Thursday, October 30, 2014

Homeland Security and Public Safety : 'Widespread Harm' Likely from Cyberattack in Next Decade

A majority of Internet experts think that by 2025, a major cyberattack will have caused widespread harm to a nation's security and capacity to defend itself and its people.


(MCT) — Be afraid of potentially devastating cyberattacks, and be better prepared to guard against them. But also be wary of the risks — especially to privacy — that accompany a growing focus on cybersecurity that may exaggerate some threats.

Those are among the themes and dissents that emerge from a report Wednesday by the Pew Research Center and Elon University's Imagining the Internet Center. Its authors surveyed more than 1,600 computer and Internet experts on the future of cyberattacks and found most said there was good reason to worry.

More than 60 percent answered "yes" to the question: "By 2025, will a major cyberattack have caused widespread harm to a nation's security and capacity to defend itself and its people?"

"The majority opinion here is that these attacks will increase and that lots of institutions, including major government institutions, will be at risk," said Lee Rainie, director of the Pew Research Internet Project and coauthor of the report.

Rainie said many experts cited the Stuxnet worm as an example of how a cyberattack could wreak havoc on essential systems such as power grids, air-traffic controls, and bank networks.

Stuxnet, widely believed to have been created by U.S. or Israeli intelligence to undermine Iran's nuclear program, infected the software of at least 14 industrial sites in Iran and helped destroy as many as a fifth of the centrifuges being used to enrich radioactive fuel, Pew said. Unlike computer viruses, which a user must unwittingly install, worms can spread on their own through a computer network once they are introduced.

Many study participants called Stuxnet a harbinger of future cyberattacks. Jason Pontin, editor and publisher of the MIT Technology Review, likened it to "a Pearl Harbor event."

"Do we really believe that the infrastructure of a major industrial power will not be so attacked in the next 12 years?" he asked. “The Internet is an insecure network; all industrialized nations depend on it. They're wide open."

Some said a cold war-like dynamic — particularly the threat of "mutually assured destruction" — should inhibit international cyber warfare, at least involving major attacks. Others see more danger to financial systems than to other essential infrastructure that could easily be hit by ordinary weapons.

"Right now, cyberattacks are too costly," one unnamed respondent said. "The bigger risk will be when cyber crooks drain Wall Street of all its cash."

And some say the threats themselves "are being exaggerated by people who might profit most from creating an atmosphere of fear," said coauthor Janna Anderson of Elon University. Some also warn privacy would continue to suffer if security risks are exaggerated.

"Perhaps I am optimistic, but this concern seems exaggerated by the political and commercial interests that benefit from us directing massive resources to those who offer themselves as our protectors," wrote Jonathan Grudin, a principal researcher at Microsoft Research, who said media reports overstate the threats.

Recalling President Dwight Eisenhower's 1961 warning about the influence of a "military-industrial complex," Grudin said leaders seem "powerless to rein in the military-industrial-intelligence complex, whose interests are served by having us fearful of cyberattacks."

Many skeptics also voiced hope that the worst threats would be containable.

"While, in principle, all systems are crackable, it is also possible to embed security far more deeply in the future Internet than it is in the present Internet environment," said Lee McKnight, a professor at Syracuse University's School of Information Studies.

McKnight said that although it was easy to see today's multimillion-dollar online financial frauds foreshadowing even larger attacks on property or life, "the white-hat good guys will not stop, either."

But the worriers and the skeptics agree on one point: Today's expensive cyber arms race has only just begun.
 
©2014 The Philadelphia Inquirer. Distributed by MCT Information Services.
www.emergencymgmt.com 

www.emergencymgmt.com

Public Health : Governors' Ebola Quarantines at Odds with Scientists' Warnings

Obama administration officials warned that mandatory quarantines in the U.S. of doctors, nurses and other health-care workers who have traveled to Africa to help Ebola patients risked worsening the epidemic.

