Dear FRONTLINE
I appriciate your show tonight on cyber security. I think the subject is taken far too lightly by corporate America today. Working as a computer consultant I see many business without firewalls and back-up recovery measures. They never seem concerned about such things until data is lost or there is some problem in which network access has undeniably been breeched.
Security should always be a concern...there is never a completely protected network as long as it has a connection to the internet. All firewalls and platforms can be breeched so long as the hacker has the proper knowledge to infiltrate the system he is trying to get into. Many times the Microsoft defaults, cheapskate penny-pinching bosses and unlearned network administrators are to blame. A word to the wise---always try to improve your security because someone may be trying to disprove your security.
P.S. Linux is good but its open source code will make it more hackable in the future..8000 recorded hacks last year alone. Still a better track record than Microsoft though!
Jeff Stevens
Houston, Texas
Dear FRONTLINE
I've been working in information security which includes computer & network security for two decades. I currently direct one of the largest academic programs in the US in this field. I can assure readers that the threats are real, the dangers are real, and the resources being brought to bear are insufficient.
Al Qaeda is not the only concern. Organized and disorganized crime results in on-going losses to industry, with more to come. Anarchists and vandals create viruses and exploit scripts that result in widespread losses and defacements. Political ideologues seek to destroy online resources to advance their causes. All of these -- and more -- result in damages, losses, and compromises. It doesn't require a terrorist attack to cause substantial expenses or exposures of sensitive data.
It is also the case that poorly-designed systems, faulty code, and improper operation can lead to faults and failures that expose private information, delete critical data, or lead to accidents. Some of the same vulnerabilities that enable attacks also allow accidents and misuse to occur. Whether your critical information is destroyed by a virus written by an anarchist, by buggy software, or by an accident triggered by a poorly-trained operator, it is still gone.
Unfortunately, people want simple answers and don't understand the problems. They also want "silver bullets" that require minimal investment and quick return. Thus, firewalls, anti-virus programs, and calls for use of alternate software platforms such as Linux are held out as solutions....but aren't. They're solutions to parts of the problem, but too few people have the perspective to see how they fail to address the entire set of problems.
My concern isn't so much terrorism or hostile nation-states, but a system compromised by criminals and recreational hackers, and riddled with fault-prone software operated by users ignorant of the risks. It is vulnerable to terrorism and espionage, but the sheer weight of misuse and accident will cause more damage on an on-going basis. So long as government and end-users continue to pursue the cheapest solutions rather than invest in education, research, and defense-in-depth, the problems will get worse rather than better.
Eugene Spafford
West Lafayette, IN
Dear FRONTLINE
National security has long been threatened by attacks or disruptions involving cybersystems, including digital control systems and SCADA systems. The reason for greater concern now is that it is apparent since the attacks of 9/11 that there are those who would stop at nothing to destroy and disrupt our way of life. While the motives of the attackers or mischievious hackers can differ greatly, the effects of their efforts can have devastating effects on the infrastructure, the economy, and the social fabric. Indeed, the kinds of scenarios that were considered possible for Y2K are every bit as possible today owing to cybersecurity threats. Two websites with extensive writing and references on both of these matters can be found by searching on "Gordon" + "homeland". References to Congressional testimony on the vulnerability of digital control systems and SCADA systems can be found on the homeland security website.
We are living at a time of great technological complexity. Those in policymaking positions do not necessarily have the expertise they need in order to make the best decisions concerning whom they need to hire to provide them the best possible advise.
In addition to having advisors with sufficient technological expertise, ideally such advisers also need to understand the policymaking process and be skilled at getting their concerns across in a way that the policymakers will understand. They also need to be able to recommend and make a case for courses of action that will greatly lessen our vulnerability.
The course of action that was implemented during Y2K, whatever its shortcomings, had the effect of significantly minimizing problems. Why haven't current efforts to improve cybersecurity and the security of related systems been as energized and purposeful as the efforts made to meet Y2K challenges and threats? In large measure, of course, this was due to the time certain deadline involved in Y2K. In the case of cybersecurity, policymakers can have a very hard time imagining the seriousness of a new kind of threat that could occur at any time, now or in the future. The people with an adequate understanding of the threat may, for whatever reasons, be ineffective in getting their message heard. The Frontline piece, Cyber War, may well play a decisive role in capturing the attention of policymakers. The program may help policymakers understand the seriousness of these vulnerabilities and the need to take decisive action, whether it be to educate, encourage, promote, and/or incentivize or use other means to ensure that needed actions are taken.
Paula Gordon
Washington, DC
Dear FRONTLINE
Congratulations PBS, your presentation tonight was extremely thought provoking.
