NewsScan Daily, 6 June 2003 ("Above The Fold")

NewsScan Daily, 6 June 2003 ("Above The Fold")
***********************************************************
NewsScan Daily is underwritten by RLG, a world-class organization
making significant and sustained contributions to the effective
management and appropriate use of information technology. NSD is
written by John Gehl and Suzanne Douglas, [email protected].
***********************************************************

"ABOVE THE FOLD"
        Oracle Makes $5-Billion Bid for PeopleSoft
        IBM Supercomputer Keeps an Eye on Hurricanes
        Distributed Computing Made Easy
        Publishing the SQL Slammer Code: Training or Education?
        Politics by Modem
        Andrew Sullivan Says: 'The Internet Did It'

FEATURES
        Flash Card
        Safe & Sound in the Cyber Age

ORACLE MAKES $5-BILLION BID FOR PEOPLESOFT
Oracle has made a $5.1 billion cash bid for rival business-software maker 
PeopleSoft in what some analysts are saying could be the beginning of a new 
wave of consolidation in the software industry. PeopleSoft recently offered 
to purchase J.D. Edwards for $1.58 billion in stock, and Oracle said that 
once it completes its proposed acquisition of PeopleSoft, it would "review 
whether, and on what terms, Oracle would support that transaction." Oracle 
said it planned to incorporate advanced features from PeopleSoft's products 
into its own Oracle eBusiness Suite. (Wall Street Journal 6 Jun 2003)
http://online.wsj.com/article/0,,SB105490099734075500.djm,00.html (sub req'd)

IBM SUPERCOMPUTER KEEPS AN EYE ON HURRICANES
The National Weather Service is touting the capabilities of its new IBM 
supercomputer, predicting that its enhanced computing power will enable it 
to forecast hurricanes and other weather patterns five days out, as opposed 
to the current three days. In addition, scientists hope that the new 
supercomputer will facilitate more accurate weather reporting. "The 
objective ought to be to get that to an understanding of 95% probability of 
rain (as well as) where, how much, etc." says Dave Turek, VP of IBM's deep 
computing unit. "Amplifying the precision of forecasts both in terms of 
advanced warning and (accuracy) has significant and material benefits to 
many segments throughout the U.S. economy." (CNet News.com 5 Jun 2003)
http://news.com.com/2100-1008_3-1013846.html?tag=fd_top

DISTRIBUTED COMPUTING MADE EASY
Berkeley scientist David Anderson has devised a cheaper and easier way to 
write distributed computing software, paving the way for more projects that 
rely on the combined power of millions of idle computers to seek solutions 
to some of life's mysteries -- such as a cure for cancer or whether there's 
extraterrestrial life out there. About a dozen research projects now depend 
on distributed computing, but up until now the software needed to exploit 
the unused power of volunteers' PCs has been expensive and time-consuming 
to create. Anderson's open-source software will eliminate those barriers. 
"The more projects that start using distributed computing the more people 
will be interested in lending their computers for research," says 
Anderson.(Popular Science Jun 2003)
http://www.popsci.com/popsci/computers/article/0,12543,454648,00.html

PUBLISHING THE SQL SLAMMER CODE: TRAINING OR EDUCATION?
Wired magazine has decided to include the code of the SQL Slammer worm to 
educate its readers on how worms work and how they cause damage. (SQL 
Slammer shut down Internet service providers in South Korea, disrupted 
plane schedules, and jammed ATM bank machines.) Symantec security director 
Vincent Wheeler warns that the publication of such code is "something you 
need to be cautious of, particularly in a broad-based magazine. You need to 
be aware of your audience and what you're saying to them." Blaise Zerega, 
Wired's managing editor, says that "the people who are in a position to 
wreak havoc on the Internet don't have to read about it on Wired." 
(Reuters/USA Today 6 Jun 2003)
http://www.usatoday.com/tech/news/2003-06-05-wired-runs-slammer_x.htm

POLITICS BY MODEM
Presidential aspirant Howard Dean is hoping that aggressive use of the 
Internet can bolster his candidacy, and efforts to build a grass-roots 
political organization. Earlier this week Dean supporters congregated at 
259 meeting sites throughout the country and learned how to sell their 
candidate over the Internet: "When you make your pitch, make it very 
personal," advised technology consultant Thatcher Williams. But Drake 
University political science professor Dennis Goldford thinks the future of 
Internet campaigning isn't quite here yet: "In 50 years it may be 
effective, maybe even in 25 years." Howard Dean is not willing to wait that 
long before he gives it a try. (AP/San Jose Mercury News 6 Jun 2003)
http://www.siliconvalley.com/mld/siliconvalley/6029239.htm

