Skating on Stilts

Will Jeff Bezos Bring Feudal Security to the Net?

The Kindle Fire is a remarkable innovation in the Apple mold:  taking a bunch of components that are pretty well known and combining them into a powerful new experience.  But unlike Apple, Amazon’s integrating vision isn’t visual design or even user delight.  Instead it’s far more ambitious -- a new vision of the entire Internet ecosystem.

OK, let me try that again without the Valley babble.  The Kindle Fire forks Android into an Amazon-designed and Amazon–controlled operating system.  So far, no surprises. Amazon owns and subsidizes the hardware, too, so it can design features that integrate operating system and processor tightly.  Again, nothing that Apple can’t do.  But then comes the clever, almost-new idea:  Fire uses its own browser, called Silk, which is designed to work with Amazon’s massive cloud computer.  So instead of downloading web pages one after the other and opening them on your computer, Amazon’s cloud stores and even opens them, sending you the end result.  This allows speedier downloads for a couple of reasons:  Caching of popular pages (or even parts of pages) avoids download delays when the original source is overloaded; and Amazon’s cloud can handle even the most processor-intense pages instantaneously, far faster than your wheezing desktop machine.  In short, your Internet experience on the Fire ought to be lightning quick.

There’s another advantage to this new vision of what might be called the Bezosnet.  The Bezosnet ought to be a lot more secure.  One way that hackers compromise your machine is by getting you to go to malware infected sites.  Just visiting the site triggers routines that take over the visitor’s computer.  But if the routine runs, not on a visitor’s computer but in a virtual environment at Amazon’s data center, the attacker’s code isn’t likely to work. 

In fact, it looks to me as though Amazon has a remarkable security opportunity here.  It controls the Fire hardware, the Fire operating system, and the Fire user’s internet connection. If a Fire tablet joins a botnet, Amazon will know immediately. It can quarantine the tablet and alert the owner.  Indeed, it can go further, performing diagnostics to figure out and remedy the security flaw the botnet exploited. If a Fire tablet starts sending beacons or massive encrypted data files to a Chinese controller site, Amazon can spot the pattern and alert the user or even block the transmissions.  No one else, not even Apple, maybe not even DoD, will have the same ability to drive security into all parts of the Internet ecosystem.

If Amazon exploits its security opportunity, this could be transformative for users. To take one example, most people are, or should be, wary about Internet financial transactions.  Small businesses that do electronic funds transfers are at enormous risk today.  Like consumers, their machines are easily compromised, but unlike consumers, their losses to hackers are not underwritten by the banks.  That’s costing them easily hundreds of millions of dollars a year. As small businesses come to appreciate the risk, Amazon has a chance to persuade them that a dirt-cheap Amazon Fire tablet is the only safe way to access their funds.

Competitively, that could put Amazon squarely in the stream of high-value Internet transactions.  Maybe it becomes a bank.  Maybe it forces Mastercard and Visa to give it a discount because fraud on Amazon-mediated transactions is lower. Maybe it takes on Google’s relationship with advertisers, since now Amazon has insight into information advertisers really want:  what are consumers actually buying and how much are they paying? Maybe it kills the prospects of ISPs and telcos hoping to transcend dumb pipe status and exploit their direct connection to consumers; that connection won’t be much use if Amazon controls and can encrypt the entire stream of communication.

For consumers, the Fire opens up a prospect of feudal security on the Internet.  We already know that we can’t protect our own machines from attack. For all the talk of insecurity in the cloud, it’s almost certainly more secure than the decentralized system we have now. To take one example, I have a lot more faith in Google’s ability to protect my gmail account than in the ability of my system administrator to do the same for my corporate account.  And I have more faith in Amazon’s ability to spot malware infested websites than in my ability to do the same, even with help from Google and antivirus software. Yes, you’re putting all your eggs in one basket, but you’re also hiring someone to guard that basket while you get on with life. Sooner or later, to get security, it looks as though we’re all going to have to pick a liege lord and shelter under his castle walls. And now Amazon has an chance to build the first string of forts and castles across the most desirable territory.

Of course, where there’s feudalism, there’s droit de seigneur. The price for security will be, probably must be, a loss of privacy, anonymity, and control to Amazon.  Right now, Amazon’s terms of service provide some contractual anonymity to users, but as a technical matter Amazon has total visibility into everything that happens on a Fire tablet.  That visibility is very likely necessary for security, and it is damn sure valuable for commercial purposes.  So it’s hard to imagine that it won’t be used for both purposes.

I can hear the privacy Luddites cranking up their outrage machinery now.  As usual, they'll be a day late.  But they’ll also be a dollar short, at least if I’m right that the alternative to sheltering under Amazon’s walls is living out on the plains alone, at the mercy of marauders. No one will thank the data protection authority that saves us from Amazon by pushing us into the arms of the Russia Business Network. What the authorities can do is police Amazon’s terms of service and perhaps hold Amazon to any promises of security with tough new liability rules.  But, like Regulation Z, which declares that credit card fraud can’t cost US consumers more than $50, a rule imposing liability on Amazon for Internet security breaches could turn out to be an enormous market advantage (not to mention a tough barrier to entry for imitators).

All in all, then, the Fire Tablet is potentially a very big deal.  Too bad I’m too cheap to buy one.

(As always when I get into the details of security technology, I do so with considerable humility about my grasp of, well, actual technical details. This is technology poetry, not prose, and a first draft of the poetry at that. I welcome technical corrections. )

Gaga Scats

I've never much appreciated Lady Gaga. Not because she's so committed to pop, or to over-the-top personal transformations; that doesn't keep me from working out regularly to Ke$ha
 or P!nk or Britney.  The real problem was that I didn't find Gaga's hooks that good or her rhythms that compelling.

But Lady Gaga's work with Tony Bennett, on Bennett's Duets II, has changed my mind.  Singing "The Lady Is A Tramp" she turns in a great performance, hanging in there with Bennett, ad-libbing, enjoying herself, and even doing a bit of respectable scat.  

Who knew? The woman is a musician.

Photo credit: By Domain Barnyard (Lady Gaga at CES 2010) [CC-BY-2.0 (www.creativecommons.org/licenses/by/2.0)], via Wikimedia Commons

The Law of Cyberwar: What FDR, Hitler, and the Blitz Can Teach Us

I’ve just finished a longish piece on cyberwar and the role of lawyers, published in Foreign Policy magazine.  Here’s how it begins:

Lawyers don't win wars. But can they lose one?

We're likely to find out, and soon. Lawyers across the U.S. government have raised so many show-stopping legal questions about cyberwar that they've left the military unable to fight or even plan for a war in cyberspace.

...

 

And here’s the part that inspired the title of this post:

By the 1930s, everyone saw that aerial bombing would have the capacity to reduce cities to rubble in the next war. Just a few years earlier, the hellish slaughter in the trenches of World War I had destroyed the Victorian world; now air power promised to bring the same carnage to soldiers' homes, wives, and children.

In Britain, some leaders expressed hardheaded realism about this grim possibility. Former Prime Minister Stanley Baldwin, summing up his country's strategic position in 1932, showed a candor no recent American leader has dared to match. "There is no power on Earth that can protect [British citizens] from being bombed," he said. "The bomber will always get through.... The only defense is in offense, which means that you have got to kill more women and children more quickly than the enemy if you want to save yourselves."

The Americans, however, still hoped to head off the nightmare. Their tool of choice was international law. (Some things never change.) When war broke out in Europe on Sept. 1, 1939, President Franklin D. Roosevelt sent a cable to all the combatants seeking express limits on the use of air power. Citing the potential horrors of aerial bombardment, he called on all combatants to publicly affirm that their armed forces "shall in no event, and under no circumstances, undertake the bombardment from the air of civilian populations or of unfortified cities."

Roosevelt had a pretty good legal case. The 1899 Hague conventions on the laws of war, adopted just two years after the Wright brothers' first flight, declared that in bombardments, "all necessary steps should be taken to spare as far as possible edifices devoted to religion, art, science, and charity, hospitals, and places where the sick and wounded are collected, provided they are not used at the same time for military purposes." The League of Nations had also declared that in air war, "the intentional bombing of civilian populations is illegal."

But FDR didn't rely just on law. He asked for a public pledge that would bind all sides in the new war -- and, remarkably, he got it. The horror at aerial bombardment of civilians ran so deep in that era that Britain, France, Germany, and Poland all agreed to FDR's bargain, before nightfall on Sept. 1, 1939.

Nearly a year later, with the Battle of Britain raging in the air, the Luftwaffe was still threatening to discipline any pilot who bombed civilian targets. The deal had held. FDR's accomplishment began to look like a great victory for the international law of war -- exactly what the lawyers and diplomats now dealing with cyberwar hope to achieve.

But that's not how this story ends.

...

Flight search done right

I find even good flight search sites, like Hipmunk, Yapta, and Kayak, a little frustrating.  Now Google Flight Search is getting ready to do what Google does best – transform Internet tools for free. Google's new travel search service is the first fruit from its acquisition last year of ITA Software, a travel search firm. 

Lots of travel sites trembled when Google bought ITA.  And well they should. 

This thing is cool. 

You kind of have to explore it yourself, but the visualization tools are excellent and will save you money.  Example: A weekend trip Burlington from Washington would cost $845 right now.  Last time I took that trip, I had to fly to Albany and drive to get a decent fare.  Now, thanks to Google Flight’s visualization of future weekend fares, I’ve discovered that United will sell me a $219 weekend ticket from Dulles to Burlington if I just make reservations about a month in advance.  (To see this example, go to the search page for that trip and click on the little calendar icon on the top right side of the page.)

That’s the kind of thing you could learn from the other sites only by laboriously typing dates over and over again, then waiting to see what turned up. With Google Flight, the low fare just jumps out at you.  There’s lots more geeky fun to be had with other tools, too. 

Poisoning the Hamburger Helper

The Obama Administration’s legislative proposals on cybersecurity are a distinctly mixed bag.  But probably the worst ideas are those put forward by the Justice Department, which last week testified about the need to update the Computer Fraud and Abuse Act. 

Again.

In fact, for the eleventh time since it was adopted in the 1980s.  We've seen this movie. Every time Congress gets exercised about cybersecurity, the Justice Department claims that the CFAA needs to be updated.  But “updated” almost always turns out to be a euphemism for “made more prosecutor-friendly.”

Justice’s latest proposals fit squarely into this mold.  Justice wants to create a new crime, hacking a critical infrastructure computer, with a mandatory minimum sentence of three years.  It wants to impose the same penalties on conspiracies and attempts as on successfully completed crimes.  It would get rid of first-time offender provisions in sentencing, increase sentences in general, allow civil forfeiture of hackers’ real estate, and make violation of the CFAA a RICO predicate, which would allow heightened penalties and private civil suits against violators.

