Category Archives: Catastrophe

Davos discovers cyber attacks

Cyber attacks made the Davos Top 5 Global Risks in Terms of Likelihood. Davos, the annual conclave of the hyper-rich and famously elected, has also discovered Severe income disparity and Water supply crisis, so maybe they’re becoming more realistic.

However, in Figure 17 on page 25 they’ve got Cyber attacks as an origin risk, along with Massive incident of data fraud or theft and Massive digital misinformation. I think they’re missing the point, which is the real origin risk is poor infosec, and the origin of that is vendors like MSFT knowingly shipping systems with design flaws and people and organizations running them while hiding such problems.

Interesting comment on page 26: Continue reading →

Route Hijacking: Identity Theft of Internet Infrastructure

Peter Svensson gives an old and quite serious problem some mainstream press in this AP story from 8 May 2010:
On April 25, 1997, millions of people in North America lost access to all of the Internet for about an hour. The hijacking was caused by an employee misprogramming a router, a computer that directs data traffic, at a small Internet service provider.

A similar incident happened elsewhere the next year, and the one after that. Routing errors also blocked Internet access in different parts of the world, often for millions of people, in 2001, 2004, 2005, 2006, 2008 and 2009. Last month a Chinese Internet service provider halted access from around the world to a vast number of sites, including Dell.com and CNN.com, for about 20 minutes.

In 2008, Pakistan Telecom tried to comply with a government order to prevent access to YouTube from the country and intentionally “black-holed” requests for YouTube videos from Pakistani Internet users. But it also accidentally told the international carrier upstream from it that “I’m the best route to YouTube, so send all YouTube traffic to me.” The upstream carrier accepted the routing message, and passed it along to other carriers across the world, which started sending all requests for YouTube videos to Pakistan Telecom. Soon, even Internet users in the U.S. were deprived of videos of singing cats and skateboarding dogs for a few hours.

In 2004, the flaw was put to malicious use when someone got a computer in Malaysia to tell Internet service providers that it was part of Yahoo Inc. A flood of spam was sent out, appearing to come from Yahoo.

The Pakistani incident is illustrated in the accompanying story and video by RIPE.

This problem has been known for a long time. Why hasn’t it been fixed? Continue reading →

Confusopoly, or Scott Adams, Prophet of Finance

While sitting in a small room perusing a book from the bottom of the stack, The Dilbert Future, I idly looked again at Scott Adam’s prediction #2:
In the future, all barriers to entry will go away and companies will be forced to form what I call “confusopolies”.

Confusopoly: A group of companies with similar products who intentionally confuse customers instead of competing on price.

OK, good snark. But look at the list of industries he identified as already being confusopolies:
  • Telephone service.
  • Insurance.
  • Mortgage loans.
  • Banking.
  • Financial servvces.
Telephone companies of course since then have gone to great lengths to try to nuke net neutrality.

And the other four are the source of the currrent economic meltdown, precisely because they sold products that customers couldn’t understand. Worse, they didn’t even understand them!

It gets better. What industry does he predict will become a confusopoly next? Electricity! And this was in 1998, before Enron engineered confusing California into an electricity-price budget crisis.

For risk management, perhaps it’s worth considering that simply selling something the customer can understand can rank way up there. Certainly for the customer’s risk. And given how much the FIRE companies drank their own Kool-Aid, apparently it’s good risk management for the company itself. Especially given that the Internet now gives the customer more capability to find out what’s going on behind a confusopoly and more ability to vote with their feet.

To actually make a product the customer wants, and then provide good customer service: how old-fashioned! And how less risky and more profitable in the long term.

Sony Rootkitting: How It Happened

sonyrootkit.gif Here’s a paper about Sony and the Rootkit:

While Sony BMG’s customers first became aware of the dangers posed by the rootkit through media reports following Russinovich’s October 31 announcement, the company was on notice that its product contained a rootkit, at the very least, four weeks earlier.12 Finnish anti-virus software developer F-Secure contacted Sony BMG on October 4, 2005, alerting it to the presence of the rootkit.13 Of course, First4Internet, as the developer that chose to incorporate the rootkit into its design, necessarily knew of its presence from the outset.

