The COVIDtests.gov site has launched ahead of schedule and right at the top it has a “Here’s how you know” link to explain why you should trust this “official website“:

Does it seem safe? While they make a couple sound points, there’s more to it.

Do you also trust that a .gov was developed using a secure lifecycle, is operated safely and that it hasn’t been compromised by commercial motive? In other words, is there high integrity of the data on the pages as much as there may be integrity of the source identity?

I strongly recommend developing quality measures for the former (hard) much more than the latter (easy).

It reminds me of another .gov launch not so very long ago that was subjected to extreme partisan yet technical bickering…

The “healthcare.gov” website at the end of 2013 was ruthlessly attacked by Republican lobby groups and “experts” such as TrustedSec. Here’s a good example from headlines in early 2014:

Someone barking that the healthcare.gov site is “100 percent insecure” and trending worse seems factually false, no? It was a gross misrepresentation for political gain if not an outright lie.

In fact, while TrustedSec used the press to spread a rumor that healthcare.gov was 100% unsafe they were actually telling congress in testimony…

It is accurate that no system can ever remain one hundred percent protected against threats.

Could this kind of absolutism fallacy and obvious gaslighting be grounds for being disbarred from practicing security though?

No, because let’s be honest the security industry has no baseline of integrity for meaning being delivered in a message.

Sound harsh?

Consider that the TrustedSec CEO Dave Kennedy was on a highly-politicized PR campaign to discourage people from getting health insurance, mugging with Michele Bachmann (infamous religious extremist who advocated for dropping bombs as “one of the greatest acts of peace” while simultaneously trying to block peace agreements because she believed they could usher in World War III and the horror of… dropping bombs).

Kennedy’s obvious political self-promotion at this time went from hugging the extremist bomb-advocate Bachmann back stage at FOX news to literally spreading “100 percent” nonsense and FUD… claiming even healthcare.gov would hack anyone who dared to use it for their life-saving healthcare needs.

…saying vulnerabilities remain on “everything from hacking someone’s computer so when you visit the website it actually tries to hack your computer back, all the way to being able to extract email addresses, users names—first name, last name—[and] locations.”

“Actually tries to hack your computer back”?

This is nails-on-chalkboard stuff, only made worse by him saying the threat scale goes “all the way to being able” to know your name. So your name has been leaked proving that you’re in America and need healthcare insurance just like everyone else? That’s “all the way”?

And then there was the false claim made on FOX news that large numbers of probes of a .gov website indicates it already has been hacked or will be soon.

And this nonsense of course had the expected reaction putting people in a frothy partisan panic:

…you couldn’t pay me a million $ to go anywhere near that website #FullRepeal #ImpeachObama #MakeDCListen

That’s a 2014 reaction tweet from @livinbythelake. Today that same account is retweeting the wife of the Executive Editor for the Washington Examiner that COVID19 is a communist plot.

While clearly a “poison squad of whispering women” show they are coordinated in amplifying a fear narrative from TrustedSec as right-wing misinformation, the actual flaws were being misrepresented.

Probes ought not be directly correlated to breaches without some intelligence. That’s like saying evidence of water around a floating boat means you should guess it soon will spring a leak.

FUD.

Here was another clear sign TrustedSec’s Kennedy was speaking completely out of his mind on this issue.

His examples of “models” were sites later breached at FAR WORSE scale than healthcare.gov.

When it comes to securing personal information online, Kennedy cited Amazon, Facebook, and Twitter as models for the industry.

Facebook?! Are you FFFFFing kidding me.

FACEBOOK and AMAZON?

More than 540 million records about Facebook users were publicly exposed on Amazon’s cloud computing service…

Remember this was TrustedSec CEO testifying to Congress in November 2013 that Facebook should be held up as a model for the industry to protect privacy. This is literally what he said to Congress:

…the federal government isn’t known for having super secure web sites or even having adequate security to protect U.S. related sensitive data.

Oh really?

Facebook had just been breached in June 2013 leaking 6 MILLION records for over a year when this highly politicized testimony was filed alongside a poisonous PR campaign.