Well, you might ask, why not get tough with hackers?  Surely we shouldn’t be playing pattycake with Anonymous and Lulzsec, let alone the foreign hackers endangering our national security.  That’s true, but the problem we have with those hackers is not the weakness of our criminal penalties but the fact that, most of the time, we can’t find them.  Until we do a better job of breaking the anonymity that protects them, increasing penalties for criminals we don’t catch will not make much difference. 

Take a look at the website where Justice maintains a representative list of its most significant prosecutions.  What’s striking is how few prosecutions it has to brag about – less than 50 – and how few of those (maybe half) represent cases in which we actually caught the kind of remote hackers we’re most threatened by. I’m willing to bet that there is no other federal criminal law that has been amended so often in prosecutors’ favor with so few successful prosecutions to show for it. 

The latest amendments are more of the same:  Shooting in the dark with a bigger gun. As protections against cyberattack, these amendments are useless.  They are added to the administration’s package mainly to give it the appearance of heft.

They are the legislative equivalent of Hamburger Helper.

Actually, they're worse than that.  The RICO provision is far more dangerous than it first appears. To explain, I’ll need to repeat some of what Orin Kerr has been saying for years, so if you’re already familiar with that, you can skip the next ten paragraphs.

***

As I’ve said, the remarkable growth in cyberattacks over the last quarter century has enabled Justice to turn the CFAA into what may be the most prosecutor-friendly criminal statute on the books.  What does “prosecutor-friendly” mean in practice?  That any competent prosecutor can find a way to indict and convict anyone who does anything Really Bad with a computer. 

With the CFAA, that’s mission accomplished:  The law imposes harsh criminal penalties on anyone who accesses a protected computer “without” or “in excess of” authorization.  The definition of a “protected computer” has been expanded until it covers any computer used in interstate or foreign communication, which in the Internet age is, well, every computer. As a practical matter, then, you can be indicted any time you do something on a computer that isn’t authorized. That term isn’t defined, but you can bet that if you do something Really Bad with a computer, it will turn out to be unauthorized.

Take Lori Drew, an overprotective, nasty mother who created a fake teenage-boy identity on MySpace in an effort to humiliate her daughter’s teenaged frenemy.  The scheme worked so well that the teen killed herself.  There’s no doubt that Lori Drew’s behavior was Really Bad, and it involved computers, so federal prosecutors decided it must violate the CFAA. And, mirabile dictu, it did.  By using a fake identity, Drew had violated MySpace’s terms of service, which meant that she had accessed a MySpace computer “in excess of” authorization. Drew was convicted, although in the end, with Orin Kerr’s help, the guilty verdict was overturned.

This kind of prosecutorial overreach is an inherent risk of the CFAA, given its reliance on the slippery concept of authorization.  As some civil liberties groups recently pointed out, the CFAA at its heart makes it a federal crime to violate a private contract, even a contract of adhesion like a social network’s terms of use:

If, for example, an employee photocopies an employer’s document to give to a friend without that employer’s permission, there is no federal crime (though there may be, for example, a contractual violation).  However, if an employee emails that document, there may be a CFAA violation.  If a person assumes a fictitious identity at a party, there is no federal crime.  Yet if they assume that same identity on a social network that prohibits pseudonyms, there may again be a CFAA violation.

I don’t want to be too hard on the drafters of the CFAA;  they faced a tough drafting problem.  Hackers cause terrible harm, but the things they do aren’t all that different from the things legitimate users do.  Legitimate users open files, modify code, install programs, and send data to remote sites.  So do hackers.  We know the difference between the two, but it’s not easy to express that difference without falling back on the notion that the good guys are authorized to do those things and the bad guys aren’t.

I think this means that any statute that criminalizes hacking is likely to be either too broad or not broad enough.  Congress chose broad language to make sure that hackers couldn’t get off on a technicality, but in the process it gave Justice enormous prosecutorial discretion. Justice Department official James Baker gave a persuasive defense of the "authorization" test in last week's testimony.  But the Department’s misuse of its broad discretion in the Lori Drew case suggests a need for greater accountability and discipline within the Department.  Requiring that the head of the Criminal Division sign off on all such cases -- and take the blame if they turn out badly -- may be a more workable solution than taking away the prosecutors’ discretion by changing the law.

Remarkably, though, that isn't even the worst problem created by the CFAA.  The law also creates a private cause of action, handing a big legal weapon to everyone from the RIAA to the Church of Scientology.  And private parties aren’t exactly showing a lot of restraint.  According to the Center for Democracy and Technology, at least one company has brought a CFAA counterclaim in a pregnancy discrimination case, seeking damages under the Act because its employee acted in excess of authorization on the corporate network.  What did she do?  She violated a corporate proscription on “excessive Internet use.”  Equally abusive is a case that Orin Kerr has pointed out – Sony’s threat to sue PS3 hackers because they used their own computers in violation of Sony’s licensing restrictions.

Maybe back in the 1980s, Congress thought that creating a civil action would unleash the plaintiff’s bar on real hackers.  If so, Congress was deluded. 

Civil CFAA lawsuits have proliferated but by and large they aren’t being filed against people who hack into systems.  Instead, they’re being brought by corporations against employees thought to have downloaded too much information from the corporate network before quitting.  They’re being brought by websites to keep competitors from using “scraper” software to collect their pricing data. Maybe those are bad things.  If so, they’re probably already torts under state law, and it’s hard to see why the cases should be in federal court.  And if they aren’t torts under state law, well, it’s even harder to see why they should be in federal court.  It’s the law of unintended consequences run amok.

***

OK, that’s the Gospel According to Orin Kerr. Now back to the latest proposal from Justice. 

Justice wants to make the CFAA one of the federal crimes that qualify as “racketeering activity” under the Racketeer Influenced and Corrupt Organizations Act, or RICO.  This would add RICO prosecutions to the long list of get-tough measures that Justice rarely uses against actual hackers because, well, because it can't catch most actual hackers.   

But that doesn't mean the amendment would have no effect.  Because, like the CFAA, RICO creates a private cause of action against RICO violators.  Actually it’s not just a private cause of action.  It’s a bonanza. Plaintiffs can recover treble damages plus attorney’s fees by bringing suit against “racketeers.” And what do you know, just like CFAA civil suits, it turns out that most RICO civil suits have been brought against ordinary businessmen, “rather than against the archetypal, intimidating mobster,” according to the Supreme Court. 

The Supreme Court and Congress have struggled for decades to curb abuses of civil RICO.  Now, almost casually, the Justice Department proposes to open another can of RICO liability for unintended defendants.  

How would that happen?  First, treble damages under civil RICO can be claimed by any person “injured in his business or property by reason of” a RICO violation.  18 U.S.C. § 1964(c).    A violation of RICO occurs, inter alia, when a “person employed by or associated with any enterprise engaged in” interstate or foreign commerce participates, “directly or indirectly, in the conduct of such enterprise’s affairs through a pattern of racketeering activity.”  (Sorry for the dense language; it may help to parse the language by thinking of a mobster who acquires partial ownership of a legitimate “enterprise” through threats of violence. He would be squarely covered by the provision, as long as he committed a  pattern of racketeering activity –- that is, more than one predicate crime.  But the words will sweep in far more conduct than classic mobster tactics, especially if Justice gets its way and violating the CFAA becomes a predicate offense.)

Pulling these elements together, let’s look at what the Justice Department’s proposal would mean for some of the unnecessary federal litigation now being brought under the CFAA.  We can start with the employer lawsuits against departing employees.  Employers who want to turn their CFAA claims into much more potent RICO claims would have to show that the departing employee committed two CFAA violations, which should be easy, since every unauthorized download is a new offense.  And, they'd have to show that they were injured in their business by reason of the racketeering; this they can do by showing the same damages that supported the CFAA case.  In short, on a quick look, the Justice Department seems to have created a massive incentive for companies to sue departing employees, and perhaps the companies they join, as racketeers.  Anyone who has a plausible CFAA case today will have a plausible RICO case once Justice gets its amendment. 

Okay, another one: How about CDT’s favorite case – the pregnant worker accused of a CFAA violation because of excessive Internet use?  Well, she probably violated the rule on Internet use more than once, which makes for a pattern of racketeering, and she’s employed by an enterprise, in whose affairs she participated by misusing its computers.  The enterprise has been injured, too, by virtue of not getting her full attention at work.  What do you know? She sounds like a racketeer too!  It would be malpractice not to hit her with a counterclaim for treble damages and attorneys’ fees.

(At this point, you may be wondering why the Obama administration, of all administrations, wants to give employers even heavier litigation weapons to use against their employees. Beats me.  Maybe it has something to do with trial lawyers.  Maybe it's just prosecutorial myopia.  James Baker's testimony doesn't even acknowledge the issue.)

OK, let’s try a harder problem.  You’re a copyright holder -- Jon Stewart, say -- and you’d like faster takedowns and more respect from YouTube.  Posting copyrighted material on YouTube is a violation of law and can lead to termination of your YouTube account.  The Lori Drew case tells us that the people who post clips in violation of that policy are using YouTube’s computers “in excess of authorization.” That’s a CFAA violation.  Do it twice and it becomes a pattern of racketeering, at least if Justice gets its way.  Now, the people doing the posting aren’t employees of YouTube, but they are “associated with” the YouTube enterprise, and they are participating indirectly in the conduct of YouTube’s affairs by virtue of their shocking CFAA violations.  What’s more, the Daily Show can claim injury in its business because it has lost viewers and ad revenue.  Presto!  Another racketeer takes the fall.  Maybe they’ll name Google as a co-conspirator just to keep it on its toes. 

Oh, and what about you, dear reader?  Have you ever violated the terms of service on a website?  Hell, have you ever read them?  C’mon, I’ve seen the comments on my privacy and TSA posts. Are you sure yours didn’t violate the site’s proscription on “abusive or denigrating comments”?  Cause if you did it twice, that’s a predicate, and this blog is an interstate enterprise that you are associated with and in whose affairs you are participating by virtue of your appalling violations of the terms of use and thus of the CFAA.  Best of all, the blog has what strikes me as a pretty upscale readership.  Treble damages and attorney’s fees would go a long way toward finally monetizing my blogging habit. 

(Had you going there, huh?  Actually, this blog doesn’t have any terms of use for commenters, so fire away. You’re safe.)

I’m not a RICO lawyer, thank God, so maybe I’m oversimplifying what it takes to make out a civil RICO suit.  But, what the hell, the lawyers representing departing or pregnant employees aren’t RICO lawyers either.  If the claim against them is plausible on its face, they will face overwhelming pressure to settle, quite possibly by abandoning good claims, especially if their next employer is dragged in as a co-conspirator.  Ditto for the YouTube uploaders.

