Parties short of ideas on how to secure Britain's digital future

There's few enough bright sparks here. ev0luti0nary, CC BY-ND

Opening Labour’s 2015 manifesto made me wonder whether I’d downloaded the right document, as it states that we’re “at the start of the internet revolution” – a peculiar viewpoint for a supposedly future-focused policy. It had me wondering what the party thinks has been happening for the last 25 years since the birth of the web.

The manifesto contains some principles that are right for delivering a sound digital future, but the party comes across as out of touch with the cutting edge of digital innovation by offering a series of predictable and uninspiring (if necessary) policies. For example, the need to invest in skills to ensure there is no shortfall of next-generation coders and creatives. Yet there’s no mention of updating those skills, or even trying to nurture a skillset within the population that’s more adaptive to changing digital needs.

More required than just a connection

The need to plug holes in the UK’s broadband infrastructure and fill in the mobile phone coverage “not spots” is obvious, but is no different from other parties' aims including the ubiquitous desire to achieve “digital inclusion”. The Conservatives take a similar line, focusing especially on ensuring libraries have free Wi-Fi on offer.

Yet in this race online, none of the parties offers much explanation of what this means beyond getting more people connected. Nor do any of them distinguish between different levels of access and the effect it has on civic participation. Getting the last 10% of people online is no guarantee they will reap the rewards. We have moved on from mere access to the internet to the need to inform how and what to do with it – a matter of digital literacy that is crucial if the internet is to provide any empowerment.

Labour’s manifesto really puts digital at the heart of government, through aims for greater efficiencies through better data sharing and use of technology across the civil service. Labour’s eggs seem to be all in one basket, yet its aspirations do not go far enough to confronting the major digital issues the public faces. In contrast, the Conservative party focuses on highlighting next generation technology: ultrafast broadband and 5G mobile networks.

Rights and data

Labour’s digital promises are found within its economic strategy, and scant attention is paid to other more wide-ranging issues that stem from the adoption of the internet into our lives. For example, the Liberal Democrats make a point of championing the need for a digital bill of rights – a proposition set out by Sir Tim Berner-Lee in 2014, and by others before and since, as necessary to ensure the internet remains a place of freedom and innovation.

It’s important that governments protect people from exploitation or other harm online, and setting forth citizens' rights to control their own data deserves to be a major priority of any party in government. But there’s little said about data beyond that held by government – in fact most personal data on citizens is held by private companies and stored for proprietary services – something that goes without mention in Labour’s manifesto.

With an exponential growth in health data from wearable trackers produced by Apple and other tech firms, there’s a need for a framework for controlling, migrating and protecting this data across different services from different providers. No firm should be allowed to lock users, and their data, into a single platform in perpetuity. In fact the lack of attention paid to the growing mobile health market alone is glaring, but the same applies to online medical records, music collections on streaming services, or all manner of data.

Policymaking for the present

Politicians need to recognise that this isn’t the “beginning” of anything, but a mature global platform that in a little more than 10 years has reshaped most markets on the planet. Policies need to reflect what’s happening now – with the growth of the internet of things, something also absent from any party’s manifesto, the challenge will exponentially increase.

Overall, Labour’s digital manifesto doesn’t go far enough to identify what’s really at stake, nor bold enough to promise the changes required to ensure we’re best placed to reap the benefits of the digital economy.

The Lib Dem’s aspiration for a digital bill of rights is heading in the right direction but is founded in paranoia, rather than empowerment. The Conservatives are similarly focused on protecting people online, but campaign’s like the Web We Want need to be so much more, focusing on empowerment, ownership, authorship, and on the changing digital desires of our population.

Revealed for the first time: map sheds light on dark matter that binds the universe together

Dark Matter: as simulated, the scaffold that underpins the universe. Virgo Consortium/Crain/Geach

Dark matter is the most common stuff in the universe. A billion sub-atomic particles of dark matter pass through your outstretched hand every second, yet few if any of these ethereal particles might actually touch and rebound from your hand in your lifetime. Now, studies are beginning to shed some light on this mysterious substance.

Astronomers have known since the 1930s that there is more than just the visible universe. The Milky Way, the galaxy we live in, is spinning too fast to be held together by the gravity between its stars. If stars were all there is, we should have long ago been flung off our cosmic roundabout. Instead, our galaxy contains about six times more material of some kind than is accounted for by every atom of all the elements in the periodic table: material known as dark matter.