(MCT) — Top Obama administration officials publicly warned Sunday that mandatory quarantines in the U.S. of doctors, nurses and other health care workers who have traveled to Africa to help Ebola patients risked worsening the epidemic.
Mandatory 21-day quarantines, now in place in New York, New Jersey and Illinois, are "a little bit draconian" and could discourage people from helping to fight the disease, Dr. Anthony Fauci, the top Ebola expert at the National Institutes of Health, said in several television interviews Sunday.
Fauci's public remarks came as the administration privately pushed the states to reconsider.
New York Gov. Andrew Cuomo defended the quarantine policy during a Sunday night news conference, but outlined a version that appeared less onerous than the treatment that has been accorded so far to the one person in quarantine, in New Jersey. Cuomo and New Jersey Gov. Chris Christie had ordered the quarantine policy Friday but had left details unclear.
"My personal practice is to err on the side of caution," Cuomo said. Health care workers returning to New York who were exposed to Ebola patients in West Africa would be required to stay home for three weeks, he said. The state would work with hospitals to encourage doctors and nurses to travel to Africa to fight the disease and, if necessary, would pay the salaries of health care workers while they were in quarantine, he added.
The three states with quarantine orders are among five with airports used by travelers arriving from West Africa. The other two states, Georgia and Virginia, have not taken similar action. Florida has ordered enhanced monitoring of people in contact with Ebola patients, but not a quarantine.
The federal government could soon propose new rules for dealing with returning health care workers that would not involve quarantines, a senior administration official said.
As controversy grew over how to handle health care workers, the nurse who has been the first person subjected to quarantine called her treatment in New Jersey "inhumane." New York Mayor Bill de Blasio said the nurse had been mistreated.
Kaci Hickox, a nurse and epidemiologist for Doctors Without Borders, returned from Sierra Leone on Friday and was detained at Newark International Airport. She has been held since then in what she described to CNN's Candy Crowley as a "tent structure" outside University Hospital in Newark, N.J., with a portable toilet and no shower.
"I feel physically completely strong and emotionally completely exhausted," she said, noting that she has no fever or any other symptom of the disease. "This is an extreme that is really unacceptable, and I feel like my basic human rights have been violated."
Doctors Without Borders said the tent was not heated, "and she is dressed in uncomfortable paper scrubs."
Hickox's lawyer, Norman Siegel, a former New York Civil Liberties Union executive director, said he would go to court to seek her release.
De Blasio likened her to a "hero, coming back from the front" _ using a word also used by Fauci and other administration officials. De Blasio said Hickox had been "treated with disrespect, was treated as if she has done something wrong, which she hasn't."
The mayor made his comments at a midafternoon news conference at Bellevue Hospital in Manhattan, where the city's only Ebola patient, Dr. Craig Spencer, is being treated. A spokesman for the hospital said the doctor was in "serious, but stable condition" and "looking a little bit better than he looked yesterday." De Blasio also appeared with Cuomo on Sunday night.
Earlier in the day, Christie defended the quarantine policy that he and Cuomo had ordered after Spencer's diagnosis.
"I don't believe that when you're dealing with something as serious as this that we can count on a voluntary system." Christie told the "Fox News Sunday" program. "This is government's job. If anything else, the government's job is to protect the safety and health of our citizens."
The quarantine order from Cuomo and Christie requires 21-day confinement for anyone who has come into contact with Ebola patients in Sierra Leone, Guinea or Liberia, the three countries hardest hit by the epidemic.
They announced the move after Spencer, who had treated Ebola patients in Guinea, came down with the virus. Spencer had visited several places in the city, including a restaurant and a bowling alley, before developing a fever and contacting health officials on Thursday. Health officials have stressed that he was not contagious before developing symptoms.
Shortly after Christie and Cuomo acted, Illinois Gov. Pat Quinn issued a similar quarantine order. "This protective measure is too important to be voluntary," Quinn said. "We will continue to take every safeguard necessary to protect first responders, health care workers and the people of Illinois."
Fauci, the director of the National Institute of Allergy and Infectious Diseases, said that the public could be protected without going as far as a quarantine and that ordering people confined for an extended period could result in "unintended consequences."
"Let's not forget the best way to stop this epidemic and protect America is to stop it in Africa," he said on ABC's "This Week." "And you can really help (stop) it in Africa if we have our people, our heroes, the health care workers, go there and help us to protect America."
A senior administration official, speaking anonymously in accordance with White House policy, said Sunday that the administration was working on new guidelines for returning health care workers. Administration officials had let Cuomo, Christie and other governors "know that we have concerns with the unintended consequences ... policies not grounded in science may have on efforts to combat Ebola at its source in West Africa," the official said.
New rules for health care workers returning from Africa could include mandatory temperature check-ins twice a day or daily visits from public health workers, Fauci said on NBC's "Meet the Press."
Samantha Power, the U.S. ambassador to the United Nations, who is on a fact-finding mission to West Africa, similarly warned against measures that might discourage health care workers from volunteering to fight the epidemic, which has killed nearly 5,000 people in Africa.
"We have to find the right balance between addressing the legitimate fears that people have and encouraging and incentivizing these heroes," she told NBC after landing in Guinea.
"We need to find a way when they come home that they are treated like conquering heroes and not stigmatized for the tremendous work that they've done."
(The Chicago Tribune and Times staff writer Matt Pearce in Los Angeles contributed to this report.)
(c)2014 Tribune Co. Distributed by McClatchy-Tribune Information Services
www.emergencymgmt.com 

