Category Archives: History

UK Water Poison Cover-up

The BBC reveals that staff were told to ‘keep quiet’ after accidental Camelford poisoning.

Staff from a company involved in the UK’s worst mass water poisoning were told to keep quiet about what had happened, an inquest has been told.

Twenty tonnes of aluminium sulphate were accidentally added to the water supply in Camelford, Cornwall, in 1988.

A former manager at the South West Water Authority (SWWA) said senior managers did not want the public knowing what had gone wrong that July.

Three weeks passed before the public were alerted. The story gives examples of people who died from the poison.

NIST on APT Protection

I noticed in a NIST FAQ on Special Publication 800-37 (continuous monitoring) that guidance has been given to address Advanced Persistent Threats:

Finally, to enable cyber preparedness against the advanced persistent cyber threat, organizations must enhance risk management and information security governance in several areas. These include, but are not limited to: (i) development of an organizational risk management and information security strategy; (ii) integration of information security requirements into the organization’s core missions and business processes, enterprise architecture, and system development life cycle processes; (iii) allocation of management, operational, and technical security controls to organizational information systems and environments of operation based on an enterprise security architecture; (iv) implementation of a robust continuous monitoring program to understand the ongoing security state of organizational information systems; and (v) development of a strategy and capability for the organization to operate while under attack, conducting critical missions and operations, if necessary, in a degraded or limited mode.

There is nothing unusual in the text. I see no mention of protection against advanced attacks or persistent attacks. It would read the same whether or not APT was the attack vector.

What NIST really could have said was that continuous monitoring gives the upper hand against APT.

The fourth (iv) area is the most important. Persistent threats evolve over time so data sets must be maintained for longer periods and reviewed with a wider scope against a baseline (activity trends over three months, six months, etc.). Therefore continuous monitoring of controls plays directly into defending against APT by generating a larger and longer information feed, reducing the effectiveness of the attack vector. The tough part is making use of the data.

I spoke a about this in my recent presentation at RSA Europe. The Pope and the Magna Carta both tried to outlaw the crossbow. Why? It was thought to be unfair in battle. Anyone could pick one up and be quickly trained to kill, unlike a sword that took a lifetime of training. This meant the economics of battle shifted and defenders looked for ways to respond to the new attack. An expensive trained soldier was no longer effective against inexpensive mercenaries (peasants hired to kill).

Why did the Pope or King John’s detractors care about this? I suspect it had to do with who had access to what resources at the time. More money meant favor to the crossbow. King John, for example, could bring loads of troops from France carrying crossbows and fight the barons. Less money, more training, meant favor to the law against crossbows. The balance was shifted again when defenders found ways to exploit time required to reload the crossbow. Defenders only needed to make the attacker miss once while exposed and then a counter-attack by any means was highly effective. Then the crossbow men devised special shields to hide behind while reloading…and so on.

One weakness in the APT attack is found within its long intelligence gathering phase. Information collected over time may show changes from a baseline. This could not only be a way to detect incoming attacks but also potentially show awareness to the attacker and thus prevent them — attackers often move to a target with lower risk.

Rinderpest Virus Wiped Out

The BBC brings good news about the cattle plague (Rinderpest) virus — it has officially been wiped out. The virus has been blamed for widespread famine.

The World Health Organization (WHO) so far has declared only two diseases officially eradicated.

The first was smallpox caused by variola virus (VARV), which was in fact eradicated by application of cowpox. The second was cowpox or rinderpest (caused by the rinderpest virus — RPV). Smallpox had caused epidemics throughout human history with estimated death tolls in the 300-500 million range (as high as 10% of all deaths in the 20th century).

Although rinderpest was used to cure smallpox, on its own it continued causing mass death of cattle herds throughout Europe and Africa for centuries.

More than a third of the population of Ethiopia died in the 19th century, for example, after Italians introduced infected cattle from India.

Vaccination was hindered due to conflict, lack of authority and perhaps even a lack of will from Europeans to solve for destabilization of Africa (preferring wealth accumulation to be controlled from Europe).

The BBC article points out the method used to test and eliminate the virus had to be administered locally, which meant operation in uncontrolled environmental conditions and by non-professionals.

The test, which was developed with the support of the UK’s Department for International Development, was designed to be used by local people in the field and to give reliable results within minutes. It proved highly effective and the technology has been rolled out across Africa. This was particularly important in the later stages of the programme when pockets of the virus remained in war-torn areas of southern Sudan and Somalia. Dr Mike Baron of the IAH told BBC News that it had been too dangerous for outsiders to enter those areas. Experts, he said, would train locals – so called ‘barefoot vets’ – to recognise the disease and administer vaccines. They would work with nomadic tribesmen in the regions and vaccinate herds “on the move”.