Dark matter is invisible and can be detected only though the effect its gravity has on things we can see such as passing rays of light – an effect known as gravitational lensing. This is like looking through an uneven pane of glass which, while transparent, is obvious because of the distortions it produces on objects seen through it. By calculating the extent of the distortion, it’s possible to work out the thickness of the glass.

The recently released Dark Energy Survey used gravitational lensing to generate a huge map of dark matter. As seen from the Blanco telescope in Chile, they saw a crisscrossing web of thick, dark matter filaments.

A map of cosmic dark matter, as seen from the Earth. Colour represents dark matter, increasing towards red. Circles mark galaxies and galaxy clusters. Dark Energy Survey

The dark matter web is the invisible scaffolding that underpins the entire visible universe. The scaffold formed very soon after the big bang, and its gravity began to pull in all the ordinary material of which stars, planets and people are then built. Indeed, the galaxies are all found along dark matter filaments, with clusters of up to a thousand galaxies located wherever filaments cross each other.

So now we know where dark matter is. To find out what it is, we need the Hubble Space Telescope to zoom right in to the dark matter map.

Light vs Dark

On Earth we use particle accelerators to find out what matter is made of, firing particles at each other with enormous energy and seeing what the collision produces. This has been the principle behind experiments from Lord Rutherford’s discovery of atoms in 1908, to mankind’s biggest experiment, the Large Hadron Collider at CERN. But we can’t capture dark matter, nor interact with it at all. Nature, however, provides the experiment for us: we can watch what happens when the dark matter around galaxies or clusters of galaxies smash into each other by chance.

Galaxies are made from three ingredients: stars, dark matter and swirling clouds of gas. When two galaxies collide – an event involving expanses of time and space and size that makes it hard to comprehend – individual stars almost always pass straight unscathed. They are pinpoints of matter separated by vast regions of empty void. Conversely, the clouds of gas smash into each other and are pulled by friction to a stop. Dark matter is expected to behave somewhere in between, and its trajectory out of a collision should reveal its properties.

Points representing visible stars and galaxies (left) as seen through effects of gravitational lensing (right). TallJimbo, CC BY-SA

Astronomical particle colliders

In one well-studied collision known as the Bullet Cluster, dark matter appeared to whizz straight through the collision. As close as we can tell, dark matter kept pace with the stars, not measurably slowed by its ordeal. But interpreting only a single collision is difficult. We must reconstruct the 3D scene from just one viewpoint and one freeze-frame from a movie that lasts 100m years.

To crowd-source the full movie, we recently observed 72 high-speed collisions of the dark matter around galaxy clusters. We view some from the side, others head-on and each at a different stage in the crash. Reconstructing the statistical properties of a dark matter collision, we confirmed robustly that dark matter interacts very, very little with anything else.

The Cerro Tololo observatory, home of the Victor Blanco telescope used. David Walker, CC BY-SA

The dark matter drag factor

Now we’ve also reported our observations of a 73rd collision. This involves individual galaxies, rather than clusters, which remain sufficiently intact for the immense gravitational forces to swing them around and throw them back into each other again. It makes for a very sensitive experiment. If invisible dark matter feels even a tiny amount of friction, it would eventually grow into a detectable lag behind the visible stars. Our collision itself is also nearer to Earth – and happens to take place perfectly in line with a gravitational lens, providing us the ideal viewing angle to track dark matter.

We found that the dark matter is indeed slightly offset from the stars. But while this is a more sensitive experiment than the cluster collisions, it’s also harder to interpret. The gas that originally accompanied the galaxy has slowed so much that it is long gone – and this removes one calibration point against which we could compare the behaviour of dark matter. Nor do we know the exact duration of the collision: an offset could be produced by a small amount of friction for a long time, or an even smaller amount of friction for a longer time.

Simulating hypotheses

After such a long, messy collision, there might also be a more mundane explanation for the offset visible stars and dark matter. We can’t think of any yet, but Durham University’s Institute for Computational Cosmology runs the world’s biggest supercomputer simulations of dark matter. We’re teaming up with the Institute for Particle Physics Phenomenology in order to simulate millions of cluster collisions with different physics, to see if we can reproduce the observed offset in any other way.

The thought that dark matter might interact with, or respond to, forces other than gravity is tantalising – even a very small interaction is completely different to none at all. Once two particles of dark matter can interact, they need another type of particle (a force carrier) to interact through. At this point the bare bones of dark matter chemistry begins to emerge.

