RISKS-LIST: RISKS-FORUM Digest Monday, 2 November 1987 Volume 5 : Issue 53
FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS
ACM Committee on Computers and Public Policy, Peter G. Neumann, moderator
Contents:
Re: Risks in intelligent security algorithms (David Redell)
Danger of typing the wrong password (Scot Wilcoxon)
Inadvertent Launch (Kenneth R. Jongsma)
MX Missile guidance computer problems (John Haller)
Re: Autopilots (Jan Wolitzky)
Aircraft accident (Peter Ladkin)
Missiles; predicting disasters (David Chase)
DISCOVER Uncovered? (Bruce N. Baker)
TV Clipping Services (Tom Benson [and Charles Youman], Samuel B. Bassett)
The RISKS Forum is moderated. Contributions should be relevant, sound, in good
taste, objective, coherent, concise, nonrepetitious. Diversity is welcome.
Contributions to RISKS@CSL.SRI.COM, Requests to RISKS-Request@CSL.SRI.COM.
For Vol i issue j, FTP SRI.COM, CD STRIPE:<RISKS>, GET RISKS-i.j.
Volume summaries for each i in max j: (i,j) = (1,46),(2,57),(3,92),(4,97).
----------------------------------------------------------------------
Date: Mon, 2 Nov 87 11:10:03 PST
From: redell@src.dec.com (David Redell)
To: RISKS FORUM (Peter G. Neumann -- Coordinator) <RISKS@KL.SRI.Com>
Subject: Re: Risks in intelligent security algorithms (RISKS 5.52)
Peter Denning reports (5.52) on an annoying rough edge on the San Francisco
Airport's parking lot computer system, which attempted to double charge him
when he re-entered the lot on the same day. I had a similar experience at the
San Jose airport, but in my case, I parked for two consecutive weekends, and
when I left after the second one, the blasted system tried to charge me for
the week in between! This seems really unforgivable, since it had plenty of
time to both purge the old record and enter the new one. Fortunately, I just
happened to still have the first receipt in my car. Unfortunately, I was in a
hurry, and so did not display Peter's diligence in tracking down the official
"explanation".
[Sounds like the SAME program! If you
drive a BMW, Let the Bayer Beware. PGN]
------------------------------
Subject: Danger of typing the wrong password
Date: 1 Nov 87 15:37:22 CST (Sun)
From: umn-cs!sewilco@datapg.MN.ORG (Scot Wilcoxon)
To: RISKS@csl.sri.com
Yet more from the Program Trader Nelson article (WSJ, Oct 13, pg 39):
One time, a broker typed in the wrong password (on the Bankers Trust
computer), which happened to be another broker's password. "So they
both had this same list of securities. I get a call from a broker
saying, `I'm trying to buy XYZ and it keeps getting bid up out there.`
We couldn't figure it out. Then it suddently dawned on us that (two
different brokers) were working the same list."
Both brokers were getting the same list of stocks to buy and sell, and were
bidding against each other.
Scot E. Wilcoxon sewilco@DataPg.MN.ORG {ems,meccts}!datapg!sewilco
Data Progress Minneapolis, MN, USA +1 612-825-2607
------------------------------
From: portal!cup.portal!Kenneth_R_Jongsma@Sun.COM
To: risks@csl.sri.com
Subject: Inadvertent Launch
Date: Mon Nov 2 17:06:28 1987
In regards to the post that talked about parking a vehicle on top of a
Minuteman III silo to prevent it's launch: I was a Minuteman commander
for several years and had a similar experience. One evening while on
alert, I had a missile report "Launch In Process". This was unusual,
to say the least! It was also not preceded by the usual indications
of a launch. When I called the problem into the base, I received the
reply: "Well sir, keep an eye on it. It's either going to launch or
shut itself down. In either case, there's not a lot we can do about
it." This was not a true statement and probably was the type of Shortly
thinking that led to the vehicle being placed over the silo at
F.E. Warren. If that did indeed occur, it would be questionable
to it's effect. The silo door is approximately 5 feet of hardened
concrete and is designed to open even when buried under a substantial
amount dirt and rubble.
Inadvertent launch sounds serious, but hold on before you assume
the worst. A subsequent investigation revealed that there was a fire
in the communications rack that reported site status. At no time
were any of the interlocks that prevent accidental launch at risk.
In effect, the missle's status had never changed from the reported
"Strategic Alert".
