409.330.9373 Info@OhainWEB.com
Pick Your Numbers – Pick Your Focus – Don’t Panic

Pick Your Numbers – Pick Your Focus – Don’t Panic

Dave Derosier

I recently wrote about Ethnic Thoughts, where I shared some of my own feelings about prejudice and discrimination today. In the end I referenced a situation where five Democrat lawmakers from the US Congress had accused the COVID-19 virus of being racist.

The basis for their accusations were statistics about how the African American and Latino communities had statically more cases of and deaths from COVID-19, more in relation to their share of the population.

NUMBERS

Based on numbers from the CDC website, as of April 28th 2020, the African American population represented 13% of the population in USA. On that same date, African Americans represented 21% of the COVID-19 deaths in the USA. That’s a 70% bigger share of COVID deaths than of the population. More racism!!!

This became a hot point for the media and rapidly spread through the country – like the coronavirus itself. It was all because of racism – perpetrated by the white community over centuries and that’s what has caused all the hardship on these protected classes of people in our country.

As noted in a previous article, I am neither African American nor Latino. As a result, perhaps I have no right to criticize the use of the race card when it comes to COVID-19.

NOT SO! I am a senior citizen. That puts me in a special class when it comes to COVID-19. Why? Because, from the same CDC website statistics, on the same date, 80% of the COVID-19 deaths were to people aged 65 and older.

I’ll tell you what, when 80% of the deaths are to people over 65 and only 21% of the deaths were to people in the African American community – I think any discrimination is against seniors a lot more than it is people of color. But who can seniors blame? God? Mother Nature? The Devil?

This is a great illustration of how “Figures don’t lie, but liars do figure.”

AGE GROUPS

The CDC website mortality tables referenced above show the number of recorded deaths from COVID-19 as of 4-28-2020.

The age group from birth through 24 years old indicates less than 50 deaths…out of tens-of- thousands! That is a miniscule number. It doesn’t mean that age group doesn’t catch the virus, only that it doesn’t kill them (statistically).  So why are all the schools closed????

If we take the total deaths (USA) from the virus and subtract those age 65+; and we then remove those who are under age 25 because the number of deaths is miniscule, we are left with a population group from age 25 through 64, and that represents only 20% of the deaths from the virus.

When we are talking about re-opening the economy, we should be looking to isolate, one way or another, the most vulnerable people – those 65+ (80% of the deaths). We should not be overly concerned with the school-age kids (all the way through grad school) because even if they get sick from the virus they recover.

FOUR CLASSES

The most important portion of the population to focus on is the 25 to 64 age group. Those are the people to be tested. When tested they could fall into four classes:

  • They have underlying/pre-existing medical problems that put them at high risk;
  • They have no signs of COVID-19;
  • They have the disease currently, with or without symptoms, and are contagious;
  • They have already had the virus and have antibodies to protect themselves,

Once tested, let’s get back to productivity, without a doubt:

  • Place Class 1 people under the same umbrella as the protected seniors;
  • Class 2 needs to take preventative measures (masks, social distancing, etc.) and continued testing until/unless they move on to either Class 3, but in the meantime, they should be able to return to productivity;
  • Isolate Class 3 until they progress to Class 4 with antibodies;
  • And send Class 4 back to work.

With that strategy, the economy will start to regenerate, some people will still get sick, but almost all of them will get over it, and we are protecting the most vulnerable people – who are 65+ or have medical problems that put them at high risk.

Sounds simple doesn’t it?

FOCUS

I guess it’s all in how you pick your numbers as to how the focus goes. Instead of choosing the numbers to pass the blame, let’s encourage our leaders to choose numbers that help us to move forward and do what Americans have always done – meet and beat the challenge.

Please go and tell your elected leaders at all levels how you want them to lead us forward in the face of the COVID-19 challenge. It’s up to you to influence the leaders to do the right thing.

[The CDC website for the data in this article is https://www.cdc.gov/nchs/nvss/vsrr/covid19/index.htm.  It is regularly updated by the CDC and the numbers may have changed since May 1st 2020.]

J David Derosier consults with small business on planning and marketing issues, and provides web design and hosting services through OhainWEB.com, an accredited business with the Better Business Bureau that is rated A+ by BBB. He can be reached at JDAVID@Strategy-Planning.info

This article was first published in The Orange Leader on May 6th 2020.

Ethnic thoughts

Ethnic thoughts

Dave Derosier

Some of my earlier opinion pieces may have given you a few ideas about how I think. Maybe some of you have even developed a mental image of me. Let me give you a few more tidbits about me as a person, and then identify one of my hot-buttons for you to ponder.

I live in Texas, but I’m from New England. In between I have lived in Europe and Canada. I have worked or just visited all 50 states and 49 countries. I was born in Rhode Island, the smallest state; and I’ll die in Texas, the largest state (or will be when global warming melts the ice in Alaska).

Both of my grandfathers were of French Canadian descent (Canucks). My maternal grandmother immigrated from Salt Hill, a small town next to Galway in Ireland. I never knew my dad’s mother, nor was she spoken of.

My wife’s mother was a Cajun. The Cajun French came from Nova Scotia (means “New Scotland”) in the late 1700s when they were deported by the British. Most ended up in Louisiana. In contrast, the Canuck French migrated from La Nouvelle France (primarily today’s Quebec) to New England for economic reasons.

My wife’s dad was from a Danish family living in Birmingham. I remember meeting her dad’s mother there once, she was a true “Southern Lady”. Once, while in Denmark, I looked up her family name in the phone book…and there were three pages of them.
I grew up in Rhode Island. Most of my friends were either Italian or Portuguese. When I say that, I mean that’s the language that their parents spoke – as immigrants.