So for 80 years, scientists have suspected that an invisible, parallel dark universe exists around us, but remains elusive. Dark matter has always been described in terms of what it isn’t. With these experiments, we are for the first time describing dark matter for what it is.

Google and Android in the firing line as EU pulls trigger on competition inquiry

Offers of candy won't prevent the European Commission's scrutiny now. Google by Asif Islam/Shutterstock.com

The are some specific words that are not particularly popular with the European Commission: “hi-tech”, “anti-competitive” and “bundling”, to name a few. Throw “US firms” into the mix, and the result is as many expected: Google has been accused of anti-competitive practices in Europe.

The culmination of a three-year investigation, the commission will now examine not only the prominence of Google’s own services in its search results, but also launches an inquiry into Android, Google’s mobile phone operating system.

The European Commission’s competition chiefs have sent a Statement of Objections to Google, requiring the search giant to respond to allegations of anti-competitive behaviour in online shopping, where “Shop with Google” links – paid for by advertisers – are promoted over other search results.

Concerns of anti-competitive behaviour will similarly form the heart of the commission’s investigation into Android, which is expected to focus on Google’s agreements with tablet and smartphone manufacturers which might fall under Article 101 of the Treaty of the Functioning of the European Union (TFEU).

These sorts of contractual arrangements include exclusivity agreements, such as where manufacturers are required to pre-install Google’s applications and services exclusively in their tablets and phones – for example, apps such as Google Maps, Gmail, Play, Music, Search and the other elements of the Google-branded ecosystem. They also include agreements whereby manufacturers are restricted from developing and marketing rival products to those Google offers.

The commission will also investigate Google’s practice of bundling its applications and services. Tying and bundling occurs when the supplier requires that two or more products are purchased together, even though they might have not been requested. This practice can be equated to abuse of dominance, especially when the supplier is a market giant the size of Google – and particularly in Europe where its dominance in search is greater than in the US and other markets.

This anti-competitive behaviour is likely to trigger Article 102 TFEU, which prohibits the abuse of a dominant position due to its likelihood to prevent or restrict competition. Similar issues have dogged Microsoft, which was dragged through the European courts for anti-competitive practices involving, among other things, software bundling and designing its products in such a way that it was difficult for third parties to create compatible products.

Bundling Google’s many products is one bone of contention. logos by Yeamake/Shutterstock.com

Google comes out fighting

In anticipation of the investigation, Google issued a memo presenting its basic argument against the commission’s allegations and aiming to reinforce its brand as a promoter of innovation and an investor in new ideas.

Google points to the open-source nature of the Android system, the pricing of its products, as well as the existence of a vibrant competing market for apps and services – worth US$7 billion in revenue for developers and content publishers last year alone. The point Google is trying to make is that in a market where innovation thrives and consumers have wide choice characterised by low prices, there cannot be a negative or anti-competitive effect on trade.

Practically speaking, this investigation is likely to lead to a highly protracted court case – the EU case against Microsoft took 16 years. If and when Google is charged with breach of EU Competition Laws, the firm could face fines up to US$6 billion. But the bigger problem for a company the size of Google is the legal costs such a protracted case will incur. Distracted by arguing its case against the European Commission, Google risks falling behind in its highly competitive and fast-moving industry.

Proceed with caution

A lesson from the Microsoft saga is the importance of timing – Microsoft was ultimately forced to unbundle software such as its media player from Windows many, many years after the case was brought – at a time when it no longer mattered. The pace of technological progresses far outstrips the European Commission’s ability to keep pace, and the grounds for a lengthy investigation launched in 2015 may no longer be relevant a few years from now. Markets can change overnight, something of which the European Commission is well aware.

Ultimately, the technology industry and associated markets have unique characteristics in respect of competition law – the pace of innovation means no one can be sure today what tomorrow’s big products will be. Consequently a dominant firm today may be last in line tomorrow. Competition specialists have long identified this fact and called for caution when intervening, as competition in the field of innovation takes place not in today’s markets, but for the markets of tomorrow.

Chemistry set pencils can turn life-saving tests into child's play

The new chemistry lab - just add water. stux

If you’ve ever sat opposite a doctor and wondered what she was scribbling on her notepad, the answer may soon not only be medical notes on your condition, but real-time chemical preparations for an instant diagnostic test.

