Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!


Forgot your password?
Privacy Security

Grad Student's Work Reveals National Infrastructure 662

CodeHog writes "The WP reports about a student working on a PhD and how it relates to national (US) security. Very interesting that he has been able to get all this information. It raises some very challenging questions, should some of this information be classified?"
This discussion has been archived. No new comments can be posted.

Grad Student's Work Reveals National Infrastructure

Comments Filter:
  • Well.. (Score:5, Funny)

    by Gortbusters.org ( 637314 ) on Tuesday July 08, 2003 @11:08AM (#6391567) Homepage Journal
    In the background, he plays the Beastie Boys.

    He's got the right to party!
    • Re:Well.. (Score:5, Funny)

      by reverseengineer ( 580922 ) on Tuesday July 08, 2003 @11:38AM (#6392002)
      Given his research, wouldn't Sabotage be a more appropriate track?
    • by bwhaley ( 410361 ) * <spam4ben AT gmail DOT com> on Tuesday July 08, 2003 @12:19PM (#6392473)
      The implications, however, in the post-Sept. 11 world, were enough....

      In this post-September 11th world, I'm getting REALLY sick of that phrase.

      • by Ninja Programmer ( 145252 ) on Tuesday July 08, 2003 @03:27PM (#6394445) Homepage
        Every time someone says or writes "post-Sept. 11 world" I am reminded that Al Qaeda's attack was more successful beyond their wildest imagination. I am reminded of our failure to acquire Osama Bin Laden, our failure to create a global unified front against terrorism, our failure to destroy Al Qaeda, and our continued reliance on the FBI, CIA and NSA, who have demonstrated an inability to do anything about these terrorist attacks.

        The only way to beat the terrorists, is to show that were will not change as people despite their best efforts. But every time I read or hear that phrase -- its like we are *complicit* in wanting Al Qaeda to win.
      • by fr2asbury ( 462941 ) on Tuesday July 08, 2003 @05:54PM (#6395813)
        Yeah, last time I checked it was early July. I'd say this is a PRE-September 11th world.
  • by Jeremy Erwin ( 2054 ) on Tuesday July 08, 2003 @11:09AM (#6391577) Journal
    I can't figure out how to download his dissertation. I want to judge for myself whether "tedious and unimportant" is an apt description.
  • by Anonymous Coward on Tuesday July 08, 2003 @11:10AM (#6391589)

    You're either "land of the free", or you are not. So either live up to the hype, or change the tagline. Can't have it both ways, with a closed society fueled on fear, claming to be "free".


    • by rose_bud4201 ( 651146 ) on Tuesday July 08, 2003 @11:24AM (#6391806) Homepage Journal
      Frankly, I'm on your side...keeping some of the stuff he used to generate his maps classified would knock some information which is really very handy from the public use - things like the shipping/loading dock information that he mentioned (would a prospective company have to go through clearance procedures to find out whether shipping their goods through a given area is worthwhile??), like ISP bandwidth and routing information, and the depth of cable trenches (would telephone or paving companies also have to be cleared before putting in a new pole or rebuilding a road?) "It gives us a great thrill," Young said. "If it's banned, it should be published. We like defying authority as a matter of principle." That, I think, is a little extreme, but there are some things which can't be pulled from the public domain without wreaking havoc on the people dependant on them.
    • by dboyles ( 65512 ) on Tuesday July 08, 2003 @11:37AM (#6391994) Homepage
      You're either "land of the free", or you are not. So either live up to the hype, or change the tagline. Can't have it both ways, with a closed society fueled on fear, claming to be "free".

      That's a huge oversimplification. I wouldn't even respond to such a troll had some ill-informed moderators not decided to mod it up to a 5 and make it the first comment on the page.

      Ideally, information becomes classified when the benefits of the information being publicly available are less than the dangers of that availability. Here at the university where I work, when I need to get a list of students in my department, I can't just call up and request it. I have to be authorized to have it. In that case, the extra day it takes to get the information is justified because we don't want just anybody to have access to that sort of information.

      On the flip side, we have the Freedom of Information Act. It has been decided that certain information should be available to the public without such restrictions. In this case, the public benefit outweighs the negative aspects of the FOIA.

      To suggest that the "land of the free" entails zero security is simply ignorant.
      • Indeed. You cannot be free if you do not have any security.
      • by sphealey ( 2855 ) on Tuesday July 08, 2003 @11:49AM (#6392147)
        Ideally, information becomes classified when the benefits of the information being publicly available are less than the dangers of that availability. Here at the university where I work, when I need to get a list of students in my department, I can't just call up and request it.
        A few questions:
        • Who makes that determination?
        • Who reviews the decisions of the determining body and enforces penalties if the decisions are not in the best interests of the citizens?

          Given Pournelle's Law of Bureaucracy ("regardless of the reasons for which they are established, the top priorities of bureaucracies are to survive and to grow") who determines what controls are placed on those doing the classifying?

        Not "trolling" - just asking.


      • by rossjudson ( 97786 ) on Tuesday July 08, 2003 @12:02PM (#6392301) Homepage
        You have responded to an oversimplification by making another, far more dangerous simplification.

        Your ideal is that we classify when the benefits of information being available are less than the dangers. Who exactly makes this determination? What subject matters are subject to this?

        When we deal with information that is dangerous by "hiding" it, what we really do is shift resources away from solving the underlying vulnerability. Sometimes the vulnerability isn't solvable, but much of the time it is.

        With Gorman's work, he is highlighting choke points in the infrastructure. Would the rational response to this situation not be to diversify off those choke points? We should identify key weaknesses with this kind of research then solve them. We should not simply hide the information.

        First principles also apply here: I find myself somewhat in agreement with one poster who indicated that we should quit "stomping" around the world creating enemies. It is far easier to defend against an enemy you do not have.

        FOIA and classification are unrelated. FOIA is generally used to punch holes through government bureaucracy; to get at information that should be available to the public but is obscured by red tape. Classification contains information that should not be available to the public. Some FOIA requests come back redacted for security reasons.

        It is far too easy for an administration to simply designate information as confidential. Such designations can and are used to avoid information release that would be politically senstivie. The bar is too low.

