Category Archives: Politics

The state should not dictate cybersecurity policies to businesses

I read the Handelsblatt this morning and its headlines were all about IT security and what an immense threat such attacks represent for both corporations and government agencies. While I agree with the diagnosis of the situation -IT security is indeed critical- the response from the German government seems to me completely absurd.

Thomas de Maizières (CDU – Christian Democrat), the German minister of interior declared that Germany should take a leadership role in Europe to fight cybercrime and develop a comprehensive regulatory framework. This would make it compulsory for businesses to update and maintain their security infrastructure through an “IT security law”.

One should, however clearly differentiate whether the state wants to protect itself or German businesses. The former is a legitimate and perfectly acceptable mission, the latter can only lead to an increase of bureaucratic burden and costs and will most certainly not bring the expected benefits.

Thomas de Meizières announced an investment plan of 300€ millions in the cybersecurity infrastructure of the German secret service (Bundesnachrichtendienst, BND). This measure seems to make sense for three reasons. First, more and more people have an access to the Internet (which increases the pool of potential attackers, professional or not). Second, the increased sophistication of attacks makes it urgent to make sure that the intelligence agency is well protected. Finally, it is no secret that state agencies from various countries stand behind large scale attacks in order to gain access to technology or information.

The German government, however, also wants to help protect businesses through a law creating mandatory guidelines aiming at improving the information security, and hence the competitiveness of German companies.

I believe that this approach is completely ill-suited and will fail. Why? Because it is a company’s duty to protect its confidential information and there are probably as many ways to protect information as there are companies. One of the IT departments of a very large French bank, provides a key component of their security infrastructure. As one would expect from a financial services institution, they tend to be quite conservative, not applying the last updates to their systems. They simply favor stability over new features. A couple of months ago, Heartbleed, a security bug in an encryption system called OpenSSL was disclosed. This failure allowed an attacker to decipher any message presumably safe and hence get access to confidential information. This Heartbleed bug was only applicable to the OpenSSL versions 1.0.1 and above. The bank, however, ran an earlier version of OpenSSL that was still supported, which means that they were safe against this attack. With such an IT security law, the government would have had the authority to force a German bank in a similar case to use a pre-defined software versions. What would have happened if the state, for one reason or another, would have forced the bank to apply non-security related updates to the software, although they did not need it? It could lead to a situation where the bank is forced to update its software against its will and its interest, for a more than dubious advantage.

Moreover, the law would apply to all companies running an IT infrastructure, and it is almost impossible to create a baseline for companies that differ to such great extent. The electrical toothbrush company should have a similar security policy as Airbus, that builds fighter jets?

Finally, who will enforce the law? Will state agencies have to audit every company in Germany to make sure that security updates are applied? Where will they find the security experts for not only Linux, Windows, but also antiquated operating systems, such as OpenVMS (which runs some of the critical operations of many companies)? You can count people who understand this type of software (supported by their vendors) one two hands in Europe. Maximum. This law will lead either to a bad compromise, based on the lowest common denominator that will change nothing, and to a bureaucratic burden for companies that will reduce the competitiveness of Germany companies. Literally the opposite of what the government intended.

So what should the government do? US president Obama, according to the Handelsblatt, declared that “the government cannot do everything, because most of the IT infrastructure lies in the hand of the private sector. But the private sector alone can also not deal with everything, because the government very often has the most current in formation about threats.”. In my opinion, if the government is in possession of this type of information, it should release it as soon as possible to all. It is the responsibility of the government to protect itself against attacks, it is also a proof of being a good world citizen to alert as many people as possible of a possible security bug. This of course benefits businesses, who can protect themselves. Openness is the key and collaboration with IT providers and companies will help the latter become more aware about security threats that might endanger their competitiveness. Whether they do something about it or not is their prerogative and should be implemented according to their priorities.

Not state coercion, but full openness and collaboration between the state, IT providers and businesses will make Germany a leader in cybersecurity.

Taking my privacy back

In the light of the recent revelations about the large-scale spying activities of the NSA (and others, including European agencies), I will be changing my behavior to make the most of my right to keep my privacy intact. I am not stupid enough to believe that this will protect me completely from intruders, companies and government agencies alike, but I want to make use of my right to do whatever I want to do without being suspected or spied on. So I will gradually undertake the following steps:
use Tor for as much traffic as possible, including web and email. This includes not only my home desktop, but my work laptop as well as my Android mobile phone. The Tor project can help you protect your privacy. The connection is slower, but that is a small price to pay. It takes a couple of minutes to install  see https://www.torproject.org/ Having already started to use it, I noticed how Google and Microsoft services hate to see you somehow anonymous, asking at every connection if you are the legitimate user of the account.
run my own mail server. I will gradually leave GMail, which -granted- is a fantastic service, for something like email at hmarcy dot com. Gmail is way to intrusive for me and giving my or someone else’s data to the NSA does not play in Google’s favor either.
replace Google analytics with Piwik. As I do not want to be spied on, I do not want you to be spied on when you visit my website. I started an OpenShift application with Piwik to monitor my website to not give your data away to Google through Google Analytics
remove +1 buttons. I actually installed a WordPress plugin on this website to share my articles on Facebook, Google+ and LinkedIn. I removed it because these buttons will help these service to track your browsing behavior and that is just not right.
run my own calendar application. I will stop using Google Calendar and take an open-source replacement for it on my server.
use jabber. Using Jabber alone will not help protect my privacy, but I trust the jabber.org people much more than Google with their Hangouts. Feel free to add me herve at jabber  dot de. See http://www.jabber.org/
use Ixquick as search engine.
use the browser extensions Ghostery and adblock
use OSMand instead of Google Maps on my Android mobile phone (look for “osmand” on Google Play Store). It is a GPLv3 application !

An interesting presentation about today’s economy

In this interesting and easy-to-understand presentation, Professor Arturo Bris from the IMD business school in Lausanne, Switzerland, explains the latest economic evolutions in the world:
– what is happening in the US from an economic perspective
– the effects of the quantitative easing on the economy and on the finance industry
– an analysis of the PIIGS (Portugal, Italy, Ireland, Greece, Spain) countries which encounter serious difficulties with their sovereign debt.

The key take-aways for me were:
– the ration debt to GDP that is shown in every explanation of the Euro crisis is not an efficient indicator to measure how endangered a country is with its own sovereign debt. It all depends on his capacity to reimburse his creditors.
– Germany benefits from the sovereign debt crisis of the PIIGS crisis, but Angela Merkel must be careful with the German public opinion not to give the impression to bail out the other countries’ mistakes with German taxpayers money… tough task !

One remark : the USA can afford to have a weak dollar to export, since the oil, which in industrialized countries plays a critical role in imports, is payed in dollars. They don’t have the currency effects that affect other countries. This system will be beneficial to them as long as investors trust the value of the dollar. Will it always be the case ?

Finally, I have one question: Professor Arturo Bris states that the PIIGS countries, since they are net importers (i.e. with a negative trade balance), have an interest in a strong euro. But if the main providers of Spanish imports are already in the Euro zone, a strong Euro would not make a difference. Wouldn’t it ? And wouldn’t a weak Euro help increase the inflation and hence reduce the debt burden that the PIIGS country have to carry ?

Any input appreciated 🙂