Does Facebook ever sound like any sort of real “model” for an industry to you? Facebook always has been known for failing at security and being a threat to U.S. data. It’s almost inconceivable that someone in 2013 was recommending them as a model, and it’s incredibly suspicious for anyone claiming the title “TrustedSec”.

Come on people, let’s look at this in context.

TrustedSec’s CEO was spreading on partisan news campaigns that the US government website is “100 percent insecure” and that everyone instead should carelessly put their data in Facebook (foreign adversary) hands?

Here’s how I described Facebook to everyone reading this blog in 2011 why I deleted my account in 2009:

…private company funded by Russians without any transparency that most likely hopes to profit from your loss (of privacy)… if Facebook is dependent on Zuckerberg their users are screwed.

That’s a full two years before the “TrustedSec” CEO was on TV telling Americans to hand their most sensitive data to the Russians instead of their own government.

Facebook’s massive unprecedented failures of safety (gross negligence if not incompetance) were never hard to find, and have only worsened over time:

• 2005 December – 70,000
• 2007 December – 4 million
• 2013 June – 6 million
• 2015 CSO quits abruptly and new one (hired from Yahoo despite failing to disclose breaches) boldly markets delivering best security in world (fired by 2018)
• 2016 Facebook breaches implicated in US Presidential election
• 2018 May – 14 million
• 2018 September – 50 million (at least)
• 2019 March – 600 million (at least) — PASSWORDS STORED CLEAR TEXT, KNOWN WORST POSSIBLE SECURITY PRACTICE
• 2019 April – 540 million
• 2019 April – 1.5 million
• 2019 September – 419 million (repeat of 2019 April)
• 2019 December – 309 million
• 2020 March – 42 million
• 2021 April – 500 million

Am I missing some? Surely this alleged “model” couldn’t have been any worse of a recommendation.

The icing on this history cake is that TrustedSec’s testimony gave milquetoast recommendations for fixing healthcare.gov that read like they were pulled directly from a 2-minute introduction to information security.

Fix the current security problems on the web site, which pose a high or critical risk… Develop a security operations center and ensure effective controls are in place… Perform end-to-end testing to benchmark the existing risk towards the healthcare.gov infrastructure and take appropriate action…

It’s so vague and generic as to be completely unhelpful.

Here’s what the TrustedSec guide to marine safety probably looks like: if you see or hear water you must be sinking, take appropriate action.

Let’s recount.

After five years healthcare.gov reported about 10 million people had received health-care coverage (essential to quality of life) while only as many as 75,000 people may have had sensitive information breached. Even that amount is disputed, so where’s the giant disaster predicted?

Headlines by 2017 were “Obamacare is working well” no thanks to TrustedSec doing its best to tell people to stay away.

Healthcare.gov popularity increased dramatically to 56%, no thanks to TrustedSec doing its best to tell people to stay away.

So, will the right-wing lobbyist “hackers” put on suits and ties to be wined-and-dined by FOX news again to spread FUD about this new health-oriented .gov site being a threat?

Facebook, the darling of the Republican lobbyists and extremists intent on destroying Obamacare, over the same time delivered the worst security practices and breaches in history (on top of destroying quality of life and being implicated in atrocity crimes).

Why so bad?

Basic American history offered us a good insight into “experts” like Dave Kennedy stumping in 2013 for the Confederate Party, even predicting escalation to the violence seen last year.

ObamaCare cannot be accepted. No matter that it was passed by Congress, signed by the President, found constitutional by the Supreme Court, and ratified by the people when they re-elected President Obama. It cannot be allowed to stand, and so the tactics for destroying it get ever more extreme. The point of violence has not yet been reached, but the resistance is still young.

How dangerous was it in 2013 for a security “expert” to tell people not to sign up for healthcare from a .gov site?

Very dangerous, made far worse by telling them to trust Facebook instead. We can think of extremists like Bachmann telling us that dropping bombs was her model for peace like Kennedy telling us that using Facebook was his model for privacy.