— THE MAGNIFICENCE OF THE DISASTER: RECONSTRUCTING THE SONY BMG ROOTKIT INCIDENT, By Deirdre K. Mulligan & Aaron K. Perzanowski

Yet Sony apparently thought that they could still sneak a rootkit onto CDs its customers paid for. The customers knew better, because Amazon reviews told them, and sales CDs plumetted as soon as rootkit-infested versions were issued.

This maybe illustrates three points:

Continue reading →

Massachusetts Earthquakes

nequakemap.gif In addition to the possibility of hurricanes (the Long Island Express also went through Massachusetts) and tornadoes, does Massachusetts also need to worry about earthquakes interrupting baseball games?

For the second time this month an earthquake has hit Massachusetts.

NewsCenter 5 received numerous calls from people in the Groton, Westford and Littleton area. Residents said that they heard what sounded like a loud boom or explosion. Some said that they felt their homes shake.

The U.S. Geological Survey confirmed that an earthquake measuring 2.5 hit the region at about 1:30 a.m. Residents in Westford and Littleton also said that they heard rumblings at about 6:05 a.m.

— Earthquake Shakes Bay State, Residents In Route 2 Area Report Loud Boom, TheBostonChannel.com, 19 Oct 2007

Like hurricanes and tornadoes, it has happened before:

….a quake that shook Newburyport on Oct. 29, 1727. That was a 5.5 magnitude earthquake that was felt from Maine to Philadelphia.

— Bay State Residents Jolted By Ancient Earthquake, Quake Measured 1.8 On Richter Scale, TheBostonChannel.com, 10 Oct 2007

Are earthquakes as likely as tornadoes or hurricanes to cause damage in Massachusetts?

Continue reading →

HelpJet: Disaster Evacuation in Style

images.jpeg AIG may sell boutique wildfire insurance, but that’s nothing on HelpJet:
The new service from West Palm Beach-based Galaxy Aviation guarantees its well-heeled members a seat on a chartered jet out of the hurricane zone, reserves five-star hotel rooms and limousine transfers and rolls out a red carpet — literally.

“We call it evacuation in style,” said Brian Rems, who came up with the HelpJet concept.

— Hurricane Victims Can Evacuate in Style, By MATT SEDENSKY, Associated Press Writer Saturday, September 16, 2006

Naomi Klein points out the flip side:
For the people left behind, there is a different kind of privatized solution. In 2006, the Red Cross signed a new disaster-reponse partnership with Wal-Mart. “It’s all going to be private enterprise before it’s over,” said Billy Wagner, chief of emergency management for the Florida Keys. “They’ve got the expertise. They’ve got the resources.” He was speaking at the National Hurricane Conference in Orlando, Florida, a fast-growing annual trade show for the companies selling everything that might come in handy during the next disaster.

— Disaster Capitalism: The new economy of catastrophe, By Naomi Klein, Harper’s Magazine, September 8, 2007

So what are we looking at here? Clever entrepeneurs seeing a market need and filling it? Or the calculated privatization of every government function (Klein)? More to the point, is it good risk management?

Oh, and is there really money in it? www.HelpJet.us currently is all about Galaxy Aviation, and doesn’t say Help Jet anywhere, nor does it mention the kinds of services Help Jet was selling. (I’m pretty sure that’s the right URL, since Google still shows old initial text for about.html as “Not any more with Help Jet, the world’s first hurricane escape plan that turns a hurricane evacuation into a jet-setter vacation. Here’s how Help Jet works. …”) Meanwhile, AIG has been known to start a line of insurance just to see if it will sell.

-jsq

Boutique Wildfire Insurance

aigtrucks.jpg Of course it’s AIG offering this:

In 2005 the loss prevention experts at AIG Private Client Group created the first-ever personal wildfire protection program. This groundbreaking service is available exclusively to AIG Private Client Group policyholders who reside in designated response zones in the western U.S.

— Wildfire Protection Unit®, Exclusively for AIG Private Client Group Policyholders, AIG Private Client Group, accessed 9 October 2007

If you guessed that Aspen and Vail were among the designated response zones, you guessed correctly! And Los Altos and Beverly Hills. Good old AIG: charge what the traffic will bear and see if there’s a market.

They have a similar hurricane protection unit.