        As with so many other things, it comes down to "who decides"...
        • by Wakko Warner ( 324 ) * on Tuesday July 08, 2003 @01:32PM (#6393214) Homepage Journal
          The scary/sick/sad part of all this is that Gorman got every piece of information from the Internet and other publically-available sources. The fact that a grad student working with a single research assistant was able to construct something like this should certainly ring alarm bells, but it's sheer idiocy on the part of the government and private corporations to demand he hand over his collection of information, or that it be classified. It's even more asinine that they aren't interested in the kind of insight such a system can provide. If one man working alone was able to create a system of this complexity and detail, it's logical and safe to assume that others (including scary evil people who aren't Americans) have done so, as well, and are probably using it to their advantage.

          Should we, then, go about the process of finding and destroying all systems similar to Gorman's? Obviously, this is unrealistic because we don't know who else has created one. We should assume others have been created, though. The only correct course of action is to use systems such as Gorman's for their intended purpose: to identify points of weakness in our infrastructure and, from there, eliminate them.

          That the government and corporate America haven't jumped at this opportunity to discover and eradicate these points of weakness but instead have attempted to eradicate the system which can be used to find such weaknesses should fill one with a sharp sense of dismay. It seems incompetence and information-hiding is the way we've chosen to go about ensuring our national security; I have a strong feeling this will come back to bite us in the ass, and I've no remorse for those who stand to lose billions from such an attack yet seem to have no interest in doing anything to prevent it. I only hope the human toll of such an attack is negligible.
      • by freuddot ( 162409 ) on Tuesday July 08, 2003 @12:19PM (#6392474)
        I don't usually answer people signatures. However, given that yours is :

        "Complacency is a far more dangerous attitude than outrage." -Naomi Littlebear

        And that your first sentence is :

        That's a huge oversimplification. I wouldn't even respond to such a troll had some ill-informed moderators not decided to mod it up to a 5 and make it the first comment on the page.

        I must say that this is a very nice display of consistency.
      • is that he has it in one convenient package... Kindof a Terrorist to-do list. When you think about it, this is really just turning the tables on the privacy debate.

        Conpanies (i.e. financial institutions) don't mind compiling scads of public information on us until they can tell what brand of hemorrhoid cream you use, but when we do the same thing to them, they scream bloody murder.


        If you locked up all of the infomation he's compiled, you'd shut down the Economy just as effectively as using that same infomation to blow up critical infrastructure points. The real point of his data is that he also allows the good guys to see just whwre the choke points are so that they can design backup plans and structures.

        As Ghandi said (and I'd bet he'd be on the terrorist watch list if he was doing his work today).

        I'd rather let my enemies know exactly what I'm doing and hope that they overreact

        Now, at least, these companies are clear that they need to get their ISPs to use different fiber lines to deliver their data. It's not like they couldn't have known this before. It's just that now they have it at their fingertips.
    • EXACTLY.

      It's not really that big a deal, people HAVE to know where the wires are, where the pipelines are, etc, so they DON'T DIG INTO THEM AND DIE!

      Ever see a gas pipe explosion because someone dug in the wrong spot and the crew burned to death? Or how about a town losing all of it's emergency and other communication because a cable got accidentally cut?

      We have a 2nd amendment for a reason. Try using it and stop living in fear.

      • We have a 2nd amendment for a reason. Try using it and stop living in fear.

        I can't figure out if you've gotten your amendments confused or if you're advocating armed revolt..?

        1st Amendment: Freedom of speech.
        2nd Amendment: Right to keep and bear arms.
  • by kcornia ( 152859 ) on Tuesday July 08, 2003 @11:10AM (#6391596) Journal
    After this kind of publicity, he'll have some job offers coming in, I guarantee it.

    I'd tell 'em to classify it all they want, just looks BETTER on the resume...
    • by garcia ( 6573 ) * on Tuesday July 08, 2003 @11:37AM (#6391991)
      do you honestly think that EVERYONE with a PhD is in it for the job market? If you do, you're fucking crazy.

      I know PLENTY of Professors that were interested in Academia because they enjoyed research and teaching not because of the "high-paying" jobs they had after getting their PhD.

      He's worked hard on his research and doesn't want it to get seen by him, his professor, and a few miscellaneous others. He wants to be proud and publish his results...

      You are making his work seem trivial and it's not.
    • by SoSueMe ( 263478 ) on Tuesday July 08, 2003 @11:41AM (#6392051)
      "...It's hard to put 'classified' on your list of publications on your résumé."

      Actually, it would be easy for me to put "classified" on my list of publications on my résumé. It is just the "mostly as bullshit" part that wouldn't do me any good.
  • by bc90021 ( 43730 ) * <{bc90021} {at} {bc90021.net}> on Tuesday July 08, 2003 @11:11AM (#6391598) Homepage
    For instance, this is not the first time Sean Gorman has been talked about:

    Article in Science Daily [sciencedaily.com]

    Plus, someone with the same email address has posts in rec.sports.rowing...

    The bottom line is that if you know where to look, you can find out lots of stuff. Classifying this guy's dissertation isn't going to prevent someone else (from anywhere on the planet) using the same tools he did to do the same things he did.

    We either have to control all information (hello, Mr. Orwell!) or accept that information can't be controlled and plan accordingly. It's been said many times before, but security through obsucrity just doesn't work.
    • by TopShelf ( 92521 ) on Tuesday July 08, 2003 @11:17AM (#6391702) Homepage Journal
      At least what this has prompted is a panic attack amongst some CIO's out there, who now understand that 1) too much information has long been left in the public domain, and 2) critical infrastructure security has been neglected for far too long.

      Once you can shock the CEO's and CFO's into understanding that a genuine business risk exists out there, action can take place. I think far too many people assumed that the telco/networking companies had this all figured out...
      • by jobugeek ( 466084 ) on Tuesday July 08, 2003 @11:39AM (#6392009) Homepage
        While I hope the bell went off in their heads, that something needs to be done, my guess is that they will instead over-react and try to restrict the public's access to even more information.(whew, long run-on.)

        The smartest thing they could do, is use his information and go through each weakness and look to secure it as much as possible. Many of them may look at that as cost prohibitive and just try to obsure the information and hope no one finds it.

    • by SirWhoopass ( 108232 ) on Tuesday July 08, 2003 @11:26AM (#6391843)
      We either have to control all information (hello, Mr. Orwell!) or accept that information can't be controlled and plan accordingly. It's been said many times before, but security through obsucrity just doesn't work.

