Like a thief in the night

 

Image from Unsplash

The road was winding, hilly and above all pitch dark. I had lit all the front lights: low beam, high beam and wide beam. She appeared out of nowhere. A darkly dressed woman who walked in the middle of the other half of the road, her gaze directed downwards.

We were more or less used to foxes crossing the road in the Provence at night, but this was something else. You are scared stiff. As your hand reflexively goes to the horn, all sorts of things go through your mind: what is that crazy person doing there, what a relief that she was on the other side of the road, and that one question that would haunt me for days: how would this have ended if she had been on my side of the road?

There wasn't much time to think. Because a car was approaching from the other side. The driver had to be warned! There are two ways to do that: honk, and signal with your lights. I did both, and an old annoyance about operating the high beams came to the fore again: the lever has no clear click between signaling and locking the high beams. Which means that when you want to signal, you often lock the high beams instead. And that's how the message gets lost - alarming flashing becomes irritating blinding. Other cars do it better: there you pull the lever towards you to signal and push it away from you to lock the high beams. Incidentally, the other driver had understood that something was wrong, because they slowed down.

Unexpected things that require due haste will always happen. Sometimes you’ll trust your reflexes (braking for a child crossing the road), other times you’ll make a note that you have to look at it sometime (a rattle in the car). The desired reaction time depends on two aspects. One is the time factor: how much time do you have to avert the disaster, or to repair damage that has already occurred? The other is the impact factor: how quickly do you have to react to minimize the undesirable consequences of an event?

In the past few days the Netherlands have seen an event in the 'urgent' category: a malfunction in the Defence network NAFIN, which not only affected Defence itself, but also the rest of the country. Eindhoven Airport (also a military airbase) came to a complete standstill, the communication networks of the emergency services failed, municipalities could not issue driving licences and citizens could not log in to government services because the authentication service, DigiD, was not available. In short: the impact (even socially) was great and a quick recovery was very much desired. Of course we all want to know what caused this malfunction. The Minister of Defence reported on this: "The cause of the problem was in the access to the so-called Netherlands Armed Forces Integrated Network (NAFIN). Due to an error in the software code, a problem arose in the time synchronization on the network. As a result, it was not possible to connect to this network. There is currently no indication that the malfunction was caused by a malicious party."

The latter was said quite quickly, so quickly that I initially wondered whether it was not more of an incantation than reality. But now there is a plausible story: components of the network that wanted to connect to each other were denied access because their clocks were not running in sync; that is how I interpret the ministerial explanation. Compare it to a link that you get when you click on "I forgot my password" somewhere. Those links often have a limited validity period. If a clock is not set correctly somewhere, those links won’t work, no matter how quickly you get to it.

The Minister of Justice and Security joined the discussion with a striking statement: “Get used to it”, was his much-quoted opinion. This ministry also includes the NCTV (National Coordinator for Terrorism and Security) and the NCSC (National Cyber Security Centre), so it is not just anyone who said this. Should we be concerned about this statement? Some think so, because it would mean that people at the highest levels do not see the seriousness of the situation. I myself think: hey, we have been used to it for a long time already, because things often go wrong and then they are simply fixed. However: most incidents do not have such a big impact. I can think of a few scenarios in our own organisation, for example, which would give us a bit more than the usual headache and could have a significant social impact. We would rather not get used to that.

The NAFIN malfunction had actually already been resolved, but this morning (Friday) it turned out that the airport police is still experiencing problems. If you are going to fly in the coming days, don't forget your passport. Because issuing an emergency passport is not an option for the time being.

 

And in the big bad world…

• Many readers of this article have an opinion about the NAFIN problems. [DUTCH]
• Prime Minister Schoof was not that impressed by the major disruption. [DUTCH]
• Seattle Airport is likely to have suffered a cyber attack.
• this journalist gives an eyewitness account of the situation in Seattle.
• iPhones and iPads crash when you type four specific characters in a row.
• France has arrested the of Telegram’s CEO.
• Signal 's boss was interviewed in the context of the chat app's tenth anniversary.
• It's always a shame when a well-intentioned action strongly resembles phishing.
• you better throw away this security camera.
• a bank employee sold customer data to criminals. [DUTCH]
• Ireland is seeing more and more WhatsApp hacks (and it could happen in your country too).