And in exchange for all this uncertainty and injustice, what benefit can we expect in fighting actual criminals?  About as much as we’ve gotten from the CFAA’s private right of action, which is nothing, and from RICO’s private right of action, which is less than nothing. 

This is Hamburger Helper with a dose of cyanide.  

 Photo credits:

http://www.flickr.com/photos/arkangl/with/4709166389/ 

http://www.flickr.com/photos/like_the_grand_canyon/3853938360/lightbox/ 

Cyberwar: Iran's Counterattack?

Iran is to cyberwar what 1930s Spain was to airwar – contested ground where everyone tries out new technology and tactics.  After being on the receiving end of Stuxnet, which sabotaged the Natanz enrichment plant and showed that cyberweapons could replace cruise missiles, it looks as though the Iranian government has gone on the offensive.

The Dutch government’s electronic certification authority, DigiNotar, was compromised by a hacker in July of this year.  DigiNotar handled the hack badly, trying to fix the problem without disclosing it. As a result, DigiNotar's credentials are being revoked by all of the major browsers.  This means that most web users will not be able to verify the bona fides of any site that DigiNotar has vouched for.  That includes a lot of Dutch government sites, and there are some reports that the Dutch government is leaning on Microsoft to keep the credentials operative for another week.  It also means that DigiNotar will be either out of business or buried in lawsuits that could also reach its parent, VASCO Data Security International.

The hacker who pulled off the compromise has posted messages claiming that the hack was revenge for Dutch peacekeepers’ surrender of thousands of Muslim men to Serb militias during the Balkan wars; the men were executed. The hacker says nothing about Iranian government sponsorship.

So why do I think the Iranian government was involved?

To understand that requires a bit of background about the role of certificate authorities on the Internet.  One of Netscape’s cleverest technological innovations was its solution to the problem of Internet eavesdropping.  It used public key encryption to encrypt the channel between a website and each user.  The user could look up a site’s public key and use that key to encrypt all of the user's communications with the site.  (I’m oversimplifying here, but that’s the idea.)

The only problem was that the system was open to a “man in the middle” attack, where Mallory turns what's meant to be a secure link between Alice and Bob into two secure links with himself as a secret hub and Alice and Bob as unsuspecting spokes.

Put another way, if an Iranian user asks Google for its public key, and he uses it to encrypt his communications, how does he know that he's really using Google’s key?  If the Iranian government wants to read his Gmail, it could intercept his request and send him its own key.  He’d set up a secure channel with the government, which would then simply pass his login credentials on to Google.  For the rest of the session the government would sit in the middle, reading and passing on all the packets from both sides of the transaction.  Not good.

To prevent that, Netscape decided to bake a set of public keys into its browser.  The companies with the baked-in keys were certification authorities.  They could issue certificates vouching for the credentials of every site that wanted to offer secure, encrypted communications. 

It was a great system, lightweight and very secure.  But only if the certification authorities kept their credential-signing process completely secure.  If they didn’t, then users would not know who was at the other end of the line, the website they wanted or a man in the middle.

Occasionally, of course, some fraudster would use fake documents to persuade a certification authority to sign credentials for a site the fraudster didn’t own.  That sort of thing could be fixed pretty easily.  Browser providers had already recognized that there had to be a way to revoke website certificates obtained by fraud, so browsers now do an online check each time they use a certificate; in essence, they ask an online server whether the certificate they are about to use has been revoked. So a single fraudulently obtained credential can be rendered harmless as soon as the fraud is discovered.

What happened to DigiNotar was not so easily fixed.  It appears that the hacker gained control of the credential-signing process for some weeks during July of this year, and he signed credentials for hundreds of online sites, including Google, Microsoft, and the CIA.

Now, that’s deeply embarrassing, and it probably would have been enough on its own to spell the end of DigiNotar.  But what came next was even worse. 

Starting in August, according to investigators, online revocation checks for DigiNotar certificates jumped. Suddenly lots of people wanted to know whether the DigiNotar certificate for Google had been revoked.  This meant that hundreds of thousands of users were sure that DigiNotar was the authority that had signed Google’s credentials.  (In fact, Google signs its own credentials.) And 99% of the users asking about DigiNotar's certificate for Google came from Iran. (Even the 1% of requests that didn’t come from Iran seem to have come from proxies and TOR routers in other countries, meaning they too could have been Iranian users.)

Clearly a lot of Iranian users had been fooled into thinking that DigiNotar had issued Google’s credentials.  I can only think of one way that could happen – if the Iranian government and ISPs were systematically intercepting packets bound for Google and saying, in effect, “I’m Google. Here are my credentials, signed by DigiNotar.  Let’s go secure and foil any eavesdroppers.” The user’s browser would say, “Wait a minute while I check to make sure DigiNotar hasn’t revoked your DigiNotar credentials, Google… Ok, you check out, let’s talk.”  As soon as the user started sending his login name and password to the fake Google, the middleman would use those credentials to log in to Google, which would set up a secure communications channel with the middleman.  The entire session would be encrypted unbreakably at every point in the chain save the one that mattered:  the government listening post in the middle. The Iranian government would be sitting pretty -- Mallory between Alice and Bob.

Some observations, mostly additional reasons for thinking that this was an Iranian government operation, and what that means: 

• The notes posted by the DigiNotar hacker make him sound like a flake and a braggart, hardly the kind of postings you’d expect from the Iranian secret police. Maybe this is misdirection, or maybe he pulled off the exploit and then handed over his loot to the Iranian government, voluntarily or involuntarily. But the implementation of the man-in-the-middle attack was so quick and so smooth that it looks to me as though the hacker was working with the government from the start.
• The same hacker who compromised Diginotar claims to have carried out attacks on Comodo and Globalsign, two other certification authorities. Both companies agree that they were hacked, although Globalsign is not admitting that its credentials were compromised. Again, compromising certification authorities is a great idea if you're in the business of man-in-the-middle attacks; otherwise it's got mostly nihilistic look-at-me-trashing-your-infrastructure appeal, which might make you wonder why this hacker has specialized in such attacks if he doesn't work for the government.
• If this were an Iranian government op, the websites for which fake credentials were issued should be an Iranian government wish list -- all the places where it most wants to be in the middle between the site and Iranian users. If so, the point of the fake CIA certificate wasn't help hackers break into the CIA's network. The point was to impersonate the CIA on line – to lure dissidents into setting up an apparently secure communications channels with a foreign intelligence service.  Iranian government paranoia about the CIA’s influence is so profound it’s almost flattering, and the Iranian government probably is kidding itself that the election protests were the result of foreign meddling, not the government’s unpopularity. 
• In fact, the domains whose credentials were falsified do seem to be a kind of museum of Iranian government paranoia. Along with Google, Microsoft, and the CIA, the hacker made fake credentials for Mossad, MI6, Facebook, Skype, WordPress, Twitter, azadegi.com (an Iranian dissident site in Persian), Walla.co.il (a site in Hebrew), torproject.org, and Yahoo, along with others.  The full list is here.  In some ways, it’s an honor roll.
• It's also a tell -- more evidence that the attack on DigiNotar was government sponsored.  After all, if the DigiNotar hacker was really acting on his own, without government guidance, how did he manage to create so many certificates that would have so much value for an Iranian government man-in-the-middle attack?
• If this is cyberwar, it's an Iranian government war against its own people.  And a very dangerous one. The flood of revocation checks coming from Iran continued all through August, meaning that anyone in that country who logged on to Gmail or Hotmail or the other honor-roll sites has probably lost control of everything – not just emails they sent in August but their passwords, their stored emails, their stored files, anything that could be accessed by passwords they used in August.
• As a result, DigiNotar’s security breakdown could foretell a new human rights disaster, with hundreds of thousands of victims. And, since we know the IP addresses that checked DigiNotar’s certificates, we could probably identify each victim individually.
• Which raises this question: We know from the online revocation checks that three hundred thousand Iranian users were fooled into using fake  DigiNotar certificates for Google. The same information should be available for Microsoft, Facebook, and every other fake certificate that was issued by the hacker.  Those numbers are the big story, and I don't understand why reporters have dropped the ball on it, unless they don't appreciate its significance.
• Mozilla has done a particularly good job of dealing with this issue, communicating more details earlier than most browser companies. Most recently, it called on the certification authorities it bakes into its browser to audit their security -- and to put automatic blocks on some of the names, such as Google or Facebook, that are most likely to inspire man-in-the-middle attacks and least likely to change certificate authorities on short notice.  In contrast, Apple handled the whole affair pretty badly, taking days longer than the other big browsers to announce that it was revoking DigiNotar's credentials.
• Iranian dissidents probably could protect themselves from these attacks by installing a browser extension called CertPatrol, which warns you if a site you've visited before has suddenly changed its certificate authority.  CertPatrol likely would have told all those Gmail users that, instead of going to a "Google" site that Google vouched for, they were instead going to a "Google" site that DigiNotar vouched for. They could also protect their Google account by turning on Google's two-step verification process, which won't let you log on from strange IP addresses until you've typed in a separate code sent directly to your phone.

As always when I venture too far into technical territory, I am quite aware that there are fine points I may be missing.  I welcome corrections and comments.

Better Swatch What You Say

Earlier this year, Bloomberg reporters sneaked onto a conference call that Swatch held with invited securities analysts.  The reporters taped Swatch executives’ two-hour exchange with the analysts, even though the call-in preliminaries included warnings that the call would be recorded for Swatch and that no other recordings should be made. When Bloomberg started selling its own transcript of the call, Swatch sued.

You might think that Swatch had some sort of privacy claim – that Bloomberg violated the wiretap or computer hacking laws.  In fact, though, Swatch registered its recording of the call with the US Copyright Office and sued Bloomberg for infringement. 

Bloomberg’s actions are controversial, for sure.  But how can copyright extend this far?  We live in a world where more or less everything can be recorded. If Swatch has a copyright claim here, what about former Senator George Allen? Having learned from his macaca moment six years ago, can he announce that he’s recording all his campaign events, so no one else can?  What about a police officer who objects to bystanders using their phones to film him in action?  Can he point to his cruiser-cam and accuse the bystanders of infringing copyright? 

That seems to be the view of Manhattan federal judge Alvin Hellerstein, 78, who approved Swatch’s copyright claim with little display of concern about its implications.  Denying the motion to dismiss, Judge Hellerstein blandly found that Swatch had met the requirements for claiming copyright: (1) the call was “fixed” on tape and (2) Swatch executives had exercised creativity during the call.  (Point 2 might give Swatch investors pause, of course, but that’s a different question.) 