      Security through obscurity alone doesn't work, but that doesn't mean that obscurity isn't important too. It's not like the fiber connections to the New York Stock Exchange run through a box on the street with an "off" lever. They're underground. But that doesn't mean the NYSE should put the exact location on their web site.

      If you look at how the military handles classified information you'll note that in order to access information you need both the proper clearance and the "need to know". That means that just because you have a top secret clearance because you work on stealth fighters doesn't mean you get to see the top secret photos of North Korea's nuclear reactors. You have the proper clearance, but you don't have the need to know.

      The main issue isn't (or shouldn't be) about classifying this guy's thesis. The issue is why all this imformation was so freely availble in the first place and whether power companies, telecoms, etc. should look at restricting access to certain types of data.

      • Security through obscurity is NOT "security" at all, because it's impossible to know what the other guy knows.

        In fact, STO is WORSE than NO security because it leads to a FALSE sense of security.

        This weekend I took a ferry to Long Island and I used my GPS to record my track. As I was doing so it occured to me that my activity could be considered suspicious, and suddenly I got very nervous about using my GPS on the ferry. What the fuck kind of country are we living in now? Why should ANYTHING _I_ do be con
    • by Surak ( 18578 ) * <surak.mailblocks@com> on Tuesday July 08, 2003 @11:51AM (#6392181) Homepage Journal
      You'd be surprised at how easy it is to penetrate the security of a lot of facilities.

      For instance, I worked in one somewhat secure facility that requires ID bages with magnetic stripes to get in and out.

      Only thing is, they had one door to the facility that didn't have a card reader attached to it. It was for the union guys that worked in the shop, who according to contract, could not be required to swipe an ID badge.

      Which is fine, because to get into any place but the shop you have to have a card swipe anyway.

      Only thing is, the doors between the shop and the badge-secured office area were kept open more often than not. And even if they weren't there was one interior door that you could use to access the service tunnel that wasn't carded either.

      So you could walk into the service tunnel. Once there, you could get into the badge-coded office area because the doors near the elevator that takes you to the office area had to be kept open for ADA compliance (a wheelchair user couldn't be expected to swipe their card and open the door, apparently)

      So once in the elevator, you were free and clear. You just got in the building without a single card swipe. And though there are cameras, anyone walking around with anything that looked *close* to the visible badges around their neck/clipped to their lapel, etc. were ignored.

      I simply observed my surroundings and in less than a day of working there, I knew how to get in and out of the facility without going through security. Even if I left my security pass at home, I could get in and out, no problem. I've noticed similar scenarios in hospitals or banks other places where tight security is supposed to be the rule but the people working there just don't think this stuff through.

  • by tiled_rainbows ( 686195 ) on Tuesday July 08, 2003 @11:12AM (#6391609) Homepage Journal
    I work for Transport for London (Transport Authority in London, UK, duh), and, after 9/11 my boss asked me to print out a huge map of the city and put a little sticky label over every "potential terrorist target". Buckingham Palace, Houses of Parliament, the big wheel thing, ministry of defence, big office blocks, army barracks, more palaces....
    After three hours I was running out of sticky labels and was very scared.

    But hey, look on the bright side, maybe it'll never happen!!!
  • by albin ( 52375 ) <iamNO@SPAMtheonlyonewhocares.com> on Tuesday July 08, 2003 @11:12AM (#6391613) Homepage
    You cannot keep information like this secure forever, or even very long. Someone will always have this information. The question is, will we allow the US government to to deprive us of our liberties to the extent that the gov't really can keep this information for ourselves, and only let it out when it's in their interest for a building to get bombed, or do we fight to keep information free?

    People who claim this information is a security risk are looking at things the wrong way round.
    • If information wanted to be free, it'd have a will or method of making itself known.

      Also, the gov't witholds certain information for our own safty. You don't want people panic'd and making situations worse. It doesn't justify keeping all information classified, but it does justify keeping some of it.
  • by Noryungi ( 70322 ) on Tuesday July 08, 2003 @11:12AM (#6391624) Homepage Journal
    Is what kind of database and what kind of software he has used to create the program that is the basis of his PhD.

    On a more serious note, I think his work is great. While it certainly has serious security implications, it could also be used by ISPs, telcos, power companies, etc. to disseminate information on outages and/or find the root causes of problems.

    Ah, well... I suppose we'll never see the results... but I do hope he gets his PhD.
    • I suspect he's using several tricks to discover correlate IP addresses to services providers, to businesses to physical locations and superimposing that data on a traditional map. The geographical info is available from many sources; the trick is tieing all that info together to form a coherent 'big picture'.

      Some info on discovering the physical location of a IP address (or multiple IP's in order to form a physical route map) is available here [private.org.il]

      Interesting that there is an extension to DNS as described in
  • Dark undertone (Score:5, Interesting)

    by Gortbusters.org ( 637314 ) on Tuesday July 08, 2003 @11:12AM (#6391626) Homepage Journal
    Did anyone else think that this article had a dark undertone of government and corporerations looking to lock down information in the name of security. I mean, some of this information is important and may have benefits to the general public.

    The scariest line is that they wanted to burn his research. Flash backs of 1984 flashed in my mind.
  • Not all evil (Score:5, Interesting)

    by Azghoul ( 25786 ) on Tuesday July 08, 2003 @11:12AM (#6391627) Homepage
    Some people might wonder why in the world you'd need to have maps of electrical grids and fibre lines...

    I'm working on the periphery of the emergency response industry, and suffice it to say, any infrastructure data is vital as hell for responding to major natural disasters like quakes, hurricanes and tornadoes.

    Tossing all this "scary" data into the classified domain will hammer on emergency responders' ability to effectively map this stuff.

    It's vital, and I think the anti-"security through obscurity" comment in the article hits the nail on the head...
    • Re:Not all evil (Score:5, Insightful)

      by kawika ( 87069 ) on Tuesday July 08, 2003 @11:32AM (#6391923)
      Plus, the people who have allowed stupid things to happen (like a single choke point for the information flow of 25 companies) don't like that problem being revealed. I worked for a telecom company in the 1980s that was supposedly providing a redundant link for an AT&T leased line. One day a backhoe cut through the line and our customer found out the ugly secret--we leased OUR line from AT&T, and their "redundant link" went through the same piece of cable!