ANDREW SULLIVAN SAYS: 'THE INTERNET DID IT'
Prominent blogger-journalist Andrew Sullivan, former editor of the New 
Republic magazine, says that the Internet should be given much of the 
credit for forcing the resignation of top New York Times editors Howell 
Raines and Gerald Boyd: "Only, say, five years ago, the editors of the New 
York Times had much more power than they have today. If they screwed up, no 
one would notice much. A small correction would be buried days, sometimes 
weeks, later... The blogosphere in general created a growing chorus of 
criticism that helped create public awareness of exactly what Raines was up 
to." Sullivan quotes a letter from one of his readers: "Now in newspaper 
journalism, as in so many other traditional industries (real estate, 
banking, computers, retail sales, airlines, travel, etc.), we see that the 
Internet strips away discretion, power and secrecy. It is very hard to 
withstand the forced transparency induced by this new technology." To which 
Sullivan adds: "And you ain't seen nothing yet." (The Daily Dish 6 Jun 2003)
http://www.andrewsullivan.com

*****

FLASH CARD
      "There's a moment coming. It's not here yet. It's still on the way. 
It's in the future. It hasn't arrived. Here it comes. Here it is… It's gone.
(George Carlin)

SAFE & SOUND IN THE CYBER AGE
      This week our security correspondents Chey & Stephen Cobb pick up 
where they left off in the last issue:
                       ...
"YOU SAY TIA, I SAY GENOA"
      Let's call the whole thing off. But seriously, we had several 
interesting responses to our last column, which described TIA (Terrorism 
Information Awareness, formerly Total Information Awareness, see NewsScan 
May 30, 2003). We appreciated your comments and felt we needed to use a 
couple more columns to clarify some of the many points we raised.
      First of all, we may have given the impression that TIA is a 
hypothetical, something that might happen. In fact, the first component of 
the system has already been delivered to the government under the project 
name "Genoa." Work is currently under way on the next level, "Genoa II." 
For more on this project, and a sense of just how many buzz words you can 
fit in a sentence, see www.darpa.mil/iao/GenoaII.htm. For a better sense of 
how such projects come about, we will draw on Chey's experience in the 
intelligence community (note: absolutely no official secrets are revealed 
in what we are saying).
      Projects like TIA/Genoa often start as the bright idea of some 
government contractor or project manager. Quickly the idea becomes a 
prototype. The developers work on the prototype with hopes of convincing a 
government agency to give them funding and a contract to go to the next 
stage. They give the government officers a gee-whiz dog-and-pony show about 
the prototype. Sometimes they get the thumbs-up for further development. 
Because no "requirements" are identified prior to development, the 
requirements are written to match what has already been created. There is 
little oversight of these "rogue" developments (which is an unofficial 
government secret, the kind that needs to be exposed).
      When Chey worked as a security officer for an intelligence agency, 
she would often uncover rogue projects as part of her job. She then had to 
make them submit to a security review. Typically, they failed the review 
because securing them would either be a cost-prohibitive nightmare or a 
technical impossibility. Since the government has pretty much abandoned 
coding its own systems, the rogue systems tended to be a hodge-podge of 
commercial software and freeware found on the Internet. Despite these shaky 
underpinnings, many developers fully expected to be given the go-ahead just 
because of the really cool gee-whiz factor (Chey would be the first to 
admit that some of these projects were indeed very cool, but that cool is 
not the same as "worthwhile" or "feasible").
      We don't know if Genoa started out as a rogue project or not, but it 
seems to fit the pattern. Consider TIA/Genoa's need to pull data from 
banks, airlines, car rental agencies, real estate companies, manufacturers, 
gun sellers, and countless other sources. The pull of data will need to be 
"one-way" to ensure that the data flows into a "secret" system and stays 
there, with no way to leak out, and no possibility of an attacker riding in 
on that data flow (an "allowed path attack" to use the term coined by our 
friend and fellow CISSP, David Brussin). Frankly, we have yet to see a 
one-way connection into a network that can't be used to infiltrate that 
system, or that can't be "broken" to allow the data to flow back out. Even 
David, who has designed some of the most secure commercial systems yet 
deployed, will tell you that it's all about resources versus risk.
      David will also tell you, and we concur, that high-end commercial 
systems such as stock brokerages tend to be a lot more secure than 
government systems. That is because commercial systems have always had to 
address the challenge of securing data while sharing data. Until recently, 
most "secure" government systems were in bunkers, isolated and impregnable, 
secure but unable to share. Sharing information while tightly controlling 
access to that information is a daunting challenge which you cannot hope to 
meet unless you exercise a lot of discipline and restraint, qualities all 
too often lacking in rogue projects driven by political agendas and 
inflated expectations (we suspect the amount of discipline and restraint in 
a project is in inverse proportion to number of buzz words used to describe 
it).
      Discipline and restraint are not abstract qualities when it comes to 
running a multi-billion dollar company. Exciting and potentially profitable 
gee-whiz network projects actually do get cancelled because the data cannot 
be adequately protected and the risks are judged too great. That reflects 
both discipline and a healthy respect for the people whose data you have 
been entrusted to protect. So, are we comfortable that TIA/Genoa will be so 
secure that our personal data won't find its way to non-governmental hands? 
No.
      But what about the fact that we are in a war against terrorism? 
Doesn't that mean the risks of personal privacy violation are an acceptable 
price to pay for greater personal security? Our response is: Show us the 
security. We don't think TIA will improve security and so we don't think it 
is worth the risk. In our next column we will detail why.
      [Chey Cobb, CISSP, the author of "Network Security for Dummies," is 
an independent consultant (www.cheycobb.com) and a former senior technical 
security advisor to the NRO. She can be emailed as chey@patriot,net. 
Stephen Cobb, CISSP, developed computer programs to audit oil companies in 
the early eighties. More recently, he helped develop SpamSquelcher to fight 
spam. He can be emailed as scobb,eprivacygroup.com.]