Thanks to the work of a team of researchers from California Polytechnic State University, recently published in the journal Lab on a Chip, chemicals formed into pencils can be made to react with one another by simply drawing with them on paper. The team may have taken inspiration from colouring books for their take on a chemical toolkit, but their approach could make carrying out simple but common diagnostic tests based on chemical reactions – for example diabetes, HIV, or tests for environmental pollutants – much easier.

The project started with an established technique called paper-based microfluidics. This uses the capillary effect of paper to carefully mix together what are called reagents – those chemicals mixed to form a reaction, or to measure the presence or absence of a substance. The capillary effect in action is easily seen by dropping two inks of different colours onto a piece of tissue paper. As the liquid is absorbed by the paper the colour drops spread out until they merge with one another and form a colour blend. In the same way two or more reagents can be mixed with water on a strip of paper.

Colouring-in chemistry. Lab on a Chip/RSC

In this case, the difference is that the reagents aren’t added to the paper via droplets. Instead they’re applied via pencils, meaning that without specialist equipment anyone can set about creating chemical reactions by simply using them on the paper.

The team made the reagent pencils by pulverising a mixture of graphite (just as you’d find in normal pencils), test reagents and polyethylene glycol, which helps to keep the reagent dispersed throughout the mixture, as is used for the same reason in toothpaste. They compressed the mixture into pellets and mounted them into mechanical pencil holders bought from the high street stores.

The reaction paper pad was created by using a waxy ink to print small connected enclosures onto filter paper. The reagent pencils could be used to colour in these areas within the enclosures – when water was added to the paper, the reagents dissolved and, confined by the waxy ink, were forced to diffuse towards one another and react.

Real world uses for real world problems

The team demonstrated a potential use of the reagent pencil technique by using it in place of a common test used by diabetics to check their blood glucose levels, which involves reacting a pinprick blood sample with a chemical solution and examining the result.

One pencil was constructed with a mixture of enzymes, one called horseradish peroxidase (HRP) and the other glucose oxidase (GOx). A second pencil contained a reagent called ABTS. When combined in the presence of glucose these react together to give a blue-coloured product. Comparing the results from their pencils on the pad with the more traditional dropper method used by diabetics the team found the results were identical.

An example of how chemical reactions using pencils can provide instant results. Lab on a Chip/RSC

The image shows, on the left, the reagents applied via droplets of solution. On the right, the reagent pencils were used. The top row shows the paper at the beginning of the test, the bottom row the result. Applied to the left enclosure, the sample solution carries the two reagents together which react. The coloured product produced is, as shown on the graph, identical between the two methods.

This is of course extremely easy to set up. Traditional diagnostic tests require training, while this pad and pencil system requires no more than skill than required to colour within the lines. The reagents are extremely stable once made into pencils – usually they would degrade in a matter of days as liquids, limiting how and where the tests can be made. However the reagent pencils showed no sign of degrading after two months.

So this pencil tool kit has obvious advantages: a kit of reagent pencils, much like a box of colouring pencils, is easily transported, without the chemicals degrading. Kits could be designed with particular tests in mind – and the reaction mix can be adjusted by applying more or less, without the need or equipment to make-up complex solutions. There’s scope to monitor environmental pollutants, carry out diagnostic tests in remote locations – not to mention teach chemistry in primary schools.

Human and technical ingenuity will be required to defeat shape-shifting malware

When malware stops looking like malware, we're in for a tough ride. patterns by cepera/shutterstock.com

The FBI and Europol recently brought down a criminal botnet – a network of remotely-controlled PCs – powered by Beebone, an advanced, polymorphic malware capable of shape-shifting up to 19 times a day to prevent detection by antivirus scanners.

By cutting off the command and control (C&C) servers used to issue commands to Beebone, the malware could be more easily located and removed. This particular botnet incorporated around 12,000 infected PCs, but researchers estimate Beebone has infected another 5m computers worldwide.

Widespread use of polymorphic software is a major change in the computer security arms race. In fact it’s Beebone’s polymorphism that has allowed it to remain a continual threat since it appeared way back in 2009.

The first virus

The story of the computer virus or what we now call malware began in 1983, when Fred Cohen wrote a parasitic program that seized control of computers. This was the first computer virus and the first use of the term. Cohen’s test was soon followed by the work of a 15-year-old teenager who wrote Elk Cloner, the first widespread virus which targeted the Apple II computer via the floppy disk.

