Net security efforts going nowhere fast

There's an odd disconnect between technology and security these days that deserves examination on the first anniversary of the Sept. 11 terrorist attacks.

The harder technology tries to ensure data security, it seems, the more hacking incidents and thefts it enables.

Look at the track record over the past five years. Credit-card numbers are sold over the Internet. Identity theft has tripled. Scandals over "smart card" piracy and unauthorized use of digital IDs have become routine.

This is all ironic given technology's soaring promises to make the world safer in the 21st century. It also suggests a potential futility to relying on technological solutions to security problems — an ideal that may be crippling technological advances and innovation in our connected world.

Before the World Trade Center attack a year ago, the technology arena was focused largely on making it easier to share information over networks for "anytime, anywhere" communication via a variety of devices. You would be able to shop, bank, hear music, watch videos, check e-mail, verify a flight and play games via your cellphone, personal digital assistant or whatever. These were called Web services, and nearly every tech company had a strategy to promote them.

Since Sept.11, however, sharing has taken a distant back seat to securing. And momentum toward providing all those convenient services has faltered.

Consider the case of Microsoft. To proliferate seamless on-the-go computing, the Redmond giant centered its corporate strategy on .NET, blending microprocessor capabilities with the ubiquity of the Internet. Then came Sept. 11. Within four months, Chairman Bill Gates announced a new companywide mission: Make all Microsoft software more secure.

Since then, Microsoft, in what amounted to an admission that it had not adequately protected personal information, agreed to 20 years of government oversight of its online identity service Passport. Two weeks ago, the company issued half a dozen fixes to Internet Explorer. Microsoft also has issued numerous patches to Windows and related programs.

The company also is backing a "trusted computing" initiative called Palladium. But critics have raised antitrust and privacy concerns over Palladium, and leading security analyst Bruce Schneier has written that "like everything else Microsoft produces, Palladium will have security holes large enough to drive a truck through."

The upshot of the security focus: Gates acknowledged at a July meeting of analysts and members of the news media that .NET was not coming along as quickly as expected.

Microsoft is hardly the only high-profile enterprise with security challenges. There's smart-card maker Canal Plus Technologies, which, in a bizarre case of corporate sabotage, has accused competitor NDS Group of hacking Canal Plus' encryption, enabling production of counterfeit Canal Plus cards. No matter who is found culpable, both companies are supposedly in the business of ensuring data privacy.

Also disturbing are analyses of the host of biometric scanning devices — for fingerprints, irises and faces — which since Sept. 11 were offered up for increased airport and business security. A German team tested a variety of devices and was able, "aided by comparatively simple means, to outwit all the systems tested."

Given its spotty success so far, should technology even try to promise robust security? By holding out hope of a fail-safe system, technology may be diverting focus away from the human values needed to provide true social trust.

In a recent Los Angeles Times article on the Canal Plus-NDS fracas, security expert Schneier had a telling comment: "A lot of people look at computer security and say: 'Give me the answer. Tell me what will make these problems go away.'

Schneier's answer: "Nothing."

Paul Andrews is a free-lance technology writer and co-author of "Gates," a biography of the Microsoft chairman. He can be reached at pandrews@seattletimes.com.