Flash Gordon Left Me The Keys

DISSERTATION BECOMES TERRORIST TREASURE MAP

Sean Gorman's professor called his dissertation "tedious and unimportant." Gorman didn't talk about it when he went on dates because "it was so boring they'd start staring up at the ceiling." But since the Sept. 11th attacks, Gorman's work has become so compelling that companies want to seize it, government officials want to suppress it, and al Qaeda operatives -- if they could get their hands on it -- would find a (Dissertation Could Be Security Threat
Student's Maps Illustrate Concerns About Public Information )¡¿Sean Gorman's professor called his dissertation "tedious and unimportant." Gorman didn't talk about it when he went on dates because "it was so boring they'd start staring up at the ceiling." But since the Sept. 11, 2001, attacks, Gorman's work has become so compelling that companies want to seize it, government officials want to suppress it, and al Qaeda operatives -- if they could get their hands on it -- would find a terrorist treasure map.

Tinkering on a laptop, wearing a rumpled T-shirt and a soul patch goatee, this George Mason University graduate student has mapped every business and industrial sector in the American economy, layering on top the fiber-optic network that connects them.

He can click on a bank in Manhattan and see who has communication lines running into it and where. He can zoom in on Baltimore and find the choke point for trucking warehouses. He can drill into a cable trench between Kansas and Colorado and determine how to create the most havoc with a hedge clipper. Using mathematical formulas, he probes for critical links, trying to answer the question: "If I were Osama bin Laden, where would I want to attack?" In the background, he plays the Beastie Boys.

For this, Gorman has become part of an expanding field of researchers whose work is coming under scrutiny for national security reasons. His story illustrates new ripples in the old tension between an open society and a secure society.

"I'm this grad student," said Gorman, 29, amazed by his transformation from geek to cybercommando. "Never in my wildest dreams would I have imagined I'd be briefing government officials and private-sector CEOs."

Invariably, he said, they suggest his work be classified. "Classify my dissertation? Crap. Does this mean I have to redo my PhD?" he said. "They're worried about national security. I'm worried about getting my degree." For academics, there always has been the imperative to publish or perish. In Gorman's case, there's a new concern: publish and perish.

"He should turn it in to his professor, get his grade -- and then they both should burn it," said Richard Clarke, who until recently was the White House cyberterrorism chief. "The fiber-optic network is our country's nervous system." Every fiber, thin as a hair, carries the impulses responsible for Internet traffic, telephones, cell phones, military communications, bank transfers, air traffic control, signals to the power grids and water systems, among other things.

"You don't want to give terrorists a road map to blow that up," he said.

The Washington Post has agreed not to print the results of Gorman's research, at the insistence of GMU. Some argue that the critical targets should be publicized, because it would force the government and industry to protect them. "It's a tricky balance," said Michael Vatis, founder and first director of the National Infrastructure Protection Center. Vatis noted the dangerous time gap between exposing the weaknesses and patching them: "But I don't think security through obscurity is a winning strategy."

Gorman compiled his mega-map using publicly available material he found on the Internet. None of it was classified. His interest in maps evolved from his childhood, he said, because he "grew up all over the place." Hunched in the back seat of the family car, he would puzzle over maps, trying to figure out where they should turn. Five years ago, he began work on a master's degree in geography. His original intention was to map the physical infrastructure of the Internet, to see who was connected, who was not, and to measure its economic impact.

"We just had this research idea, and thought, 'Okay,' " said his research partner, Laurie Schintler, an assistant professor at GMU. "I wasn't even thinking about implications."

The implications, however, in the post-Sept. 11 world, were enough to knock the wind out of John M. Derrick Jr., chairman of the board of Pepco Holdings Inc., which provides power to 1.8 million customers. When a reporter showed him sample pages of Gorman's findings, he exhaled sharply.

"This is why CEOs of major power companies don't sleep well these days," Derrick said, flattening the pages with his fist. "Why in the world have we been so stupid as a country to have all this information in the public domain? Does that openness still make sense? It sure as hell doesn't to me."

Recently, Derrick received an e-mail from an atlas company offering to sell him a color-coded map of the United States with all the electric power generation and transmission systems. He hit the reply button on his e-mail and typed: "With friends like you, we don't need any enemies in the world." ?!

New Dutch Pie'n Face Winner (Dissertation Could Be Security Threat )Toward the other end of the free speech spectrum are such people as John Young, a New York architect who created a Web site with a friend, featuring aerial pictures of nuclear weapons storage areas, military bases, ports, dams and secret government bunkers, along with driving directions from Mapquest.com. He has been contacted by the FBI, he said, but the site is still up.

"It gives us a great thrill," Young said. "If it's banned, it should be published. We like defying authority as a matter of principle."