Most of the Italians came from Sicily, in the south. The Casa Nostra (Mafia) was an integral part of the Rhode Island culture. The Portuguese came from the Azores off the coast of Africa (“Black Portuguese) or from the mainland (White Portuguese).

Immigrants tended to live in their own ethnic communities. Even today, many parts of New England have their ethnic equivalents of Boston’s Italian North End or the South Boston Irish.

So, here I was, growing up through high school with a French-Canadian name and strong Irish heritage, living alongside Italians and Portuguese.

Did I learn new, non-English, words and expressions? Yes. Did I learn to make judgements about people because of their heritage? Yes. Is that natural to do? Yes. For example, to this day I still associate Italian with the Mafia. I still associate being Irish with beer and hot tempers (and maybe red hair).

After high school I went away to college, Boston College in Chestnut Hill, about 40 miles from home. Ever heard of BC? It’s probably the 2nd best known Irish Catholic university in the US, following Notre Dame. It’s run by the Jesuits and sits smack dab in the middle of a well-established Jewish area of Boston. I learned a lot more non-English words and sayings from our Jewish neighbors.

Throughout my early years, ethnic influences have permeated my life. I’ll bet they have yours too.

Did I make ethnic judgements? Yes. Do I think those judgements are still valid today? Some.

A while back I wrote about Hypocrisy in the Anti-Discrimination rules in this country. In that article I defined a few words for clarification of my thoughts:
Stereotypes are oversimplified ideas about groups of people.
Prejudice refers to the beliefs, thoughts, feelings, and attitudes someone holds about a group.
Racism is a type of prejudice used to justify the belief that one racial category is somehow superior or inferior to others
Discrimination consists of actions towards a group of people. Keyword here is action.

Sticking just to ethnic judgements for the time being, let me tell you how my early life relates to these four words.

STEREOTYPES: Yes, I have cultivated ethnic stereotypes, I’ve already talked about some of these, like the Italians and the Irish.

PREJUDICE: This is prejudging a group based on stereotypes. Yup, I have a tendency to still do that on occasion.

RACISM: No, I do not look at ethnic groups as being superior or inferior to others. After decades of international business and living, in order to be successful, one had to live by, “It’s not better or worse, It’s different.”

DISCRIMINATION: No, I do not discriminate against groups. Yes, I DO discriminate between individuals, based on my knowledge of them. I suppose you could say I put people into groupings such as friends, acquaintances, not-friends, and unknowns; and I discriminate by treating them accordingly.

I have two good friends named Debra. Both are women. One is black and one is white. One is active in the bigger public community, the other is not. One is white collar; one is blue collar. They each have lots of differing attributes.

When I think about either of them, I think of her as an individual, as a friend. I do not think of her as a black friend or a blue-collar friend, or any other of her attributes. And, just for the record, I use the word “her” out of respect for her gender, not as a sexist thing.

I’m so sick and tired of all the polarizing that is going on today, especially how easy it is to refer to enemies as being racist – in what I hear (broadcast as well as discussions), in what I read (newspapers and the internet), and in what I see happening especially in the government. Just last month, five Democrat lawmakers even accused the COVID-19 virus of being racist.

Anyone out there have any ideas on how get the rhetoric down to what’s right? And stop blaming the “other side” for what’s wrong? There is no reason to have winners and losers.

Throw the race-card out and let’s all just treat people as individuals, as equals, and search for win-win solutions instead of trying to pick winners and losers based on ethnicity.

 

J. David Derosier consults with small business on planning and marketing issues, and provides web design and hosting services through OhainWEB.com, an accredited business with the Better Business Bureau that is rated A+ by BBB. He can be reached at JDAVID@Strategy-Planning.info

This article was first published in The Orange Leader on April 22nd 2020.

Deception as a Cyber-Defense

Deception as a Cyber-Defense

Deception as a Cyber-Defense

In a recent article I talked about how governments are adjusting their approach to collecting signals intelligence data in the fight against national enemies – both terrorists and unfriendly states. What about private companies and individuals, what defenses are available to them in these changing times?

Topping the terrorist list are ISIS and Al Qaeda. The leading unfriendly states, ranked by offenses recorded, are China, Iran, North Korea, and Russia.

In December of 2018 alone, major international cyber-attacks on government agencies, defense and high tech companies, or economic crimes with losses of more than a million dollars** included:

  • Chinese hackers were found to have compromised the EU’s communications systems, maintaining access to sensitive diplomatic cables for several years
  • North Korean hackers stole the personal information of almost 1,000 North Korean defectors living in South Korea
  • The United States, in coordination with Australia, Canada, the UK, and New Zealand, accused China for conducting a 12-year campaign of cyber espionage targeting the Intellectual Property and trade secrets of companies across 12 countries. The announcement was tied to the indictment of two Chinese hackers associated with the campaign.
  • S. Navy officials report that Chinese hackers had repeatedly stolen information from Navy contractors including ship maintenance data and missile plans.
  • Security researchers discover a cyber campaign carried out by a Russia-linked group targeting the government agencies of Ukraine as well as multiple NATO members
  • Researchers report that a state-sponsored Middle Eastern hacking group had targeted telecommunications companies, government embassies, and a Russian oil company located across Pakistan, Russia, Saudi Arabia, Turkey, and North America
  • Italian oil company Saipem was targeted by hackers taking down hundreds of the company’s servers and personal computers in the UAE, Saudi Arabia, Scotland, and India
  • North Korean hackers have reportedly targeted universities in the U.S. since May, with a particular focus on individuals with expertise in biomedical engineering
  • The Security Service of Ukraine blocked an attempt by the Russian special services to disrupt the information systems of Ukraine’s judicial authority
  • The Czech security service announced that Russian intelligence services were discovered to have been behind attacks against the Czech foreign ministry in 2017
  • Chinese hackers breached the systems of an American hotel chain, stealing the personal information of over 500 million customers

Deception - crossed fingersOne of the fastest growing defenses against hackers and malware is “deception”.