Public Health : Harvard Professor Develops Fast, Cheap Prototype Ebola Test

The test could detect the virus in 30 minutes and cost less than $1 to reproduce.

The test could detect the virus in 30 minutes and cost less than $1 to reproduce

Homeland Security and Public Safety : Unclassified White House Networks Hacked

The process hackers follow to infiltrate an organization has been called a Kill Chain, and security teams must find a way to detect and break this sequence of events.

The FBI, Secret Service and National Security Agency are now investigating a recent breach into unclassified White House networks, the Washington Postreported.
A third party alerted the White House of the breach two or three weeks ago, noting that the breach led to some temporary disruptions of service, but no networks were taken down, and no classified networks were breached.
Few details have been released by the White House, and the party responsible for the breach is unknown. Some analysts guessed that Russian hackers are responsible, either rogue or state-sponsored, though the White House has not commented on that claim.
After the White House was alerted of the breach, some staffers were asked to change their passwords, and intranet access was temporarily disabled. 
A White House official anonymously told the Washington Post that these kinds of attacks are to be expected, and that the government is in a constant struggle to defend its networks.
Tim Erlin, director of product management at cyberthreat detection firm Tripwire, said this breach could serve as a learning experience.
“Even though the affected systems are unclassified, it’s unlikely that we’ll receive a full account of the activity,” he said. “The White House could take an important step forward in threat intelligence sharing by being more forthcoming with details of the attack in order to help others defend themselves as effectively as possible.”
And this incident underlines the growing success of advanced attacks, said Chris Boyd, malware intelligence analyst at Malwarebytes Labs, a security software firm.
“Traditional security solutions are continually being left wanting as advanced exploits, social engineering and other complex attacks develop too fast,” he said. “Large organizations, particularly those in sensitive areas, need to combine advanced countermeasures with frequent staff training to ensure the best possible defense against this relentless progression in attacks.”
This breach also is a prime example of the importance of building defense in depth, said Michele Borovac, vice president at HyTrust, a virtualization security and compliance solution provider.
"Perimeter security is no longer adequate, as hackers are clearly able to get inside networks almost at will. Once inside, hackers will ‘land and expand,’ ideally finding privileged administrator accounts that would grant them unfettered access to more important systems," she said. "The process hackers follow to infiltrate an organization has been called a Kill Chain, and security teams must find a way to detect and break this sequence of events.
This article was originally published by Government Technology.
www.emergencymgmt.com 

Public Health : Despite CDC's New Ebola Guidelines, States Go Their Own Way

The CDC issued new guidelines on dealing with travelers from Ebola-stricken regions Monday, but its lack of firm rules left a patchwork of state-by-state strategies that include mandatory quarantines for some travelers.