This is a time when people are rethinking the idea of innocent information. But it is hardly the first time a university has entangled itself in a war. John McCarthy, who oversees Gorman's project at GMU's National Center for Technology and Law, compared this period to World War II, when academics worked on code-breaking and atomic research. McCarthy introduced Gorman to some national security contacts. Gorman's critical infrastructure project, he said, has opened a dialogue among academia, the public sector and the private sector. The challenge? "Getting everyone to trust each other," McCarthy said. "It's a three-way tension that tugs and pulls."

When Gorman and Schintler presented their findings to government officials, McCarthy recalled, "they said, 'Pssh, let's scarf this up and classify it.' "

And when they presented them at a forum of chief information officers of the country's largest financial services companies -- clicking on a single cable running into a Manhattan office, for example, and revealing the names of 25 telecommunications providers -- the executives suggested that Gorman and Schintler not be allowed to leave the building with the laptop.

Businesses are particularly sensitive about such data. They don't want to lose consumer confidence, don't want to be liable for security lapses and don't want competitors to know about their weaknesses. The CIOs for Wells Fargo and Mellon Financial Corp. attended the meeting. Neither would comment for this story.

Catherine Allen, chief executive of BITS, the technology group for the financial services roundtable, said the attendees were "amazed" and "concerned" to see how interdependent their systems were. Following the presentation, she said, they decided to hold an exercise in an undisclosed Midwestern city this summer. They plan to simulate a cyber assault and a bomb attack jointly with the telecommunications industry and the National Communications System to measure the impact on financial services.

McCarthy hopes that by identifying vulnerabilities, the GMU research will help solve a risk management problem: "We know we can't have a policeman at every bank and switching facility, so what things do you secure?"

Terrorists, presumably, are exploring the question from the other end. In December 2001, bin Laden appeared in a videotape and urged the destruction of the U.S. economy. He smiled occasionally, leaned into the camera and said, "This economic hemorrhaging continues until today, but requires more blows. And the youth should try to find the joints of the American economy and hit the enemy in these joints, with God's permission."

Every day, Gorman tries to identify those "joints," sitting in a gray cinderblock lab secured by an electronic lock, multiple sign-on codes and a paper shredder. No one other than Gorman, Schintler or their research instructor, Rajendra Kulkarni, is allowed inside; they even take out their own trash. When their computer crashed, they removed the hard drive, froze it, smashed it and rubbed magnets over the surface to erase the data.

The university has imposed the security guidelines. It is trying to build a cooperative relationship with the Department of Homeland Security. Brenton Greene, director for infrastructure coordination at DHS, described the project as "a cookbook of how to exploit the vulnerabilities of our nation's infrastructure." He applauds Gorman's work, as long as he refrains from publishing details. "We would recommend this not be openly distributed," he said.

Greene is trying to help the center get federal funding. ("The government uses research funding as a carrot to induce people to refrain from speech they would otherwise engage in," said Kathleen Sullivan, dean of Stanford Law School. "If it were a command, it would be unconstitutional.")

All this is a bit heavy for Gorman, who is in many ways a typical student. His Christmas lights are still up in July; his living room couch came from a trash pile on the curb. Twice a day, Gorman rows on the Potomac. Out on the water, pulling the oars, he can stop thinking about how someone could bring down the New York Stock Exchange or cripple the Federal Reserve's ability to transfer money.

On a recent afternoon, he drove his Jeep from the Fairfax campus toward the river. Along the way he talked about his dilemma: not wanting to hurt national security; not wanting to ruin his career as an academic.

"Is this going to completely squash me?" he said, biting his fingernail. GMU has determined that he will publish only the most general aspects of his work. "Academics make their name as an expert in something. . . . If I can't talk about it, it's hard to get hired. It's hard to put 'classified' on your list of publications on your résumé."

As he drove along Route 50, he pointed out a satellite tower and a Verizon installation. Somewhere in Arlington he took a wrong turn and stopped to ask for directions. It has always been that way with him. He's great at maps, but somehow he ends up lost. ...Tinkering on a laptop, wearing a rumpled T-shirt and a soul patch goatee, this George Mason University graduate student has mapped every business and industrial sector in the American economy, layering on top the fiber-optic network that connects them...

Using mathematical formulas, he probes for critical links, trying to answer the question: "If I were Osama bin Laden, where would I want to attack?" In the background, he plays the Beastie Boys.

For this, Gorman has become part of an expanding field of researchers whose work is coming under scrutiny for national security reasons...

"Never in my wildest dreams would I have imagined I'd be briefing government officials and private-sector CEOs..."

Invariably, he said, they suggest his work be classified. "Classify my dissertation? Crap. Does this mean I have to redo my PhD?" he said. "They're worried about national security. I'm worried about getting my degree..."

"He should turn it in to his professor, get his grade -- and then they both should burn it," said Richard Clarke, who until recently was the White House cyberterrorism chief. "The fiber-optic network is our country's nervous system."

