Peter's Technology Trumpet : Estonia

Web World Order and the Baltic Border

SmallCountry — Wed, 13 May 2009 13:30:08 GMT

With global recession in the foreground threatening ruin for many in the developed World, it’s easy to forget other clear and present threats to commerce, society and our way of life.

However, the growing threat of vandalism, crime and even espionage perpetrated using computer and network systems should certainly be higher up the agenda of your average UK citizen.

Whilst prioritising the global war on terror, western countries have generally been poorly prepared to defend against the growth of organised Internet crime. Cyber Warfare and online terrorism are even more disturbing prospects as, in our increasingly connected world, computer and network systems we all depend on can be penetrated wreaking widespread havoc equivalent to any violent terrorism.

In 2007 the world saw the first Cyber-attack on a sovereign state in the form of small EU member Estonia. A diplomatic spat with its powerful neighbour Russia quickly evolved into concerted Internet attacks including massive SPAM attacks on government email servers, distributed denial of service (DDoS) attacks on key Internet banking sites, and hacking/defacement of significant websites such as the ruling political parties homepage.

In 2008 as the Russian military annexed the province of South Ossetia, a co-ordinated cyber-attack blocked key Georgian Government websites.

Whilst there was evidence that these attacks were Russian orchestrated, as any Internet security expert will tell you, the use of Botnet's and Zombies around the World makes the ultimate source of attacks almost impossible to identify. The Kremlin, with Litvinenko-esque brass neck, denied all involvement.

Whilst the plight of small nations in Eastern Europe is of some concern here in Scotland, its worth remembering that the World Order is generally shaped by those nations and organisations with access to new weapons technologies and military strategies. Consider the 2^nd World War - Superior German tank technology and mastery of armoured warfare allowed the Nazi powers to quickly “Blitzkreig” across Poland in 1939 despite stronger Allied forces. The deployment of the nuclear fission bomb in 1945 ended this war and defined World order for the next 45 years.

Even now, the world order is largely subservient to the United States, whose economic powerhouse allows it to deploy more aircraft carriers and accurate, high speed projectiles than any other nation. Whilst this could be considered reassuring to the national security of its close ally the United Kingdom, it seems likely that future international power struggles will feature the Cyber battlefield as an important theatre of operations, and those nation-states with mastery of its weapons and techniques will prevail.

The USA’s new administration is aware that economic might and ocean borders cannot defend from cyber security threats. The Pentagon recently revealed it was on the back foot with cyber attack damage limitation costing $100M in last 6 months alone. The Wall Street Journal reported last month that Chinese and Russian spies had penetrated the U.S. electrical grid to leave “sleeper” software which could be used to disrupt key infrastructure.

Again, the embassies of both countries vehemently denied any knowledge of this. It is extremely difficult to trace and prove the identity of an attacker, and therefore nigh on impossible to prove whether an attack is government sponsored. However, the league table of malware producing nations show that China and Russia together are responsible for well over half of the Internet’s spyware and malicious code.

No surprise then that since election Barack Obama earmarked $335M for private and public sector cyber infrastructure, not including any secret funding for the National Security Agency, and is about to appoint a cabinet level “cyber-czar”.

Finding the perpetrators of Internet crimes and aggression is notoriously difficult and requires painstaking detective work. The conviction in May of 8 men on child pornography charges in the High Court at Edinburgh, following a long, multi-agency investigation codenamed Operation Algebra and a 10 week trial, was only possible because of the dedication of Lothian and Borders Police, and the aid of leading edge techniques made available by academia and Microsoft.

As many nations wake up to the need for improved Cyber defences, tiny Estonia has emerged as the worldwide leader in the field.

Estonia is possibly the most switched on of the EU countries in terms of penetration of paperless government, web-based banking and ambitious plans for country-wide WiMAX networks. Whilst 2007’s Russian internet attacks were underway the Estonian government called in the top Internet security spooks from NATO, US Security agencies and elsewhere.

Subsequently the Co-operative Cyber Defence Centre has been established in Tallinn as the NATO centre of excellence for this key area of defence. The U.S. Secretary of defence Robert Gates announced the USA would join the Cyber Defence Centre as a sponsor. And just last week, Shawn Henry the FBI Assistant Cybercrime Director revealed that the he would be basing his top cybercrime agents in the Baltic State.

Meanwhile it seems that the UK is waking up to the threat and will take some steps to consolidate responsibility for the cybercrime remit currently spread across multiple agencies. David Davis, the shadow Home Secretary, announced that the Conservatives would follow Barack Obama’s lead and appoint a Cabinet-level CyberSecurity Minister if elected into Governement.

