AIDE 2014: Emily steps up her game!

     Are you going to be in the Huntington, WV area next week? If so, stop by the Appalachian Institute of Digital Evidence annual conference. What you will get is a week long training and presentation conference that only costs $60. This will be my 3rd time to attend and I am proud to say, my 2nd time selected to speak. This time I will be sharing the stage with my daughter Emily. We will be giving a first hand account of building and deploying a RachelPi educational computer to Kenya. In addition to this, we will give an update of our return trip.

     Check out the AIDE website at www.appyide.org What you will find is an organization dedicated to forensics, e-discovery, and Information Security.

     I hope to see you all there!

A short (musical) history of my life in IT

1980's: Listened to "Alternative" music on my boombox while playing on my TRS80 Color Computer 2

1990's: Listened to "Grunge" on my Walkman while installing computers and pulling cables

Late 1990's: Listened to "Rock" streaming on my computer while installing and managing Cisco routers

2000's: Listened to "progressive-house music" streaming on my computer while pentesting and doing reverse MALWARE analysis

2010's: Listen to blues, classical, and jazz while writing security policy

I think I may be going down hill...

ShmooCon video of our talk is up!

Hey all. I wanted to take the time and thank everyone who came to hear me and my daughter (with a guest appearance by Johnny Long) speak about our project in Kenya. If you did not see our presentation, please feel free to watch it here. 20 minutes of your time is not too much to ask, right?

Watch video here.

Also, don't forget to donate to Hackers for Charity! They are doing GREAT work in Uganda.

ShmooCon: It Lived Up To The Hype, But Not For The Reasons I Thought

 

     I have known about ShmooCon for years now. I have always wanted to go but could not justify spending the money. I have even submitted a few CFPs and was actually glad they weren't accepted. Getting turned down made it easier to not spend the cash and go.
    Unlike other prospective presenters, some of whom I consider strong acquaintances, I never have felt entitle when it comes to CFPs. Also, I never get upset when I am not selected at a conference. Quite the contrary, I get upset when I hear others complain about getting turned down.
     This year was completely different. I REALLY wanted to go to ShmooCon and I REALLY wanted to present. Not for me though, for my daughter.
     My daughter, Emily, has always has a kind and giving heart. This genuine care for others was readily apparent at an early age. As she grew older, her love and need to assist others grew too. In 2013, my wife and I decided that it was time for Emily to travel with my mother-in-law on a mission trip to Kenya. Prior to the trip, Emily and I learned about the many uses of the RaspberryPi. After talking to Sam of Hackers For Charity, I learned about the RachelPi learning system from World Possible. Emily raised over $1,000 for her trip and decided to provide a RachelPi to the children of the Future Hope orphanage. We then built a RachelPi and she took it to Kenya with her. On this trip, Emily would assist in building a school at an orphanage, install the RachelPi, provide 2 computers to the kids, and help teach a vacation bible school at another school.
     When I wrote the CFP for this year's ShmooCon, I actually became very nervous. You see, I wrote the CFP with the hopes that my daughter would be selected to speak. Because she is 14 and cannot travel alone, I added my name to it. After what seemed like an eternity, I got that fateful email. We were accepted! My attention turned to prayers of thankfulness and safe travels. You see, Emily was scheduled to return to the US the Tuesday before we left for Shmoo. If she had travel issues like bad weather, this whole plan could be shot.

Emily testing the RachelPi

     To make an already long story shorter, all went well in Africa (there were a couple of hiccups like no power in the new orphanage site). The RachelPi was handed over to the staff of the orphanage, a care provider was trained on how to use it, and the computers still worked.
     As for ShmooCon, I have heard for years that the staff and attendees were very friendly and the atmosphere was laid back. What I learned is that this was true. I am glad I went this year and I am glad my daughter got to speak in front of a rather large audience.