I have worked with many systems, I would say that none have the number
and well thought out sets of fail safes for both Type I and II
accidental launches. One interesting fact is that no part of the
launch *procedure* for Minuteman or MX is classified. Only recently
have the operational manuals been restricted to offical use and
probably could be obtained under the Freedom of Information Act.
The challenge, of course, is to design, build and test systems that
have an acceptable level of risk.
------------------------------
Date: Mon, 2 Nov 87 19:44:10 PST
From: ihnp4!ihlpl!jhh@ucbvax.Berkeley.EDU
To: ucbvax!KL.SRI.COM!RISKS
Subject: MX Missile guidance computer problems
I'm sure many people will have something to say about Sunday's 60 Minutes
report about untested parts being used in the MX Missiles currently
deployed. I'll refrain from comparing this to SDI, and stick to the story.
There are three variables that make up a project: quality, budget, and
schedule. It has been said that it is possible to meet any two of these
objectives, but only at the expense of the third. It appears that, in the
eyes of lower management, the personal risk of not meeting the schedule was
greater than the risk of manufacturing products that had not been fully
tested. After all, if the US ever had to use these parts, the individuals
are not likely to be around to face the repercussions of MX missiles landing
in Chicago rather than Moscow.
Although this particular program focused on untested, but certified falsely
as tested, hardware, similar problems exist is software development.
Software developers are loath to have someone else checking to be sure that
they have done all the work they said they have done. The feeling is that
each individual is trustworthy, and checking work exhibits a lack of trust.
Unfortunately, human nature is such that someone testing an error leg of
code, probably at 2:30 in the morning, is likely to declare themselves done,
as they "know" they did a good job coding the software, and the last 20
error legs they tested had no problems. Even worse is the case when their
manager is pushing hard to meet a particular schedule, and the project is
understaffed. The 60 Minutes program showed how hard it is to use auditors
to discover problems when management does not want to know that a problem
exists. The organizations telling the auditors what to do all had a vested
interest in the project being completed on time.
Any suggestions? John Haller ihnp4!ihlpl!jhh
------------------------------
Date: Mon, 2 Nov 87 06:33:59 PST
From: research!wolit@ucbvax.Berkeley.EDU
To: RISKS@csl.sri.com
Subject: Re: Autopilots
Joe Morris is correct in stating that a pilot should be able to
overpower a failed autopilot. Of course, fighting a bad autopilot is
not the safest way to fly, either.
While not exactly pertinent here -- most general aviation autopilots are
analog, not digital devices, and thus hardly qualify as "computers" by
most people's definition -- a few autopilot "war stories" may be of
interest.
My friend had flown his Grumman Cheetah (a light, single-engine plane)
to a nearby airport for its annual inspection, and the shop offered to
have an instructor fly it back to him afterwards. Without shutting down,
the instructor slid across to the right seat, and my friend climbed into
the left to fly the instructor back. (I know it sounds complicated,
but it's a lot easier than setting up a car shuttle.) He immediately
noticed that the controls felt much stiffer than usual, and mentioned this
to the instructor. The instructor replied that the shop had probably
tightened up the control cables, and that everything was normal. My friend
took off and flew to the instructor's airport, disturbed that the usual
light, responsive control feel of the Grumman had been replaced by the
truck-like feel of, say, a Cessna (no flames from Cessna owners, please).
After landing, he went to the shop to complain about this. The mechanic
came out to the plane, moved the control yoke, and said that it felt fine.
My friend tried it and, sure enough, it moved freely. Turned out that
the instructor (who usually flew Cessnas) had flown to my friend's airport
with the autopilot engaged, and that my friend had not noticed this during
the run-up and return flight. The single-axis (roll) autopilot had been
engaged in a navigation-aid tracking mode, but the nav radio had been off
for the short flight, so the autopilot had been busily trying to hold the
ailerons neutral, fortunately without overwhelming success.
The other point I want to raise concerns a particular type of
autopilot (or mode of operation) popular on many corporate jets and turboprops
and heavier piston twins. This is known as a flight director, and it
involves having the autopilot compute the desired flight path for a
particular maneuver (a missed approach, e.g.), and display on the
artificial horizon -- the primary attitude reference instrument -- a
set of "command bars", which direct the pilot to maintain the appropriate
aircraft attitude. In other words, the autopilot assumes the
"executive" function, and the pilot serves as a servo motor! I never
understood why anyone would use such a device. I read a report of an
accident several years ago in which a corporate plane -- I believe it
was an MU-2, in fact -- took off from National Airport in D.C. and
flew into the river for no other reason than that the flight director
went psychotic and commanded the pilot to do so. It seems to me that
it's hard enough to remain skeptical of what your instruments are
telling you and maintain a cross-check on their reliability, without
reducing the pilot to the status of a robot, slavishly following
George's orders.