 Suppose that when your computer detects an unwanted visitor it lies to the attacker and fools it into doing something non-destructive like going to what is called a honeypot. One example of currently available commercial solutions can be found at www.keyfocus.net/kfsensor/.

According to Wikipedia, a honeypot consists of data that appears to be a legitimate part of the site, but is actually isolated and monitored, and that seems to contain information or a resource of value to attackers, who are then blocked. This is similar to police sting operations, colloquially known as baiting a suspect.

Honeypots have been around for a long time in cyber security, however they are becoming much more prevalent and have inspired various other types of destinations for attackers to be sent and neutralized.

Cyber security paradigms are shifting away from relaying solely on brute-force firewalls. These new concepts or thought patterns look to misdirect attackers rather than attempt to close the door. Just as the new concepts in signals intelligence are shifting to bulk collection of meta-data.

Looking at the major international infractions quoted above, remember they are the ones that were caught and reported. How many more have occurred undetected?

Technology is a great tool, but we need to stay on top of it for self-protection; self-protection at any level, national, corporate, or as an individual.

** Center for Strategic and International Studies, “Significant Cyber Incidents Since 2006”

David Derosier consults with small business on planning and marketing issues, and provides web design and hosting services through OhainWEB.com, an accredited business with the Better Business Bureau that is rated A+ by BBB. He can be reached at JDAVID@Strategy-Planning.info

Bulk Equipment Interference

Bulk Equipment Interference

I remember a time when encryption standards were controlled by the government. The respective national information security agencies would not allow the export of software (or hardware) that contained new encryption algorithms (formulas) unless the software/hardware maker could provide the agency with a “key” to break the code.

The intent has always been national security. For example, if an adversary from outside the USA were using encryption that the NSA could not break, that became a breach of national security.

Those days are gone. Computers have progressed so much that hackers can create their own encryption algorithms on the fly without any outsiders being given a key or an export license.

Back in the days of analog signals, each communication was carried over one frequency (channel). Today, digital signals are so much faster and narrower (bandwidth) that many, many signals can be carried through the same space that a single analog channel used.

For these (and other reasons), encryption has become ubiquitous. In my last post, I talked about how Google is forcing encryption on the Internet by marking sites without HTTPS encryption as unsecure.

This widespread use of encryption is turning the traditional targeted listening of the National Signals Intelligence Agencies obsolete! NSA would record and listen to every phone call that left the USA, and then they added faxes, then emails. Now, all of those are encrypted.

So, how do the Signals Intelligence Agencies stay in business if things have changed so much? How do they gather the intelligence they need if the signals are encrypted? The answer is actually rather simple – they collect meta-data, which if oversimplified means data-about-data.

Ever heard of meta-data? If you have a digital camera in your phone, you probably use it to take pictures. Maybe even transfer them to your computer. Each photo has an ID, it also has the date and time, and information about the camera that took it, might even have the location if GPS was enabled on your phone. All of that information is meta-data, digital data about the digital data that makes up your photo. It’s in the digital file of the photo but not in the photo.

Let’s say they want surveillance data (intelligence) on you and you’re in the Golden Triangle (SETX). Someone quietly follows you around recording the meta-data. NOT JUST YOURS! Everyone’s meta-data is collected in bulk. They hack the systems (like an AT&T cell tower) and record everything. If they can’t follow you in person, they’ll use a drone or a satellite (depending on how important you are).

They even may need to interrupt your phone conversion with a call-drop so that you’ll re-register with the nearest tower and send more meta-data.

It’s called Bulk Equipment Interference. Go look it up on the internet. Could be some scary stuff. Of course, what they’re been recording for decades can also be some scary stuff.

Careful what you say, where you go, who you talk to, or…like with Facebook, don’t worry about it, everyone else is doing it.

Don’t forget to go to the internet and look up “Bulk Equipment Interference”.

PS: Who are these agencies? Friendly agencies with prime responsibilities for Signals Intelligence, often referred to as SIGINT, include NSA (United States), CSE (Canada), GCHQ (United Kingdom), ASD (Australia), and GCSB (New Zealand). These countries make up what’s called the Five Eyes – friends who share intelligence among themselves. And, of course, many of the other 200 +/- countries in the world also have SIGINT capabilities and concerns.

J. David Derosier consults with small business on planning and marketing issues, and provides web design and hosting services through OhainWEB.com, an accredited business with the Better Business Bureau that is rated A+ by BBB. He can be reached at JDAVID@Strategy-Planning.info

How do hackers get in?

How do hackers get in?

Governments and most major companies have installed extensive cyber security defenses. However their weakest links are the contractors and independent devices that have links into their computer networks.

These smaller contractors often do not invest in cyber security at the same levels and many of the independent devices have little or no security.

As a result, hackers who want to get the big fish will most often go after the little fish first to gain access to the big fish. The big fish are referred to as “hard targets” and the little fish as “soft targets”.

Most people think of hacking as someone breaking into computers to steal information. In fact, hacking is not just aimed at computers (or phones).

The big players go after communications networks and often leave “malware” behind for surveillance of everything on the network. Smaller players may just wreak havoc as they go about their work. What’s new in the game are the various ways in which hackers can gain access.

Internet of Things (IoT)

The Internet of Things refers to things connected to the Internet that are neither computers nor communications devices in and of themselves, rather they communicate over the Internet (Wi-Fi) for control purposes. The IoT can include household appliances all the way up to widgets in our petro-chemical plants. For example, security cameras, refrigerators, and even Alexa devices.

