Cybersecurity
Authors
News Type
News
Date
Paragraphs

The atomic bombs had been dropped on Hiroshima and Nagasaki just before 18-year-old William J. Perry landed in Japan during the War of Occupation as a mapping specialist. He saw the devastation left behind by American firebombers on Tokyo and Okinawa.

The young man quickly understood the staggering magnitude of difference in the destruction caused by traditional firepower and these new atomic bombs. He would go on to devote his life to understanding, procuring and then trying to dismantle those weapons.

But that was seven decades back. And many young Americans today believe the threat of nuclear weapons waned alongside the Cold War and Cuban Missile Crisis.

So as faculty at Stanford and the Center for International Security and Cooperation evolve with the digital age by taking their lessons online, one of the university’s oldest professors is also adapting to online teaching in an effort to reach the youngest audience, urging them to take on the no-nukes mantle that he’s held for many years.

“The issue is so important to me that I tried all sorts of approaches from books and courses and lectures and conferences to try to get my contemporaries and the generations behind me engaged – all with limited success,” says the 86-year-old Perry, a CISAC faculty member and the Michael and Barbara Berberian Professor (emeritus) at the center’s parent organization, the Freeman Spogli Institute for International Studies.

“First – which is a sine qua non – they must become seriously concerned that there is a nuclear danger, which most of these kids don’t understand at all,” said Perry. “Secondly, we want to convince them that there is something they can actually do about it.”

To reach those students, he believes he must go digital. So Perry – who co-teaches with CISAC’s Siegfried Hecker the popular Stanford course, “Technology and National Security” – began to map out a classroom course that would be videotaped and serve as a pilot for an online class that would be free and open to the public.

That course, “Living at the Nuclear Brink: Yesterday & Today” included lectures by some of the best people working in the field of nuclear nonproliferation today. Among those who will be highlighted in the online course are Perry and Hecker; Joe Martz of the Los Alamos National Laboratory; Stanford nuclear historian David Holloway; Stanford political scientist Scott Sagan; and Ploughshares Fund president, Joseph Cirincione.

The Perry Project will produce short-segment videos highlighting key information and stories from the course, packaging them in an online course available in multiple platforms and possibly offered by the university.

Perry used his personal journey as a young soldier during WWII, a mathematician and later a developer of weapons for the U.S. nuclear arsenal as undersecretary of defense for the Carter administration – and then trying to dismantle those weapons as secretary of defense for President Bill Clinton.

“I’m not doing this simply because I want to put a notch on my belt, to say that I’ve done a MOOC,” Perry said. “I’m doing it because I really want to get across to hundreds of thousands of young people.”

Last summer, he launched the Perry Project by inviting a dozen high school and college students to campus for a nuclear weapons boot camp so that they could take back to campus the message that nuclear annihilation is still a real, contemporary possibility.

He asked them: How do I get through to your generation?

“They said, `We don’t get our information by books or even by television, we get it through social media and YouTube, the various social media platforms. And you want to make the message relevant and relatively compact,’” he recalls.

Perry listened. “Living at the Nuclear Brink: Yesterday and Today” is in production now and a short-segment pilot video should be made available in the fall.

 

CISAC is turning to other forms on online learning, as well.

Cybersecurity fellow Jonathan Mayer is teaching an online course in surveillance law.

And lectures from CISAC's signature course, “International Security in a Changing World” (PS114S) will soon go up on YouTube as lecture modules entitled, “Security Matters.”

“Online learning offers a way to expand CISAC's reach to new audiences, geographies, and generations,” says CISAC Co-Director Amy Zegart, who has co-taught the popular course for the past few years with CISAC’s Martha Crenshaw.

“At the same time, the PS114 online modules will give us a living lecture library so that future Stanford students can compare faculty lectures on similar topics across time – learning, for example, how Martha Crenshaw assessed the terrorist threat in 2010 vs. 2015,” Zegart said.

