.170 --> 44:29.330]  That's how they got their act together, financed with billions and billions of various governments in concert with the private sector.
[44:29.450 --> 44:32.770]  Now Boeing is worried about a lot of stuff.
[44:33.430 --> 44:38.150]  Over in the Far East, monopolization is considered good business.
[44:38.310 --> 44:39.770]  It's fair to do that.
[44:39.930 --> 44:44.450]  So when we start talking about competition, we really need to define, again, where are we talking about?
[44:44.530 --> 44:46.150]  Are we looking at this as the US-centric?
[44:46.330 --> 44:47.210]  We rule the universe?
[44:47.210 --> 44:50.490]  We're only 4% of the population of the whole planet.
[44:50.710 --> 44:58.330]  So our concepts of what we're trying to do and the ethics, if you will, of business do not necessarily apply everywhere else.
[44:58.590 --> 44:59.750]  One quick sentence.
[45:00.010 --> 45:04.750]  The relationship between the government and industry is going to have to change.
[45:05.870 --> 45:10.470]  Lest anyone not understand my position, I say government is good.
[45:10.690 --> 45:11.870]  We need government.
[45:11.870 --> 45:16.850]  Government does the external diseconomy things that Bill Gates doesn't want done.
[45:18.210 --> 45:19.730]  But government is ignorant.
[45:20.090 --> 45:23.090]  Government is 25 years behind where it needs to be.
[45:23.650 --> 45:25.670]  The relationship is going to have to change.
[45:25.670 --> 45:32.350]  And I think the way it's going to change is government will orchestrate standards and due diligence legislation and things like that.
[45:32.990 --> 45:35.010]  Citizens will actually enforce it.
[45:35.210 --> 45:39.370]  It will come to the day when a whistleblower, just like that beautiful thing with the Intel chip.
[45:39.370 --> 45:40.890]  I mean, wow!
[45:42.070 --> 45:43.650]  Overnight their ass got kicked.
[45:44.250 --> 45:45.870]  This is important stuff.
[45:46.210 --> 45:47.450]  You can do that.
[45:47.650 --> 45:54.970]  But you need to do it legally with no harm done to the systems that you are examining on behalf of the citizens.
[45:57.790 --> 45:59.630]  And we'll take one more question.
[45:59.750 --> 46:01.450]  We have five more minutes, we're told, over here.
[46:01.510 --> 46:01.830]  Five more.
[46:01.950 --> 46:02.130]  Okay.
[46:02.730 --> 46:02.990]  I'm sorry.
[46:03.070 --> 46:04.130]  I've asked you... Five short questions.
[46:04.330 --> 46:07.770]  I'm going to try to get several rows back and then slightly to the left.
[46:08.070 --> 46:08.810]  You've got three seats in.
[46:10.870 --> 46:15.830]  Yeah, I appreciate what you're saying about the government happening to legislate official standards.
[46:16.010 --> 46:21.130]  I think you drew some parallels to some of the fiduciary responsibilities that many organizations have in the nation today.
[46:21.130 --> 46:25.550]  For example, the SEC regulates things in the interest of shareholders, benefits, et cetera, et cetera.
[46:25.850 --> 46:31.970]  And I also agree that some of the federal standards that exist today, some of the FIB standards may be woefully inadequate or antiquated in other respects.
[46:32.310 --> 46:41.450]  However, I think what you didn't mention that's important, and I'm interested to hear your thoughts on this, is that I don't think academia bears sufficient burden in this process.
[46:41.570 --> 46:49.810]  And the reason is that while there's a lot of great things about the Wild West situation we're in right now, there's not certain types of degrees that we need.
[46:50.070 --> 46:57.070]  And some of the real computer science theory that we were taught in college, a lot of us, is not necessarily applicable to what we do in our day-to-day lives.
[46:57.390 --> 47:10.830]  And I think academia really needs to bear some of the burden for having an actual stringent and rigid qualifications, much like with a JD or an MBA or an MD, where you're qualified in a vocational sense to execute these professional tasks.
[47:10.830 --> 47:15.930]  So don't you think that the responsibility should be shared by the American and international university system in that respect?
[47:16.510 --> 47:16.990]  All right.
[47:17.150 --> 47:18.250]  There's a couple issues there.
[47:18.550 --> 47:20.390]  Academia actually is fairly well under
[47:33.600 --> 47:38.340]  advanced degrees in security and software engineering and how those disciplines tie together.
[47:38.520 --> 47:46.020]  But the other issue with academia, again, ties in with the points on internationalization and global issues of security.
[47:46.540 --> 47:51.460]  The current range of security criteria is called the common criteria.
[47:51.460 --> 47:52.940]  And the U.S.
[47:53.040 --> 48:02.060]  has basically sat out of it because the Europeans and other countries have all gotten together and said, yeah, we like this stuff and we can develop any standards.
[48:02.360 --> 48:08.220]  Academia is heavily involved in those processes to develop standards on an international basis.
[48:08.700 --> 48:21.760]  And basically, whether it's the government politically or it's the NSA and the National Bureau of Standards, NIST, but we are not participating actively even though, beginning 30 years ago, we're the ones that developed the original standards.
