Book Reports
Total Page:16
File Type:pdf, Size:1020Kb
BOOK REPORTS failure disrupts daily life, most people quickly forget Title: Click Here To Kill Everybody Security and about the experience, and probably could not Survival in a Hyper-connected World mention the last software problem that interrupted Author: Bruce Schneier everyday life, yet such attacks occur frequently – and Date and place of publication: 2018, New York, few people understand how necessary it is to resolve United States of America this issue. Reading this text will enable the uninformed reader to understand the world in which Publisher: W. W. Norton & Company, Inc. we live now. ISBN: 978 0 393 60888 5 It is not proposed to consider the practical and political issues properly raised by Schneier in this This book by Bruce Schneier acts on two levels for book. What is considered is why the legal profession lawyers and judges. First, it alerts those in the legal ought to be aware of it. profession that do not know about the world in which To begin with, Schneier sets out an important aspect we now live (comprising the vast majority), about the about software code that few lawyers and judges lack of substantive law to protect citizens and the understand (p 25): that computers are extensible with failure of procedural law to require owners of three ramifications: software code to reveal the causes of injury and (1) Extensible systems are difficult to secure. death. On another level, it informs lawyers of the precarious nature of the duties they owe to their (2) They cannot be externally limited – which clients regarding the confidentiality of their client is why Digital Rights Management is poor at files. protecting copyright – in other words, software code cannot be constrained because Every lawyer should read with Schneier’s monthly it can be repurposed, rewritten or revised. Cryptogram and keep a close watch on the web site run by Brian Krebs. When a problem occurs, Schneier (3) Every device can be upgraded with and Krebs invariably pursue the facts until they additional software features, which add understand them fully, and then report on the issue in insecurities. detail – the sort of detail one would expect a court to In setting out these three issues, Schneier seals the establish in the absence of lightweight media reports. fate of wanting to achieve a more secure digital world For the reader that is not aware of Bruce Schneier and (as much as the reviewer agrees with the author). The his work, this book is a must-read, as always. In the scale of the problem is sufficiently illustrated with two context of this journal, the text, centred on the United examples: (i) (p 29), where hackers penetrated the States of America, considers the failure to respond network of a casino by getting in through a fish tank politically to surveillance capitalism that is now connected to the internet, and (ii) (p 116) where the pervasive; considers the position of the security oil pressure in the Baku-Tbilsi-Ceyhan oil pipeline was services in relation to the proper security of software increased by gaining access to the control system to code and the digital infrastructure, and alerts the cause an explosion, then the hackers hacked into the reader to the ravages of relying on software code and sensors and video feeds that monitored the pipeline. the development of the Internet of Things, by which The purpose of this action was to prevent operators every aspect of our lives are recorded by people we from realising the explosion had occurred. There was do not know, exposing everybody to being disrupted a time lapse of 40 minutes before people in the at a time decided by the attacker. When a software control centre were aware of what had happened. This work is licensed under a Creative Commons Attribution-NonCommercial-NoDerivs 4.0 International License Digital Evidence and Electronic Signature Law Review, 16 (2019) | 93 BOOK REPORTS vvvvvvv The ramifications for establishing causation in civil is important, and why the legal profession ought to be litigation and guilt or innocence in criminal aware of the world in which we now live, and to join proceedings are obvious. in with the forces for change. In seeking a more secure digital world, it is possible to This leads on to the issue of ‘trust’, which Schneier point to the failure of the law to provide for adequate refers to (pp 190; 207 – 208). We trust in the absence remedies when software code is at issue: such as of knowledge.2 In relation to the law and how judges medical devices, motor vehicles, aircraft, computers and lawyers respond to the world of software code, and so on. Litigation is one of the remedies suggested not only do they need to understand that software (p 121), but unfortunately there are problems: judges code is ubiquitous, but it is essential to have a better rarely agree for