Likewise, the Commons Defence Comittee trip to Estonia’s Cyber Defence Centre in April suggests that the UK will be next to join the Americans in the Cyber defence trenches at the Baltic Border.

Wind problems?

SmallCountry — Tue, 07 Aug 2007 17:22:54 GMT

In Finland its completely Baltic from about October to April. So it is that they make the best of the Scandinavian Summer and the entire workforce downs tools for July and as much of August as they can get away with.

So it is that the pages of the Trumpet have been neglected whilst I observed the Scandinavian summer holiday habit. I've divided my time between the yearly Estonian holiday with Mrs. Ferry and the cost centres, then the Microsoft Partner Conference in Denver, CO.

Throughout the summer I was struck by the increasing awareness and press comment on energy issues and global warming. Even in the USA, Mr. Bush has finally taken an interest and called a conference in Washington to discuss how carbon emissions can be capped, although in a typical Bushism it conflicts with the UN's own climate change conference up the road in New York.

Of course the President's changing mood is as much about energy security as about reducing emissions. Western society is a global patio heater burning fossil fuels like there is no tomorrow, and much of the global energy supplies are not under U.S. control. Mr. Putin has maneuvered Russia into a powerful position where it can hold net energy importers to ransom , and recently annexed an oil rich area half the size of Europe under the North Pole. Meanwhile Mr.Bush is exploring Mars.

The political desire for energy independence was in evidence during my trip to Estonia this year. No doubt wary of the Russian clout wielded over Georgia and Ukraine last year when Russia turned off the gas taps when it was -10 outside, Estonia is at pains to reduce the dependence on Russian gas supplies. Currently it generates 2.5% of its requirement from Wind energy, but is lucky to have oil shale reserves which meet about 75% of its energy requirements. However, an ambitious project to erect a wind farm in the Baltic sea to the NorthWest of the beautiful isle of Hiiumaa will have a capacity of 1GW from 200 big windmills, and be connected to Baltic capitals Tallinn, Stockholm and Helsinki. That's about the capacity of your average nuclear power station, and should fill the gap nicely to ensure that Estonia does not share the Ukraine's chilly fate as an energy hostage of the Kremlin.

Several small countries long ago realized that a forward-looking energy policy is vital to national security, like Denmark (75% wind) and Finland (nuclear and biomass, lots of trees in Finland). Sadly Scotland's has thus far failed to take advantage of the staggering opportunity from renewable energy capacity and the remaining North Sea reserves - the UK is a net importer of energy, relying on an extension lead from the French (80% nuclear) power stations, and foreign gas and coal supplies.

But the trouble with wind is that it doesn't always blow....

This is a shame, as if these Wind Energy plants were spinning at maximum capacity all the time, they would be ideal to meet societies base load power requirements. Base load requirements refer to the always-on power requirements, ignoring the peaks of energy usage when everyone switches on the kettle in the morning. Computing and high-tech devices left switched on are making an ever increasing contribution to these requirements. According to Colin Pykett in Physics World devices in the home on standby (such as PCs, DVD players, Freeview set top boxes, even Microsoft Home Servers) typically contribute to a household standby power usage of around 100W. Multiply by the number of households in the UK, and you need 2GW of capacity just to keep the green LED switched on your flatscreen telly. That's another 2 coal-fired power stations!

As Web 2.0 makes its dramatic effect on society and business, consider also the growing requirements of the computing power in Internet datacentres. Society expects these resources to be available 24/7, which translates to huge requirements for the energy inefficient server rooms (I blogged on this back in March). The effect of rising energy costs now drives AMD and Intel to compete based on performance-per-watt and energy efficiency rather than absolute speed. AMD recently stole the moral high ground by announcing low power quad core chips which are backwards compatible with Opteron architectures but with 25% more performance-per-watt than the nearest Intel chip. Much of the energy requirement in the server room is waste - server power supplies are typically only 80% efficient, and with current hardware/software processors don't use much less energy when not fully utilised.

Microsoft's Bill Laing, GM of the Server division and a Scottish ex-pat, recently claimed that Windows Server 2008 (the artist formerly known as Longhorn) should knock a further 20% off power requirements. Firstly through Virtualisation technologies, processors will be more fully utilised. Server core installation means that superfluous processes are trimmed away for a given physical or virtual OS image, reducing processor load and power usage. Finally by better taking advantage of the AMD and Intel processor P-state features, the OS can dynamically flick the processor into a lower power usage state during short periods of lower utilisation.