Bloomberg will be free to assert a “fair use” defense at trial, but that’s cold comfort, especially if, as I suspect, Swatch’s registration of copyright allows it to seek massively punitive statutory damages.

You might think that Judge Hellerstein was forced into this unappetizing precedent by a broadly written copyright law?  But he wasn't.  In fact, the statute as written seems to require that Swatch give Bloomberg and everyone else 48 hours’ notice before Swatch could turn the call into a copyrighted performance.  But the court adopts Nimmer’s view and refuses that reading of the statute because limiting copyright damages claims “would serve no purpose.” 

And I suppose that’s true, as long as you can’t imagine the law serving any purpose other than enforcing copyright.

Mea Minima Culpa

At Ben Wittes's request, I've put up a post on Lawfare reflecting on the things I got wrong in the days after 9/11. I can't pretend it's much of an apology.  Here's the gist:

First, I misread the willingness of the press and the Pulitzer committee to stop celebrating disclosures of classified information. A few years later, two New York Times reporters Eric Lichtblau and James Risen, were actually awarded a Pulitzer for blowing the secrecy of the Bush administration anti-terror wiretap program.  given the doubts about its legality, that’s understandable.  But the same two reporters, along with the Times itself, shortly thereafter disgraced themselves by disclosing a secret Treasury Department program that tracked terrorist finances — a disclosure they made despite a complete lack of either scandal or illegality.

The second thing I got wrong was thinking that the press still mattered in the same old way.  I thought that the only way to influence the national conversation about terrorism was to persuade the editors of the Times to expand their Circle of Respectable Opinion to include a greater concern for security. Instead, the months after 9/11 created massive demand for independent bloggers who were willing to highlight stories and analyses that the press was filtering out. And so began a hemorrhage of readers, a loss of indispensability, that would fatally undercut the hold that mainstream media had on the national attention.

In an odd way, the two errors are connected.  Because the mainstream media didn’t take its loss of influence well.  In fact, it acted like a country parson who begins to deliver fire and brimstone sermons as his flock starts to dwindle. Remember the New York Times’s endless campaign in 2002 against the Augusta Country Club for, um, something or other? Its attack on Bush’s antiterror programs was part of that same doubled-down bet. But the mix of self-righteousness and flop sweat that infected the Times gradually forced anyone with views to the right of Manhattan’s Upper West Side to look elsewhere for news judgment.

Gut Feeling

This just in: The right kind of bacteria in your gut can literally change your mind – reducing anxiety in stressful situations.  Now we know why they call it intestinal fortitude. Because it is.

NYPD's Antiterror Tactics -- and Federal Turf

I have an op-ed in the NY Post, commenting on the role that bureaucratic turf fights may play in the Associated Press story looking for scandal in NYPD's counterterrorism efforts after 9/11. 

Here's a sample:

When you’re done [with the story], you find that NYPD is uniquely determined to find terrorists before they strike.  To do that, NYPD is willing to go far outside its borders -- to London, to Jerusalem, even to New Jersey.

It partners with counterterror analysts at the CIA.  It looks for leads in places where terrorists have been found before – in immigrant communities and in mosques, for example – and it doesn’t give terrorists a haven where they know the cops can’t  go.  It takes advantage of its diversity by asking its officers to hang out in communities where they blend in.  It recruits street sources wherever it can find them. It maps the neighborhoods it’s most concerned about.

Shocked yet?

Me neither. 

So what gives? How come we’re getting this story, at this length, at this time?

One possibility is turf.... 



Trekking in Mustang, Part 10

 

Wednesday, May 25

We are leaving the last of Tibet behind today, descending from Chelle to the floor of the Kali Gandaki. To extract the maximum up-country time from our territory permit, we’ve left ourselves a single day to get to Kagbeni from Chelle – a hike that took two days on the way in.

It is a demanding day, in part because our guide wants to get as much hiking in before noon, when the winds will surely be raging up the river valley. So we plough on with only a couple of occasional five-minute stops at the top of steep climbs. The good news is that I can feel the altitude change. My legs get as tired as ever, but the sense that every step requires a special breathing rhythm is gone. Even on the steepest uphills, running out of breath is rare. Other symptoms, such as a hacking cough, also recede as we drop below 3000 meters for the first time in a week.

The Kali Gandaki remains as remarkable as ever. The valley floor is so flat and barren that it looks almost like a reservoir of stones -- as though a dam had been constructed downstream and the gravel and rocks had somehow floated to the top. This is more or less what environmentalists tell us will eventually happen to Lake Powell and other big hydropower lakes; they’ll fill with debris. I’m sure that they’re right to tell us how terrible that will be, but if the floor of the Kali Gandaki is any guide, it will also produce some dramatic landscapes.

Toward the end of the day, we drop to the floor of the Kali Gandaki. It is not as flat as it looks from a distance. Rocks slip under our feet with each step, and old channels, now dry, make the footing unpredictable. Worse, the bridge we used to cross the river has washed away. We have a choice – wade or climb back to the road running high along the valley wall,

By now, I’m damned if we’ll climb these cliffs one more time. The water is swift but not deep, perhaps a bit above our knees. With poles, that’s usually safe, though pushing things if the current is very strong.

The standard Western stream crossing technique is to take your socks off, put your shoes back on, cross the river, pour out the water, put on the socks, and walk in damp but not squelching-wet footgear for a few hours. Wearing shoes helps a bit with the shocking cold of mountain streams and a lot with the treacherous footing of the streambed. Braced against the stream with a strongly planted upstream pole and an insurance pole downstream, this technique has gotten us across some tough streams, including a memorable encounter with the Upper Yellowstone in thigh-high flood.

But the Nepali guides have a different idea. They want to cross barefoot. So we too tie our shoelaces together, drape them around our necks and start across barefoot. I can feel the rocks underfoot – a mixed blessing, but good for stability. What I haven’t counted on is the way being barefoot changes the enthusiasm with which you drive your upstream pole into the river, knowing that the current will inevitably drag the point back downstream a foot or more before it hits the gravel. At least you hope it hits gravel.

When we get to Kagbeni, feet unpunctured, the Tiji festival boom is over. No one in the inn is going to Lo Manthang. Kagbeni is also on the month-long Annapurna Circuit trail, and the inn is full of guests doing some portion of tha trek. There’s a large group of mature Japanese women and men, plus a gaggle of 20-something backpackers – Germans and Russians, mainly – who’ve hooked up by chance during their last few days of the Annapurna circuit. They spend much of the evening arguing about whether to walk or take the bus next day to Jomsom, and how far to go beyond Jomsom. They finally agree to walk to Jomsom, starting at 6 a.m. One Russian boisterously puts forward first one proposal then another. He seems oblivious to the group dynamic. Sooner or later, someone needs to tell him to stop throwing out disruptive new options and to get with the program. If this is what the Russian Duma is like, I think, it’s easy to see why so many Russians voted for Putin.

This gaggle of Europeans seems as isolated from Nepal as any packaged-tour group staying at the local Hilton. A tour group may remember Kathmandu as the place with the terrible breakfast buffet, while the Europeans remember it as the place where they met a bombshell German babe, but either way, the trip is more about them than about Nepal. Maybe that’s true for all of us.

What I find interesting is that this group isn’t full of gap-year college kids. These trekkers have finished school. Many have dropped out of professional-track jobs. Some expect to pick up a new job in a few months, others lost jobs in the 2008-09 recession and are waiting for better times. But Nepal isn’t that cheap. Just to eat, sleep and indulge in the occasional beer or a bus, those backpackers must be spending $10 a day, plus airfare in the thousands of dollars. I’m not sure how many college students in the West can get their parents to underwrite the cost of a month on the Annapurna Circuit, so the trek is left to a slightly more affluent crowd. I suppose it’s no surprise that even backpacking has gone upscale as global economies converge.

Next morning, the Euro gaggle ends up leaving a little before we do, around 7. They move, like a convoy, at the speed of the slowest ship. We pass them in the first hour and soon are able to drop our packs at the Jomsom airport hotel and keep going. We’ve decided to take a day trip down the valley to a town called Marpha, also on the Annapurna circuit.

Marpha is a big change from the country we’ve been trekking through. On the way, we pass the first bit of greenery we’ve seen all trip that isn’t walled up like Ft. Knox. It’s a simple, close cropped patch of lawn that no doubt serves a pasture for the occasional horse, but unlike Mustang, the landowners aren’t consumed by fear that someone else’s goat might sneak an illicit bite. Indeed, even the walls around gardens here are lower, more symbolic and casual than in Mustang; water is clearly more abundant here.

Marpha itself is a lovely town full of white-washed stone homes with dark red frames around doors and windows. Marpha is proud of its apples, and it should be. We have an apple pie for lunch – a cinnamon flavored core of chopped apple surrounded by a flaky, deep-fried crust. I buy some yak cheese to go with it, despite anxiety about eating uncooked food. But we’ve spent the trip worrying about how to sterilize anything that passes our lips, and so far we’ve been fine. Maybe the economic convergence that makes backpacking more expensive is also slowly reducing the risk of bad water even in countries as poor as Nepal.

We head back along the road. It is a taste of what Mustang trekkers will soon experience. We can go twenty minutes with no traffic, but we can never ignore the risk that a truck or bus will come barreling around a turn. They take up so much of the road that you always have to have to be ready to jump for the side of the road if a horn sounds behind you. Even the motorcycles expect you to move if you’re in the same rut they’ve chosen. The Annapurna circuit is quickly replacing trail with dirt road, and I mentally cross it off our list of likely future hikes.

We end our hike at the airport hotel. It’s not fancy, but it does let us take our first hot shower in ten days. What a heavenly way to end our trek.

China Discloses Its Own Cyberattacks on National TV?

It appears that Chinese TV inadvertently disclosed custom-built software in the act of attacking Falun Gong websites.  In a story that originally broke on Falun Gong media outlets but has since been corroborated by others,  background footage from a government-run channel’s documentary “showed a piece of custom-built CIt appears that Chinese TV inadvertently disclosed custom-built software in the act of attacking Falun Gong websites.  In a story that originally broke on Falun Gong media outlets but has since been corroborated by others,  background footage from a government-run channel’s documentary “showed a piece of custom-built Chinese software actually launching a cyberattack against a U.S. target.” According to Security News Daily,

The clip shows a Chinese-language dialogue box with two drop-down menus, which, according to The Epoch Times, give users the option of selecting which IP addresses or specific websites to attack, followed by a button labeled, "Attack." The text above atop the software tool translates to "Select Attack Destinations," and is credited to the Information Engineering University of China's People's Liberation Army. In the video, which can be seen in its entirety here, the perpetrators apparently use or spoof an IP address belonging to the University of Alabama at Birmingham to attack Minghui.org, the main website of the Falun Gong, a Chinese spiritual practice banned in its homeland.

