Vital Systems Security

My forays into the wired world are paying off: Now I’m only a year or two behind the curve. Check out this fascinating story picked up by Time (and NPR). It reports on the dastardly named “Corrupted Blood”, an intentionally released virus (and resultant epidemic) which wrought a fair amount of damage in the virtual “World of Warcraft”. Apparently the disease, originally designed to affect higher-level cave-dwellers (nevermind the oxymoron), ended up spreading unexpectedly to the world’s virtual cities — where the common folk live. Tellingly, the game’s own administrators had trouble controlling the virus once released.

In addition to all the buzz this generated in the gamer world, it’s also led to some pieces in scholarly journals, including this one (article info only; you’ll need an institutional subscription to access it, I think). Of particular interest is that the virtual gaming world might be a space to test out all those interesting theories that cannot be feasibly tested in the real world during a massive ID outbreak, like: will people comply with public health and infection control measures? Will communities panic? In fact, more broadly stated: Just how will people behave when a catastrophic Mondo virus comes crashing down on them? Of course, disaster researchers have said for decades that data derived from research on community behavior is pretty compelling, and clear: People generally don’t panic. People are generally compliant. Be that as it may, it is interesting to think about — and be slightly concerned about — the possibility that overly Red Bull-ed, highly testosteroned, über-gamers might form the sample out of which more general findings about community behavior in times of an apocalyptic viral meltdown will be extrapolated. Nevertheless, I find it intriguing to think about just what kind of knowledge — new, unexpected knowledge — can and will be produced as these kinds of imaginative enactments and scenarios take shape down the road.

Come to think of it, I find it equally intriguing to think about the ethical positions (and implications) associated with the intentional release of a harmful ‘pathogen’ in virtual space. Can we profit from the virtual deaths of thousands? Millions? Yes. Should we? That’s a wee bit trickier. How do we do it? Informed Consent?

This may come as a surprise to no one: The Intelligence Community (IC) of the US, comprising over a dozen agencies across the civilian and military spheres, has introduced a variety of social networking technologies in order to facilitate… no, not dating … but rather knowledge dissemination and sharing across organizational and professional silos and compartments. The not-so-original named “Intellipedia” was announced in 2006, and modeled after… well, I think you can figure that one out. A number of sites have some interesting info on it, including of course Wikipedia. You can also find more info than you probably want on it here.

The point of all this is not to re-hash old news; rather it is to flag an interesting debate within (and, of course, outside) the IC, which has been sparked by the decision to go ahead with a number of social networking technologies. In addition to Intellipedia, there is now “A-Space.” Can you guess what that emulates? Yes, A-Space, tagged as a kind of MySpace for Spies — probably unfairly — has been introduced as a way to get people talking with each other across intra- and inter-agency lines. Crudely put, the contours of the debate just mentioned revolve around two views: On one hand are those who feel that social networking technologies will help to break down the ossified barriers which contributed to the well-documented intelligence failures around 9.11. If Jane can’t post certain documents and invite others with a similar security clearance to have a look and make comments; or if Joe can’t float certain ideas to his peers or cast about for others, then (the argument goes) the IC will not have properly taken advantage of today’s cutting-edge technologies to help reform the byzantine rules and governance structures having to do with the community’s knowledge production and dissemination. On the other hand runs the counter-argument, loose lips sink ships. A slip here, a misstatement there, and irreparable harm may come either to the security interests of the US or to actual operatives in the field — or both. If Jane’s document contains sensitive information that Joe is not supposed to know about (even if he has a comparable clearance), then Jim’s cover might get blown. And that could be bad.

I have had an abiding interest in the last few years around questions of what makes knowledge dangerous, including the forms dangerous knowledge takes. In this case, it seems, danger exists not so much at the level of the individual (at least, I don’t see it that way), but in the fact that a (rhizomatic?) network of information threatens extant structures that govern information — structures which adhere to values and practices associated with secrecy. One question, interesting to pose, difficult to study: What effect will these technologies and this form of social organization have not only on the production and dissemination of knowledge, but on the forms knowledge takes? What form(s) will dangerous knowledge take both in the IC and in the public at large as these technologies evolve and are embedded more firmly in a variety of critical infrastructures? Indeed, at a more general level: What is the relationship between information and infrastructure?

A series by this name can be found here, assembled by the Federation of American Scientists. They also have a “strategic security blog” that might be worth a look. The case studies are particularly interesting — each is a kind of teaching module with information about the biology of the experiment and the pathogen in the case, some information about public reaction, and interviews with scientists involved.