Jan Wolitzky, AT&T Bell Labs, Murray Hill, NJ; 201 582-2998; mhuxd!wolit
(Affiliation given for identification purposes only)
------------------------------
Date: Mon, 2 Nov 87 15:03:53 PDT
From: ladkin@kestrel.ARPA (Peter Ladkin)
To: risks@csl.sri.com
Subject: aircraft accident
i found the following letter in the 8.1.87 copy of aviation safety.
apart from the deja vu, it raises questions about certification
procedures for light aircraft, does it not? i had understood that
aircraft had to be flown through all the appropriate flight regimes to
validate the data. maybe i am mistaken, and perhaps someone can clarify?
density-altitude is a term used for the `correction' of true altitude for
`non-standard' air temperature (based on the international standard
temperatures and lapse rates used for aircraft design). all pilots are
taught to compute it, and to be aware of it on takeoff from `hot-and-high'
fields. it's a measure of airplane performance, e.g. i have taken off from
grand canyon (6606ft MSL) on a hot day in june when the density altitude was
9300 feet and i expect the airplane to behave according to the handbook's
figures for 9300ft.
the letter is reprinted without permission. i reproduce the letter in full
because of the apparent legal history. the grumman aircraft are not
currently in production.
peter ladkin
(From Donald H. Slavik of Milwaukee, Wisconsin)
I enjoyed the article in your May 15, 1987 issue regarding the Grumman
AA-1. As an attorney, several years ago, I represented the estate of a
man who was killed in an accident involving this aircraft. He attempted
to take off from a 3,000-foot long, 150-foot wide, one-degree uphill
grass runway in northern Wisconsin. The aircraft was loaded to maximum
gross weight and the outside air temperature was about 70 degrees. The
aircraft failed to clear trees which were located 1,400 feet past the
end of the runway.
My investigation into the background of the aircraft revealed that
original flight testing for takeoff and climb performance was
accomplished at sea level only. This data was then used as input to
a computer program to reduce it to data applicable to higher density
altitudes. A careful review of the computer program revealed that there
was a sign error in one of the exponents for the critical equations.
This caused serious errors in the resulting output data. Secondly, the
technical research paper which the computer program was based upon had
a footnote which was ignored by the manufacturer of the aircraft. The
footnote pointed out that these equations were not applicable to
aircraft with low thrust-to-weight ratios (such as this particular plane).
We initiated our own set of flight tests under the direction of Michael
Antoniou, the consultant referred to in the Aviation Consumer article.
These tests, accomplished at the same density altitude as that which
existed on the day of the accident, correctly predicted the performance
of the aircraft and also matched the impact point in the trees.
In conclusion, I sincerely believe that the takeoff and climb performance
data in the pilot's operating handbook is incorrect.
[End of Letter]
------------------------------
Date: Mon, 2 Nov 87 10:13 PST
From: David Chase <acornrc!rbbb@ames.arpa>
To: risks@csl.sri.com
Subject: Missiles; predicting disasters
(on faulty missiles)
I find it interesting that the doors are controlled by the missile and not by
the person(s) giving the launch order. I suppose that this removes one way of
thwarting a launch, but it seems unlikely that agents of the Evil Enemy Empire
would be able to get at the door controls if they were ground-based
(certainly, it is no more likely than them being able to park an APC on top of
the silo). The trade-offs that our military makes between ensuring a desired
launch and preventing an accidental launch tend to give me the creeps.
(on predicting disasters, and the comment that it didn't really matter)
There is no question that disaster prediction is useless without some advance
preparation. Since there is a cost to both prediction and preparation, as
soon as the expected cost of disaster X falls (well) below the costs of
prediction and preparation, one stops preparing and predicting. Consider
hurricane preparation on the West Coast, earthquake preparation on the East
Coast, and snowstorm preparation in the South. One region's minor disaster is
another region's calamity, and a day or two of warning won't help that much.
Preparation for all these events requires widespread, long-term preparation,
and an occasional "baby disaster" helps enormously to keep people aware and to
test their response.