(The University later offered this statement: "It is impossible to tell how old the archival footage used in the military technology program is. UAB decommissioned the website in question in 2001. It appears from the Chinese video that the purpose was not to launch an attack from that website, but to block access to it. We are not aware of any attack, current or historical, involving that IP address.” )

What gives?  Are the Chinese dumb enough or insouciant enough to disclose on national TV a cyberattack program so well established that it has its own purpose-built software?  Ordinarily, we'd be left with no answers beyond this rather unsatisfying news story.  But the involvement of an American IP address almost certainly gives US prosecutors authority to investigate the incident as a possible violation of the Computer Fraud and Abuse Act.  

And right now, the website of the US Attorney in the Northern District of Alabama is highlighting such achievements as “Federal Judge Sentences Hueytown Tax Preparer To 2 ½ Years In Prison.” I’m guessing that, compared to policing Hueytown tax preparers, going after Chinese cyberattacks might look pretty good to federal investigators in Birmingham.

So perhaps someday we’ll get more definitive answers about that 6-second clip.

Trekking in Mustang, Part 8

Monday May 23

Four hours of hard hiking with few stops takes us to Shyangmochen. We are back on the same trail we took on the way in, and we’re staying in the tearoom where we had lunch on our way to Gheling.

It seems a lot softer and more civilized on the way out than it did when we stopped for lunch so many days ago It has a hot water shower that actually gets above tepid (though the air temperature makes it a challenge not to lose all the warmth of the shower and then some while drying and dressing.) The lunch table is set up directly beneath a traditional Mustang skylight. There are electric lights and even a couple of power outlets. The beds and pillows have sheets and pillow cases. Really, it’s practically the Ritz.

Perhaps energized by the slightly lower altitude and the half day of hiking, I decide it’s time to wash a bunch of clothes. The village’s washing is done at the community tap, fed in an endless stream that flows out of the irrigation system. And back into it, for that matter, since any water that flows from the tap is recaptured for the crops downhill.

 

I share the tap with several women who are obviously better at this than I. They bring big metal bowls that they fill with soap, clothes, and water, working up an impressive lather while I’m rubbing a bit of hand soap into my clothes, one sock at a time. It doesn’t take long for me to learn what seems to be a universal female phrase for, “If you’re done messing about in a typically useless male way, would you reconnect the hose so we can get about our business?” I also learn not to stand about downwind of the tap when they’re vigorously rinsing.

The best part of doing the wash is the drying. The afternoon wind is again hitting 50 mph and the sun is out. I hang the wet clothes on a metal wire clothesline. It’s very satisfying when hiking to have reasonable confidence that in the morning your clothes will be not just cleanish but that you won’t be putting them on wet, which tends to take the joy out of clean clothes.

Trekking in Mustang, Part 9

Tuesday, May 24

Today we are retracing our original path, making the long descent to Chelle, the last of the “Tibetan” villages along the trail.

We pass the same road construction machinery that blocked our path on the way up. The road builders have made visible progress since we passed this way last week. I have new appreciation for the difficulties the road builders will face. Finding a way for cars and trucks to navigate those grueling staircases won’t be easy. But with enough blasting powder, the road will get through, even if flash floods and rockfalls occasionally cut the road during wet seasons. And that will make an enormous difference in Mustang’s culture. We were privileged to see it before the trucks start grinding through the villages, bringing cheap beer, wifi hotspots, and HIV.

Back in Chelle, the teahouse that we had to ourselves last week is now packed. More than a dozen French trekkers are using the adjacent campground and enlivening the common rooms. Germans, New Zealanders, and others have taken over the remaining rooms. They are all bound for the Tiji festival in Lo Manthang.

All day on this leg we’ve met party after party hustling toward Lo Manthang for the same reason. I’m sorry we missed the festival, but in the end I suspect it’s a bit like our audience with the king – a maguffin, more exciting in prospect than in reality. And it turns out that by missing the festival we earned a bonus -- walking to Lo Manthang alone, scarcely seeing one foreigner a day, even after we stopped for the night. These trekkers will never be alone. They’ll be passing and repassing each other every day, queuing with each other outside the latrines, and straining Lo Manthang to the bursting point when they arrive.

To our eyes, the mass of festival trekkers on this leg looks like a freak – completely out of proportion to normal travel levels before or after the Tiji crowd. The Tiji bulge resembles a pig making its way through a python, or a baby boom making its way through a nation’s demography. But the Tiji trekkers, like the boomers, won’t see it that way. The crowds and the queues will be their normal, never changing as they move up the valley. They won’t realize how rare it was to meet other hikers on the trail just a few days on either side of the trek they took.

We’ve been looking for a chance to play carom, a game that we’ve seen porters playing all along the trail. Carom resembles pool, if pool were played with poker chips on a table about 3 feet square, with a raised lip and a hole in each corner. In the middle of the table are eleven poker chips. Each player has an outsized chip that he flicks at the other chips. The object is to be the first to drop your 5 chips and then the “queen” into the corner holes. A crack pool player, Gordon has deduced the rules.

Now we’ve found a carom joint that is willing to let us try our hand. When the raucous Nepali game ends, a few observers linger to watch the Westerners make a hash of their game. Accurately flicking a chip at a target turns out to be remarkably difficult. By luck, I get one chip almost on the lip of a hole across the table from me. Then I waste ten turns just trying to hit the damn thing, and when I do, it moves further from the hole. Gordon is better, but only at the theory. He understands the angles and possibilities better than I do, but his execution is just as bad. We battle to a tie, with each having a single chip, plus the crucial red queen, on the board. By then, all observers have drifted away in disgust, unable to extract even comic relief from our efforts. At that point it was safe for me to let Gordon win. That’s my story, anyway, and nothing will shake it; there were no witnesses.

Trekking in Mustang, Part 7

Sat., May 21

After breakfast, we head up the valley, me riding, Gordon walking. We’re making for a gompa on a hill a few miles to the north. When we arrive, the gompa is locked. It looks down at heels, and finding the custodian takes so long that we nearly leave. When he does come panting up the trail from the village, though, the custodian proves to be a young, chatty fellow who is full of information. Not himself a monk, he nonetheless provides a detailed tour of the gompa's ceremonial hall. It has extensive murals, a wall of religious texts in special containers, and a host of musical instruments. In winter, he says, every village family but one heads for lower and warmer ground, along with most of the monks. He stayed this winter, enduring waist-high snows and bitter cold, shoveling snow off the gompa roof so no water could seep in to wreck the murals. It occurs to me that someone must have done this every winter for centuries to preserve the murals he's just shown me.

If you have to stay the winter, he says, it's better not to be a monk. The villagers who stay can eat their animals to keep up their strength. The monks are vegetarians, and vegetables aren’t easy to find in Mustang in winter. But the monks who stay through the winter have to live on potatoes they've buried in the dirt during the summer. True, they have a greenhouse to speed the arrival of summer vegetables, but it's late May now, and there are no new crops; the monks are still digging up last year's potatoes.

He takes us outside and points at the border with China – a series of low hills no different from those we’ve crossed many times already. No wonder the traders -- and the Khampas – were fond of Mustang. And no wonder the Chinese are working so hard to extend their influence here. The custodian tells us that the Chinese distributed food to all the villagers this winter. Despite the largess, he remains skeptical of their motives. Nepal has no troops on the border, he notes, while China has many. Nepalese crossing into China need to get permission for every trip, he adds, but Chinese officials cross the border at will, with no permission that he’s aware of. He confirms that the caravan we saw yesterday was Chinese.

In a nearby village a home is under construction. All of the houses we encounter seem to be built in the same general way. Even the modern materials incorporated into the houses follow a traditional pattern.

By far the most common building materials are sundried mud bricks, perhaps one foot long and six inches square. They can’t be kiln-dried because firewood is too scarce. So vacant fields are regularly filled with rows of bricks curing in the sun. They look like post-modern war memorials.

What wood is available is used mainly to frame doors and windows and to construct the higher floors. In the first floor, it looks as though stones surmounted by mud bricks make up the walls, although mud seems like a dubious load bearer.

For higher floors, poles are set in the ground to support large rafter-type horizontal poles. Across these main rafters are laid a series of lesser poles at two-foot intervals. These are then spanned by one-or-two-inch wooden strips. Atop the strips is hay impregnated with mud. At the end of the day, the houses are sticks and mud, and I realize that, without careful upkeep, all of this -- walls, buildings, whole gompas -- will melt back into the landscape. In fact, many of the hilltops carry ruins that are halfway through the transition from buildings to eroded mounds of dirt.

Trekking in Mustang, Part 6

Friday, May 20

Today and tomorrow, instead of moving on, we will make Lo Manthang our base for day trips. Today we rent a horse to get to Choser, a small village about an hour or two from town and the site of the third and last school where we’re dropping off books and toys.

It's an Asian mountain horse – a pony, really. I could walk alongside him with my arm slung companionably over his back. Horses in Mustang are guided largely by the grunts and whistles and shushes of their herdsmen. They're mainly used as pack animals, and using verbal cues lets a single herdsman guide the whole pack train from behind on the mountain trails.

Leaving the walled city, we move through dust as fine as talc. It rises in great clouds as we walk. The villages all have a rhythm. In the morning as we’re leaving, herdsmen are dr

 

iving their livestock out of the village and up to the hills where there is a bit of grass. Bells on cows and horses ring as they pass. Herds of goats also move toward the hills, the kids jumping on every wall they pass through the villages, dancing with enthusiasm.

One reason this region was closed to foreigners until the 1990s was its role as a center of armed resistance when China invaded Tibet. Not all Tibetans met the invaders with spirituality and passive resistance. The Khampas were a Tibetan tribe that fought back. Famous and feared as warriors, they wore their hair long and fought China for decades after the 1950 invasion, raiding from refuges across the border in Nepal. Mustang was one of their principal staging areas because it had such a low pass into Tibet. I discover that the CIA supported the Khampa warriors, even flying some to Colorado for advanced training. CIA support for the insurgents gradually diminished, ending for good in the early 1970s. Not much later, the Nepalese government, likely under heavy pressure from China, forced the Khampas to disarm.

After that experience, it is no surprise that the Chinese have built a road across their border and into the heart of Mustang. They want to be sure that they can respond in force if guerrilla war ever returns to the region. Meanwhile the road makes it easy for Chinese officials to visit Lo Manthang. As we hike along the road, a convoy of late-model SUVs suddenly rounds the turn and heads toward us at high speed. We scramble out of the way as the cars, two white and two black, splash through a stream and past us.