Having read several of the discussion letters so far, I can only say that it still looks like it will take a full scale armegedon type attack of some sort before this cyber war problem is taken seriously. How truely sad to think that we have learned so little from 9/11.
Why does America always seem to wait for the worst to happen before doing anything.
This "invulnerable" attitude must be forgotten because it dwells in the past.
We as a nation are more vulnerable than ever before to any number of attacks from any number of sources and must be begin to seriously do everything we can to minimize any damage from same.
The truth is no matter what type of system is used, Microsoft, Unix, Linux, Mac, etc. all are vulnerable and all have, or will be compromised sometime in the future.
It's the nature of the game, made easier by the lack of concern we so readily display.
E L
Kingston, New York
Dear FRONTLINE
I'm deeply disappointed with your treatment of this issue. You weave a series of tenuous and unconnected assumptions together in an effort to use fear to stimulate your audience when you should be using compelling analysis to influence us.
You didn't mention that Code Red was the result of the awful security that plagues most Microsoft products. You didn't mention that it only affected systems whose system administrators were too incompetent to install the proper patches. You didn't mention that most of the recent email worms are easily defeated with simple configuration measures. You didn't mention the current use of encryption and virtual private networks to let corporate and government sytems make use of the internet without exposing their private networks.
In short, you let your desire for ratings overwhelm your obligation to present objective truth. While there are serious risks that should be managed, I don't believe it's even remotely at the level you purport it to be. I expect more from Frontline. You should be ashamed of this show.
L C
Ketchum, Idaho
Dear FRONTLINE
I do system/network/security administration on a SCADA system and the one thing that has always made the assessment of cyber threats difficult is the lack of any real analysis on the probabilities of these attacks occurring. I kept hearing words like 'possibility' and 'theoretically' and 'theoretically possible' but I again saw no hard statistical evidence brought to the front from any of the people interviewed for this show.
We have to be very careful and not spread any more FUD Fear, Uncertainty, Doubt then already exists in abundance in any of these cyber-terrorism discussions. That being said, I have seen an increased interest & focus on both cyber & physical security in my organization mostly as a result of September eleventh. IMHO, the associated increase in resource allocation is lagging, esp. in these hard economic times.
One other point I would like to make about tonight's show is that someone said that all or most of the SCADA systems are hooked up to the Internet and run one of the Microsoft operating systems.
It is my experience that most of these systems may only be directly linked to their individual corporate Intranets and some others may have firewall protected and very specific and specialized links to some Internet sites. Most SCADA systems, to my knowledge, are not directly connected to the Internet, as that would be a very foolish thing to do from a security standpoint
While some of these systems may have Microsoft MS Windows workstations hooked up to them most of the SCADA servers, where the real monitoring & control work is done, run Unix based operating systems.
It is possible for new SCADA systems to be ordered and configured to be total MS operating system based, both on their workstations & servers, and the entire SCADA network can be directly connected to the Internet. However anyone who proposes and, even worse, implements such a system would most likely be looking for a new job in the very near future.
Kevin McGrath
Brooklyn, NY
Dear FRONTLINE
FUD - Fear, Uncertainty and Doubt
I'm used to expecting a superior level of reporting from Frontline and I'm disappointed to see that the producers have presented us with an overly paranoid view of global connectivity put forth by self-interested obfuscators that prey upon the ignorance of the general public and their government patrons. Their livelihoods depend upon promoting a culture of fear about technology risks.
It is disappointing to see statements that are easily analyzed passed through without criticism. An "expert" stated that the viruses circulating were test cases for the "big attack". These virus do little more than annoy those who are affected and the exploits used to replicate and disable are typically quickly patched by vendors. A closed hole cannot be exploited again, so what is the point of the nefarious hacker wasting their opportunity to destroy civilization?
There is no magic to cyber warfare. Hackers are glorified dumpster divers that exploit human errors in code or improper information security. It is not rocket science and you don't need to be particularly clever to do it.
The story here is not "running a script" to destroy a dam or shutting down the power grid. The story should be about the risks to the individual such as identity theft.
Danger still resides predominantly in the material world and it is going to stay that way for a long time. I hope to see Frontline return to a more balanced, less sensational mode of reporting in the future.
Hoboken, NJ
Dear FRONTLINE
Congratulations on another smashing show. Tonights show Cyber wars brings forward the issue of that has be talked about for years. The points raised by Richard Clarke should be taken very serious. The fact that he resigned from the White House post over this issue should serve as warning to the current administration that this threat is real. The fact that Howard Schmidt is resigning over this is also puzzling to me.
We can no longer allow the U.S. government to return to the days of being complacent of potential threats. The evidence that was uncovered on several of the laptops in Afghanistan should also be an indication that we are vulnerable to a cyber attack by terrorist groups with the help of some branch of government.