I find the current administration's early depictions of SDI particularly
amusing in light of this. Remember the "umbrella"? Whatever happened to
civil defense? I recall some interpretation of civil defense as "threatening"
-- does that mean that SDI is not? On the other hand, civil defense may
whip up emotions in ways that the "umbrella" does not; it's harder to
generate public sentiment for peace and friendship when the public is also
preparing for an attack by the Evil Enemy Empire. Sigh. I wish I could
think that this was Reagan's Secret Plan for better relations with Russia.
David
------------------------------
Date: Mon 2 Nov 87 14:44:51-PST
From: BNBaker@KL.SRI.Com
Subject: DISCOVER Uncovered?
I just received a promotional letter designed to entice me to join Discover
Card Travel Services. There is a sweepstakes involved in which I may already
be a winner. I get so excited everytime I read those words. In other words,
I get excited at least once a day, but this one has a new twist.
The flyer states, "Enter now. You could be an INSTANT WINNER! Your dream
vacation stamp bears a unique UPC Symbol. It will be electronically scanned
to reveal if you are an instant winner!" It so happens that we have two
Discover cards for some reason, and I happened to open both envelopes. I
already mentioned how excited I get and so I was able to get excited twice.
Then I noticed that the UPC symbols were the same on both flyers. As you
may recall from a couple of issues ago, I have an interest in semantics so
I called Discover Card to learn about this new meaning of the word "unique."
I was told that there is a secret code on the UPC Symbol that makes each one
unique. The bar codes are identical so there would have to be some special
material in the ink of the winning ones. If, however, the bar codes differed
on the winners, then the winners would be obvious to those printing them up.
Either way, my entries are not unique, as claimed. The Discover Card
representative simply gave cute answers back to my questions.
They asked how big my sample size was, so part of the purpose of this is to ask
RISKS readers if they by chance received the same unique set of UPC symbols
that I did, namely Canada 12345 06240, Hawaii 12345 50030, West Germany 12345
02990, Walt Disney World 12345 75740, Colorado 12345 00580, Arizona 12345 10300
If yours are different, please let me know also.
The things that annoy me about this are:
The aura of electronically scanning the entries to determine who the
winners are, when in fact that process may not take place.
The attempt to dispense my concerns by stating that there is a secret code
on each of the UPC symbols that can only be read by their special
computer.
The technology is produced by UPC Games of Chicago (no phone listing). At a
minimum, this appears to be misrepresentation, but I've been notified that I
may already be a winner so many times that this slight twist to the
misrepresentation game should not bother me I suppose. Does anyone know how
this one supposedly works?
Bruce N. Baker <bnbaker@kl.sri.com>
------------------------------
Date: Sun, 1 Nov 87 08:33 EST
From: "Tom Benson 814-238-5277" <T3B@PSUVM> [BITNET]
Subject: TV Clipping Services
To: RISKS@KL.SRI.COM
In RISKS-5.51 Will Martin asks about TV clipping services. The best
comprehensive source for network television news is the Vanderbilt
Television News Archive, at Vanderbilt University. They collect all
national network news (since 1968, I believe), plus some special events.
Full print indexes of this service are available at good research
libraries or from Vanderbilt. They will provide videotape of specified
stories at, I believe, about $100 per hour of tape.
There are also several commercial clipping services, which charge more
but which also collect such things as local tv news. They operate in
several major cities, but I have little information about them; I could
find out more if it's of interest.
On the general point, Will is right: these services are a good way
to monitor what the public is hearing about various areas in which
scholars and scientists are interested.
Tom Benson, Penn State University [Also noted by Charles Youman]
------------------------------
Date: Fri, 30 Oct 87 23:29:39 PST
From: amdcad!well!samlb@hplabs.HP.COM (Samuel B. Bassett)
To: risks%csl.sri.com%hplabs@hplabs.HP.COM
Subject: Video Clips
For the person wondering about being able to get videotapes of TV
programs, I would suggest contacting Bacon's PR & Media Information Services
in Chicago. They do, certainly do newspaper and magazine clips, and may also
do video clips -- if not, they will likely be willing and able to refer you
to somewhere that can.
The address and telephone number I have are from 1984, but they do
have an '800' number, and you can get it by dialing 1-800-555-1212 and asking
the AT&T operator.
Bacon's is a decidedly commercial operation, and is not cheap, but my
experiences with them in '81-'83 were decidedly positive.
------------------------------
End of RISKS-FORUM Digest
************************