      Instead of hiding this info for "national security" reasons, these maps should be analyzed to death by a program to find and eliminate these kind of problems, or at the very least let companies understand and anticipate these risks.
  • by fuzzeli ( 676881 ) on Tuesday July 08, 2003 @11:13AM (#6391633)
    It's very interesting the way that an assemblage of publicly available information is suddenly a matter of national security. This must be based on the assumption that evildoers are never grad students.
    • I work for Sandia National Labs as a student intern. In August student interns are required to present the projects they've been working on during the summer at a symposium. Each project has to be checked because say a student is working on an airplane lets say or some sort of technology to cover the airplane...well if the student mentions in his presentation that this technology could possibly be used to make an invisible skin for airplanes that presentation all the sudden becomes a classified discussion o
  • by bdhein ( 456277 ) <brendanedhein&gmail,com> on Tuesday July 08, 2003 @11:13AM (#6391647) Journal
    From the article, all of the data he compiled was obtained from public sources. If anybody else wanted to replicate the work, it would only take their time. I'd imagine that you could get all the information you need through public records for building permits and right of way use. I mean, squelching the person who took the time to compile it all isn't going to do much good unless you classify every public record the US has for infrastructure.
  • by Lagged2Death ( 31596 ) on Tuesday July 08, 2003 @11:14AM (#6391651)
    "Tedious and boring?" He's got an application that can actually do some of the stuff Hollywood hackers have been doing for years. How could anyone think that's boring?

    "Tank, find a structural drawing of this building. Find it fast."
  • by hndrcks ( 39873 ) on Tuesday July 08, 2003 @11:15AM (#6391666) Homepage
    In a word, No.

    Those who would exploit it for ill already have the data, or can easily obtain it. Classsifying the data now would only hide it from those with reasonable use; and would allow for mistakes or security lapses to be covered up.

    If you don't think authorities - whomever they might be - won't abuse the privlege of 'classifying' data, then you have some big surprises in store...

    • by garcia ( 6573 ) * on Tuesday July 08, 2003 @11:29AM (#6391883)
      Those who would exploit it for ill already have the data, or can easily obtain it.

      Exactly. Should we make flying lessons only for military pilots? Wasn't that what Bin Laden had his militants use when they attacked us?

      We are so afraid of this high level of technology being used against us yet the terrorists are using what we consider to be the lowest common denominator to hurt us.

      They could have found explosives on the web, or in books, or talked to experts in person, but instead they took flying lessons...

      So now we are going to ban research, prosecute those that use encryption, and FUD our children to death in schools over this crap.

      Great, soon the kids will be hiding under desks because the Turtle on the DVD said it would protect them from the terrorists...

      Just think about it.
  • Maybe... (Score:5, Funny)

    by vasqzr ( 619165 ) <vasqzr@netsCOBOLcape.net minus language> on Tuesday July 08, 2003 @11:15AM (#6391679)

    With all this information, maybe he can tell me when they're going install my damn DSL line...
  • Publish or Perish (Score:5, Interesting)

    by Foochar ( 129133 ) * <foochar@g m a i l .com> on Tuesday July 08, 2003 @11:16AM (#6391689) Journal
    The other interesting thing this brings up is the student's right to earn a living and do what he enjoys vs. the national security implications of this. Like he says, putting classified down on a resume doesn't get you very far, especially outside the Military/Intelligence arena.

    The other thing is that, yes, he did put all of the together, but according to the article the raw data he used is all available on the internet. Who's to day that Al Qadea hasn't hasn't already done the research to create their own version of his map. In that case this work could very well prove to be a map of what to defend.
  • Yes but... (Score:5, Insightful)

    by Anonymous Coward on Tuesday July 08, 2003 @11:16AM (#6391691)
    Correlating information is what gives you the bigger picture. Sure, it might be a secuirty threat as a whole, but it's been made up of snippets of information gleaned individually that probably aren't much use on their own.

    Same as a bomb really, component parts are pretty common; chemicals, circuitry. It's about knowing how to connect stuff together to make it a bomb. 9/11 was flying lessons, plane timetables, GPS and box cutters. Each on their own is pretty harmless until you join the dots...

    Same with information, connected together in the right way, it's just as dangerous. Ask the CIA or any intelligence agency...
  • Tom Clancy's work (Score:5, Interesting)

    by boomerny ( 670029 ) on Tuesday July 08, 2003 @11:17AM (#6391701)
    the same questions have been asked about some of Tom Clancy's work. I remember reading that he was paid a visit by the FBI asking where he got his classified information, only it turned out everything he used was publicly available. My thought is that suppressing information will not prevent terrorism, only when would-be terrorists change the way they think of the free world will it stop. /rant
  • Similar website? (Score:3, Interesting)

    by diegoq ( 149586 ) on Tuesday July 08, 2003 @11:17AM (#6391717) Journal

    The article mentions an interesting website:
    Toward the other end of the free speech spectrum are such people as John Young, a New York architect who created a Web site with a friend, featuring aerial pictures of nuclear weapons storage areas, military bases, ports, dams and secret government bunkers, along with driving directions from Mapquest.com. He has been contacted by the FBI, he said, but the site is still up.
    But even with the wonderous google I am unable to find the website that they are talking about.
    Anyone know of it?
  • Sigh. (Score:5, Insightful)

    by Billy Bo Bob ( 87919 ) on Tuesday July 08, 2003 @11:19AM (#6391739)
    Is everyone forgetting that a part of the price of freedom is safety? An open society is a vulnerable society in some ways. The same vulnerability keeps society safe from itself and its own excesses.

    Of course if we classified everything like this no one would have a road map to destruction. But they could still poison the water supply, blow up buildings and cause untold grief. They could still locate some of the bottlenecks themselves and exploit them.

    Like so many things the government/corporations seek to classify, the real people they don't want to know are the ordinary people. It puts me in mind of the many "the area bombed last night is classified...we don't want to give the enemy important information" remarks we see. Like the enemy doesn't know they were bombed...
  • by tigersha ( 151319 ) on Tuesday July 08, 2003 @11:20AM (#6391756) Homepage
    When Tom Clancy published the Hunt for Red October the US Navy wanted to nail him because they thought he stole some confidential info about their submarine ops.

    It turned out that he got all his info from public domain sources. And they could not do much about it. He just knew where to search.
  • by ab762 ( 138582 ) on Tuesday July 08, 2003 @11:20AM (#6391760) Homepage
    As a long-time reader of comp.risks (archive here [ncl.ac.uk]) I remember a lot of problems caused by "redundant" connections that were all routed over the same fiber. I believe that this showed up in the 1999 Hinsdale fire [ncl.ac.uk] amoungst others.

