Creeping Failure: How We Broke the Internet and What We Can Do to Fix It

by Jeffrey Hunker

The Internet is often called a superhighway, but it may be more analogous to a an immense tangle of streets, highways, and interchanges, lined with homes and businesses, playgrounds and theatres. We may not physically live in this city, but most of us spend a lot of time there, and even pay rents and fees to hold property in it.

But the Internet is not a city of the 21st century. Jeffrey Hunker, an internationally known expert in cyber-security and counter-terrorism policy, argues that the Internet of today is, in many ways, equivalent to the burgeoning cities of the early Industrial teeming with energy but also with new and previously unimagined dangers, and lacking the technical and political infrastructures to deal with these problems. In a world where change of our own making has led to unexpected consequences, why have we failed, at our own peril, to address these consequences?

Drawing on his experience as a top expert in information security, Hunker sets out to answer this critical question in Creeping Failure . Hunker takes a close look at the "creeping failures" that have kept us in a state of cyber how and why they happened, and most crucially, how they can be fixed. And he arrives at some stunning conclusions about the dramatic measures that we will need to accomplish this.

This groundbreaking book is an essential first step toward understanding the World Wide Web in a larger context as we try to build a safer Internet "city." But it also raises issues that are relevant far outside the online for example, how can we work together to create not just new policy, but new kinds of policy? Creeping Failure calls for nothing less than a basic rethinking of the Internet — and of how we solve problems together.

Genres: Nonfiction

288 pages, Hardcover

First published January 1, 2010

Reviews

[Phoenix · Rating 4 out of 5]

Interesting and Relevant

Recently we had a one day in-house workshop on network security and this book was on the recommended reading list, in part because it had references to Canadian responses to the problems of Internet related crime. It touched on a number of issues brought up in our seminar but missed some such as the need to establish protocols to ensure traceability and for recovery after the fact.

The author begins by outlining the problems faced by the technical community. Some of these I was aware of however the extent was greater than I realized. For example both Chinese and Russian groups were far more aggressive in attacking systems than I imagined and over a third of US agencies including the DOD received a grade of F on the "Federal Security Report Card". (pp 129 - DOD to be fair is extremely large and diverse; DOJ, NSF, Social Security and the EPA all received A or better). The attacks are usually distributed and hackers are now leasing armies of tens of thousands of "bots" with specific payloads to both the foreign governments and organized crime. As examples he cites cyber attacks against Estonia in 2007 and against Georgia in 2008 just prior to the Russian invasion, and, as a response to the accidental bombing(1) of the Chinese embassy in 1999, the attacks on the White House and US government agencies. In all cases the offending parties blamed "hacktivists" who were sympathetic to the other side. Hunker then asks what what the appropriate response might be, given the non specific source of the enemy attack.

One of the aspects of the book that I enjoyed that made the issues understandable was the author's use of historic analogy between the growth of city infrastructure and the Internet. He uses the example of the transition of fire departments from private subscriber only organizations that would let the neighbour's house burn if she were not a member to city services. Similarly he argues that one way to improve both the quality and security of software is to make the software firms liable for failures to perform which worked for product safety.

However when it came to technical recommendations the book comes up a bit short. Hunker believes that we need a "new Internet" built on different protocols, specifically IP-6 which he indicates has been around for a decade or so, but people have been slow to implement. He suggests that nations such as Canada, the US, Australia, Britain and New Zealand develop a secure prototype using military research funds. He makes the need clear, but doesn't get into what will be different in this approach other that it will give make it easier to verify the identity of system infiltrator. I'm not in total agreement given the positive subversive roll the Internet currently is playing in toppling despotic regimes in the Middle East (2), nor do I get the sense of how it could be successfully done and possible downsides. Given that he had served on the National Security Council as the Senior Director for Critical Infrastructure I was hoping for more.

However I did learn of reporting agencies such as US-CERT and the Canadian Cyber Incident Response Centre.

(1) It may have been no accident - the Chinese were apparently supplying information to Milosevic's forces.
(2) My understanding is that the collapse of the Soviet Union was enabled by communication technology as well - fax machines and internet email.

[Donald]

Reminds me of the book Geekonomics. Compares the Internet to a rapidly growing city such as 1800s London. Identifies the need for appropriate policy to govern and control the Internet, including things like tort liability for software vendors and perhaps ISPs. Recommends creation a new network, designed and built securely.