AquariumAquarium

An example was given at the Wall Street Journal’s CEO Council annual conference in December. According to Nicole Eagan, CEO of Darktrace, a cyber security company, a casino was hacked through a thermometer in an aquarium in the lobby. The thermometer was connected to the casino’s network to control the water temperature.

Alexa

I was talking just last week with a friend that lives in Orangefield. He was commenting on getting an Echo device from Amazon for Christmas. The Echo device can play music, turn the lights on, or order stuff from Amazon, apparently under the direction of Alexa, who is always waiting for someone to call her name with a request.

When you say the word “Alexa”, she recognizes the word and starts recording your voice. When you have finished speaking, she sends this recording over the Internet to Amazon. Alexa needs the internet to work; Alexa needs the internet to send your recorded words back to Amazon. Alexa provides a listening device right in your own home, one that is programmed to record what it hears and sends it on to a third party.

What do you think Amazon can do with your words? Almost anything they want! And this was not placed in your home by the CIA, you purchased it yourself. Just another piece of the IoT.

Houston Rodeo

Disappointed concert goersJust last week, the Houston Chronicle reported on how computer robot software (“bots”) impersonated customers and tried to order concert tickets for the Houston Rodeo. Their ticket company shut down the offending server and quarantined about 838,000 bots.

In the meantime, up to 2,000 actual customers may have been kicked off the website while in the middle of buying tickets. Those that got kicked off probably couldn’t get back on in time to get tickets before the two concerts that were targeted got sold out. I’ll bet there are some unhappy Rodeo fans out there right now.

WOW! A thermometer, Alexa, even software robots causing denial of service at the ticket office.

Think about the vulnerabilities you may be introducing into your digital environment. Some might be able to come back and haunt you in the future.

David Derosier consults with small business on planning and marketing issues, and provides web design and hosting services through OhainWEB.com, an accredited business with the Better Business Bureau that is rated A+ by BBB. He can be reached at JDAVID@Strategy-Planning.info

 This article was first published in The Orange Leader on January 16th 2019.

Do you use Google Chrome?

Do you use Google Chrome?

Have you noticed that many of the smaller websites you visit using Chrome now carry the admonition of “not secure”? These websites have not changed, Chrome has changed.

Google wants the world to believe that it is truly concerned with the security of its customers, and has chosen one of its flagship products, the Chrome internet browser, to show the world that it is a leader in cyber security.

First, let’s look at how your computer accesses websites. You give your computer an address (domain name) which it locates on the internet and copies the page (or file or whatever) down to your computer. Then it disconnects from the internet. What you see and what you do is on your own computer…until another internet access is needed. If you go from the website’s home page to another one, the same process happens, only now you have copies of two pages on your computer. And so on.

The browser software on your computer uses an application (app) called a protocol. For decades these apps used HTTP (HyperText Transfer Protocol) to communicate. When websites started collecting personal information (like credit card numbers and passwords), a modified protocol named HTTPS (“S” for secure) was created which encrypted the communications to protect the privacy.

Before, whenever your browser encountered a website that used HTTPS, it would show you something like a padlock icon to let you know that SSL (Secure Socket Layer) was being used and your data was encrypted.

Today most browsers still do that, but not Google Chrome. Google now calls any website with the old HTTP as being not secure. If no personal information is sent to the website, does it make any difference? Technically, no. However, in the perception of the user, Google has just said the website is bad, maybe you shouldn’t go there.

Google is trying to come across as the market leader that is protecting the public. And it’s not just adding those two words, “not secure”. Google also penalizes the website in its search engine rating so it may appear lower in a Google search. More like bullying to me.

However, they are big enough to get away with such bullying and we are now advising our clients that they have an option to switch to HTTPS if they would like.

All of the other major browser makers are starting to follow suit, encouraging websites to change over to HTTPS. One cannot win against these cyber bullies.

How does a website change over? Your website provider or hosting service can acquire a special certificate for your web pages that says you are legitimate. Today, there are three levels of certification – at the domain level, the organization level, and at an extended level.

The SSL certificate verifies that the website really is who it says it is – either an individual or an organization. The certificate confirms the identity of the website owner and vouches for its authenticity.

At its lowest level, domain validation, the certifying authority (CA) only checks whether the applicant actually owns the domain for which the certificate is to be issued.

At the next level certificate, called organization validation, in addition to domain ownership, the CA examines relevant information, such as company public filings. Information that has been vetted is accessible to website visitors, which boosts the site’s transparency. The somewhat demanding nature of this certificate means that it can take longer and be more expensive to issue.

The highest level of SSL certification (today) is called extended validation and has the most extensive authentication level. This process requires company information to be even more thoroughly scrutinized. This exhaustive review should additionally increase the website’s credibility. This certificate is also the most cost-intensive of the three.

In addition to the actual certificates, software may review the website to make sure it works the way it says it should. For example, does contact information collected actually go to the owner of the certificate? These are things one should expect from a “secure site”.

The cost to upgrade to HTTPS varies with the level of certification and how well the website was developed in the first place. As you can expect, the higher the level the higher the cost.

For existing sites, the cost to convert can be minimal if you do it yourself, or up to several hundred dollars if you use a professional. Usually there are also additional costs to be included in your periodic hosting fees when HTTPS communications are used.

For a new website, the developer will probably build the cost for SSL and HTTPS into the overall price of the website and hosting.

Does a website really need HTTPS?

In the past, if the website didn’t collect sensitive data, like credit cards or social security numbers, the owner may not have needed an SSL certificate. However, with the new browser notices, it’s becoming more important to ensure that a website has an SSL certificate and is loaded via HTTPS.