The Nepalese tell me not to get too close to the Mustang-Tibet border. “Local people can cross there. They’re known,” says one, “but if we Nepalese go there, maybe they’ll arrest us, torture us. We don’t know.”

The third school is a public boarding school for the district. It serves 120 students. Students spend 8 months of the year in Choser, but in winter the whole school transfers to Pokhara; it’s just too cold to stay in Mustang.

The Chinese government, evidently on a charm offensive here, has paid for the construction of a science lab that’s still being completed. It contains a large multipurpose room with twenty Compaq laptops running Windows 7. The school also boasts a large array of solar power panels to power the place. The library, though, is the least impressive we’ve seen.

We end the afternoon with a visit to caves built into local cliffs. Window holes poked through the rock wall expand into interlocking rooms that extend deep into the cliff. The rooms rise five stories high, one level linked to the next by crude ladders or carved foot-holds. Moving from one room to another sometimes means jumping over holes that lead to the level below. The ceilings are stained shiny black with soot from 2500 years of fires.

This is where local villagers used to hide out when raiding parties from Tibet or Nepal rode through the valley. The only problem was that if the raiders settled down for a siege, they could cut off the defenders' water. Once, the story goes, besieged cavedwellers had almost run out of water; desperate, some of them poured mustard oil over their heads and leaned out of the windows, dripping wet, to mock the invaders. Convinced that the villagers had plenty of water and that the siege had failed, the raiders moved on.

Today, the villagers are building an irrigation terrace at the foot of the caves. Everything must be done by hand. Men and women use picks to pull earth from the uphill side of the terrace. They shovel the loose earth onto stiff, flattened animal hides; other women drag the hides across the terrace and dump it on the downhill slope, extending the terrace by perhaps an inch or two. I think that they’ve probably been using the same techniques for the last 2500 years.

 

"Skating on Stilts" Wins Award

Well, this is cool.  Skating on Stilts has won an award.  It is a ForeWord Review 2010 Book of the Year, with a bronze in the Political Science category. The awards are made each year by a panel of librarians and booksellers choosing among the offerings of independent publishers.  But I won't let it go to my head.-- "Award-winning author, Stewart Baker" (OK, I let it go to my head. But just this once.)

Trekking in Mustang, Part 5

Thursday, May 19

Hard beds make for a bad night. On the whole, the room beds have been fine – narrow cots with a very firm foam mattress. More disturbing is the lack of sheets and pillowcases. The pillows (also very firm, bordering on unyielding) have permanent looking cases covered with embroidered designs – too fancy to change every day or even every week. Ditto for the blankets. As I lay awake last night listening to an indefatigable barking dog, just the barest hint in the air left me convinced that some traveler has thrown up on my blanket -- and that washing it in cold water wasn’t quite good enough.

Today’s hike is a sprint to Lo Manthang. We mostly follow the new Chinese road, which climbs steadily without the steepness of a footpath.

We walk for a time with a European aid official. The official was pleasant and clearly loved Nepal. But the official reminded me again that our aid programs have a kind of moral vanity at their heart, as rich nations pay poor ones to do things we wish we were doing. This official bemoaned the Chinese road, not just as hegemony (“The Chinese are imposing their goods on Mustang”), but for the change it will surely bring (‘they insist on making the same mistakes as us”).

I, too, will be sad when the road breaks through the last few kilometers to Chelle, and goods and people begin moving swiftly throughout Mustang. When that happens, hiking from in Mustang will become a choice, a form of recreation, and not simply the only way to see the country. Plus, the traffic will make the trip nasty and dangerous for walkers.

But I know that is simply an aesthetic preference, and one that it would shameful to impose on people who measure their net worth in cords of firewood. What kind of aid program, I wondered, do you get from countries whose officials believe that roads are a “mistake” for less developed countries? Apparently a lot of very well engineered footbridges, to hear what this official was proudest of. Maybe suspension footbridges are a good idea, but there is a whiff of patronization in such a gift: “We'll help you walk, but don't ask us to help you drive!”

Four hours of concentrated hiking brings us at last to Lo Manthang. This walled city was once the seat of an independent kingdom. The king and the kingdom were Tibetan in culture, but they also had close ties to Nepal. The Loba, or Lo people, spent several centuries exploiting the low pass that leads to Tibet, trading salt from India for crops and animals from the Tibetan plateau. The ruling dynasty has been a dependency of Nepal for a century or more. The current raja of Lo retained some autonomy until the 1990s, when he accepted the rank of Colonel in Nepal’s army in exchange for more complete integration into Nepal’s government. Then, in 2008, when Nepal's royal family abdicated and Maoists joined Nepal’s government, the last vestiges of the Kingdom of Lo were also abolished. The raja, born in 1933, still lives in Lo Manthang and mediates local disputes, but he has no formal authority.

The raja met with the first few visitors allowed into Manthang in the 1990s, and their accounts of the meetings are quite charming. We discover that the raja still grants audiences to trekkers. It is necessary to buy an admission ticket for the palace, a great hulk in the center of town, and to bring a traditional scarf or prayer flag.

And one more thing, says our guide. It would be good to bring him a present.

Hmm. This is complicated. I am not carrying a lot of extra gear suitable for a gift.

“Would he like a toy?” I ask.

Not likely, I'm told. But a bottle of whiskey would not be amiss. Perhaps that’s when doubts about this audience began to creep in.

But still. I’ve never been received by royalty before. This could be exciting. I dust off the talent for pleasant chats with foreign officials that I once had to draw on every week while in government. Will he speak English, I wonder, or will we have to wait for translation? What is the proper protocol for introducing Gordon, for entering the audience room? What about photographs? I have no protocol officer to advise me; I'm going to have to improvise. And then
 there’s my clothes. It’s too cold to wear anything less, but I’m pretty sure that dusty boots and a watch cap aren’t the usual attire for royal audiences in other parts of the world.

Meanwhile, we have time to explore the city. The walls are impressive – twenty feet high, with watchtowers that are even higher. And they would have to be, becau
se apart from a steepish hillside below one wall, Lo Manthang has no natural defenses to work with – no cliffs, riverbanks and the like. There’s a river at the foot of the hillside – or at least a creek, because without irrigation there would be no agriculture and no city in this vast dry land. A tiny tributary runs right into the city, but there’s little room for agriculture within the walls.
 Instead, Lo Manthang is a warren of high homes in the traditional layout – animals on the ground floor, living quarters above, and a flat roof for working in the sun.

Temples are everywhere, along with monks, who support a large monastery here. Outside the palace, there's a square where people congregate to watch the tourists, to spin prayer wheels, and to chat. This is where the residents will hold the Tiji festival in a couple of weeks.

A light rain is falling, but it cannot drive the villagers away. As in many other parts of Mustang, the heart of social life here is the public faucet, where women gather to wash pots, clothes and themselves. Everyone is friendly, and only a few are importunately selling souvenirs. Walking the alleys of Lo Manthang, I understand the spell that Nepal casts on Westerners. Almost all of the residents are dignified and friendly. There’s isn't the whiff of predation that often taints encounters with the locals in poor countries. Even the salesmen take no for an answer. And, after two toy distribution sessions, what impresses me most about the c
hildren is their discipline and cooperation. Not one child has grabbed a toy to play with alone. They take great care to handle the new toys cautiously and to share them with others.

Our guide enters the room. “Quickly please!” he says. “The raja will see you now.”

We assemble in front of the palace and a young woman gestures us up the stairs. It's the biggest building in Lo Manthang, but it doesn’t look much like a palace. What it does look like is a major reconstruction project that was halted halfway through, with piles of dirt and abandoned planks lying about in lightless gloom. The stairs are bare planks, rising like a ladder laid against a house. You really need a handrail. There is one, but it's simply a rounded strip of wood nailed to the stairs themselves. Surprisingly, that works fine, because the stairs rise so steeply that two or three steps bring the handrail to waist level. We climb two levels in the gloom. It's a five-story palace, and it occur

 

s to me that perhaps the bottom two floors have been reserved for livestock, following a traditional Tibetan layout.

Sure enough, after climbing through the dark, we at last come to a living area, where an open atrium lets in light from the roof. We head up a third set of stairs. I’ve just seen a few people walk down these steps; they bent an inch or more when stepped on, so I try to stay close to the handrail.

Assembling at the top of the stairs, we are at last given a quick protocol lesson. Hold your scarf draped over both hands, and extend them to the king when you are presented. He will put it over your head, we’re instructed.

We enter the audience room. It has a dusty charm – good rugs, plenty of wooden furniture, and many pictures and other decorations on the wall. I approach the king. He is an old man seated on a comfortable bench.

 

Best of all, he’s wearing a watch cap and dusty boots.

We line up, scarves are placed over our heads, and we sit for a cup of tea. I put my bottle of whiskey on a table beside the king. He beams at me.

We sit, silent. The king occasionally looks over at us, but he obviously feels no need to make small talk. OK, I think, time to call on my rusty diplomatic chit-chat.

I open with praise for Mustang. It is translated. He gives me another smile. I introduce Gordon. Another smile, but less wattage. It’s becoming clear that small talk from visitors is not especially welcome. Instead, we’re told that when we’re finished our tea, we can kneel beside the king for a photo. We chug our tea and kneel for photos. The audience is over.

We make our way down the rickety stairs. The handrails are more necessary but less visible on the way down. We must go slowly, feeling for each step. When we get to the construction zone, my suspicions about livestock are confirmed. From the shadows, a mastiff begins barking. He’s savage, and determined to get at the intruders. Holes in the palace wall provide just enough light to see him in profile, straining against a chain and kicking up dust as he lunges at us. Taking the steep steps slowly and carefully becomes less of a priority. Half walking, half sliding, we burst through the palace door and tumble into the street.

Trekking in Mustang, Part 4

Wednesday, May 18

We can hear the monks chanting as we get up, followed by children's voices. Apparently, the whole village begins its day at the gompa.

We begin ours with a soul-destroying haul out of the valley, past the villagers watering their horses and tending to their herd. It’s only a 300 meter climb, but the altitude requires a self-conscious deep breathing rhythm if I don’t want to stop every 20 steps. I may finally have to admit that Gordon can now out-hike me. He is keeping up with our guide while I consistently lag back a few yards or more.

When we get to the top we’re just over 4000 meters. We descend rapidly to Ghemi, where we have an early lunch. The scenery is beginning to change, opening out into big dry hills, a bit more watered than New Mexico or Utah but with the same broad vistas of a rolling country mixed with eroded sandstone in vivid yellow and orange.

As always in a country of irrigated oases, the last mile or two to the next village is downhill. We’ve got some toys and books for the school in this town, called Tsarang. We don’t know much more about it than the name of the headmaster, and at first our guide reports that it’s closed. But the tearoom  proprietor recognizes the name and remembers Liesl Clark and her two kids. She calls the headmaster, Mr. Bista, and he shows us to the school.