CDC Director Thomas Frieden
Director of the Centers for Disease Control and Prevention Dr. Thomas Frieden testifies during a hearing on Ebola before the Oversight and Investigations Subcommittee of House Energy and Commerce Committee on Oct. 16, in Washington, D.C. (Olivier Douliery/Abaca Press/MCT)

(MCT) -- The federal Centers for Disease Control and Prevention issued new guidelines on dealing with travelers from Ebola-stricken regions Monday, but its lack of firm rules left a patchwork of state-by-state strategies that include mandatory quarantines for some travelers.
The different rules among states, and the CDC's recommendation of looser monitoring than what is being carried out in several states, highlight what some public health experts said was the problem with the current system.
States not only have the leading role in devising policies to quarantine or isolate people with infectious diseases, they also control the enforcement, said Lawrence Gostin, a public health expert at Georgetown University.
"It's a very ineffective way" to assure Americans' safety in a public health emergency, he said. "We need to have much more uniformity in funding of local health departments. And we need to make sure procedures are standardized across states and the country. At the moment there's just far too much variability."
The new guidelines advise states to monitor travelers based on four levels of potential Ebola exposure, from high risk to no risk. They do not recommend 21-day Ebola quarantines for anyone who is symptom-free.
"We base our decisions on science and experience," Dr. Thomas Frieden, director of the CDC, said during a news briefing.
He repeated the argument from quarantine opponents: that quarantines could lead airline passengers to conceal their travel histories and discourage medical workers from going to Africa to fight Ebola.
"If we turn them into pariahs instead of recognizing the heroic work they're doing," Frieden said, "they may be less likely to go and stop" Ebola at the source in Africa.
As he spoke, states were shifting and updating their existing standards for dealing with travelers from Guinea, Liberia and Sierra Leone -- the three counties hit hardest by Ebola.
Maine, Minnesota and Georgia were among states announcing three-week quarantines for some travelers, including those who are not symptomatic. New York, New Jersey and Illinois already have such measures in place.
Pennsylvania, Florida and Virginia announced enhanced screening of travelers from West Africa, with some individuals subject to bans on the use of public transportation.
The CDC hoped to bring states into line behind its guidelines by recommending more aggressive monitoring of some travelers, and by recommending the banning from public transport of some people deemed at high risk of Ebola exposure.
But the new guidelines are not requirements.
"It goes back to federalism," said Felice Batlan, a professor and associate dean for the Chicago-Kent College of Law.
"This is federalism on hormones, in that you have these multiple jurisdictions that all have the power to regulate," Batlan said of various states' approaches to Ebola.
Very few people are likely to fall into categories that would require them to be quarantined, no matter where they enter the United States.
Frieden said slightly fewer than 100 people daily arrived in the United States from West Africa. Of them, "5 or 6%" are healthcare workers who have cared for Ebola patients -- the group most likely to be deemed at possible risk of exposure, he said.
According to the World Health Organization, 450 healthcare workers are known to have been infected with Ebola and 244 have died. The infected include Craig Spencer, a doctor who was hospitalized in New York on Thursday, six days after he returned from Guinea.
New York and New Jersey sparked the quarantine debate a day later when they declared that all returning healthcare workers who had treated Ebola patients would be quarantined for 21 days upon their arrivals.
A nurse who had been working in Sierra Leone, Kaci Hickox, became the first person quarantined, and her isolation in a tent in Newark, N.J., sparked a debate that drew in civil rights activists, public health specialists, politicians and the United Nations.
"We depend on them to fight this battle," U.N. Secretary-General Ban Ki-moon said Monday. "Please do not quarantine them because they have volunteered to serve in the affected countries."
New Jersey Gov. Chris Christie on Monday bowed to public pressure and released Hickox, who was never symptomatic, to return home to Maine. But in accordance with New Jersey's rules, she remained under quarantine until she left -- meaning she had to travel by private vehicle.
In Maine, she will be probably be quarantined in her home until 21 days after her last exposure to Ebola patients, according to regulations posted Monday on the state health department's website.
The governors of New York and New Jersey have defended their actions, saying they are more concerned about public safety than about critics' complaints that they are using draconian measures to allay fears of a virus that is far harder to spread than the flu or common cold.
The editor in chief of the New England Journal of Medicine, weighing in on the controversy Monday, said bluntly: "The governors have it wrong."
"The governors' action is like driving a carpet tack with a sledgehammer. It gets the job done but overall is more destructive than beneficial," said the editorial written by Jeffrey M. Drazen and a team of Journal editors.
Trish Perl, a professor of medicine at Johns Hopkins University and senior epidemiologist for the Johns Hopkins health system, said quarantines were an important part of the public health system but a "tool of last resort."
Such measures also lead to inconsistencies, such as the steps that would quarantine healthcare workers coming from West Africa but not those exposed to Ebola in U.S. hospitals, Perl said.
Healthcare workers treating Spencer in New York are not restricted from moving about the city, but they would be quarantined if they came back from treating patients in West Africa.
New York Gov. Andrew Cuomo, in defending quarantines, said if Spencer had been restricted from going out after he arrived in New York on Oct. 17, the city would have been spared having to track his movements and trace everyone he spent time with.
Perl, though, cited Spencer's case as an example of how the system should work.
"He developed a fever, he notified authorities, they sent an ambulance equipped to handle a possible Ebola patient and he was brought to the right place. It was a textbook response," she said. "We couldn't have hoped for better."
Times staff writers Matt Pearce, Monte Morin and Alexandra Zavis in Los Angeles and Noam N. Levey in Washington contributed to this report.
(c)2014 the Los Angeles Times. Distributed by McClatchy-Tribune Information Services.
www.emergencymgmt.com 

