What Should be Hidden and Open in Computer Security: Lessons from Deception, the Art of War, Law, and Economic Theory Professor Peter P. Swire George Washington University TPRC-2001 October 28, 2001

Overview of the Talk n Military base is hidden but computer security is open n Compare physical & computer security n Model for openness in computer security n Economic model: monopoly v. competition n Military model: Sun Tzu v. Clausewitz n Applications n Research agenda

I. Physical and Computer Security n Physical walls and the pit covered with leaves n Computer security – Firewalls – Packaged software – Encryption

II. Model for Hiddenness in Computer Security n Static model n Dynamic model

Static Model for Openness n First-time vs. repeated attacks n Learning from attacks – Surveillance vs. other defenses n Communication among attackers – Script kiddies and the diffusion of knowledge

Dynamic Model n Security-enhancing effect – Many software bugs – Repeated attacks on computers – Security and inter-operability – Security expertise outside the organization n FOIA and other accountability effects

III. Economics and Openness in Computer Security n System information hidden -- monopolist about the security information n Open source and system information open - - competitive market n Strong presumption in economic theory for competitive market

Monopoly and Under-disclosure n Competitive market -- system/software designer discloses where benefits of disclosure exceed costs of disclosure n Monopolist -- costs $100 extra to re-design, but gains $10 per user; may not re-design n Disclosure may reduce market power n Disclosure may reduce network externalities

Other Lessons from Economics n Other market failures – Information asymmetries and under-openness n Government systems even stronger incentives to under-disclose – Lack the market incentive to disclose enough to gain sales – Optimal disclosure (competitive market) – Some disclosure (monopoly market)

IV. Military Strategy & Openness n Sun Tzu and all war is deception n Clausewitz and deception as incidental n Hiddenness and Terrain – Mountains (deception works) – Plains (deception doesnt work much) n Hiddenness and Technology – Detection -- binoculars & infrared – Communication -- radio and Internet

Military & Openness n Sun Tzu and the intelligence agencies n Brute force attack & Clausewitz – Hackers and the opposite of deception n Intellectual project – Military (usually hidden) – Economics (usually open) – Computer security (intuition unshaped)

V. Some Applications n Open source movement as better security? – When is there security through obscurity? n DMCA and Felton case – Ignores the security-enhancing effect n Classified employees for computer security? n Carnivore as open source? n New FOIA limits on computer security?

Concluding Thoughts n A new field of study: – What should be hidden or open in computer security? – Future conferences and studies on this? n Big shift to openness for computer security compared to physical security n What is optimal for military computer systems n I invite comments, sources, and questions!