Which brings us back to Hiiumaa, Estonia and wind farms. All the above adds up to a growing base load power needs to keep the economy ticking over. Airtricity, who operate many wind farms in Scotland, Ireland, US and mainland Europe, have an idea for how Wind Energy could address this, and overcome the vagaries of the weather. They have an ambitious plan to build a European Supergrid. The basic idea is that as it is always blowing somewhere in the weather systems of continental Europe, electricity can be transported to regions of demand to support Europe's base load power needs - and ultimately create an energy trading network providing 30% of the continents power.

Before any Electrical Power Engineers cry foul, there are some technological advances which make this viable. In the past it has been inefficient to transmit power over the long distances between countries. This is because the conventional High Voltage AC power lines become less efficient over long distances, and generally start to peg out after around 200km. Instead Airtricity plan to use High Voltage DC lines, which remain over 90% efficient after 1000km. That this can now be achieved economically is all down to Thyristor Valves. I believe these were used along with the Flux Capacitor in the construction of the Back to the Future time-travelling DeLorean, and if you are interested in the science, take a look at this white paper.

Come to think of it, could it be viable to take DC straight to the billions of devices which use it (like all PCs, servers and consumer electronic devices) rather than wastefully convert 240V AC to 5 or 12V DC in billions of inefficient power supplies? Many companies, including Rackable systems the DC powered server supplier, and Moixa energy Ltd, who brought the USB battery to market, and seem to think so.

Baiting the Bear and Zapping the Zombies

SmallCountry — Tue, 29 May 2007 18:59:50 GMT

The internal affairs of the small Baltic republic of Estonia hit the global news headlines in April when its ethnic Russian minority rioted in protest of the removal of a Red army war memorial.

As a resident of another small country, I know that the weight of history can cause a difficult relationship with a more powerful neighbor. But Culloden was 350 years ago - for some ethnic Estonians the demise of the 1st Estonian republic and mass deportations following the 2nd World War are still within living memory. (Disclaimer: Regular readers of this column will know that as Mrs Ferry hails from Estonia, I may express some bias.)

The Kremlin's response to these events bordered on the sinister, with threatened sanctions and a failure to defend the Estonian embassy in Moscow against pro-Kremlin youth groups. Its all a bit scary for a country of 1.3 million people positioned next to the Kremlin's military might, which perhaps Estonian PM Andrus Ansip should have considered before he started baiting the Russian bear by removing the statue of the Red Army soldier.

Meanwhile back in the UK the Baltic political situation is of some interest to any follower of international news, but more significantly we may just have witnessed the first CyberWar on record. By mid-May it became apparent that Estonian government, media, email and commercial web servers were under a deliberate and targeted attack. These took the form of massive spam attacks on government email servers, distributed denial of service attacks on key Internet banking sites, and hacking/defacement of significant websites such as the ruling political parties homepage.

Estonia is possibly the most switched on of the EU countries in terms of penetration of paperless government, web-based banking and ambitious plans for country-wide WiMAX networks. So the Estonian government considered this a substantial threat to national security, and didn't take long to call in the Internet security spooks from NATO, Israel and elsewhere. The attacks peaked around the time of the Russian Victory Day public holiday on May 9th. The most damaging attack was probably on national bank Hansapank's website, which was forced to shut down for an hour - and for a week or so afterwards, I found that along with all foreign IP addresses, I had been blocked from their Internet banking site - a simple but effective line of defence. The skills and preparedness of Estonian companies, their IT security experts, and the swift response of international partners were all instrumental in avoiding more serious consequences.

Whilst there was some evidence that these attacks were Kremlin sponsored, as any Internet security expert will tell you, the use of Botnet's and Zombies around the World makes the ultimate source of the attack almost impossible to identify. But its clear that this was an orchestrated and organised attack, and was a highly successful terrorist attack on a sovereign state. The Kremlin has denied all involvement, but conspiracy theorists will point the finger at Putin following the Alexander Litvinenko affair. And now there is even now some evidence of counter-attacks from Estonia

What this situation has graphically illustrated is that IT Security is no longer an issue which is only important to Chief Security Officers and IT Security propeller-heads. Scotland's top technology journalist Bill Magee pointed out that "CORPORATE Scotland [...] could be hit by exactly the same sort of cyber criminal attack that brought state and commercial website systems crashing to a halt"

Here in Microsoft Scotland, we continue to invest in our network of Partner companies with the Security Solutions competency. These companies have proven skills and experience in design and deployment of the security infrastructure, policy and tools. With the availability of Forefront Client Security, Microsoft is unique in providing a comprehensive line of business security tools which can help Corporate Scotland establish robust Internet defenses.

Only with the right partners, skills and tools will we keep the zombies at bay.

Link to The St. Petersburg Times - Top Stories - Estonian Claims Kremlin Behind Attacks on Web Sites

Link to Scotland Warned of attack by Zombies