    Gorman's work and the access he used is vital - if I'm paying for two links that should be separate, I need to know that I can really check that we have separated physical facilities.

    There are a lot more backhoe operators than terrorists - and historically, the chances of a backhoe impact on infrastructure are pretty high.

  • by amorico ( 40859 ) on Tuesday July 08, 2003 @11:21AM (#6391766)
    I do not understand why the information would be classified. Our national highways are critical infrastructure, without which we would all be brought to a standstill, yet maps of them are readily available online or at any bookstore.

    Could you imagine if the locations of communications infrastructure were classified? Would you need clearance to set up a node? Would you need to pay to have every line technicican get a full background check? This reminds me of the reaction of "security" people when they see WHOIS entries for their companies for the first time. Their foreheads are usually bruised for weeks because of the knee jerking. The first thing they want to do is take it down. They forget that a certain level of openness is neccesary for a system that benefits everyone.

    The whole point of a privatised distributed communications infrastructure is that a terrorist or enemy state cannot cripple the entire thing. Now if the people at banks and government insititutions have not done a good job of ensuring redundancy and disaster recovery then it's their own fault. The solution is to fix it, not suppress information about it.

    Obviously, no one recommends mailing al-qaeda a copy of the telecom/data infrastructure, but this exposes a major flaw with what's going on and we would be foolish to ignore it or suppress it.
  • Duh. (Score:5, Insightful)

    by NoData ( 9132 ) <_NoData_@@@yahoo...com> on Tuesday July 08, 2003 @11:22AM (#6391785)
    From the article:

    "This is why CEOs of major power companies don't sleep well these days," [CEO of power co. Pepco Holdings] Derrick said, flattening the pages with his fist. "Why in the world have we been so stupid as a country to have all this information in the public domain? Does that openness still make sense? It sure as hell doesn't to me."

    Because security through obscurity is just as brainless an alternative for the physical infrastructure as it is for virtual infrastructure.

    Hiding things doesn't make them safe. It makes them safe until found. With the added bonus of fostering the kind of clandestine, repressive, bitter societal climate that our govnt seems bent on pursuing these days.

    You want to protect something? 1) Make it less desirable as a target (i.e. take away people's reasons for attacking in the first place). 2) Build in redundancies to dilute vulnerability. 3) Monitor, patrol, survey in an open and visible manner

  • The Cukoo's Egg.. (Score:5, Interesting)

    by bigattichouse ( 527527 ) on Tuesday July 08, 2003 @11:24AM (#6391807) Homepage
    Cliff S. in "The Cukoos Egg" tails down a spy selling secrets to the russians. Most of the info he steals is *NOT* classified, but by having *ALL* the info, he can piece together something he doesn't know:

    1. New fighter being developed
    2. Contract awarded to company X
    3. Rifle through purchase orders for titanium and other strategic parts.
    4. Get shipping info on said parts
    5. now you know the facility where it will be built.
    6. find airline reservations from company in question
    7. look for engineers and test personell.
    8. find nearest test base from point of arrival.
    9. Fighter X will be built in location A and tested at location B, between arrival date and departure date.

    Needless to say, this is why more things have become classified since the early 80's

  • paranoia (Score:5, Insightful)

    by Kludge ( 13653 ) on Tuesday July 08, 2003 @11:25AM (#6391818)
    People are _SO_ freaking paranoid these days. Having access to a database like this could be enormously helpful to a great range of people. But all people think about is, "What will al Queda do with it?"

    Since 2000 about 3,000 people have died in terrorist attacks. About 175,000 have died in car accidents. About what should we be worried?
  • by tuffy ( 10202 ) on Tuesday July 08, 2003 @11:28AM (#6391864) Homepage Journal
    I really don't see how this pile of data is going to help a terrorist. Simply cutting off one or more bits of modern conveniences isn't going to bring society to its knees. If a bridge is destroyed, people will use another 'til it's rebuilt. If phone lines are cut, people will use the post office 'til it's fixed. If the power goes out, people will catch up on some sleep. If the water is contaminated, people will switch to bottled 'til it's safe again.

    Killing people causes terror, because nobody wants to get killed. Cutting off infrastructure causes annoyance, because it happens regularly already. And when it happens, people will get by like they always have.

  • Designed for this? (Score:4, Interesting)

    by Trurl ( 3494 ) on Tuesday July 08, 2003 @11:28AM (#6391870)
    I thought the whole point of the Internet, being a packet-switched network, was that it could survive damage... like from nuclear war.

    So now we're worried that a terrorist with a scissors is gonna bring it down?
    • by hankaholic ( 32239 ) on Tuesday July 08, 2003 @12:01PM (#6392299)
      Not "the Internet" as a whole, but if a city's telecommunications access is fed through a handful of isolated fiber lines, then yes, it's quite possible, and that's the point.

      My former employer owned one of the first ISPs in Pittsburgh (Pittsburgh Online/Webstation, since sold to Stargate), and once told an old friend who worked at the FBI an anecdotal story about how easily he could rob a given bank. It involved jamming the police band frequencies (easily done with equipment you could build yourself), and arranging an "accident" which knock out the telephone lines to the police station.

      When the dispatchers' lines were cut, you could walk into the bank and take your time, confident in knowing that even if the bank called 911 (or their security service made the call), the police could not be notified until communications were restored. The person most aware of the coincidence of the two outages (radio and telephone) would be the dispatcher, and they wouldn't be able to coordinate anything until you were long gone.

      I don't know what became of the situation, but I do know that my former employer ended up retelling his tale to some very interested higher-ups in the local FBI branch.
    • by mfarver ( 43681 ) * on Tuesday July 08, 2003 @01:21PM (#6393088) Journal

      I thought the whole point of the Internet, being a packet-switched network, was that it could survive damage... like from nuclear war.

      The original research into packet switched technologies was done with nuclear survivability in mind. The folks that built the internet however just took a good idea and ran with it. Since the internet was never designed to be a critical system, very little actual redudancy was built in. As the p2p system have found, its simplier to have "supernodes" where the majority of interconnection occurs. (I believe the internet has about 15 major points, Chicago, Mae West/Mae East, Dallas, New York, etc.