Guest lecturers whose presentations will be included for the YouTube package include:

  • Jack Snyder of Columbia University: Democratization and Violence
  • Francis Fukuyama of Stanford: The Changing Nature of Power
  • Zegart: Understanding Policy Decisions: The Cuban Missile Crisis
  • Scott Sagan of CISAC: The Nuclear Revolution; and Why Do States Build/Forego Nuclear Weapons?
  • Abbas Milani, director of Iran Studies at Stanford: Historical Perspective on Iran
  • Former FBI Director Robert Mueller: the FBI’s Transformation Post 9/11
  • U.S. Army Lt. Gen. Karl Eikenberry (Ret.) and former U.S. ambassador to Afghanistan: The War in Afghanistan and the Future of Central Asia
  • Jane Holl Lute, former deputy secretary of Homeland Security: Emerging Threats in Cybersecurity
  • Perry: Security Issues in Russia, Yesterday and Today
  • Brad Roberts: former U.S. Deputy Assistant Secretary of Defense for Nuclear and Missile Defense Policy: Ensuring a (Nuclear) Deterrence Strategy that is Effective for 21st Century Challenges
  • CISAC Co-Director David Relman: Doomsday Viruses

And lectures at CISAC’s Cybersecurity Boot Camp for senior congressional aids will also be videotaped and packaged for YouTube and online consumption later this year.

“We are excited to enter into this phase of experimentation to see what works, what doesn't, and how we can further CISAC's teaching mission both here at Stanford and around the world,” Zegart said.

Hero Image
perry large
All News button
1
-

Abstract: Zero-day exploits (ZDEs) are programs that make use of newly-discovered software vulnerabilities to allow attackers to break into and manipulate information systems. A market for software vulnerabilities and exploits has developed, with military and intelligence agencies sometimes paying over $100,000 for exploits and software vendors offering bounties for their disclosure. Labeled a ‘digital arms race’ by some, it is generating a transnational debate about control and regulation of cyber capabilities, the role of secrecy and disclosure in cybersecurity, the ethics of exploit production and use, and the implications of trading software vulnerabilities for a secure and reliable Internet.

This research uses concepts and methods of science and technology studies (STS) and institutionalism to the debate over the production, sale and regulation of ZDEs. The goal of this research is to advance understanding of the way discourses are related to the emergence of governance institutions. The work also sheds light on the socio-technical and economic consequences of efforts to control software vulnerabilities and exploits, and make more transparent applications of ZDEs and cyber capabilities.

This talk will report on the ongoing dissertation work and explore how the discourse on software vulnerabilities and exploits is co-produced along with new institutions and practices in cybersecurity.

 

About the Speaker: Andreas Kuehn is a Ph.D. Candidate in Information Science and Technology and a Fulbright Scholar at Syracuse University. He joined CISAC as a Zukerman Cybersecurity Predoctoral Fellow in October 2014. Before joining Stanford, he was a visiting graduate student at Cornell University’s Department of Science & Technology Studies.

In his dissertation research, Andreas examines the discourse and the emerging institutions in cybersecurity with a particular focus on software vulnerability and exploit markets. The trade with exploitable security flaws in software and their use in cyber attacks has sparked a controversy about the control and regulation of information technology, and the role of secrecy and disclosure in achieving cybersecurity. While at CISAC, Andreas is conducting qualitative, empirical research on cybersecurity institutions.

His broader research agenda is informed by Science and Technology Studies and Internet Governance to study emerging technology and its relation to privacy, security, and surveillance. Previous research included an NSF-funded project on deep packet inspection technology (DPI) and its implications on Internet governance (www.deeppacket.info), and the use of information technology in the public administration (e.g., enterprise architecture, standardization, interoperability).

Andreas worked in various research positions for the Austrian Ministry of Finance, the Swiss E-Government Institute, the Swiss Federal Office of Communications, and the Malaysian National Advanced IPv6 Centre of Excellence. The Austrian Computer Society awarded him an eGovernment Innovation Award for his research on multidisciplinary actor coordination and collaboration in large scale public ICT efforts. Andreas holds a M.Sc. in Information Systems from the University of Zurich, Switzerland, and an M.Phil. in Information Science and Technology from the School of Information Studies at Syracuse University. He is originally from Zurich, Switzerland.

Encina Hall (2nd Floor)

Andreas Kuehn Zukerman Cybersecurity Predoctoral Fellow Speaker CISAC
Seminars
-

Abstract: Organizations face a range of cyber threats including spammers, lone hackers, and advanced nation states. Significant uncertainty surrounds how to best secure organizations, and the relative value of different safeguards such as intrusion detection, two-factor authentication, and full disk encryption is unknown. In this talk, I will summarize results from a data analysis performed on a data set from a Research and Development Center and present stochastic models to assess risk in organizations. 