So back to today, how dangerous will it be if someone says avoid .gov and don’t get test kits or vaccinations during this pandemic?

Read more 2014 analysis of history for the answer.

Our modern Confederates are quick to tell the rest of us that we don’t understand them because we don’t know our American history. And they’re right. If you knew more American history, you would realize just how dangerous these people are.

So it all begs the question who do you trust and what does it mean when you see that you are using a .gov site? History has the answers.

Related: Timeline of Amazon breaches and timeline of Twitter breaches, neither doing nearly as well in trust as healthcare.gov has this whole time.

An inability to translate clear signals is perhaps the most interesting lesson I’ve found from an analysis of North Korea’s 1968 capture of the USS Pueblo spy ship.

The following paragraph comes from unclassified CIA files: Studies in Intelligence Vol 59, No. 1 (Extracts, March 2015).

The ship would gain little insight or warning from monitoring the North’s clear-voice communications because the rusty language skills of two Korean linguists belatedly assigned to the ship’s SIGINT detachment were not up to the job of rapidly translating fast-moving tactical traffic. At a tactical level, NSA observed that had the linguists been qualified they would have understood a full 20 minutes before the first shots were fired at Pueblo that North Korean patrol boats were maneuvering to fire.

The CIA might be making a subtle yet very poignant argument that all the best high-tech in the world doesn’t amount to a hill of beans when basic skills and wisdom for placement and use are missing.

As a corollary, someone thought it a good idea to mount exposed machine guns on the high deck of this “oceanographic research” vessel — too small to defend against threats, too large to be denied, and completely exposed to ice and enemy fire in a way nobody ever could want to use in bone-chilling hostile waters.

The CIA also has pointed out key material for stolen cryptography machines were leaked to the KGB around the same time by a US Navy Chief Warrant Officer, John Walker.

For a KGB station chief personally to meet a prospective agent was unprecedented, but Solomatin spent the next two hours talking privately with Walker. The American favorably impressed him by saying nothing about love for communism, which most phonies emphasized. This was strictly business.

That wasn’t a backdoor risk from engineering, but rather a front-door insider threat, made possible due to weakness in key management processes.

Because the KW-7 used key-lists it was considered expendable as long as the monthly key-list cards themselves were not compromised. […] KW-7 cryptographic machines were most certainly lost prior to the unit that was aboard
Pueblo. […] he one thing that the Soviets or the East Germans did not obtain was the key-lists. They may have possessed a few key-cards at various times but John Walker provided the constant flow that was needed to make penetration of US Naval communications by the Soviets such a continuing success. […] The flaw in the system was the assumption that the outdated key-cards had been destroyed. Walker certified he had destroyed the cards, when in actuality he simply took them and gave them to the Soviets. No one verified that Walker had indeed destroyed the previous month’s cards.

I find this all worth consideration today given how journalists repeatedly cast a negative light on the chief of security at platforms like Facebook (e.g. Alex Stamos), who clearly and repeatedly failed to deploy basic proficiency in spaces where information risks were known to be the highest.

Did the NSA come to any similar conclusions as the CIA about this fundamental failure in risk monitoring (skill for clear-voice translation), let alone management of how and where crypto should sail or not?

As I stood there Don Peppard came up behind me and asked if I had any idea of where we were. I said that I didn’t have the foggiest idea. When we’d left Japan and headed north, my knowledge of geography must have been on hold — it simply never dawned on me that the only countries west of us had to be China, Korea or Russia. Where were we?

On 28 July 1969, a document in the NSA files called “Report on the Assessment of Cryptographic Damage“, offered itself as the final assessment of the incident:

That rosy picture of risk definitely wasn’t carried into the 2015 CIA files, which argue significant damage was done by compromise of intelligence gathering materials as well as the link to Walker.

Congress was on to these things right away in their 1969 “Inquiry Into the U.S.S. Pueblo and EC-121 Plane Incidents: Hearings, Ninety-first Congress, First Session” (US Government Printing Office, page 729):

The National Security Agency, which questioned the risk of the Pueblo mission, had neither the responsibility nor the authority to do so. […] There is a great difference of opinion at high intelligence levels as to whether or not the loss of the Pueblo was very serious in terms of our national security and national intelligence effort.