Helping build a school

   
After our presentation, Johnny and Sam pulled us aside and offered to help us on our next trip. They provided us with a PelicanPi and support for a future trip to Kenya. This is something that really touched me and am embarrassed to say brought me to tears (I was able to keep it together when they were talking to us but lost it later). I have had many encounters the staff and volunteers of HFC and I know they do good work but I never thought they would help us do that work too.

Johnny Long, Emily, and me

     After getting home and discussing logistics with my wife, we have tentatively decided to take a trip to Uganda and Kenya in the Fall of this year (before the rainy season). At a minimum, Emily and I will go. We are praying that my wife will be able to go with us. Plans may change but, God willing, this is a GO!

Note: As usual, I will post a link to the presentation when the videos are uploaded.

My daughter and I will be presenting @ShmooCon!!!

For those of you attending ShmooCon in January, please stop by the "One Track Mind" presentations on Friday. My daughter, Emily, and I will be presenting on her efforts to bring Rachel-Pi and Khan Academy to a school/orphanage in Kenya. Here is the outline:

How Hackers for Charity (possibly) saved me a LOT of money

Who we are
How she got to this point in her life
The process of gathering, building, deploying, and training
What's next

I am proud of my daughter and the work she is doing in Africa, all at the ripe old age of 13.

Help me support her by showing up to the talk. As I said in my CFP for ShmooCon: "As a dad, I feel the need to push the limits of my children. This is the perfect outlet for my daughter to learn about our community in a purposeful way. Not only this, I want the rock stars in our community to help me! IT TAKES A VILLAGE! (or so I hear)."

P.S. It is perfectly acceptable to heckle me, as always, as long as you are not too disruptive to her.

NSA: The "big stick" of the Executive Branch and how this really affects US security worldwide

***As a former employee (US Navy analyst at NSA), I must say up front "I can neither confirm nor deny any comments made for or against NSA and their collection efforts both internal and external to the US. All questions should be directed to the Public Affairs Office at Ft. Meade, MD."***

Now that I have parroted the official party line, lets talk.

Today I read an very well written, but sad, article in the Wall Street Journal entitled "Missteps Doomed Civilians As Chemical Attack Loomed." The article outlines a series of steps leading up to the mass chemical attacks in Syria on August 21st. Due to efforts of the US collection system (probably NSA and/or CIA), Syrian troops were know to be using chemical weapons on the population prior to this occasion. These attacks led to the death of a small number of civilians, but were unconfirmed by independent sources. Then on the 21st, an order was giving by a senior level person to perform a mass attack on rebel held locations and the civilian population in the area.

"Sources" stated that the communications intercept (the order) was not immediately translated and reported because these attack had become commonplace. It was not until the death toll kept climbing up that the full weight of the intercepted order came to light.

I do not blame the analysts who intercepted, translated, and reported this occurrence. I blame the the 3 branches of the govarnment for this. You see, it was Congress who voted in the shambles of a law known as USA PATRIOT ACT. It was President Bush who approved the law with his signature. It is President Obama who has taken the collection requests to an absurdly high level (the number of collection requests on US citizens met a "critical mass" before the administration decided to stop reporting the numbers.) I also blame the Judicial Branch for slowly eroding the power of the Constitution and Bill of Rights over the years.

I mostly blame the Executive Branch of the government for endangering the US. You see, NSA has a military commander who receives collection orders from the Executive Branch. I don not advocate replacing DIRNSA with a civilian because a civilian would still receive orders from the same source. When orders are given, resources in the already strapped NSA are stretched further. This is simple supply and demand. You have a set number of resources. When you add tasking, something else has to stop being collected and analyzed. In this case, it appears that the Executive branch ramped up tasking on the US populace in a vane attempt to prevent terrorism at home. This left us with fewer resources to stop terrorism abroad.

***Side note - We homeschool. My wife spends a lot of time discussing the law of unintended consequences and their effect on our country. I am beginning to understand the value of this approach.***

Could the mass slaughter of a civilian population have been avoided in Syria? The simple answer is probably not. The long answer is that the Executive Branch already had knowledge of "low level" use of chemical weapons in Syria and did nothing about it. Worse, the Secretary of State opened the door for Russia to step in and solve the chemical weapons dilemma. Finally, the Presidents inability to lead the World (much less the country) in this matter is abysmal.