Continue reading →

Bananas and Apples: Another Monoculture

banana-bunch_d.gif Yes, we will have no bananas, again:

Most commercial growing facilities handle just a single banana type — the one we Americans slice into our morning cereal.

…

How much time is left for the Cavendish? Some scientists say five years; some say 10. Others hold out hope that it will be much longer. Aguilar has his own particular worst-case scenario, his own nightmare. "What happens," he says, with a very intent look, "is that Panama disease comes before we have a good replacement. What happens then," he says, nearly shuddering in the shade of a towering banana plant, "is that people change. To apples."

—Can This Fruit Be Saved? By Dan Koeppel, popsci.com, June 2005

Cavendish is the variety of banana eaten the world around. "Quite possibly the world’s perfect food," says Chiquita. But perfection comes with a price if it leads to monoculture. And that’s what we’ve got with bananas: every commercial Cavendish banana tree is grown from cuttings of the original tree, and so is genetically identical. Banana monoculture has borne the fruit of disaster before.

Growers adopted a frenzied strategy of shifting crops to unused land, maintaining the supply of bananas to the public but at great financial and environmental expense — the tactic destroyed millions of acres of rainforest. By 1960, the major importers were nearly bankrupt, and the future of the fruit was in jeopardy. (Some of the shortages during that time entered the fabric of popular culture; the 1923 musical hit "Yes! We Have No Bananas" is said to have been written after songwriters Frank Silver and Irving Cohn were denied in an attempt to purchase their favorite fruit by a syntactically colorful, out-of-stock neighborhood grocer.) U.S. banana executives were hesitant to recognize the crisis facing the Gros Michel, according to John Soluri, a history professor at Carnegie Mellon University and author of Banana Cultures, an upcoming book on the fruit. "Many of them waited until the last minute."

Denial in the face of a clear and present ecological danger. We’ve seen this before.

Continue reading →

Common Sense Lacking for Big Perils such as Georgia Hurricane or WorstCase Worm

KClark.jpg Why it’s not good to depend on common sense for really big perils:
The models these companies created differed from peril to peril, but they all had one thing in common: they accepted that the past was an imperfect guide to the future. No hurricane has hit the coast of Georgia, for instance, since detailed records have been kept. And so if you relied solely on the past, you would predict that no hurricane ever will hit the Georgia coast. But that makes no sense: the coastline above, in South Carolina, and below, in Florida, has been ravaged by storms. You are dealing with a physical process, says Robert Muir-Wood, the chief scientist for R.M.S. There is no physical reason why Georgia has not been hit. Georgias just been lucky. To evaluate the threat to a Georgia beach house, you need to see through Georgias luck. To do this, the R.M.S. modeler creates a history that never happened: he uses what he knows about actual hurricanes, plus what he knows about the forces that create and fuel hurricanes, to invent a 100,000-year history of hurricanes. Real history serves as a guide it enables him to see, for instance, that the odds of big hurricanes making landfall north of Cape Hatteras are far below the odds of them striking south of Cape Hatteras. It allows him to assign different odds to different stretches of coastline without making the random distinctions that actual hurricanes have made in the last 100 years. Generate a few hundred thousand hurricanes, and you generate not only dozens of massive hurricanes that hit Georgia but also a few that hit, say, Rhode Island.

— In Nature’s Casino, By Michael Lewis, New York Times, August 26, 2007

And of course a hurricane did hit the Georgia coast before detailed records were kept, in 1898. The article notes that before Hurricane Andrew, insurers believed that a Florida hurricane would cost max a few billion. The actual cost was more like $15.5 billion, predicted only by one woman: Karen Clark, founder of A.I.R.

Sure, the Georgia coast doesn’t have any single concentration of wealth like Miami. But it does have a swath of wealth that could be taken down by a single storm. And complacent owners who think it can’t ever happen, just like people in Thailand didn’t believe Smith Dharmasaroja before the 2004 Tsunami.

Meanwhile, on the Internet, the few insurers of Internet business continuity are winging it and most companies have no insurance at all, despite online crime becoming increasingly sophisticated, leveraging the global reach of the Internet, and the possibility of a global worm that could cause $100 billion damage still being out there.

-jsq .