It’s up to the owners to figure out how they want their visitors to perceive the security of the website. It’s up to the visitors to figure out if there is any perceived decrease in value without it. I’ll bet most people never even noticed the “not secure” notice from Google Chrome.

J. David Derosier consults with small business on planning and marketing issues, and provides web design and hosting services through OhainWEB.com, an accredited business with the Better Business Bureau that is rated A+ by BBB. He can be reached at JDAVID@Strategy-Planning.info

This article was first published in The Orange Leader on January 3rd 2019.

David Derosier consults with small business on planning and marketing issues, and provides web design and hosting services through OhainWEB.com, an accredited business with the Better Business Bureau that is rated A+ by BBB. He can be reached at JDAVID@Strategy-Planning.info.

Elections and Cybersecurity

Elections and Cybersecurity

In my last column I talked about propaganda and election influencing in the USA by foreign governments, as well as the US doing it to others. My basic take was, so what; if others want to meddle, they always will. Just be sure to lock the barn door before the horse (data) escapes. We need to stop complaining and be prepared for when they try.

99% of votes in the USA are either cast or counted by computers.

We have invested in computerized elections because they reduce miscounts, help voters with disabilities, improve access to voting for rural voters, and speed up delivery of results. That’s goodness.

Unfortunately, we have NOT invested in strong security for our computerized elections. The average state election cybersecurity grade in a recent report was only a C-. The average grade for states with toss-up Senate races in 2018 is an F!

 Without question, our computerized election system is vulnerable to cyber threats!

 Let’s take a look at four areas of our computerized elections:

  1. Campaigns, overall risk: severe

Cyber-attacks on campaigns have been used for selective release of private documents in which adversaries release potentially compromising data on candidates and campaigns. These attacks have undermined the credibility of candidates, exacerbated social, economic, and political divisions among the US Electorate, and fueled fears of corruption and abuse by government officials.

So far in 2018, cyber-attacks by Russians have allegedly targeted multiple Congressional campaigns, including Senator Claire McCaskill of Missouri, as reported in TheDailyBeast.com.

Cybersecurity practices for political campaigns remain inconsistent, although efforts by Homeland Security and the FBI to provide cybersecurity training have had some effect. Extremely tight budgets, mostly-volunteer staffs, poor cybersecurity awareness, and the issue of distributed, ad-hoc systems by campaigns have made improving campaign security difficult in spite of significant publicity around attacks on campaigns and campaign officials, particularly for local and state elections.

  1. Voter registration and election management systems, overall risk: serious

Attacks on voter registration systems and e-poll books could be used to steal data on American voters, or affect Americans’ ability to exercise their right to vote if their voter registration is manipulated. Blocking certain voters from the polls could even alter the results of an election.

Voter registration systems in at least 21 states were targeted by Russian hackers in the 2016 election, although there is no evidence that voter rolls were actually changed.

Voter registration systems remain vulnerable to cyber-attacks, but progress is being made on basic cybersecurity standards and training, and Homeland Security is coordinating information sharing and incident response exercises with state election officials.

  1. VOTING SYSTEMS, overall risk: serious

Cyber-attacks on voting systems could be used to disrupt the voting process, or even to directly manipulate votes, perhaps the most widely-feared form of election manipulation.

There has been no evidence of foreign tampering with US voting systems in 2018, but known vulnerabilities have been demonstrated in many of the most widely used voting systems in the USA.

Vulnerabilities in voting machines and vote counting systems have received a lot of attention since 2016, but most voting systems are not connected to the Internet, and getting physical access to such a large number of machines would be challenging, particularly for a foreign adversary. Furthermore, most states have plans to replace aging voting systems and implement a paper audit trail for all votes.

  1. ELECTION NIGHT REPORTING, overall risk: serious

While attacks on election night reporting systems cannot affect the actual outcome of the election, if reported vote tallies are manipulated it could call the real results into question even if they are ultimately verified.

No evidence has emerged of foreign tampering with election night reporting systems, but exploitable vulnerabilities in official election websites, traditional and social media platforms could be exploited by foreign actors.

Secure election night reporting has received comparatively little attention and resources relative to voter registration and voting systems, and known vulnerabilities in official election night reporting websites, traditional and social media platforms remain unaddressed.

Without question, our computerized election system is vulnerable to cyber threats, and foreign adversaries want to exploit our vulnerabilities. 

Areas with the greatest risks are 1) Influence operations, 2) cyber espionage against campaigns/ candidates, and 3) attacks on voting systems. Influence and espionage are much bigger threats than sabotage.

What countries pose the greatest overall cyber threats to US Elections? Russia (81%), China (10%) Iran (2%).

The good news:

Progress is being made. Today, Basic Best Practices for cybersecurity are currently in place for information sharing (50 states), access control (46 states), and regular vulnerability analysis and intrusion detection (43 states). 9 states are using voting machines more than 10 years old; 33 states perform post-election audits, and (to me at least) most important – 36 states have a paper-trail audit for all voters.

By 2020, 46 states will either have or be in the process of implementing a Voter Verified Paper Audit Trail. (Look up VVPAT with an Internet Search Engine.)

More is needed.

A paper audit trail is a key first step in establishing resilience if computerized election systems are compromised.

Current funds are helping to implement basic security practices, but the full cost of robust security systems is much higher. Many states and counties have developed plans to upgrade or replace vulnerable systems but lack funding to implement them.

Attacks on campaigns and election night reporting systems cannot directly disrupt of change the outcome of an election, but they can undermine the credibility of American democracy, and comparatively little money or effort is being put into securing these systems.

Campaigns and election officials should leverage every available opportunity to partner with the government and with cyber security professional s and pro bono initiatives to continuously improve security on our election systems.