Homeland Security and Public Safety : PG&E Prepares to Open New Power-Grid Command Center

Located in Fresno, the control center will allow operators to monitor an increasingly complex electricity grid in real time.

Power lines

(MCT) — Pacific Gas & Electric Co. is getting ready to open a new control center in northeast Fresno from which operators will be able to monitor an increasingly complex electricity grid in real time and quickly isolate where problems are happening.

The $28.5 million facility on Bullard Avenue east of First Street is the first of three such control centers that PG&E is developing in northern and central California. The Fresno center will be responsible for managing the electrical distribution grid for an area that ranges from Stockton to Bakersfield and includes between 16 million and 18 million power customers. Operators began training Monday, and the center will become operational in two weeks, said Gary Cassilagio, PG&E’s director of business applications. By January, it will employ about 25 grid operators and another two dozen engineers and support staff.

A larger center in Concord is expected to open in June, and a third control center in Rocklin will be operational in October 2015.

It took about 16 months to build the 24,000-square-foot center, located next to a PG&E power substation, and about two months to install the computer servers, work stations and other furnishings to get it ready to open. The heart of the facility is a high-security control room, where operators at computer stations will keep an eye on power demand and circuit problems in real time enabled through Smart Grid technology. “This is where we quarterback what’s going on with the distribution grid,” Cassilagio said.

In the event of power outages, Smart Meters that have been deployed at homes and businesses across PG&E’s service area will automatically alert the control center. Computers will process that data and show affected neighborhoods on schematic circuit maps, allowing operators to quickly determine how many customers are affected, evaluate which circuits or switches may be causing the outage and potentially re-route power circuits to restore electricity while crews repair the problem.

Because PG&E’s service vehicles are equipped with GPS systems, operators will also be able to see where the nearest crews are to problem areas, allowing a more rapid dispatch of workers to outages or emergencies like downed power lines. Crews with access to the computer system will also be able to see much of the same data as operators in the control center as they troubleshoot outages.

Inside the control center, four large video display walls mirror the computerized maps available at the individual operators’ workstations, as well as screens showing satellite weather maps and other power-grid system alerts. During large-scale events such as storms or regional power emergencies, the views and data on the computer screens in Fresno can instantly be shared with operators at the other two control centers, giving PG&E a better capacity for what Cassilagio called “greater disaster-recovery flexibility” should another center be incapacitated.

Once the Fresno, Concord and Rocklin centers are running, they will take over operations now handled by 13 older control centers in different parts of PG&E’s sprawling service area, Cassilagio said. The technology of the new centers is a marked contrast to the older facilities, where operators use large paper maps and push pins to locate power outages or other emergencies.

About 125 grid operators now work in the 13 older centers; by the time the conversion is complete, that number will be reduced to about 100, many of which will be relocating to work in the new centers. Those figures don’t include mappers, engineers and other support staff, Cassilagio said.

In addition to the technological guts of the facility, the center includes a fitness area and locker room for employees, two kitchens and dining areas where employees can prepare and eat their meals, and diesel generators that can keep the center up and running for at least 24 hours in the event of a power disruption.