Alarm at the pool

 

Image from Pixabay

In the past, 100 to 150 children drowned every year in France. A significant portion of these tragic accidents occurred in private swimming pools. That is why legislation was introduced in 2004 requiring safety measures. The number of annual drownings in private swimming pools fell to 20-50.

Nowadays, French private swimming pools must have a fence, cover or alarm system. During the holidays we encountered the latter, which was intended to alert parents if a child falls into the water. The owner of the house had explained to us how it worked: hold down one button on the remote control, then press the other and voilà, the alarm was turned off and the pool was open for business.

If you forgot to turn it off and jumped into the water, you were treated to a loud alarm sound just a moment later. Then someone had to quickly grab the remote control and press the buttons. It soon became apparent that this did not work properly: only after several attempts did the alarm go silent. It was unclear what was wrong. A light came on on the remote control, so apparently the batteries were still good. The buttons were soft and vague to the touch, so you tended to press harder and harder. Perhaps the circuit board under the buttons had become damaged over the years. Anyway, this couldn't go on any longer.

Fortunately, there was an alternative. There was a magnet in the garage with which you had to touch the alarm box in the swimming pool to switch off the alarm. That worked flawlessly and saved us from a lot of hassle. Although sometimes things still went wrong, because if no one had been in the pool for fifteen minutes, the alarm was automatically activated. If you didn't think about that at the next refreshing dive, you were still in trouble.

The lights on the alarm didn’t really help, either. There were two of them: one red, the other green. If the green light was on, you were not allowed to swim, and if the light was red, you were all right. From the alarm’s point of view, I get it: if the alarm is on, the swimming pool is protected, and therefore the green light is on. Alarm off means unsafe, so red. But from the user's point of view, this is not convenient, because one usually crosses the road when the light is green.

No concerned neighbors showed up on the doorstep in the event of a (false) alarm. They simply lived well out of earshot. But what would this be like in a more densely built-up environment? I don’t think that the entire neighborhood would show up with swimming rings and rescue hooks at the first beep. Only if the alarm continued, a slightly irritated neighbor might perhaps come and take a look. But isn't it already too late then?

And yet the legislation appears to be quite effective. I think that a sturdy fence with a child-resistant lock works best - preventive measures prevent misery, while detective measures only signal that there is a (possible) problem. Prevention is better than cure; not being able to fall into the pool is better than having to be fished out half drowned.

I could make a clever link to my field of expertise here, but you get the idea yourself. Automatically throwing away a phishing email before it ends up in your inbox causes less hassle than clearing up the mess after you have clicked on that link. Blocking access to a rogue website is more effective than having to respond to a malware infection. Not asking your customer for data that you don't actually need is more sympathetic than having to inform your customer that their data have been leaked - yes, sometimes not doing something is also a measure.

Of course, this is not a disqualification of all those security systems that signal that something may be wrong. We really need that too. Defense in depth means that you build up protection in layers. If someone has left the pool gate open, an alarm system can still prevent a lot of grief. Just as it is very important that you recognize phishing and handle it correctly - in case the security systems fail to catch it. It's a shame that French legislation only requires one measure.

 

And in the big bad world...

• it's a bad idea to save passwords in your browser.
• you can of course also hack the gears of expensive racing bikes.
• Household robots are also not safe from hackers.
• There are still programmers who think hardcoded passwords are a good idea.
• Maybe it wasn't such a good idea to connect all our solar panels to the internet.
• the Dutch Data Protection Authority warns against incidents involving artificial intelligence. [DUTCH]
• Electronic equipment is now forbidden during Cabinet meetings. [DUTCH]
• the Prime Minister himself explains the importance of this measure. [DUTCH]
• this Android malware plunders your bank account using your physical bank card.