National CTO's Plans Sound Pretty Good… Let's Hope They Don't Get Bogged Down In Politics

Politics

from the good-signs dept

Aneesh Chopra, who recently became the federal government’s CTO has a very impressive track record in encouraging more governmental openness and also adopting new technologies. I think he was an excellent choice as CTO, though I’m always cautious until we get to see what actually is being done. Saul Hansell from the NY Times interviewed Chopra recently, where he laid out his basic priorities, and they definitely sound like steps in the right direction:

• Economic growth through innovation
• Addressing presidential priorities through innovation platforms
• Building the next-generation digital infrastructure
• Fostering a culture of open and innovative government

While those bullet points may sound a little vague, they certainly are the key things he should be focused on, and the rest of the article details some of the details of where he may be heading on all of those points, and it suggests that he’s certainly going beyond the soundbite style thoughts found all too commonly in political circles these days. For example, when most politicians talk about economic growth through innovation, they usually mean just dumping more money into research programs or increasing the number of patents. But, as we’ve all seen, those don’t necessarily serve as an accurate proxy for real innovation. Instead, Chopra wants to focus on looking at actual data about how products are getting to market:

Rather than purely thinking about basic research, he said, the government should focus on investing in technologies that can be developed. A first step is to find ways to actually measure how much research is being commercialized.

“There is an implicit assumption that R.&D. investment will lead to job growth and economic success,” he said. “The measurement question will lead us to think about, how do we begin to assess the outcomes.”

It’s great to see that he’s skeptical of the common wisdom that R&D automatically leads to economic growth, but wants to dig deeper into the data to see what the numbers really mean. He’s also hoping to learn from how different universities lead to commercialization:

Mr. Chopra noted that among universities, there is a wide range in how effective they are in commercializing the work of their laboratories. He wants to take the practices used by the most commercial of universities and spread them to other research facilities.

Again, this is good news. Many people falsely assume that things like the Bayh-Dole Act, which pushed universities to patent their research to drive commercialization was a good thing. But there’s a growing amount of research suggesting that Bayh-Dole has actually harmed research and the ability to commercialize products. Hopefully, the data that Chopra is looking at takes that into account. Bayh-Dole caused many universities to set up “tech transfer” offices, but the vast majority of them are losing money — in part because they’ve focused on the patents rather than the actual steps to innovation. The universities that have focused on enabling innovation rather than just collecting and licensing the most patents, have had the most success.

Hopefully, there is where Chopra will lead the government… but, as always, until we see it in action, it’s worth being skeptical and watching closely. At this point, though, it’s nice to see that he actually seems to be looking in the right direction.

Filed Under: aneesh chopra, cto, innovation, plans, priorities

The Internet Isn't 'Critical Infrastructure'

Overhype

from the cyber-hysteria dept

A new report (PDF, via Slashdot), by a security analyst named Gadi Evron, analyzes the recent Estonian “cyber-attacks” and makes recommendations about how to deal with such attacks in the future. While it makes some good suggestions, it also rather dramatically overstates the nature of the threat. For example: “The Estonian authorities need to revise some of their former preconceptions and define the Internet as critical infrastructure, equally strategic to national security as its electricity grid and water supply.” This is rather silly. If the water supply is cut off, people can die of thirst or sanitation problems. If the electricity grid fails, it can lead to the death of old people dependent on their air conditioners or medical devices. If the Internet fails, it’s a big headache for a lot of people, but it’s unlikely to be a life-threatening emergency.

The report points out that some mission-critical activities, including voting and banking, are carried out via the Internet in some places. But to the extent that that’s true, the lesson of the Estonian attacks isn’t that the Internet is “critical infrastructure” on par with electricity and water, but that it’s stupid to build “critical infrastructure” on top of the public Internet. There’s a reason that banks maintain dedicated infrastructure for financial transactions, that the power grid has a dedicated communications infrastructure, and that computer security experts are all but unanimous that Internet voting is a bad idea. The Internet’s architecture is optimized to be cheap and ubiquitous; such a network is never going to be perfectly secure or reliable. There are too many botnets, incompetent administrators, and other problems on the Internet. And so transactions that absolutely have to be done correctly and on time need to be done on a dedicated network, or at least the people doing them need to have a backup plan in case the Internet has problems.

But the report takes the opposite approach, essentially concluding that because people do important things on the Internet, the Internet needs to be treated as an essential national security asset. This reaches absurd lengths when Evron writes that because attacks often originate from botnets consisting of compromised personal computers, “personal computers need to be reprioritized and considered as critical infrastructure.” He doesn’t discuss what that means in any detail — maybe they can post soldiers with automatic weapons outside peoples’ home offices. Evron concedes that “the attacks in Estonia did not hurt critical infrastructure, energy, and transportation,” but nevertheless insists that “an Internet-staged attack on energy could easily disrupt entire supply and distribution chains, prompting severe shortages.” He never elaborates on how that would work, but if he’s right, the solution is to do a better job of separating critical infrastructure from the public Internet.

Wide-scale cyber-vandalism is a real problem, and it’s good to be talking about ways to respond to it more effectively. But we need to keep a sense of perspective. Launching a distributed denial-of-service attack — even a really big one — is nothing like conventional warfare or a terrorist attack. Terrorism and warfare lead to massive loss of life and destruction of property. Internet vandalism rarely involves more than a few hours’ inconvenience and lost productivity. That’s certainly something we should try to prevent, but we shouldn’t blow it out of proportion.

Filed Under: critical infrastructure, internet, priorities