The NSA today offers readers a raft (no pun intended) of related documents available to the public, which purports to be lessons learned.

Indeed, much of this history is directly relevant to the nature of problems faced by security officers today.

I just don’t see the clear-eyed analysis from the NSA. And in current context I wonder if anyone at Facebook security (often hired out of the NSA) thought about the Pueblo incident before claiming they didn’t anticipate basic translation skill or insider threats would be so important given all their fancy communication equipment being repurposed today in hostile countries.

An neuroscience article from 2017 in HBR lays out the premise that improving trust has direct and immediate benefits to productivity:

Compared with people at low-trust companies, people at high-trust companies report: 74% less stress, 106% more energy at work, 50% higher productivity, 13% fewer sick days, 76% more engagement, 29% more satisfaction with their lives, 40% less burnout.

This study was based upon “an amount of money to send to a stranger via computer” and also claims it found an absolute observed causation.

This research even took me to the rain forest of Papua New Guinea, where I measured oxytocin in indigenous people to see if the relationship between oxytocin and trust is universal. (It is.)

I want to get back to that point in a minute, but first, I noticed that exposing vulnerabilities is one of their key recommendations for building trust when running a business.

Show vulnerability: Leaders in high-trust workplaces ask for help from colleagues instead of just telling them to do things. My research team has found that this stimulates oxytocin production in others, increasing their trust and cooperation. Asking for help is a sign of a secure leader—one who engages everyone to reach goals. Jim Whitehurst, CEO of open-source software maker Red Hat, has said, “I found that being very open about the things I did not know actually had the opposite effect than I would have thought. It helped me build credibility.” Asking for help is effective because it taps into the natural human impulse to cooperate with others.

This tracks to the story I wrote about here before where the British in WWII undermined Nazi morale using such a “show vulnerability” tactic.

…the BBC was choosing to broadcast detailed news of Britain’s military setbacks. The decision was part of a deliberate strategy to win the hearts and minds of the German people…

Now back to Papua New Guinea and the indigenous people. If trust is universal, that doesn’t necessarily mean money fits the model. An article way back in 2013 made the salient point that modern psychology tends to be heavily biased towards post-industrial value systems.

At the heart of most of that research was the implicit assumption that the results revealed evolved psychological traits common to all humans, never mind that the test subjects were nearly always from the industrialized West. Henrich realized that if the Machiguenga results stood up, and if similar differences could be measured across other populations, this assumption of universality would have to be challenged.

The results being talked about are this: not all people play the prisoner dilemma game the same way. People living in the Amazon Basin jungle regions of southeastern Peru had a fascinating take on trust.

When he began to run the game it became immediately clear that Machiguengan behavior was dramatically different from that of the average North American. To begin with, the offers from the first player were much lower. In addition, when on the receiving end of the game, the Machiguenga rarely refused even the lowest possible amount. “It just seemed ridiculous to the Machiguenga that you would reject an offer of free money,” says Henrich. “They just didn’t understand why anyone would sacrifice money to punish someone who had the good luck of getting to play the other role in the game.”

Believing someone else has luck in getting to be the winner is a collaborative and holistic view, much like seeing a team mate score a goal. But who is on which team, or is it all just one team? A new book called “The Social Instinct: How Cooperation Shaped the World” makes it sound like the Machiguenga are on to something:

If we think about society as a whole, we can think of nepotism, corruption, and bribery—not normally words that bring cooperation to mind, yet all describe some form of cooperation. Nepotism is helping a family member; corruption is forming a collaboration with another individual that, nevertheless, has a cost to society. So, global or societal cooperation is always under threat from more local cooperation, which affects our collective welfare. The big challenge for us is to find ways to cooperate to generate larger societal benefits and not just local benefits.