Hopefully we made it through the 2018 elections without any major glitches turning up. Let’s hope we’ll be much more ready two years from now.

[Most of the information contained here was distilled from papers published by the Technology Program of the Center for Strategic & International Studies in Washington DC.]

David Derosier consults with small business on planning and marketing issues, and provides web design and hosting services through OhainWEB.com, an accredited business with the Better Business Bureau that is rated A+ by BBB. He can be reached at JDAVID@Strategy-Planning.info.

Will the Russians again meddle in the upcoming American elections?

Will the Russians again meddle in the upcoming American elections?

Propaganda and election influencing by USA.

Did you know that the United States created Radio Free Europe as an overt propaganda effort during the Cold War, partially funded by CIA? Did you know that Radio Free Europe continues to this day with headquarters in Prague, a corporate office in Washington, D.C., and 17 local bureaus in countries throughout their broadcast region, broadcasting in 25 languages to 23 countries including Armenia, Russia, Iran, Afghanistan, and Pakistan. (www.RFERL.org).

The U.S. has meddled in presidential elections in other countries as many as 81 times between 1946 and 2000, according to a database amassed by political scientist Dov Levin of Carnegie Mellon University (www.dovhlevin.com/).

From Radio Free Europe to influencing elections, USA has a well-documented history of meddling in other countries’ affairs.

KremlinThink the Russians are going to try and interfere again?

I’m sure they will.

And why shouldn’t they? Especially when we do the same thing all the time.

So, if YOU think the Russians are going to try and interfere again, is that a problem?

What is the problem?

In an earlier article I wrote that problems cannot be solved…until they are broken down into issues to define the problem.

In this case, the problem is not that the Russians want to meddle in American elections; the problem is that apparently we do not have adequate counter-measures to stop them.

There is no question that we have equal or better offensive capabilities than our adversaries. We need to put more effort into having better defensive capabilities – cyber defenses in the Digital Environment. And, we should stop complaining about others, like Russia, doing what we’re doing. Just be quiet and don’t let it happen.

The Digital Environment

The Digital Environment is exploding exponentially in terms of its breadth and capabilities, and will continue to do so (I touched upon this in my article on “Changing Technology “).

Our lives are becoming increasingly dependent on the health and security of the Digital Environment.

Automation, machine learning, artificial intelligence, the Internet-of-Things (IoT), and many other advances bring tremendous opportunities…and also tremendous challenges to the Digital Environment.

Today the push is to protect privacy in the Digital Environment. That’s all well and good. However, we need to do a lot more in optimizing the security of the Digital Environment for Americans, not just privacy.

When governments collaborate with criminal hackers, such as mentioned above, it allows the governments to distance themselves from the direct perpetrators. This makes it more and more difficult to pinpoint the blame…and to point the finger at them.

We need to lock the barn door before the horse leaves, not point fingers afterwards.

On other topics…

  • REMEMBER – KNOWLEDGE IS POWER. GET OUT AND VOTE…for or against the Bond Issue and for candidates.
  • Congratulations to my friend and former mayor, Essie Bellfield, for being recognized once again for her contributions to Orange. Salem UMC is naming an education building after Ms. Bellfield, a longtime member of the congregation.
  • My next article will address strategies being discussed and put into place at the national level in the Digital Environment to add more security for Americans and our allies.

 

David Derosier consults with small business on planning and marketing issues, and provides web design and hosting services through OhainWEB.com, an accredited business with the Better Business Bureau that is rated A+ by BBB. He can be reached at JDAVID@Strategy-Planning.info.

Problems cannot be solved…

Problems cannot be solved…

Dave Derosier

…without breaking them down into issues.

Like so many other things in life, problem solving activities have an “80-20 Rule”. To correctly address problems, spend 80% on your time on the problem and 20% of your time on the solution. Most people do it the other way around.

Picture this, a business meeting where it is announced that, “Sales are down and the company is losing money”. Immediately someone in the group says, “We need to increase sales.” The group agrees and they go ahead with efforts to do that, happy that it was so easy to solve the problem.

Do you think that was a good way to solve the problem?

The folks at this meeting jumped on a knee-jerk reaction and then implemented it. Like most people they spent all of their time on the solution. “We need to increase sales.”

If they had spent more time on the problem, they might have found out that their selling costs were so high that they lost money on every sale. Increasing sales would just increase the losses!

The first step in addressing problems is to answer the question, WHAT IS THE PROBLEM?

In this case, what they thought was the problem, “sales are down”, was not the problem at all. The real problem was that they were losing money.

Problem diagnosis requires getting from the “simple why” (often just a symptom) to the “real why”. The real why searches out the causes of a problem. These causes usually go beyond technical reasons. Causes are best found by the repeated asking of “why” as we dig deeper and deeper into a problem.

Problem diagnosis means seeking answers to factors that could have affected or contributed to the problem. For example:  When does the problem occur? Where does it occur? Who is involved in the problem? Are the people involved carefully selected, trained, and motivated? What equipment and facilities are involved? What events or conditions are connected to the problem? What were the hints of an impending problem? What calamities, crises, and/or unusual events may be contributing?

Solving problemsThe answers to these real why’s are the issues (factors) surrounding a problem. Not all issues contribute to the problem and some don’t need to be addressed, but always assume that there can be multiple contributing issues do contribute to the problem.

Determine any constraints you may have for solutions (like the cost, legality, etc.), then analyze the issues, and come up with possible solutions. Evaluate each possible solution and select one or more. Develop a plan and implement it. Problem solved.

Remember that fixing a symptom doesn’t cure the problem. For example, an offer of a ride from a neighbor doesn’t solve the real problem of a vehicle not starting in the morning. Another example would be failing grades at school – that’s a symptom; the problem is kids not learning.