Sunday, July 13, Pittsburgh Post-Gazette
9/11 Turned Thesis into Time Bomb
"Sean Gorman's professor called his dissertation 'tedious and unimportant.' Gorman didn't talk about it when he went on dates because 'it was so boring they'd start staring up at the ceiling.' But since the Sept. 11, 2001, attacks, Gorman's work has become so compelling that companies want to seize it, government officials want to suppress it, and al-Qaida operatives--if they could get their hands on it--would find a terrorist treasure map. Tinkering on a laptop, wearing a rumpled T-shirt and a soul patch goatee, this George Mason University graduate student has mapped every business and industrial sector in the American economy, layering on top the fiber-optic network that connects them."

Old shit!

BOB GARFIELD: A George Mason University grad student was just hoping for a doctorate and a job. Instead, his PhD dissertation is being called a "terrorist treasure map" and scaring the bejesus out of the gatekeepers of America's communications infrastructure. That's because his project maps the nation's entire fiber-optic network, overlaying every business and industrial sector in America. The question is: should the map be public information like any other academic research or placed under lock and key? Steve Aftergood directs the Federation of American Scientists' project on government secrecy and he joins me now from Washington, DC. Steve, welcome back to OTM.

STEVEN AFTERGOOD: Thank you.

BOB GARFIELD: So what can this map do? Accordin8g to the Washington Post -- I'm quoting here -- "He can click on a bank in Manhattan and see who has communication lines running into it and where. He can zoom in on Baltimore and find the choke point for trucking warehouses." Has he indeed created a road map of the nation's communications vulnerabilities that, that had never existed before?

STEVEN AFTERGOOD: I doubt it. What he's - he himself says that what he did was to compile information that was already in the public domain.

BOB GARFIELD: But if you were a terrorist and you were looking to wreak havoc, it would be like one of those mall maps -- You can bomb here.

STEVEN AFTERGOOD: I don't think it's the right way to look at things. If one were a terrorist, one would not require a, a PhD dissertation on this subject or any other in order to locate a vulnerability. There are vulnerabilities all around us, and the idea that if not for this or that piece of information, we could be perfectly secure, is an illusion.

BOB GARFIELD: Gorman said that government officials and private sector CEOs want his work to be classified by the government! Can it be classified?

STEVEN AFTERGOOD: Strictly speaking, it cannot be. That applies only to government information. The only situation in which the government can seize privately-generated information is when that information concerns nuclear weapons. If I conceive of a design for a nuclear weapon and write it down on a napkin, the government can claim ownership of the napkin and come in and seize it.

BOB GARFIELD: Richard Clarke, the former White House cyber-terrorism chief sai-- told Gorman he should turn his dissertation in for a grade and then burn it. [LAUGHTER] Well apart from voluntary immolation, what do you expect will happen next with this particular piece of research?

STEVEN AFTERGOOD: I am a big believer in people taking responsibility for their own work. Nobody knows this work better than Mr. Gorman, the author, and-- if he is persuaded that there is a real national security concern here, he should act accordingly, and I gather that that is the course of action he has chosen. He is not releasing the work. He - it is apparently being kept in secure storage. I presume that's the right thing to do.

BOB GARFIELD: I guess I'm asking you if -- can you imagine a circumstance where you would change your stripes on this subject -- where you would say well you know what -- at some point the government does have not only the right but the responsibility to step in to suppress otherwise public information.

STEVEN AFTERGOOD: I think that the answer is clearly yes. What's an example? Detailed information on the production and manufacture of biological weapons. Now, I would hate for an admission like that to be turned into an indiscriminate new power of the government to control information. The desire for security is a natural, normal and, and important one. But the desire for absolute security is neurotic. It's neurotic because it is not achievable and because it leads to a self-defeating posture. You end up tying your own hands, diverting resources where they are not productively used, and you can never really solve the problem.

BOB GARFIELD: Now there's another wrinkle on this, and that is not government oversight but scientific oversight.

STEVEN AFTERGOOD: Earlier this year a number of the largest scientific journal publishers issued a statement that from here on out they are going to consider security -- the hazards of publication -- when they review scientific papers for publication in their journals. Last year, for example, a, a group of scientists published a paper on the production of a synthetic polio virus, but the fact of the matter is there's no great solution to this challenge. The science of biological weapons is largely indistinguishable from many areas of life sciences, medical research and so on, and you cannot restrict one without restricting the other.

BOB GARFIELD: All right, Steve. Well, once again, thank you very much.

STEVEN AFTERGOOD: Thank you.

BOB GARFIELD: Steve Aftergood directs the Federation of American Scientists' project on government secrecy. His newsletter is called Secrecy News.

BROOKE GLADSTONE: Coming up, cartooning -- both naughty and nice. And taking revenge on telemarketers.

BOB GARFIELD: This is On the Media from NPR.