©2014 The Fresno Bee (Fresno, Calif.). Distributed by MCT Information Services.
www.emergencymgmt.com 

Public Health : How Well Can Technology Fight Ebola? Efforts to halt the spread of the Ebola epidemic include a variety of tech tools. But their effectiveness remains unclear

 | October 29, 2014

Ebola outbreak map
On Oct. 28, Healthmap.org reported the latest figures on the Ebola outbreak: Spain 1 case; Guinea 1,553 cases and 926 deaths; Sierra Leone 3,896 cases and 1,281 deaths; Liberia 4,665 cases and 2,705 deaths. And for the U.S., 4 cases and one death. The website's Ebola timeline also provides projections on the number of cases and deaths, based on infection rate data from the World Health Organization, a list of the most recent articles about Ebola outbreaks, as well as relevant social media postings.
Healthmap is one example of how easy it is to find information on this rapidly growing epidemic -- and it also represents the way technology can play a major role in the effort to track and control the disease. For example, mobile phones are perhaps the most ubiquitous type of technology available in Africa, used by millions there. So it didn’t take long for researchers to identify the devices as a possible way to not just send people information about the disease, but also to track it.
And with 95.5 percent of the global population having mobile cell subscriptions, call-data records (CDRs) are one way epidemiologists can see where people have been and where they're headed based on past movements.
CDRs – information used by phone companies to manage their networks and bill their customers, according to the Economist – includes a caller’s identity, the time of the call and the number called. The data can also identify phone location even if the phone is not used. In 2010, a study conducted by the Karolinska Institute in Sweden found that CDR data accurately measured where people fled over the course of 200 days, following an earthquake and cholera outbreak in Haiti. Research by Harvard and Carnegie Mellon universities used CDR data to track the spread of malaria in Kenya and identified the places with the highest probability of spreading the disease.
Based on this research, experts believe CDRs could be used to track details about Ebola as they unfold and help organize a response. But as the epidemic has grown, lack of leadership, regulations that protect a caller’s privacy and other issues have stymied the use of CDRs in Africa.
In the U.S., the Centers for Disease Control and Prevention (CDC) has developed an app that will help locate everyone exposed to a person with a contagious disease, and collect and manage data on every case, according to GCN.com. The epidemiological viral hemorrhagic fever (or Epi Info VHF) app lets users set up databases of patient information and epidemiological case classification, and speeds up one of the most difficult parts of disease detection: finding everyone that was exposed to, and possibly infected by, someone with a contagious disease. This task, called contact tracing, is an essential step in breaking the chain of disease transmission and ending an outbreak, according to the CDC. 
Another tool is the thermal scanner, a radar-like device used to detect people who have elevated temperatures, one of the symptoms of Ebola. People flying out of Africa have been subjected to thermal scans before they board a flight. But the effectiveness of this tool has been questioned, since a person can carry the Ebola virus for up to three weeks before symptoms, such as a high temperature, begin to appear.
Some have called the scanners psychologically reassuring, but not very effective in halting the spread of the disease. For that, you need an Ebola screening test -- which currently costs anywhere from $60 to $200 and takes about four hours to produce results. Just recently, however, a Harvard researcher and his team developed a prototype Ebola test that could detect the virus in 30 minutes and cost less than $1 to reproduce.
And if thermal scanners have limitations, you would assume it’s the same with satellites. But images from space can reveal patterns that could help predict where an outbreak might be happening before hard facts are available. Researchers at Virginia Tech, Harvard and Boston’s Children Hospital studied satellite images of hospital parking lots in South America during influenza outbreaks and were predicting peak periods for the flu with a reasonably good degree of accuracy. While the situation in Liberia and Sierra Leone may look different from above, researchers say that different criteria can be used to look for signs of an Ebola outbreak. When data from satellite images is properly analyzed, models could show how the disease might move through a community.
But while technology can be an enormous help in tracking where the disease is moving, it cannot predict where it might emerge, according to Patrick Tucker, technology editor for Defense One. “You can model how a disease can move through a particular group of people," he told Bloomberg News, "but you can’t model with a high degree of credibility how those people will react to policies, regulations and restrictions."
This article was originally published by Government Technology.

Tod Newcombe  |  Senior Editor
With more than 20 years of experience covering state and local government, Tod previously was the editor of Public CIO, e.Republic’s award-winning publication for information technology executives in the public sector. He is now a senior editor forGovernment Technology and a columnist at Governing magazine
www.emergencymgmt.com