About the Speaker: Marshall is a predoctoral science fellow at CISAC. He is a PhD candidate in Management Science and Engineering at Stanford University, concentrating in Risk Analysis. Marshall studies quantitative models for cyber security in organizations. He is interested in developing probabilistic modeling techniques to improve decision making regarding defense against cyber threats. 

Marshall has a diverse background spanning many fields, that includes modeling cyber security for the Jet Propulsion Lab, developing trading algorithms with a high frequency trading company, researching superconducting materials at UIUC, and modeling economic and healthcare systems with the Complex Adaptive Systems of Systems (CASoS) engineering group at Sandia National Labs. Marshall is also the Co-President of the Stanford Complexity Group.
 
Marshall holds a B.S. in Engineering Physics from the University of Illinois at Urbana-Champaign.

Encina Hall (2nd Floor)

Marshall Kuypers Predoctoral Science Fellow Speaker CISAC
Seminars
Authors
News Type
News
Date
Paragraphs

Jonathan Mayer's education path is unusual: He has earned a Stanford law degree while working on his Ph.D. in computer science. He did research with a fellow doctoral candidate to discredit NSA claims that sensitive information about American citizens cannot be gleaned in the "metadata" the spy agency gathers from millions of phone calls.

Law and computer science both have their codes, but they're disparate. Legal code is often fuzzy and qualitative. Computer code is precise and quantitative. Not surprisingly, law and computer science tend to attract different people. It's not that the twain shall never meet; it's just that they seldom do.

Mayer is the exception. He has received his law degree and is completing his PhD in computer science, both at Stanford. Along the way he has aimed his double-barreled expertise at the National Security Agency's practice of collecting various forms of electronic information, including telephone metadata of Americans: the phone number of every caller and recipient, the unique serial number of the phones involved, the time and duration of each phone call.

Working with fellow Stanford computer science doctoral candidate Patrick Mutchler, Mayer proved that the NSA was wrong when it claimed that its analysts could not tease detailed personal information from phone metadata searches.

"Phone numbers, as it turns out, aren't just phone numbers," said Mayer, who is also a cybersecurity fellow at the Center for International Security and Cooperation. "They're an avenue for finding out detailed information about individual citizens."

Aleecia McDonald, the director of privacy for the Center for Internet and Society at Stanford Law School, said Mayer's research irrefutably demonstrated that phone metadata is anything but trivial.

"The lovely thing about Jonathan's research is that it made the sensitivity of phone metadata concrete," McDonald said. "The country was told that phone metadata were not worth constitutional protection, and now Jonathan's research confirms otherwise."

McDonald said Mayer's research confirmed the sense of unease felt by many Americans, which could have ramifications beyond the current metadata debate.

"Mobile phones are basically tracking devices, but in addition to geographic data, Jonathan showed you can obtain rich information on daily lives and associations," she said. "This speaks directly to strongly protected privacy issues. No one is calling for stopping all surveillance, but these new dragnet programs essentially treat everyone as criminals and terrorists all the time. People are wondering if they can trust government on anything, and that's dangerous."

Mayer talks to CBS News about his metadata project

Mayer's ability to have significant public impact while still a young academic stems directly from his unusual combination of legal and computer acumen, according to John C. Mitchell, the Mary and Gordon Crary Family Professor in the School of Engineering and Stanford vice provost for online learning. Mitchell, who is Mayer's adviser, is a professor of computer science and, by courtesy, of electrical engineering.

"That ability to apply high technology to legal issues, to understand both fields so deeply – well, not many people have those skill sets," said Mitchell. "In fact, he seems one of a kind. We're lucky to have him working on these issues. I don't know anyone else who could do it."

Go 'geekward,' young man

Mayer traces his interest in computer science – his "geekward leanings," as he puts it – to his childhood in Chicago, where he logged a lot of time on his family's Apple IIGS computer. Once, when he received an elementary school writing assignment, he developed a web page instead. This was in the early stages of the World Wide Web, and his accomplishment engendered both respect and confusion.