Many of the teachers are nuns, or anis, and the students can become monks or nuns if they have a calling, says the headmaster. The Ani School, as it’s called is far more basic than the school in Kagbeni. The kitchen is a simple stove and a few pots. Classrooms have nothing but blackboards and benches for sitting and for writing. The school does have an impressive solar electrical system but no way to store power, so anything requiring electricity needs to be done while the sun shines. The school also has one pretty new desktop computer (though a laptop would have been better given the power setup); the headmaster confessed that he knew nothing of the computer or what software it runs.

In contrast to the extremely basic facilities elsewhere, the library is spectacular – a big room with floor to ceiling bookshelves filled with Tibetan, Napal, and English works. Many US elementary schools have no better. 

We hand over our maps and books, and I set to work on an enormous inflatable globe donated by a partner who asked only for photos of me blowing the damn thing up at altitude. An odd mix of generosity and cruelty, I thought, but he’ll get his photo.

The kids descend on the toys, paying special attention to a toy I had my doubts about – a felt house with felt furnishings that can be stuck to the house – felt chairs, felt tables, plus toilets, cats, dogs, bathtubs, clothes for the Mother and Father, and on and on, a cornucopia of felt goods that look grotesquely excessive in this simple school.

Many of the items are clearly not familiar household items in Tsarang. (I doubt most of these kids have used a sit-down toilet in their lives.) But the teacher uses the toy as a horizon-broadening device, describing each item as she helps the kids place it in the felt home. Mostly this works. But her explanation for the bubble-bath foam that goes with the bathtub is greeted with a mix of merriment and disbelief.

Trekking in Mustang, Part 3

 

Tuesday, May 17

We start today by continuing the grim uphill that brought us into Chelle, but the trail soon levels off to something more reasonable. We pass a piece of heavy machinery working on the road. Lord only knows how they got it up the slope that so disheartened us, but it’s a reminder that this region won’t be accessible only to walkers much longer.

The Chinese have already built a good dirt road from the Tibetan border to well south of Lo Manthang, so that only the country we’re hiking today separates the Nepali and the Chinese roads.

The  isolation tells. We are now deep in the last traditional Tibetan territory left in the world. Rams' skulls hang over doorways. At meals we are offered Tibetan bread (lightly fried, pita-like, and tasty) and Tibetan beer imported from the other side of the border. We pass people crushing rocks by hand to make the mineral dyes that color the mani walls and the gompas, or monasteries.

 
Stretching our day to 8 hours, we take several long slabbing trails in and out of side valleys, gaining altitude steadily until we hit 3700 meters. The trail is wide – probably to accommodate herds of goats and horses – but the dropoff is steep. Sidetrails lead to heart-stopping suspended footbridges.

We are suffering a little from altitude – on the uphill slopes, breathing itself feels like a chore. We’re stronger on this third day, but that doesn’t make the uphill sections easy.

Arriving at last in Ghiling, an hour past our original destination, we admire the monastery and hear that the monks are celebrating Buddha’s birthday. We head up.

In the main room of the temple, six or seven monks sit in two facing rows perhaps eight feet apart. A long thin table stands before each row of monks. Some of the monks are young boys of perhaps twelve;
 others are mature men. One of the younger monks is reading a bit hesitantly from a piece of paper that has been folded so often it is coming apart in his hands. When he finishes, all the monks begin chanting. A worshipper makes the rounds, bowing to each monk and putting a few bills on a light scarf resting in front of the monk. The monk folds the scarf over the money and resumes chanting, throwing what look like small seeds in the air and ringing a bell at frequent intervals. The chanting reaches a climax with a sudden burst of drumming and horn playing – loud and dissonant to my ears. Then the chanting resumes.

A monk gives me a flashlight so I can see the pictures on each wall. They seem a weird mix of Buddhist and Hindu representations, very bright and well-executed. And well-preserved, if the inscription – 1797 – can be relied upon.

Tonight’s lodging is the most basic yet and the weather is colder, but we have beds and warm blankets. The toilet, however, does not bear further description.

Trekking in Mustang, Part 2

Monday, May 16

Today we’ll finally leave the vast gravelly bed of the Kali Gandaki river, climbing to 3,000 meters. We begin by dropping to the Kali Gandaki and crossing a few of its braided channels on makeshift wooden footbridges. The trail then takes us up onto hills and cliffs overlooking the river.

We set a blistering pace, bolstered by maximum strength ibuprofen. Sandstone rises on all sides, often as great cliffs. In a few places, manmade caves have been hacked from the sandstone, probably in the days when raiders marched regularly through the valley. The caves may once have been reached by steps and handholds carved from the rock, but these have long ago eroded away.

After a few hours, we stop for lunch at Chhusang, the last truly Nepali village along our route. From here we’ll climb away from the Kali Gandaki and into regions more influenced by Tibet's culture than Nepal’s.

Like all the villages, Chhusang's gardens have high walls to keep out wandering livestock. We walk next to a shallow stream that has been diverted to slab along the hillside and then drop to the walled gardens. There it irrigates a several-acres oasis -- startling green against a landscape that otherwise resembles the drier parts of Wyoming.

Crossing the Kali Gandaki for the last time on a metal foot bridge, we immediately begin climbing a slippery sand and gravel trail that wriggles chaotically up a steep slope – and marks the real boundary between Nepal and the ancient Tibetan kingdom of Lo.

The altitude makes itself felt now; we strain to breathe deeply enough to keep moving. After an unrelenting 15 minutes, we’ve raised our altitude two or three hundred meters and are entering Chelle, the first Tibetan village of the region.

Chelle too has the region's distinctive walled oases, dominated by stands of apple trees that look nothing like the apple trees of North America. The architecture of the town is distinctive too, and so is the atmosphere. There are far more animals; indeed, they share the town, and even the homes, with the human residents.

Cows, mules, and goats get the bottom floor of most homes, while people get the top floors. The homes feature an interior atrium, making it easy for the residents to keep an eye on their livestock. A roof closes off the atrium, often topped with glass or plastic to let in light. Otherwise, the roofs are flat, habitable spaces that add what amounts in this dry country to a third f loor. Thigh-high stacks of firewood act like balcony walls at the edge of the rooftops.

I ask whether residents burn the wood in the winter. No, I'm told. The wood is too valuable to burn.  If they need a fire, most residents burn twigs and cow dung.  These firewood parapets aren't about utility; they're about prestige.  Firewood is so rare and expensive that having a cord or two on top of your house is a status symbol -- and thus too precious to burn.

It’s noticeably colder here, and I wonder aloud how having an open atrium works in the long Himalayan winter. Turns out, many of the villagers drive their horses and marketable livestock south along the river, sell the livestock, pen the horses, and head to balmy Pokhara to get temporary jobs.

Lo in winter is a harsh land, with waist-deep snows. But it's just a 6-day walk to a balmy climate. Who wouldn't go if they could? It reminds me of all the wheat farmers in Manitoba who lock their barns and fly to Arizona for the winter.

With every square yard of farmland precious enough to tend by hand, and every animal a part of the family home, overpopulation is always a risk. There just isn't enough land to keep subdividing it for each new generation. In response, I’m told, the Lo people have devised some remarkable cultural innovations.

In the old days, and perhaps even today, brothers might share not just a farm, but a wife. That way, the fields can be handed down from one set of brothers to a single set of descendants. Marrying two men to one woman didn’t produce an excess of old maids, locals say, because girls were often scarce. I don’t have the heart to ask why.

In any event, the gender mismatch might not last long. If a wife didn't produce an heir, her husbands were allowed to take a second wife; the alternative, not having another generation to inherit the fields, was unthinkable.

Finally, the last resort for sons and daughters who didn't inherit or find a mate with prospects was one that the second sons of European nobles would have recognized – organized religion. Unmarried men and women were sent to monasteries where they worked and held the land in common.

Trekking in Mustang – Part 1

Stories from a recent trek through Mustang, Nepal:

The Royal Audience

It’s time for our audience with the raja.

There’s just one problem.

“What else can I wear?” I ask my son, Gordon.

I mean it literally. The raja and his remnant kingdom are tucked high in the Himalayas between Tibet and Nepal at an altitude of 12,000 feet and more. And with the shadows growing long, I am cold.

So, protocol can go hang. What I want to know is whether there are any more clothes I can put on before we meet the Raja of Lo. I'm wearing a watch cap, a rain jacket, cargo pants, and long underwear.  Not enough.  After walking four days to get to Lo Manthang, the kingdom's ancient capital, we’ve already got on all the clean clothes we brought with us. And most of the dirty ones.

I feel a little guilty. I spent nearly four years representing the United States in meetings with foreign officials -- meetings where it was a major faux pas to wear the wrong lapel pin. The kingdom of Lo has can trace its roots to 1380; it has had a king about three times as long as the United States has had a president. And I am going to sit down with its king wearing dusty hiking shoes and a watch cap.

I am pretty sure our protocol officer wouldn’t have approved.

Our guide entered the room. “Quickly please!” he said. “The raja will see you now.” I rise to my feet and head down to the street, stopping only to tuck a small bottle of local whiskey into my pocket.

Saturday, May 14

The bus from Kathmandu to Pokhara bumps and squeals down the steep, winding grade. The high-pitched squeal of brakes is an annoyance, except when the road pitches down and we can see, too easily, over the road’s edge. Then, the wail of the brakes has a kind of comfort in it.

We are leaving behind the press and clamor of Kathmandu. Out on narrow terraces eked from steep hillsides, we see farmers harvesting corn, cutting down everything and carrying out bundles of corn stalks on their backs.

Hours later we arrive in Pokhara – a bustling little south Asian town at Annapurna’s feet. The next day, we are up early for the short flight around Annapurna to Jomsom.

Sunday, May 15

We arrive at 5:30 for a 6 am flight. At 6, nothing has happened. We're on Nepal time now. When it finally takes off a couple of hours later, the flight rises over some steep hills, turns right at the giant peak, then cruises up a steep valley, with mountains rising above us on both sides.

The plane doesn’t exactly descend to land in Jomsom. We just keep flying at more or less the same altitude until the airfield rises to meet us.

Jomsom was until recently the jumping off point for most treks into the ancient kingdom of Lo. The kingdom and the territory around it are now known as Mustang, and Mustang has long been restricted territory. Foreigners were barred until the 1990s, and even now a permit (and a hefty fee) is required to trek in Mustang. Jomsom is the administrative and governmental capital of the region.