SUBSCRIPTION INFO FOR NEWSSCAN DAILY:
      To subscribe or unsubscribe to the text, html, or handheld versions 
of NewsScan Daily, send the appropriate subscribe or unsubscribe messages 
(i.e., with the word 'subscribe' or 'unsubscribe' in the subject line) to 
the addresses shown below:
      Text version: Send message to [email protected]
      HTML version: Send mail to [email protected]
      NewsScan-To-Go: http://www.newsscan.com/handheld/current.html

TELL YOUR FRIENDS ABOUT NEWSSCAN DAILY! Send them our little frog: 
http://www.newsscan.com/newsscan/newscup.html

***********************************************************
Please visit the site of RLG, the great organization that makes NewsScan 
Daily possible. (RLG has no influence over, nor any responsibility for, our 
editorial content.) Created in 1974 as the Research Libraries Group, RLG is 
a not-for-profit membership corporation of more than 160 universities, 
national libraries, archives, museums -- and other institutions with 
remarkable collections for research and learning. Its major initiatives are 
long-term retention of digital materials, resource sharing among member 
institutions, and improvement of researcher access to primary source 
material. RLG supplies online research resources worldwide. Visit RLG at 
http://www.rlg.org.

*********

To subscribe or unsubscribe to the TEXT version of NewsScan Daily, send an 
e-mail message to [email protected] with 'subscribe' or 'unsubscribe' 
in the subject line. To subscribe to our HTML version of NewsScan Daily, 
send mail to [email protected], with the word 'subscribe' as the 
subject. (Subscribing to the HTML version won't automatically unsubscribe 
you from the text version; please unsubscribe yourself as explained above.) 
Please note: To unsubscribe from an account to which you no longer have 
access, send mail to at [email protected].

*********

We call our news section "Above The Fold" to honor the tradition of the 
great "broadsheet" newspapers in which editors must decide which news 
stories are of such importance that they should be placed "above the fold" 
on the front page. The NewsScan Credo: Be informative, have fun, and get to 
the point! See http://www.newsscan.com/, and send us mail: John Gehl 
<[email protected]> and Suzanne Douglas <[email protected]>, or call 
770-704-7517.

*********

Get a free 6-week trial subscription to Innovation Weekly, an executive 
summary of trends, strategies and innovations in business and technology. 
Send mail to [email protected] with the word 'subscribe' in the 
subject line.

What customized news and information services do you need for your company? 
Get in touch with us at [email protected] or call 770-704-7517 to talk 
over the possibilities.

Copyright 2003. NewsScan Daily (R) is a publication of NewsScan Inc.
***********************************************************