      As an aside, all the telecommunications for Milwaukee Wi run thru a massive phone switch in the basement of one of buildings downtown. To take advantage of this nearly every ISP or internet company is located in the same building. When power was interrupted to the building (flooding in the power transformers) nearly all of the ISP service, and a lot of phone service was interrupted.

      Does it matter, probably not. You'd piss off a lot of people, make a lot of sysadmins lives difficult, and life would continue. Infrastructure is a valuable part of a society, but people working for a common benefit is the part that matters.. and shy of killing everyone the only way to bring down society is to change every person's opinion.

  • Hopefully (Score:5, Interesting)

    by stomv ( 80392 ) on Tuesday July 08, 2003 @11:30AM (#6391899) Homepage
    He's able to leverage the data so that he can see gains (I'm thinking an entire career) while the folks that have lots to lose (banks, utilities, transportation, US gov) pay for him to help show their achilies heels and bottlenecks.

    If 25 telcos happen to be sharing the same 'pipe' of fibre, it may not be a terrorist that breaks that connection... regardless of who severs that line, it ain't good for the telcos -- and the telcos should be using his data to reduce risks.

    Insurance companies and actuaries for corporations and governments love this kind of stuff, as do operations research people. Tell me how much it'll cost to reduce risk to this level, or: I have $10,000,000 -- how can I spend it to ensure that the worst case scenario isn't as bad.

    Hopefully the information doesn't become classified; hopefully, it's used over the next few years to sure up the bottlenecks and other weak points, making the infrastructure far more robust in the following years.
  • by tbase ( 666607 ) on Tuesday July 08, 2003 @11:34AM (#6391950)
    ...between all the pieces of information being publicly available and all the information being publicly available.

    From most of the comments so far, it appears the majority of people seem to think that this guy's PhD took about as long to compile as mapping a route from coast to coast with MapQuest. Hello? I imagine there was quite a bit of work put into compiling this information, and that not just anyone would have the time, persistence or devotion to duplicate the complilation. So yes, there is a HUGE difference between the information being available scattered across the 'net and having it all compiled, cross referenced and searchable in one easily downloaded program.

    And IMHO, you most definitely can had a compilation of 100% publicly available information be classified as a threat to national security.

    And personally, I don't believe there is a "publicly beneficial" use for this info in its compiled form that couldn't be easily be satisfied with the publicly available pieces - if a link is severed, you only need the info for the area of the problem (where the tornado hit, for example), not for the whole country. And the utilities that would be effected and responsible for the repairs would have the info they need anyhow.

    I think the biggest value to the public of this information is the fact that it exists and that this can be done. The information itself is only important to those who would protect it or exploit it.
  • by Rogerborg ( 306625 ) on Tuesday July 08, 2003 @11:35AM (#6391958) Homepage


    And unfortunately must give up some of our rights to buy security, or the terrorists will have already won. As we know, FREEDOM IS SLAVERY.

    And it goes without saying - although it's been said many, many times recently by our dear Commander In Chief - that WAR IS PEACE.

    We must ignore those who would warn us against this [msn.com], and march into the brave new world of strictly one sided Total Information Awareness with flags waving and proudly chanting the pledge of subservience. As Jeb would no doubt tell us, Big Brother knows best.

  • by Ricdude ( 4163 ) on Tuesday July 08, 2003 @11:35AM (#6391971) Homepage
    Sometimes, small bits of information are not considered classified, when taken by themselves. However, when certain critical unclassified pieces are aggregated, the collection of information *is* considered classified. I believe this individual's work may qualify as classified information as just such an aggregate.

    Yes, anyone with the time and resources can duplicate the effort, but they'd have to duplicate the effort, and expend the resources. And that's the point. It's not a guarantee that the information will not be collected by adversaries, but there's no point in making it any easier to hand it over to them either.
  • Too Many Secrets (Score:5, Insightful)

    by Orne ( 144925 ) on Tuesday July 08, 2003 @11:36AM (#6391974) Homepage
    For the right price, you can just buy the data from Platts [platts.com] - power line rights of ways, water pipes, etc. Once you have the data, you can throw it into any GIS software [esri.com] (purchased for the right price). Example: you need to get the natural gas pipline information to the road repair crews, so when they dig they're sure they won't hit anything [go.com]... all this data used to be open, because noone thought you could do anything with it.

    So what if I know where the local 500KV transformer yard is located over the 3rd hill on the left, who in their right mind would want to damage it? Then we realized how many people in the world really aren't in their right minds... I'm not complaining that this data should be bottled up again; what was really lacking was the chain of custody of who accessed the data, and for what purpose.
  • by stubear ( 130454 ) on Tuesday July 08, 2003 @11:39AM (#6392024)
    "Grad Student's Work Reveals National Infrastructure"

    Oh my god, we have a national infrastructure? Quick, kill it. Get rid of it. Will somebody please think of the children?

    "Grad Student's Work Reveals National Infrastructure"

    It took a student earning their PhD to discover this? Should I be worried about the status of the University educational system?
  • by Damek ( 515688 ) <adam&damek,org> on Tuesday July 08, 2003 @11:40AM (#6392034) Homepage
    With all this concern over whether the "terrorists" should be allowed to know where all of our weak spots are, where is the concern for our real weak spot: creating more terrorists? If we could just figure out how to stop behaving so idiotically and stomping all over the world, we wouldn't have to worry quite so badly about being open with our information. Granted, there would still be people who want to do damage, but not nearly as many.

    An open, friendly society breeds safety simply by virtue of not pissing so many people off to the point where they want to do unsafe things. On the other hand, greed, power-lust and secrecy just breeds more conflict. With less secrecy, greed and power-lust become a lot more difficult to hide, and therefore more difficult to perpetrate. This information, as well as so much more, should be out in the open.

    Besides, if he got it, it already is, as has been pointed out.
  • Symptoms vs. Cause (Score:3, Insightful)

    by nicotinix ( 648645 ) on Tuesday July 08, 2003 @11:40AM (#6392039) Journal
    It strikes me as very odd, that we are so concerned about fighting the symptoms of terrorism rather then eliminating the cause.
  • The problem... (Score:5, Insightful)

    by pubjames ( 468013 ) on Tuesday July 08, 2003 @11:45AM (#6392097)
    The problem is that terrorism is all about using simple means to get effective results. It is practically impossible to prevent all possible types of terrorist attacks.