That can read completely backwards unless you acknowledge the Machiguenga are operating on a local level while thinking about larger societal benefits, whereas larger society is thinking the opposite. Another way of putting that reversal is the Mission 101 in the Horn of Africa, or even the French resistance in WWII: small local cells of thinkers cooperated in order to generate larger societal benefits while under occupation by Nazis (who tried to elevate their own status based on distrust, spreading corruption on a platform that redirected society benefits to a very small group).

So it begs the question if you ask for help and show vulnerability, how do you tell whether you are on the same team, or the right team? It reminds me of the lesson “Stop Trying to Raise Successful Kids: And start raising kind ones.”

However much we praise kindness and caring, we’re not actually showing our kids that we value these traits. Perhaps we shouldn’t be surprised, then, that kindness appears to be in decline. A rigorous analysis of annual surveys of American college students showed a substantial drop from 1979 to 2009 in empathy and in imagining the perspectives of others. Over this period, students grew less likely to feel concern for people less fortunate than themselves—and less bothered by seeing others treated unfairly. It’s not just that people care less; they seem to be helping less, too.

The authors suggest popularity tests in American society are growing imbalanced, measurably dragged away from kindness and towards artifice (status).

Psychologists distinguish between two paths to popularity: status (which derives from being dominant and commanding attention) and likability (which comes from being friendly and kind). […] We tell our own children that they shouldn’t hang out with the popular kids who sneer and laugh when a classmate trips in the cafeteria. They should get to know the kids who help pick up her tray.

Let me take this even further and suggest the proper study of history is inherently about disclosing vulnerability, a shared attempt to quickly find flaws and correct them where everyone theoretically could be on the same team. Kindness and caring would stem from greater levels of trust, however that status thing often gets in the way like a siren song calling sailors to crash upon the rocks.

Here’s a 2021 opinion piece on a 1973 report called “‘Lessons’ of the Past: The Use and Misuse of History in American Foreign Policy”, which credits Taiye Selasi (a founder of Afropolitanism) with vulnerable thought:

It presented viewpoints I had not fully considered and reinforced the obvious but important lesson that our own thinking improves when we expose ourselves to voices and ideas we don’t typically encounter. What if we are wrong? While they rarely say so out loud, the best scholars, analysts, and decision-makers always wonder. Perhaps, however, we are asking the wrong question. History demonstrates time and again that, despite great effort, we will be wrong as often as not. The past demonstrates that world politics is so complex, historical processes so interdependent, that we should always expect the unexpected. Marc Bloch reminds us that “history is neither watchmaking not cabinet construction” but “an endeavor towards better understanding and, consequently, a thing in movement.” The real question — and the true benefit of engaging with the past — is how we will respond when we are wrong.

I especially relate to that last point. Sometimes when I confidently present a take on history, especially in public presentations, I am asked how dare I claim to have the only perspective on an event. Just look to the left at “popular blog posts” for an example of what they are talking about.

To this critic I always try to reply it’s the opposite, as I see the study of history much like tuning a sailboat in danger of running aground.

Like finding a vulnerability in someone’s map or chart for a destination, I’m not claiming to be replacing their destination with my own. My claim usually is to have found a vulnerability and present a transparent and repeatable falsification test to show that we all can improve our own perspectives and arrive more safely, no matter where we are headed (together or not).

How people respond when they are proven wrong is an excellent test not only of trust, but of their sense of fairness.

Perhaps there is no better introduction to this topic than the 1949 book by Marc Bloc “The Historian’s Craft: Reflections on the Nature and Uses of History and the Techniques and Methods of Those Who Write It”

This is a work that argues constantly for a wider, more human history. For a history that describes how and why people live and work together. There is a living, breathing connection between the past and the present and it is the historian’s responsibility to do it justice.

Bloch joined the French Resistance rather than escape, writing on the nature of history while under occupation by Nazis and without access to libraries or colleagues. He was executed by firing squad in 1944, his book published posthumously. His story is a perfect example of the duality of trust and vulnerability, within a context of threat to life itself. Imagine how productive he could have been if he had been even more trusted at that time.