This is hugely important to understand for the security community because it highlights how distributed and centralized systems of information can interoperate; two systems of thinking, if you will, one deliberative and controlled (follow the steps handed to you) while the other is exploratory and creative (design the steps for others to follow).

The cost of infection was extremely high as 70% of cattle infected would die. This surely gave the incentive for tests and vaccines to be taken seriously. It also probably is what enabled the broad collaboration across systems despite national, religious and ethic diversity.

…to begin with [in the 1960s] there was little to no co-ordination. Individual countries and groups of countries would attempt to vaccinate cattle, suppressing the disease for a while. But it would then re-appear. Progress was only made [in the 1990s] once large unified projects were established to tackle the disease.

A dedicated global campaign, combined with local administration, was necessary for eradication.

Conflict in Ethiopia and Somalia in the 1980s was the main obstacle to the vaccination campaigns but there were other problems too. UC Davis has an excellent write-up about issues of trust, competition and complex economics that were overcome by an Ethiopian scientist in America armed only with an elegantly simple and stable test and vaccine.

The new vaccine proved amazingly powerful in protecting cattle, even when they were injected with 1,000 times a fatal dose of rinderpest. And it met all of Yilma’s criteria for simplicity and heat stability. Requiring no syringes or needles, the vaccine could easily be scratched onto the neck or abdomen of the animal, producing sufficient immune response to ward off the rinderpest virus. Later, the herder could just peel the scab from an animal’s immunization site, grind it up in a saline solution and, from a single calf, have 250,000 additional doses for future vaccinations.

What happens next? Here is an interesting side-note in the NYT:

Still to be decided is how much virus to keep frozen in various countries’ laboratories, along with tissue from infected animals and stocks of vaccine, which is made from live virus. Virologists like to have samples handy for research, but public health experts, fearing laboratory accidents or acts of terrorism, usually press to destroy as much as possible. The smallpox virus is officially supposed to exist only in two lab freezers, one in Atlanta and one in Moscow.

This brings me back to the Italian invasion of Ethiopia. Rinderpest has been associated with wars and invasions; arguably introduced as a form of biological warfare. The first Italian invasion of 1888 destroyed the capital and foundation of social relations in the Horn of Africa by killing 90% of livestock. Rinderpest also was followed by smallpox but the complete collapse of food sources intensified local disputes and withered resistance. Anyone who wonders if Italy could have had this role only needs to look to the second Italian invasion in 1935, which involved heavy use of mustard gas, tear gas and other agents as well as bombing of field hospitals.

Was Rinderpest unintentionally carried or sent as a strategic weapon? Rinderpest is still listed as “biological warfare” agent so keeping it in Atlanta or Moscow seems like an incredibly high risk practice.

Hi-tech Attack Sub Exposed

All the latest technology and training in the world was apparently no match for the shallow waters near Skye. The BBC says the Royal Navy’s newest, biggest and most powerful attack submarine — the HMS Astute — has run aground and exposed itself.

Aside from attack capabilities, it is able to sit in waters off the coast undetected, delivering the UK’s special forces where needed or even listening to mobile phone conversations.

Unless, of course, it runs aground. Well, at least out of those three capabilities they can still listen to phone conversations.

There is some chance the mistake is related to a new “platform management system”.

Speaking to the BBC last month, HMS Astute’s commanding officer, Commander Andy Coles, said: “We have a brand new method of controlling the submarine, which is by platform management system, rather than the old conventional way of doing everything of using your hands.

“This is all fly-by-wire technology including only an auto pilot rather than a steering column.”

Auto pilot? Every auto pilot I ever have used at sea has failed. The phrase also brings to mind the Exxon Valdez disaster, which was related to late night maneuvers outside the shipping lane while on autopilot.

Some interesting trivia about the HMS Astute can be found on Marine Buzz:

  1. Longer than 10 London buses
  2. Wider than 4 London buses
  3. Consumes 18,000 sausages every 10 weeks*, yet only has five toilets for 98 crew
  4. Produces oxygen from sea water and can purify the on-board atmosphere (see #3)

*approximately 2.623 sausages per crew member every day

Just when you thought stone and feet were confusing, now they have a London bus metric — 1/10 the size of the new class of attack submarine, and 1/4 the width. The next time a bus is late it will be hard not to say “maybe it ran aground”.

The Royal Navy boasts about their sub technology in the following video:

“We are something different. Something for the 21st Century.”