    If you've got an imagination, try thinking about what you would do if you were a terrorist. If you really wanted to create havoc, you wouldn't necessarily do it by stuff like cutting communications cables. What you would want to do is make the man on the street afraid to do basic everyday things. I've thought about it a bit (let me emphasise - just as an entertaining mental exercise!) and I think there are things that a single person or small group could do that would cause chaos in a big city. And they are things that don't require access to any particular technology. Relatively simple things. But I'm not going to post those types of ideas on a public forum like this.

    If there is one thing that September 11th should have taught us it is that terrorists don't need access to fancy technology. People are maybe going to slam me down for this, but I beleive one of the main abilities of an effective terrorist is a good imagination and - to use a cliche - the ability to think "outside the box".

    So what's my point? My point is that passing laws and banning things (and invading countries and dropping bombs) isn't the best way to combat terrorism.

    Terrorism is a symptom of a disease. You can try to combat the symptom, but it will never be cured if the disease is not cured. I always thought that they way Tony Blair and the rest of them tackled the Northern Ireland situation was very sensible. They did not take the easy route - the easy route is to say "we will not be influenced by terrorists", and "shoot to kill" - that was Thatchers approach. It didn't work. More recently, the actual disease has been tackled rather than the symptoms, and although there isn't peace in N.Ireland yet, things are much better now than they were a decade or so ago.

    I'm afraid that Bush is taking the "hard man" approach to terrorism like Thatcher did. I'm afraid that the war on terrorism is going to be a very long one.

  • He'll get a job (Score:3, Interesting)

    by tevenson ( 625386 ) <tevenson AT gmail DOT com> on Tuesday July 08, 2003 @11:51AM (#6392171) Homepage
    They make it sound like it will be hard for him to get a job because most of his dissertation won't be published. I think that's probably completely wrong.

    Even though it does suck that he can't release it in its original form; he'll have absolutely no problems finding a job. If that many large financial corporations were concerned about their communication infostructure surely one (if not all of them) are scratching to hire him.

    If all he wants is money and no real academic prestige this is great. Otherwise, it wouldn't be fun to be in his position right now
  • It used to be (Score:3, Informative)

    by ONU CS Geek ( 323473 ) <ian DOT m DOT wilson AT gmail DOT com> on Tuesday July 08, 2003 @12:09PM (#6392380) Homepage
    public knowledge that you could find a few rogue backhoe operators in Columbus, cut some copper and fiber on Compu$erve's network, and kill every credit card transaction in the US, as they all went through CS's network.

    Ask anyone who's been a phone guy. We don't fear lusers, we don't fear over-zealot bosses, we fear backhoes.

    I also have a real problem with classifying/patenting things that have been funded with educational dollars. OSU has patents on what their grad students have done for their Ph.D stuff, and I'm not sure I really like that. Those students were receiving government grants to fund their research, and now, the public is 'protected' by it...even though they paid for it.

  • Ironic (Score:3, Insightful)

    by Anonymous Coward on Tuesday July 08, 2003 @12:16PM (#6392446)
    Big corporations have been compiling huge databases and mining them for interesting and very valuable information about individuals for a long time. It should not be a surprise to anyone reading slashdot that given a social security number and access to the right databases, it's not hard to discover enough about you that you'll feel that your privacy and security have both been seriously compromised.

    So it's a little bit funny that Sean Gorman has apparently compiled and mined a big database full of information on corporations and government, and that it scares the pants off them. I'd like to think that in the long run, Gorman's work might inspire some hard thinking on how and when databases can be compiled and combined, and this might eventually lead to greater protection for both our national security AND individual privacy.
  • In Soviet Russia... (Score:5, Interesting)

    by FunkyOldD ( 633953 ) on Tuesday July 08, 2003 @12:22PM (#6392507)

    Sorry, couldn't resist. I grew up in the USSR where everything was classified - so here is a map story for you.

    Map information was classified and map publishers were required to add deliberately inaccurate information to their maps. You would have whole cities that were not on the map or shown a couple of hundred km away from their real location. This was done in the name of national security, so the enemy (US) would not be able to use maps to plan a nuclear strike or sabotage military installations.

    The enemy of course just used satellite imaging to create their own maps and ended up with better maps of Russia than the Russians had. In the 80s folks who needed maps (geologists, archeologists, hikers, ...) would try really hard to get their hands on foreign made maps, because they were so much more accurate.

    Security by obscurity is counterproductive...

  • by Mordant ( 138460 ) on Tuesday July 08, 2003 @12:28PM (#6392563)
    Look, I haven't seen his work, but this article and the previous one cited both seem hype-ridden and reek of cluelessness.

    I mean, it's great that here in America someone can actually get a PhD by doing a lot of traceroutes and then using gnuplot of whatever to overlay the data onto scanned images of telco fiber-maps or whatever, but the whole premise of the article - including the moronic comments about how the guy shouldn't be allowed to leave the building with the laptop (maybe I have too much faith in humanity, but I can't imagine anyone making such a stupid comment other than in jest) is much ado about nothing.

    This information has been available for years, and continues to be available; it's just that this guy has nothing better to do than sit around collating it and putting it into MySQL or somesuch. So what? Terrorists aren't interested in blowing up the Internet - they're interested in blowing up -you-.

    So does this mean that I can now justify a PhD by sitting around correlating MapQuest thumbnails with wardriver plots open WiFi APs, or something, and then claim I'm mapping possible 'nodes of anonymous 'terrorist Internet access'? Sign me up!

    Think about it.
  • by MountainLogic ( 92466 ) on Tuesday July 08, 2003 @12:39PM (#6392671) Homepage
    When it comes to static hazards such as infrastructure secrecy decreases security. You can't really keep the location of a dam or fiber optic line a secret. Large structure such as dams are visable from space and the phone company puts bright yellow signs every 20 feeet alerting you where to find their cable.

    True security comes from risk reduction and mitigation. In the case of the dam (or chemical factory or other dangerous installation) the people who might be affected by a dam colapse need to know what kind of danger it is. They should have been told about the danger it posed BEFORE it way built. You can't keep the location of that dam secret so why try? And terrorist are the least likely cause of most earth dam failure.

    As for the fiber optic cable, you should assume that it can fail. I don't know about terrorist, but I do know that Joe farmer is going to be digging a ditch and WILL cut through a critical cable this year. If the phone company does not have a redundent solution then the end-users need to know about it so thay can plan for that kind of failure.

