Remember 9/11 By Doing Something About Software Terrorist Threat

By John Miano

[See also 10/10/01 - Ten Principles of Immigration - John Miano]

In my first computer job I learned an interesting lesson about the security of data within computer systems.  A coworker and I were installing some equipment in an office belonging to Human Resources (HR) when we were told that we had to leave immediately. The HR folks used this office to enter data about employees into the computer. Since they considered this data to be top secret, no one else could be in the room when it was entered.

As we left my coworker asked me “Do you want to see something interesting?” I followed him to his office where he sat down at his terminal, opened up a database then showed me the data the HR people had just entered.

As the administrator of the HR database, my coworker had free access to data that was supposed to be so secret no one could be in the same room when it was entered.

Since then, I have learned few corporations have any concern with, or any idea of, who has access to their computer systems. This could provide terrorists with new opportunities for making attacks upon the U.S. Serious action in this area should have been taken immediately after 9/11. It was not.

Potential computer terrorism threats come in three broad categories:

Look at some famous software accidents:

If simple programming errors can cause this level of damage, imagine what could be accomplished through deliberate malicious action.

Where computer terrorism is unique is that many such acts can be done in such a way that it would be impossible to distinguish between a deliberate act and an accident. The atrocious (and steadily declining) level of quality in software today would assist concealment. The last time your PC crashed, was it a programming error or sabotage?

This is where immigration policy comes in. In a quest for cheap labor, corporations have been importing hundreds of thousands of foreign computer programmers into the United States on guest worker visas. They receive little scrutiny of credentials and no security checks.

There have already been cases of information theft and computer sabotage by foreign guest workers. In a recent case, a U.S. Attorney noted that the Chinese accused came to the U.S. posing “as scholars. In reality, they were nothing more than sleuths” who were “ripping off cutting-edge, one-of-a-kind computer technology without spending a dime for it” then selling it to a Chinese government-owned company.

Most foreign programmers intend no harm. But it would only take a few to cause serious damage. Remember the September 11^th attack took only nineteen out of the 8 million illegal aliens in the U.S.

Another risky trend: “offshoring”.  A company moves the support for a computer system to another country to take advantage of low salaries. Programmers sitting in the Philippines, India or Pakistan have free access to data in computers sitting in the U.S. This is an open invitation to commit terrorist acts in the U.S. without even coming here. Imagine the havoc that could be caused by a programmer in another country simply by downloading and selling thousands of credit card numbers.

“Offshoring” takes place right now in customer service. Mary, who took your credit card number when you ordered that jacket from an 800 number may actually be Padma sitting somewhere Asia.

If Padma steals your credit card number, what does she have to fear from the FBI? Whom do you call when you discover someone in Asia has stolen your social security number?

The State of New Jersey was shocked to find that the company to whom it had “outsourced”  telephone support for various social programs has moved its operation to India. In other  words, New Jersey took confidential information about its citizens and, with no concern for data security, handed it over to a third party - then expressed shock when the data winds up in a third world country; a scene right out of Casablanca.

Congress must address computer security. At a minimum, these steps must be taken:

For a while after 9/11, there looked like there would be one positive development on the data security front. The Defense Department had announced plans to limit the access of foreign workers to its computer systems. The plan was bashed by the usual suspects (cheap labor advocates, immigration lawyers, politically-correct reporters). And the Defense Department caved in. Foreign workers still can have unfettered access to personnel records and the like.

In the Defense Department.

It is impossible to legislate against stupidity. If companies want programmers all over the world to have access to their business plans, where they can be stolen and sold to the competitors, it is their risk to take.  But corporations--and governments--should not be allowed to give the entire world access to Americans’ personal information--let alone to computer systems that could jeopardize American security.