All of these steps work on addressing bigger complex problems, like failing school grades, or choosing a new job, or a business that’s losing money. But what about the small simple problems? What can we do to simplify finding solutions? There are many “shortcuts” that can be used.

Everyday Techniques like these are simple:

  • Pros and Cons: Listing the advantages and disadvantages of each option, popularized by Plato and Benjamin Franklin.
  • Simple Prioritization: Choosing the alternative with the highest probability-weighted utility for each alternative.
  • Satisfying: using the first acceptable option found.
  • Acquiesce to a person in authority or an “expert”, just following orders.
  • Flipism: Flipping a coin, cutting a deck of playing cards, and other random or coincidence methods

…and of course, prayer, tarot cards, astrology, revelation, or similar methods.

One other thing to remember in problem solving – learn to differentiate between a PROBLEM and a FACT OF LIFE. “My mother has Alzheimer’s” is a fact of life. There are no solutions to facts of life, learn to adapt yourself and move on. When you encounter a fact of life, treating it like a problem will make you miserable as you search and try fruitless solutions.

On the other hand, “my mother has Alzheimer’s and she is going to need constant care” is a problem for which problem solving is needed.

I hope this brief exercise helped a lot of you in addressing problems at home or at work, even at play. In future columns I will be making references to some of these tools in addressing some big issues. Please stay tuned in.

David Derosier consults with small business on planning and marketing issues, and provides web design and hosting services through OhainWEB.com, an accredited business with the Better Business Bureau that is rated A+ by BBB. He can be reached at JDAVID@Strategy-Planning.info

This article was first published in The Orange Leader on 10 October 2018.

Knowledge is Power

Knowledge is Power

Dave DerosierMy last post departed a little from the usual technology topics, although it did stay with the principal theme of trust.

I wrote about the grades that were earned by West Orange-Cove CISD (WOCCISD) from the State of Texas. Just like the schools give out grades based on student performance, the State gives out grades based on school performance. Ten out of 11 subjects got “F” grades.

The purpose of the article was to shed light on how the WOCCISD schools are doing. Not enough people know that the schools themselves get grades from the State, even fewer know how bad the grades really are. An awful lot of comments on social media were like, “I knew there were problems but I didn’t know it was that bad”; others were in denial, making excuses for the poor performance; others took the words personally and were offended that their kids were being labeled as bad learners.

Now they know, and knowledge is power.

The article was successful in that people started talking about subjects that were not so public a few weeks ago. Dialogue is spreading – both pro and con. That was the intent of shedding some light on the subject matter.

With new knowledge, hopefully more people will go to WOCCISD meetings and participate. Ask questions, share your opinions. If light can be shed on all these failing grades then the public stakeholders – parents and taxpayers – can choose whether or not to accept it or demand change.

The power is in the people.

For at least the last 10 years WOCCISD schools have been on the State’s “List of Worst Schools in Texas”. It could go back further but I stopped downloading the documents at 2006.

We can’t blame hurricanes for more than a decade of poor performance, nor can we put full blame on the current administration that has only been at the helm since 2015.

Kudos to the Orange Leader for providing a public forum in which this and other critical community issues can be brought to light and debated by the public. Also to Facebook and other social media for the forums in which a lot of that debate occurs today.

Is WOCCISD alone?

Not really. Beaumont ISD had problems and the state stepped in and took over.

Last May, ten people were killed and 13 wounded in a shooting spree at Santa Fe High School, south of Houston. Like WOCCISD, Santa Fe ISD was not technically rated by TEA for the 2017-18 school year after applying for an exemption due to Hurricane Harvey, if they had been rated, they would have received an “F.”

A Houston paper reported that family members of Santa Fe victims admonished the school board last week for the district’s poor academic performance on the Texas Education Agency’s Accountability Rating System.

“ ’What this tells me is Santa Fe is not providing an environment conducive to education; it’s providing just the opposite,’ said Steve Perkins, whose wife, Ann, a substitute teacher, was killed in the Santa Fe High School shooting. Many of those at the meeting wore T-shirts emblazoned with the letter ‘F’, for the failures reported by TEA grades for the district.”

Santa Fe failed four out of the eleven subjects mentioned in my last article. Compare that to ten out of 11 failures for WOCCISD and yet parents are not attending school board meetings and not speaking up which they have a right to.

Who cares?

According to minutes, in the last year only one outside person has taken the opportunity to present their opinion at a school board meeting, that person was Larry Spears, the Mayor of Orange.

Any presentations to the board are supposed to be recorded in the minutes of the meeting. However, it is not always an easy thing to find because, on average since the beginning of 2017, it took 5 months (147 days) before the minutes were presented to the board and approved. For example, the minutes of the November 17th 2017 meeting were on the agenda for the September 24th 2018 board meeting – nine months after the meeting happened.

You, the parents and taxpayers, have the right to speak out at the Board meetings. Go and exercise your rights. As citizens, you also have the right to vote in WOCCISD elections. Go and exercise your rights.

Knowledge is PowerYou also have the right to remain silent…and accept the status quo.

How will YOU vote for the $25 million bond issue? Where are YOUR priorities? What’s important to you as a parent, and/or a taxpayer? Early voting starts in just a few weeks on October 22nd.

Knowledge is power – exercise your rights.

David Derosier consults with small business on planning and marketing issues, and provides web design and hosting services through OhainWEB.com, an accredited business with the Better Business Bureau that is rated A+ by BBB. He can be reached at JDAVID@Strategy-Planning.info

Originally published in the Orange Leader on Wednesday September 26th 2018.

Where there’s smoke there could be fire.

Where there’s smoke there could be fire.