    Many eyes makes for quick risk reduction

    Finally, lets put 9/11 in perspective. While any loss of life is tragic, we lost the equivelent of several weeks of smoking deaths to 9/11. The economic distruction was less than a few weeks of a war in the middle east. The thing to keep in mind is that this is terrorism not war. The goal of terrorism is to inflict terror not destruction. They could have done more economic damage by blowing up a few "uneffective: car bombs in front of shopping malls the day after Thanksgiving with little risk to the terrorist. Why haven't they done something like that? It's been two years and nothing happened. Something will happen again, but there is so much good we could be doing with our talents and time rather than frittering it away on tin-hat paranoia. Let's fix the few glairing problems, reduce risks from all sources (those old toxic solvent drumbs in the back of your company for example) and move on.

  • Miss Utility (Score:4, Insightful)

    by bleh-of-the-huns ( 17740 ) on Tuesday July 08, 2003 @12:45PM (#6392728)
    Simply calling miss utility will give you most of the information about gas lines, power lines, fibre lines etc, in fact, before you do any construction, by law you have to call Miss Utility (stupid name, and I think they are changing it now too), who then go and notify the relavant parties (power, gas, telco), who then come out to mark with chalk or paint, exactly where their lines run in that area.

    And there is no way they can classify that info, else you would have to get ALL building contractors, electricians, basically everyone who wants to do any digging or construction, clearances.

    Building permits and architectural diagrams are also publically available, aerial maps are out there too.

    There is just really alot of info that is freely available that must remain that way for our society to function.

    Rather then shutting this poor student up, they should try to resolve the problems, not keep it quiet.
  • by Major Tom ( 164687 ) on Tuesday July 08, 2003 @12:47PM (#6392754) Homepage
    1) As many people have pointed and will continue to point out, classifying the report won't make any difference because people can re-create the work. And this wouldn't take much effort, because an attacker has no need to map the entire US, they can pick whatever area is convenient for them.

    2) Slowing down internet connections doesn't scare people. Temporarily cutting corporate offices off from the grid doesn't scare anyone (save, perhaps, the CEO). Think how much more terror-bang a terrorist could get for his buck with a 9mm in mall. That would terrify people and significantly damage the economy. Attacking communications infrastructure isn't "terrorism," it's something else. It's guerilla warfare, directed against an economy rather than a person, I suppose. If our "war" descends to this point, we are totally screwed, as it is impossible to defend (or even think of) all the economically "soft" targets.

    3) In the end, the security of all civillians and civillian infrastructure depends on good will. Well, that, and fear of punishment. But the latter doesn't apply to acts of international sabatoge and/or murder. I am sick of all this talk about defending our civillian infrastructure, securing the homeland, etc. It can't happen. Until there is a soldier in body armor with a rifle every few yards down every street in the USA, this goal will not be achieved. That isn't the society any of us want to live in. We haven't put any effort into civillian security up to this point, and I say: Good for us. We didn't need to, because the general good will of human beings was protecting us. Our effort would be better spent restoring *that* state of things, rather than moving toward the soldier-on-every-corner model. For those who would like to call me naive, I ask you: why has there not been an attack on soft infrastructure before? Why has there never been a wave of men with 9mms in malls? These things are undefended. The only reason it hasn't happened is that no one ever wanted to do it.

    Three good reasons why it is a waste of time and effort to classify this fellow's dissertation. I'll let others cover the reasons why classifying it is damaging to security, an open society, and democracy.
  • by Badgerman ( 19207 ) on Tuesday July 08, 2003 @01:01PM (#6392901)
    What we see here is a combination of simple things building up. Information here, information there - but add the tools to combine it all together, and suddenly said information is a lot more meaningful and powerful.

    It's not just the data. It's not just the technology. It's what you get when you combine them, mine the data, and find something that isn't there originally.

    The problem of regulating this, of course, is that the various sources of information are "innocent," and that information itself can be deceptively harmless until you combine it with something else.

    So what do you do? You can't control the information, you can't know what to control, you can't outlaw the process. Welcome to the 21st century, where Data Mining is our new concern.

    As an IT professional, I've had to deal with much lesser concerns of the same nature - what happens when you combine and mine data. A simple-to-create synergy can reveal far more than the data sources it uses, and that synergy has to be treated as a completely different thing when it comes to concerns over access, availability, etc.

  • by qtp ( 461286 ) on Tuesday July 08, 2003 @02:10PM (#6393635) Journal
    I amazes me how often the bureaucrats in the Intelligence Comunity [intellegence.gov] ignore what they already know.

    The nth Country Expiriment [thebulletin.org] proved that once knowlege is available to the public, and similar results can be obtained without knowlege of the methods used in previous successes.

    If this grad student could compile this information, then so could sombody else, and it's probable that sombody already has.

    This information should be used to point out the weaknesses inherent in our infrastructure, and show where this infrastructure needs to be diversified. IMHO, attempts to improve security by centralizing comunications and power distribution are doomed to failure, and will only make us weaker. Micro supliers [go.com] and home based [slashdot.org] power generation would make terrorist attacks against the power grid inconsequential. The weaknesses in comunications infrastructure can probably only be cured by creating a third alternative (community high-band?) to the cablemodem and telephone company monopolies on delivering service.
  • by phliar ( 87116 ) on Tuesday July 08, 2003 @02:39PM (#6393929) Homepage
    Well, that's being charitable. This comment is indicative:
    "He should turn it in to his professor, get his grade -- and then they both should burn it."
    This is not some term paper; it's a PhD dissertation, i.e. original research. (The question about whether or not PhD dissertations are always original or are research is a separate discussion.) The whole point of research is to add to the store of knowledge we possess. Furthermore, the use of the word burn is a little too chillingly reminiscent of Fahrenheit 451.

    Another way of looking at it is that this is yet another attempt by the government to oppress us by suppressing impression. However I have a pragmatic view: all this information needs to be public anyway. (If I want to dig a ditch, wouldn't the owners of underground fiber want me to know where it is?) We can never have absolute security if we don't want to become a police state. So instead of screaming hysterically about the sky falling, why don't we think about the underlying causes of terrorism? Why would someone go to all this effort to hurt us? These are not script kiddies.

    Disclaimer: I too have one of these here PhD dissertations under my belt. And I'm sure every dissertation has at some point been called tedious and uninteresting; I know mine has!

To do two things at once is to do neither. -- Publilius Syrus