As his facility with computers grew, he became increasingly interested in security issues. This was sometimes expressed in unorthodox – even mischievous – fashion. He couldn't help but hack.

One holiday, he recalled, he received a Radio Shack watch that had a TV remote control feature. After fiddling a bit, he discovered that by setting the frequency for a Sony TV, pointing his device at the infrared port on certain Apple computers and hitting channel change, he could force the computer to reboot.

"My school used those kinds of computers, so I spent quite a bit of time pushing channel change when kids were on the computers at school," Mayer said. "They were mystified. I have to admit it was fun, but it also got me thinking about computer vulnerabilities."

Computer science quickly became a focus for Mayer during his undergraduate studies at Princeton. But he also developed interests in public policy and politics – subjects that had previously struck him as dreary.

"They just seemed somewhat vapid and tedious," Mayer said. "But my roommates were intensely interested in policy and politics, and they gradually won me over. I saw that both are viable paths for implementing change, for getting real things done."

His faculty adviser, Princeton computer science and public affairs Professor Ed Felten, reinforced that. Mayer's senior thesis reflected the merging of his interests: It was about web privacy – balancing computer science research with law and policy issues.

Taking dual paths

After graduating from Princeton in 2009 with a degree in public policy, Mayer came directly to Stanford with the intention of becoming, as he tells it, the first student to simultaneously pursue a JD in law and a PhD in computer science (CS).

"I wasn't going to do law and policy lite or CS-lite," Mayer told the Stanford Daily in February. "I was going full in on both."

Among his successes on the legal front: He was recently asked to teach a class at Stanford Law. The seminar explores the legal ramifications of security and privacy in the technology sector, emphasizing "areas of law that are frequently invoked, hotly contested or ripe for reform," according to the course overview.

He finds his new instructor role rewarding: "I get a kick out of the fact that I'm an engineer teaching law at Stanford."

His legal accomplishments notwithstanding, Mayer's computer science efforts – particularly his metadata research – have made more of a public splash. And as so often happens at Stanford, it all started with a conversation among peers.

"Patrick [Mutchler] and I were talking with our adviser [Mitchell] shortly after the Edward Snowden revelations," Mayer recalled. "We were really intrigued by the NSA's programs, especially all the claims and counterclaims about phone metadata. There was a lot of conjecture at that point but very little scientific clarity. So we thought we'd try to bring some focus to bear."

But Mayer and Mutchler found it difficult to acquire the metadata. While the NSA could harvest it directly from telecommunications companies, the Stanford doctoral students had to solicit phone records from the public.

"We realized we might be able to get metadata voluntarily through crowdsourcing," Mayer said. "So we posted an explanation on a Stanford website and provided an Android app that allowed people to send us their data. Crowdsourcing is a pretty risky basis for research, of course, because you never know what you're going to get. We would've been very happy with 100 responses – instead, we got about 500, and we were off to the races."

Metadata was revealing

Again, this innovative tactic took root in the confluence of legal and computing expertise.

"Building and distributing the app was within the capabilities of many computer experts, but its application was very clever," Mitchell said. "The rationale was: 'We would like to see what the NSA sees, but we don't want to behave like the NSA. So how do we do that?' Seeking volunteers willing to provide their phone data and devising and distributing the app was an extremely creative, sophisticated – and effective—approach."

In the course of their analysis, Mayer and Mutchler derived many revealing inferences from the metadata that show who called whom, when, from where to where and how often. For example, they could determine where the subjects lived and worked, and could see some intimation of relationships between the volunteers.

In some cases, the researchers were able to identify who was dating whom. One volunteer contacted a pharmaceutical hotline for multiple sclerosis patients, a management service for rare medical conditions, a specialty pharmacy and several neurology medical groups. Another called several locksmiths, a hydroponics dealer, a head shop and a home improvement store.

Those findings, Mayer drily observed, debunked the NSA's original assertions that phone metadata were impenetrable.

"It gave us pause," he said. "It was pretty clear that we could tease out more sensitive information with some elbow grease."