Dave DerosierA senior manager in a Fortune 50 company, to whom I reported for quite a few years, always insisted that his staff understand that, “If you can smell smoke anywhere, go and investigate, because it could be fire; and part of your job is to put out fires before they happen. “

For example, if a customer is loud and unhappy, find out why and fix it. Seldom does it happen when one loud customer is not happy that there aren’t many more quiet customers also unhappy with the same issue. If you have unhappy customers than you are not doing your job.

In a recent issue of the Orange Leader, (and on the paper’s Facebook page) there was an article entitled “TEA doesn’t tell the whole story”, which reported on the most recent WOCCISD school board meeting. At that meeting, an unnamed district employee, in relation to people raising issues about the districts recent grades from the Texas Education Agency, was quoted in the local paper as saying, “Don’t listen to the noise”.

Any business manager that dismisses smoke because they can’t see the fire is a hazard to operations at hand. Likewise, when a public official says, “Don’t listen to the noise” when the noise is coming from taxpayers and voters, that person is a hazard to the operations at hand.

Let me tell you a quick story.

Two men, good friends, would take a week each year and go moose hunting in the backwoods of Maine. They would rent a cabin on a lake where there are no roads and hire a float-plane (sea-plane) to fly them out to the cabin.

After arriving at the cabin this year, the new pilot told the hunters that the plane was too small to carry out both hunters and their gear plus two moose. They could only get one moose rather than one each.

When the pilot came back a week later he found that the hunters had gotten two moose. The pilot again told them the plane was too small; that with all that weight it would not be able to take off, let alone clear the trees.

The hunters argued that the pilot last year had said the same thing and his plane was the same size and with two moose they were able to take off and clear the trees. After much argument, the pilot gave in.

As the plane taxied across the lake it shook like crazy, finally after a very long distance it got into the air and just barely cleared the trees.

Then, poof! The plane went down propeller first into the trees.

Shortly after that, the two hunters crawled out from under the wreckage. The first one, dazed, looked around and said, “Where are we?” The second one spied the lake and said, “About 100 yards further than we were last year”.

That, my friends, is one way to measure progress.

In the same newspaper article mentioned above entitled “TEA doesn’t tell the whole story”, the word PROGRESS is mentioned in the article twice.  In my experience, progress is usually judged according to one or more benchmarks. I wonder how WOCCISD measures progress?

J David Derosier consults with small business on planning and marketing issues, and provides web design and hosting services through www.OhainWEB.com He can be reached at JDAVID@Strategy-Planning.info.

Trustee: TEA doesn’t tell the whole story

Trustee: TEA doesn’t tell the whole story

An article by Orange Leader about a WOCCISD school district meeting. Published Wednesday, September 26, 2018 by Holly Westbrook, The Orange Leader.West Orange Stark logo

Issues such as the district’s debts, an approved contractor for roofs on both the Middle School and North Early Learning Center were discussed at the West Orange-Cove CISD Board of Trustees regular meeting Monday evening.

Of all discussions, the District and Campus Improvement Plans were most informative dealing with present and future involvement towards student academic progress district-wide.

“We’re not leaving anybody behind.” Director of Federal Programs Dr. Larry Haynes said.

The collaborators for these guidelines are Haynes, Ashton Knox, Vickie Price, Dr. Troy Bethley, Brodrick McGrew, and Wilt Alexander. Individual student needs and how to get them, not just to walk a stage, but how to go from K-12 and absorb what is being taught to them is their goal.

“Every single student who takes STAAR, how did the student do? No child is left behind,” Hanes said. “Now we have to look at every kid. We are held accountable…”

From the North Early Learning Center placing only four students to one teacher to getting WO-S High School kids College Career Military Readies (CCMR), everyone in the district is pulling together to move forward.
Haynes said WO-C CISD “is making progress, despite what you might have heard, seen or read,” even with Hurricane Harvey causing so much set back in every accept of the student’s lives.

Although the district, like many others along the coast hit by the natural disaster last year, were “Not Rated” by the Texas Education Agency, Haynes showed research from 2017 to 2018 the students are improving.
“People don’t have a clue what’s going on (in our schools),” a board member said.

Even with the full setbacks of Harvey, the students in 4th and 6th grade did truly well in math. These students showed that there might be water everywhere after a storm, but numbers won’t drown them out of the equation.

Another Trustee said that the TEA doesn’t tell the whole story. “It truly gives me chills,” she said. “People can make numbers say anything they want.”

What the elementary and middle school students accomplished is the growth the teachers, students, and familiar community look forward to and want more of.

“Are we growing our kids?” Haynes said as he addressed the Board of Trustees and the few in the public. “The media is never going to tell you about our growth. Did anyone record that?”

The high school did well in English I by going up by 10 and English II by 13, Algebra was up by nine and Biology up by 19 points according to the TEA numbers. One will not find these numbers because the Harvey Wavier was in effect. However, Haynes was able to gain these statistics to help the district and board to see how to improve the individual student’s education.

“Make sure to work with our households and parents,” Linda Platt-Bryant said to the board, teachers, and administrators present Monday at the end of the open session. “We don’t want to expect failure.”

The board member was referring to students who have, in the past, not been able to graduate their senior year and therefor retook it. Later, it was found that it was the home life that was setting back the students, and she hopes to help all students by way of parent-teacher conferences and focusing on each child.

The overall Board of Trustees time focused on meeting all individual student’s needs instead of the whole school, as was done in the past.

Members also put emphasis on negative feedback from both the media and social platforms.
As one district employee said in the boardroom, “Don’t listen to the noise.”

David Derosier consults with small business on planning and marketing issues, and provides web design and hosting services through OhainWEB.com, an accredited business with the Better Business Bureau that is rated A+ by BBB. He can be reached at JDAVID@Strategy-Planning.info