This leads me to the discussion of what many people are asking of the US government. Many are calling for the dismantling of the NSA and its collection methods. These people don't usually stop there. They often times complain that we monitor (spy) on other countries, including our partners. I say this is the direction we need to move in. The charter of the NSA was to collect on foreign communications and, at one time, were forbidden to spy on US persons. The collection of US persons was not actually forbidden, but the burden of proof and the need to collect on US persons was heavy.

Anyone who says we should NOT be spying on other countries is naive. Just because you are our friends today does not mean you will be our friend tomorrow. Not only this, you will NEVER have a utopian society in which all peoples are friendly to each other. The reason for this is human nature. Ask my 7 year old why communism is such a bad idea and he will tell you it is a great idea until you introduce the human element. After all, if we can't overcome racism, how do you ever think we will reach utopia?

In conclusion, the current "policy" on spying on US persons is stretching already thin resources to a breaking point. This does not allow the NSA to effectively perform its chartered mandates in the collection and analysis of signals from non-US persons. This endangers US interests and persons by requiring poor asset management.

Please feel free to comment.

The Question of Ethics from an Unethical Blogger

Today I read a blog from Jeffrey Carr (found here http://jeffreycarr.blogspot.com/2013/11/republican-cyber-security-experts.html). What first strikes me is the title, "The Questionable Value and Ethics of TrustedSec's Pen Test of the HealthCare.gov Website."

Value: the regard that something is held to deserve; the importance, worth, or usefulness of something.

The website requires a user to enter sensitive data into it. It is discovered that the website is subject to simple reconnaissance techniques that my 13 year old can perform, with the help of Google of course. This reconnaissance results in sensitive data being harvested. I think reporting this to the public is valuable. I could be wrong but I doubt it.

Ethics: moral principles that govern a person's or group's behavior

The problem with arguing ethics is that there is no standard by which to judge. Just as the argument that NSA wiretaps of US citizens is unethical cannot be effectively argued one way or the other, this cannot be argued one way or the other. (Author's note: David Kennedy is perhaps the most ethical person I have ever met. Of course, this cannot be proven. By the very definition, it is untenable.)

At this point, I began reading the swill that follows. The point of the article is to show that the witnesses testimony was swayed by their political beliefs. The arguments are "upheld" by the author in what can only be seen as a completely political tongue-lashing. He seems to be fighting his perceived politics with politics. What? (This reminds me of the "I know you are but what am I arguments of a schoolyard child.)

The author brings up the ethics of publicly "outing" vulnerabilities. David, on more than 1 account, in his verbal testimony and in his report, stated that he contacted the government. He also redacted key information about the vulnerabilities that he reported (clearly stated in the report and in his testimony).

What we have here is an author of a blog that clearly keyed in on a single phrase, David Kennedy speaking on FOX News, and put his political beer goggles on, shut down his ability to reason, and threw a tantrum. What he would have seen if he had performed a simple Google search is that Mr. Kennedy has appeared on CNN and other "liberal" shows several times. As a point of fact, he purposefully spreads the love so as to stay above board. (Plus, he would never hear the end of it from Martin Bos if he did it any other way.)

In conclusion, I could have torn this blog apart line by line and word for word but I have better things to do. So, I will leave you with this: Suck it Jeffrey Carr. SUCK IT!

P.S. One more definition. Slander: the action or crime of making a false spoken statement damaging to a person's reputation. (Used in a sentence: Jeffrey Carr's inaccurate blog article on David Kennedy and TrustedSec was slanderous.)

Correction #1 (Sure to be more) Libel: a published false statement that is damaging to a person's reputation; a written defamation. (Example: Jeffrey wrote therefore he is libel). Thanks to Nick for the correction and sorry to @popehat for not learning a thing from your blog!