The findings have caused headaches for the NSA, and Mayer sees waning support for the agency's aggressive pursuit of private information. A number of high-profile cases on metadata are either pending or wending their way through the courts, and the entire program is up for renewal, or cancellation, in 2015. In May, the U.S. House of Representatives passed legislation to halt the National Security Agency's wholesale collection of domestic phone records. Sen. Dianne Feinstein, the chairwoman of the U.S. Senate's intelligence committee, signaled she is amenable to supporting a companion bill.

What's Next?

Mayer, who has received his JD and recently passed the California Bar Exam, expects to complete his computer science PhD in 2015. And after that?

"I would like to go to Washington, to try to bring technical rigor to federal policy," Mayer said, "though I'm aware there's always the danger of sinking into the political morass in that town. I'm working on a start-up NGO that I hope can bridge D.C. and Silicon Valley. In the interim, I just enjoy teaching at the law school."

Glen Martin is a former San Francisco Chronicle reporter based in Santa Rosa, Calif.

 

 

All News button
1
-

CISAC Central Conference Room, 2d floor

Scott Charney Corporate Vice President , Trustworthy Computing Group Speaker Microsoft
Scott Charney Corporate Vice President, Trustworthy Computing Speaker Microsoft Corporation
Seminars
Authors
News Type
News
Date
Paragraphs

The National Security Agency's mass surveillance of telephone metadata could yield detailed information about the private lives of individuals far beyond what the federal government claims, according to new Stanford research.

Stanford computer science student and CISAC cybersecurity fellow Jonathan Mayer and a fellow CS student, Patrick Mutchler, were able to acquire detailed information about people's lives just from telephone metadata: the phone number of the caller and recipient, the particular serial number of the phones involved, the time and duration of calls and possibly the location of each person when the call occurred.

The researchers did not do any illegal snooping – they worked with the phone records of 546 volunteers, matching phone numbers against the public Yelp and Google Places directories to see who was being called.

From the phone numbers, it was possible to determine that 57 percent of the volunteers made at least one medical call. Forty percent made a call related to financial services.

The volunteers called 33,688 unique numbers; 6,107 of those numbers, or 18 percent, were isolated to a particular identity.

Privacy issues

The metadata issue has taken on urgency in the wake of last summer's revelations about surveillance of American citizens by the NSA. Privacy experts have questioned the federal government's assertions on the subject.

President Obama has said, "They are not looking at people's names, and they're not looking at content."

Federal judges have split on the legality of the NSA's telephone metadata program.

Jonathan Mayer talks to Hari Sreenivasan on PBS Newshour in this video: 

Computer scientists such as Mayer say metadata are extremely sensitive and revealing.

They contend their research shows that metadata from phone calls can yield a wealth of detail about family, political, professional, religious and sexual associations.

"It would be no technical challenge to scale these identifications to a larger population," said Mayer.

At the outset, Mayer said, they asked, "Is it easy to draw sensitive inferences from phone metadata? How often do people conduct sensitive matters by phone? We turned to our crowdsourced MetaPhone dataset for empirical answers."

They crowdsourced the data using an Android application and conducted an analysis of individual calls made by the volunteers to sensitive numbers, connecting the patterns of calls to emphasize the detail available in telephone metadata, Mayer said.

"A pattern of calls will, of course, reveal more than individual call records," he said. "In our analysis, we identified a number of patterns that were highly indicative of sensitive activities or traits."

For example, one participant called several local neurology groups, a specialty pharmacy, a rare-condition management service, and a pharmaceutical hotline used for multiple sclerosis.

Another contacted a home improvement store, locksmiths, a hydroponics dealer and a head shop.

'Unambiguously sensitive'

The researchers initially shared the same hypothesis as their computer science colleagues, Mayer said. They did not anticipate finding much evidence one way or the other.

"We were wrong. Phone metadata is unambiguously sensitive, even over a small sample and short time window. We were able to infer medical conditions, firearm ownership and more, using solely phone metadata," he said.

All three branches of the federal government are now considering curbs on access to telephone metadata, Mayer noted. Consumer privacy concerns are also salient as the Federal Communications Commission assesses telecom data sharing practices, he added.

 

Hero Image
1 13617 nsasign1 news
Stanford computer science students Jonathan Mayer and Patrick Mutchler examined phone records to learn what the NSA can find out through surveillance.
National Security Agency
All News button
1
Subscribe to Cybersecurity