Nepal’s officials check our permits for the Mustang restricted area. They also tell us to change our plans. Our entire trek was planned around a festival in Lo Manthang – a religious ceremony featuring indigenous music, dancing, masks and costumes. But it turns out to be a moveable feast, and the event has been moved back a couple of weeks. We can't postpone our trek at this point. We'll have to miss the festival. It’s like this morning’s flight, I think. If you’re on a timetable, you’re bound to be disappointed in Nepal. Rolling with the flow is the only path to contentment. And, on trips like this, nominal goals like the festival are in the end a kind of maguffin – the term Alfred Hitchcock used for the otherwise meaningless object that drives the plot.

Besides, we've got another maguffin. Three of them, actually. We’re carrying books and toys for three of Mustang’s schools. This is almost a tradition for us; when we hiked the Inca Trail to Machu Picchu in Peru, we brought a bunch of our kids' outgrown toys and helped a local group distribute them at a mountain schoolhouse. This time, I've gotten advice about local schools from the Alex Lowe Charitable Foundation. Our kids are grown, and their kids are too young to have castoff toys, so I've solicited contributions from friends and colleagues, who have loaded us up with 25 pounds of books and toys. We need to find the schools and drop off three loads as we work our way up the valley to Lo Manthang. Our first dropoff is in Kagbeni, at the end of today's hike.

Mustang is in the rainshadow of the Himalayas, with annual rainfall roughly equivalent to the Great Plains of North America. The mountain slopes are steep and arid but they do not drop into a V-shaped valley. Instead they stop abruptly at a wide flat expanse of gravel with a thin braided river – the Kali Gandaki – wandering among the rocks. The original valley floor must have filled with centuries of glacial runoff. Perhaps someday this will be a pastoral scene, with a river ambling back and forth through grassy meadows. But for now the valley holds nothing but softball-sized rocks from edge to edge. In this whole expanse, there is one tree and no grass. The valley must be filled with raging snowmelt each spring, stripping away any plants that have gained a foothold since the last flood.

Working up the valley, we cross the braided river a couple of times on wooden bridges cobbled together from random debris. Then our path rises to a new road clinging to the right side of the valley, just above the river bed. We start out at a brisk pace, but even with porters to carry much of the load, I’m soon sweating and lagging, losing ground whenever I stop to take a photo. It’s a short day, with little altitude gain, but we’re already at 2800 meters and not in hiking shape. I'm glad when, after an hour and a half of hiking, we come to a small village with a teahouse. We order sweet milky tea and rest.

Refreshed, another half an hour of walking brings us to Kagbeni. The lodge has a great glassed-in dining room overlooking the largest green patch for ten miles around – 4 acres of oats and barley that dip and wave in the constant wind like the sea. It’s mesmerizing.

Liesl Clark of the Foundation has told me to look up Kunga Tashi, who leads the School Board and runs the “Dancing Yak” Restaurant. Kunga turns out to be a strikingly young man with a passion for the school. He tells me that it has recently expanded and now takes boarders as young as four and as old as sixteen. Especially in the higher grades, almost all the kids who want an education must become boarders. There are only about six or seven schools beyond tenth grade, and they have to serve a nearly roadless region the size of West Virginia.

Thanks to foreign and Nepalese government assistance, the school charges nothing for tuition, room or board. The Foundation's contribution is an extremely well stocked library to which we'll be adding toys and some books and maps. The smallest kids are on break, and they come in to road-test the toys. The most immediate hit is a set of two blocks with half of a vehicle pictured on each face. If kids successfully pair the front and back end of the vehicle – a fire engine, say, or a motorcycle – they are rewarded with a sound that matches the vehicle.

I know just enough Nepali to communicate this concept to a gaggle of four-year olds. “G 
ood?” “No good?” I ask, pairing the fire engine with the motorcycle. “No good,” they shout. When I finally get it right, with their help, they are startled with delight at the fire engine's loud siren. Then each kid gets a chance to match a different vehicle and discover the sounds of success.

I am determined to get some play value from this toy because I had my doubts about bringing wooden toys, which are almost as heavy as they are politically correct. In the end, though, the weight was worth it. And the kids’ enthusiasm for the other toys – tinker toys, jigsaw puzzles, and a set of Dr. Seuss flash cards – made it feel like Christmas.

We get a tour of the school and plenty of tea. They have no computers for the kids. A Danish group had sent one a couple of years ago, but the mouse doesn’t work. At the suggestion of Liesl Clark, we've also collected laptops from friends and colleagues. These we've left with the Open Learning Exchange in Kathmandu, where they'll be refitted with Linux and some Nepali and English learning programs. Liesl asked that we not take the laptops themselves to the schools because the students and faculty will need training before the computers are actually used. Considering their weight, we're happy to oblige. In any event, the school doesn't now have table space or a free room to put computers in.

It’s building more, though. The young men at work on the new building clearly understand twenty-first century global fashion. They wear low-slung, gravity-defying pants and a variety of branded shirts. As an apparent concession to Kagbeni's constant wind, they have covered their faces, often with kerchiefs that make them look like train robbers or wannabe-anarchist WTO protesters. But their work methods are closer to the ninth century. To move a large pile of rocks fifteen feet, they form two lines and toss stones rhythmically from one worker to the next, bucket brigade style.

Leaving the school, we have time to explore Kagbeni. Women are daubing a mani wall in traditional colors made from local minerals. Mani walls hold a long string of prayer wheels. Passersby can walk to the left of the wall and turn the entire string of prayer wheels without breaking stride.

Signs of religious devotion are everywhere in Kagbeni. It is an ancient monastery town -- though it looks more like a fortress. And perhaps it was. Fortresses are established to protect valuable assets, and the most precious resource in this dry and vertical land is probably the 4 acres of flat and irrigated barley just outside our hostel. The Buddhist monastery here dates to the 1400’s and was once maintained by hundreds of monks who farmed land up and down the valley but could retreat to defend the fortified town in a time of war. Now, though, the monastery's population has dwindled to 40 – half of them students – plus a couple of remarkably large and mean guard dogs, who bark fiercely down from a rooftop that isn’t quite far enough above our heads.

The main worship room of the monastery shows telltale signs of the monastery's declining fortunes; much like an over-stretched British peer’s stately home, it mixes impressive art and history with cracked windows and tawdry modernizing touches, like the twisty fluorescent bulb that hangs down in front of a centuries-old statue of Buddha.

Our Cyberwar Strategy: Play for the Tie?

Deputy Secretary Lynn has given a speech unveiling the unclassified parts of the Pentagon's cyberwar strategy. All of the “pillars” and practically all the unclassified content of the cyberwar strategy are defensive. Here’s the theme:

“Our strategy’s overriding emphasis is on denying the benefit of an attack. Rather than rely on the threat of retaliation alone to deter attacks in cyberspace, we aim to change our adversaries’ incentives in a more fundamental way. If an attack will not have its intended effect, those who wish us harm will have less reason to target us through cyberspace in the first place.”

This is not completely comforting. It’s like hearing that our nuclear war strategy is to build more fallout shelters.

The network defenses we have today, and even the ones we hope to have tomorrow, will not deter adversaries or deny them the benefits of an attack. The DIB Cyber Pilot, for example, is an classified version of technology the private sector has been using for nearly ten years. It’s a good thing, but it hasn’t exactly stopped hackers cold.

Defensive research is also a good idea, although neither of the ideas flagged in the speech -- self-healing networks and methods for processing encrypted data -- are likely to change the enormous advantage currently held by attackers in cyberspace.

So this is at best a partial strategy. The Pentagon deserves credit for taking on the issue and doing the planning. But the plan as described fails to engage on the hard issues, such as offense and attribution and, well, winning.

I hope that the actual classified version doesn’t suffer from the same diplomatic and political correctness.

Back from Nepal

I've posted photos from the trek for those who want to see them.  Next up:  the journal. 

UPDATE:  Fixed link and photo 

 

Iraqi refugees and domestic terrorism

It took twenty years before the Somali refugee program began producing “home-grown” terrorists in any numbers, and they were home-grown in a real sense; many were disaffected second-generation immigrants rediscovering their Somali roots and ancient Somali loyalties.

The Iraq refugee program seems to have eliminated the twenty-year lag, admitting at least two fully-formed militant Islamic terrorists in April and July of 2009, according to the indispensable Lawfare blog.  Upon admission as terrorists, and while they were probably still receiving welfare and other assistance from the US government, the two resumed their careers in support of terrorism aimed at American troops.  Luckily, the FBI was in control of their terrorist planning, and the two have now been arrested and indicted.

So far, so good.  But the arrests raise real questions about the Iraq refugee program.  The United States has admitted over 50,000 refugees from Iraq since the war there began.  Conditions are chaotic, and it is hard to insist on documentation.  In any event, fake documents aren't hard to purchase in Iraq.  So it is hard to vet these refugees.

DHS did plan on using one innovative method to keep terrorists out of the program.  It proposed to compare refugee-applicants’ fingerprints to the US Defense Department’s database of latent fingerprints found on IEDs in Iraq.  That seemed like a no-brainer.  Yet at least one of the terrorist-refugees recently arrested by the FBI did leave his latent prints on an IED, according to the arresting agent’s affidavit. And he was still admitted by DHS.

All that raises serious questions.  In my view, it suggests that the Iraq refugee program is misconceived – that we are taking too great a risk in bringing large numbers of Iraqi refugees to the United States whom we cannot vet properly.  But even for supporters of the current program, it raises questions about how the program should be run. 

The most important is:  What went wrong in the vetting of these two refugee applicants?  Were there clues in the terrorist-refugees’ background that we failed to pick up on?  Did they use forged documents to win refugee status?  Were they aided by Iraqi terror groups to enter the United States?  And why did the DHS fingerprint program fail?  The FBI was able to match one refugee’s latent fingerprints to DOD’s records from a 2005 IED bombing, but it did that in 2011, as part of a criminal investigation.  Why didn’t DHS find the same latent fingerprints in 2009, before it admitted the terrorist-refugee?  Did DOD withhold the prints from DHS on “privacy” and other legal grounds?  Or did the matching process simply fail for technical reasons?  Has the Iraq refugee program been suspended or revised in light of the ability of terrorists to scam it?

These are vital questions, because we continue to admit large numbers of Iraqis as refugees (the Conference of Catholic Bishops says this year’s target is another 18,000 Iraqi admissions to the US -- a number that it thinks is too low but one that would increase the total number of Iraqi refugees in this country by 40%).  And, as the LA Times notes, “FBI Director Robert S. Mueller III told a House hearing in February that he had information that Al Qaeda in Iraq may have used the [US refugee program's] weaknesses to send operatives to the U.S.”  What are we doing to fix those weaknesses?  And if we can’t fix them, why are we continuing to make a priority of Iraqi refugee admissions?