Michael Woodson
Boston, Massachusetts
Dear FRONTLINE
I cannot believe that the whole show focused on the potential for net driven physical collateral damage. Sure you might be able to control some digital controllers, but it seems as though a terrorist group could do more damage if it were to hit where it hurts most; remember deep throat follow the money. I am sure that the US Fed has similar security protocols to any Dam and a group could do much more damage getting under that skin than into a turbine room. Even a hack that transferred billions of dollars would cause more potential instability than any direct intervention using the net.
Even wiping out one half hours worth of trades on the NYSE would be far more damaging than a hack into a power grid. The former could just be the power going out, the latter just does not happen.
Ultimately your issues do not make sense. Sure a disruption in the power grid would be damaging, but the fail safes in all these electronic controller systems were all updated and installed prior to Y2K. The same applies for every controlling network and individual pieces of controlling technology in sensitive physical assets ranging from nuclear generators to traffic control systems. It just is not likely to happen.
This whole story seems as though it is a way for some potentially high priced consultants to one, to get hired and two extract really really high fees. Actually they missed the boat and that probably has Mr Greenspan and a whole lot of bankers and brokers breathing a bit easier.
Fraser Rieche
vancouver, bc
Dear FRONTLINE
Haven't you people heard if LINUX? Linux is the best protection against Internet terrorism. Get with the program. Spread the word. Linux is already there with Virus protection and practically hacker proof, and can be easily made to be virtually "Bullet Proof" Just ask IBM. Why even use Microsoft on the Internet? Go Figure?
Steve Gesn
irving, Texas
Dear FRONTLINE
I was so glad to see Cyber War!! on PBS tonight. As a Cybercrime technology major here in N.C., I am very interested in the way our country is dealing with the Cyber threat. I thought the program was very educational and informative.
Judy Elkins
Sylva, NC
Dear FRONTLINE
Is there any true way to be secure in the world of the internet? I wonder if sight to sight Micro wave is the only true secure avenue to follow, or is that compromised also?
What does it hold for the future?
I am glad frontline is a part of my viewing experience, once again I will go to bed wondering. Thankyou,Thankyou.
Butch Looft
Swea City, Iowa
Dear FRONTLINE
Thank you very much for the Frontline show. I'm an IT manager for a small non-profit foundation. A major part of my job is protecting my employer's network from cyber attackers. At times this is a very thankless job; for the most part users and my employer take it for granted the work that's involved in protecting my small part of the internet from attacks. The program tonight brought to light the real importance of internet security. I belong to an ever growing user group that is dedicated to the early detection of attacks. I won't drop the groups name; I'll leave that up to the group's founder. The group has been on the fore front of early detection of such attacks as CodeRed, Nimda and the latest SQL Slammer. A major concern of the group recently has been a piece of legislation named Super DMCA that could potentially make it illegal to operate NAT, Firewalls, Honeypots and IDS's. I'm hoping you can enlighten the general public about Super DMCA and hopefully enlighten the powers to be to stop this bill from becoming law in such states as Massachusetts. Again thank you for your involvement in the Frontline program.
Paul Marsh
Plymouth, Ma
Dear FRONTLINE
It is clear that cyberspace has joined the other operational environments--land, air, sea, and outer space--as a critical realm for national security operations. The DOD has for several years been adding this to the curricula of our various schools and programs. I direct the one at the National Defense University We recognize its growing importance to modern warfare and national security, and the its key place as one of the tools by which nations and political groups employ the information component of power.
Dr. Daniel Kuehl
Washington, DC
Dear FRONTLINE
As far as cyber terrorism, don't you think that there is a missing link here?
The premise was presented that a cyber attack initiated by Al Queda would benefit the perpetrators more than 9/11. I wonder just how effective it would truly be. How could Al Queda leaders explain to their target audience, a vastly uneducated and wildly superstitious group, that they just cut power to half the west coast and America must now freeze in the dark for the next six months. I just don't see the reaction coming as it did after 9/11. Remember the Palestinian woman wagging her tongue and dancing in the street on 9/12? This is what they want. Their acts have to be easily and readily understood and publicized for impact. Assembly language programming just doesn't rate with flying planes into buildings. Can you imagine a cleric stating that for every line of code that brings down one operating system you get a 12 virgins when you go as a martyr. Simply won't grab the headlines. I am not saying that we are not vulnerable, just that we need a better profile of our enemy for adequate defense. Remember the teachings of Sun Tzu: ?When you know your enemy and yourself you will succeed in every encounter .? -The Art of War
Diamondhead, MS 
| 