[48:21.940 --> 48:22.860]  So we're sitting out.
[48:23.100 --> 48:26.200]  But academia is fairly heavily involved in these processes.
[48:26.560 --> 48:28.400]  But development of standards is one thing.
[48:28.820 --> 48:34.940]  On an undergraduate level, the people that are actually entering the workforce, that's more what I'm talking about in academia.
[48:35.320 --> 48:41.960]  I mean, I don't know how many universities now have finally actually geared up the population of computer science programs into the more applied sort of degrees.
[48:42.680 --> 48:46.540]  But, you know, at the graduate, high academic level, developing standards is one thing.
[48:47.020 --> 48:52.140]  Sending qualified people who are working in the workforce who didn't just go to some eight-week crash training course is something totally different.
[48:52.680 --> 48:56.740]  Let me make a couple of quick comments because you're onto something that's very important.
[48:58.140 --> 49:07.160]  The next president, I don't know how many of you read that Wired magazine about a month ago, but it had this wonderful thing which says essentially most of you are going to live to be 100.
[49:08.320 --> 49:08.740]  Okay.
[49:09.060 --> 49:15.000]  The lifespan of Americans in particular, but people all over the world, is changing.
[49:15.160 --> 49:16.440]  100 years old.
[49:16.980 --> 49:26.320]  The next president is going to have to come to grips with the fact that the retirement age in this country is going to have to be moved out to 75 at a minimum.
[49:26.700 --> 49:34.140]  The next president is going to have to come to grips with the fact that most people, when they graduate from college, aren't qualified to do anything.
[49:35.100 --> 49:35.620]  Okay?
[49:36.240 --> 49:37.560]  They're party animals.
[49:38.440 --> 49:40.000]  They might know how to read.
[49:40.660 --> 49:45.980]  But by and large, they don't have the kind of practical skills that you have.
[49:46.560 --> 49:59.740]  We need to deconstruct and revitalize our entire educational system, and fully half of it has to shift over into what some might call vocational, but what I would call cyber education and corporate education.
[49:59.740 --> 50:04.140]  And you literally have to get recertified every two years at a minimum.
[50:04.580 --> 50:06.280]  You have to refresh yourselves.
[50:06.460 --> 50:10.700]  We have to significantly increase the amount of money that corporations spend on education.
[50:10.880 --> 50:15.620]  Unfortunately, today, they're spending money just teaching people to read and write after high school education.
[50:16.020 --> 50:18.640]  The last comment that I would make is that the U.S.
[50:18.760 --> 50:24.300]  government is spending billions and billions and billions of dollars on classified information technology.
[50:24.300 --> 50:26.280]  Now, what's wrong with this?
[50:27.660 --> 50:39.880]  The Defense Advanced Research Projects Agency, in one year that I'm familiar with, spent 70 million dollars on data visualization software pilot projects in areas that had been abandoned by Hollywood five years previously.
[50:40.960 --> 50:41.540]  Okay?
[50:42.020 --> 50:48.120]  We literally are not doing a good job of following the development and emergence of critical technologies.
[50:48.120 --> 50:49.040]  And why is that?
[50:49.360 --> 50:50.660]  It's because of secrecy.
[50:51.060 --> 50:55.280]  Had cold fusion been a classified project, it would still be alive today.
[50:56.180 --> 51:01.780]  We have literally cut off and pissed off academia in relation to the secret world.
[51:02.000 --> 51:13.100]  And that's why I really endorse and agree with most of what Senator Moynihan from the State of New York has to say when he sums it up in his book on secrecy by saying secrecy is for losers.
[51:13.860 --> 51:19.400]  By and large, you don't need 95% of the secrecy that we have in the U.S.
[51:19.540 --> 51:19.780]  government.
[51:20.160 --> 51:31.260]  And by and large, you can accomplish 95% of your national security and national competitiveness objectives by being open and ethical and legal and by embracing and bringing together everybody.
[51:31.260 --> 51:36.920]  So the issue you've really raised is are we going to talk to one another for the rest of our lives?
[51:37.300 --> 51:38.920]  Corporate, academia, and government.
[51:39.140 --> 51:42.420]  And that's something that's going to take several decades to play out.
[51:42.920 --> 51:44.880]  I'm just going to mention one thing and we'll close up.
[51:45.220 --> 51:50.280]  My own perspective on the answer is applied knowledge is very good, very useful, and very necessary.
[51:50.840 --> 51:53.920]  But if you want to break codes, there are lots of bureaucratics you can use.
[51:54.020 --> 51:55.320]  It also helps if you do the math.
[51:58.570 --> 51:59.950]  So I do believe in rigor.
[52:01.030 --> 52:08.410]  If anyone wants to take these issues up to me in person, if anyone rejects, I'm at Sam at IamSam.com or www.IamSam.
[52:09.030 --> 52:11.270]  These gentlemen are well known if you look them up on the web.
[52:11.430 --> 52:13.050]  There's a lot of interesting stuff out there.
[52:13.590 --> 52:18.090]  I'd like to thank our panelists for a very interesting discussion.
[52:18.670 --> 52:19.210]  Thank you all.