software code to be disclosed to the grasp of the wider issues that we face, as illustrated in other party – many judges accept the argument that this book. The concluding comment, that policy the code is secret and proprietary and should not be makers should understand technology (p 221), is reviewed; well-financed companies will prevaricate obvious, but sadly lacking – and the legal profession and use every means possible to delay the litigation, needs to understand the issues in the same way, but thus causing the other party (if poorly funded) to give do not.3 Arguably technologists already are involved up or accept an out-of-court remedy that includes a with making policy (p 222) – it is just that the right confidentiality clause; the substantive law relating to technologists are not well represented, as illustrated liability is woefully inadequate, and given the during the Morecombe and Wise Christmas Show in problems with politics and the substantial lobbying 1972: undertaken by the software behemoths of the André Previn (called Andrew Preview in the twenty-first century, it is doubtful that this will change sketch) asks, when listening to Eric in the short term. Morecombe play, ‘What, what were you The author refers to the possibility that software (p playing?’ 132) and the internet (p 182) might kill people, and ‘The Grieg piano concerto,’ Eric replies, and suggests the situation will change once this occurs. In continues playing. this respect, as much as it would be nice that Mr Schneier was correct in this assumption, the position ‘But you’re playing all the wrong notes,’ André is less than satisfactory. People have already been Previn protests. killed and injured by software, and nothing has been At which point Eric stands up, grips the done about it (see chapter 6 of Electronic Evidence for illustrious André Previn by the lapels of his 1 a discussion of examples). Nothing has changed. dinner jacket, and says in mock menace: ‘I’m Indeed, the two Boeing 737-8 MAX flights that have crashed killing 157 (Ethiopian airlines, 29 October 2 Stephen Mason and Timothy S. Reiniger, ‘“Trust” Between 2018) and 189 (Lion Air, 10 March 2019) illustrates Machines? Establishing Identity Between Humans and Software Code, or whether You Know it is a Dog, and if so, and emphasises our reliance on software code. Both which Dog?’, Computer and Telecommunications Law are attributed to problems relating to the new Review, 2015, Volume 21, Issue 5, 135 – 148. 3 It might surprise the non-legal reader to know that lawyers software called Maneuvering Characteristics across the globe are certified as competent to practice, even Augmentation System and how it interacts with a though they have not been taught electronic evidence (which now forms part of the evidence in virtually every criminal physical device, although we await the final reports to prosecution and civil case in every jurisdiction), and calls to understand the correct position. This is why this book include the topic has been ignored: Denise H. Wong, ‘Educating for the future: teaching evidence in the technological age’, 10 Digital Evidence and Electronic 1 Stephen Mason and Daniel Seng, editors, Electronic Signature Law Review (2013) 16 – 24, Deveral Capps, Evidence (4th edition, Institute of Advanced Legal Studies for ‘Fitting a quart into a pint pot: the legal curriculum and the SAS Humanities Digital Library, School of Advanced meeting the requirements of practice’, 10 Digital Evidence Study, University of London, 2017), https://humanities-digital- and Electronic Signature Law Review (2013) 23 – 28, both at library.org/index.php/hdl/catalog/book/electronicevidence. https://journals.sas.ac.uk/deeslr/issue/view/310 . Digital Evidence and Electronic Signature Law Review, 16 (2019) | 94 BOOK REPORTS vvvvvvv playing all the right notes, but not necessarily and the organs of the United States government have in the right order.’4 ensured that surveillance exceptionalism has expanded (pp 115 – 120). The software giants have Many people are writing and saying the right things, understood the Dispossession Cycle, the four stages of but few policy makers and politicians are listening. which are incursion, habituation, adaption and Finally, judges and lawyers need to read pages 20 – redirection (pp 138 – 155). The combination of the 22, headed ‘Most software is poorly written and failure of legislators to understand the world in which insecure’. With these few words, Bruce Schneier sums they live and how the software businesses have up the irrationality of the legal presumption prevalent manipulated them, and weak regulators and judges in common law jurisdictions that computers are failing to take robust attitudes towards the reliable (for which see chapter 6 Electronic Evidence). behemoths, has meant life has become a commodity Now it is for the judges and lawyers.