It’s been a long road since then, with malicious software escalating in capability and complexity resulting in all manner of damage and embarrassing incidents. The infamous Robert Morris Jnr worm in 1988 saw its creator accidentally cripple the early academic internet, for which he received a US$10,000 fine. Fifteen years later in 2003 the Slammer worm crippled the modern internet, practically knocking South Korea off the net. Governments have also got in on the act with Stuxnet and all manner of software used by the NSA and GCHQ as revealed by Edward Snowden’s leaked files.

An arms race escalation

However, one of the most significant changes in the malware landscape was the arrival of one the first polymorphic viruses – the 1260 virus – around 1990. The 1260 virus could change its signature, which hides the appearance of the file to scanners such as antivirus program. It did this by encrypting and decrypting parts of itself while inserting randomly-generated garbage code, which had the effect of padding the size of the file, altering its signature to avoid detection.

The shape-shifting AAEH or Beebone malware arrives as an obfuscated (disguised) piece of Visual Basic code. By faking its identity as an unthreatening file type it tempts the user to run it, using Windows security flaws to gain privileged access (administrator rights) over the machine.

In order to make detection more difficult, its two internal components can each download variants of the other from C&C servers. This makes it harder to detect as each component must be a known version for antivirus scanners to detect the malware correctly. Once the Beebone agent has taken control, those operating it over the internet can send further instructions to the Beebone agent, for example whether to download other malware such as hacking tools, Trojans, keyloggers, or even ransomware such as Cryptolocker.

File signature comparison reveals many different variants of the virus, all widespread. McAfee

Computer exploits such as hacking into systems or writing viruses were in the early days chiefly for gaining notoriety more than anything else. But in the last decade the growth of the net and its reach into most parts of society has brought with it criminals looking to profit. Cybercriminal attacks are now estimated to net US$445 billion each year in illicit revenue. Obviously, where there’s money to be made there will be people who will invest – in this case organised crime prepared to pay for the best tools for the job.

Police and investigators have had some success in countering the threat, shutting down several botnets over the last few years. But ultimately with each botnet shut down another springs up to take its place – constructed from software and other people’s compromised computers, a botnet used for criminal means is inherently expendable.

Defences must evolve too

The solution of deploying antivirus scanners to detect and remove malware is looking more and more out of date, as malware grows more capable of defending itself. Beebone, for example, can prevent efforts to remove it by blocking the internet addresses of known security and anti-virus software firms, and preventing anti-virus software from running.

The speed with which so-called zero-day-exploits – security holes known only to those who discovered them, and not the creator of the software – can spread before patches to provide adequate protection can be written has increased with the internet. This means it’s possible to compromise many, many machines before knowledge of the exploit is even public.

There is more to defence now than antivirus scanners alone, and perimeter defences and other forms of intrusion detection systems are able to detect suspicious network traffic rather than just suspicious files. Nevertheless with imaginative and ingenious criminal and programming minds at work, it’s really only skilled and experienced human talent that provide the awareness required – technology alone cannot offer a total solution.

We’ve come a long way since floppy disk viruses were created for fun not profit, but the angles of attack have changed and our defences must change with them.

Roar of China's 'Great Cannon' heard across the internet

Big guns for big jobs. archer10, CC BY-SA

China has once again surprised researchers by unleashing what has been dubbed its “Great Cannon” – a cyber weapon that has in recent weeks brought down several websites including the Github software code repository and GreatFire, an activist group working against censorship in China.

The offensive power of the cannon is closely linked to the defensive nature of the so-called Great Firewall of China, an internet control system that prevents citizens from accessing websites banned by the ruling party.

Researchers at the University of Toronto’s Citizen Lab have released a detailed analysis of the attacks against GitHub and GreatFire. While the firewall works by intercepting traffic destined to or from banned websites, the cannon works by intercepting huge amounts of unencrypted web traffic passing through Chinese-controlled networks and re-routing it to a specific target. Such a deluge of traffic becomes a distributed denial of service (DDoS) attack, a tried-and-tested method in which the scale of requests overwhelms the site’s web servers, essentially knocking it offline.

Who’s pointing the cannon?

The identities of the Great Cannon’s targets provide circumstantial evidence of the Chinese government’s involvement. GreatFire provides real-time information on the status of Chinese internet censorship, allowing Chinese web users the possibility of avoiding keywords banned by the censor, and finding other ways around the Great Firewall. GreatFire also hosts two GitHub software repositories, one of tools for circumventing China’s Great Firewall, the other a mirror for The New York Times – hardly a Communist Party favourite.

That either might be a suitable target for the Chinese government is readily apparent, but the Citizen Lab researchers also found firmer evidence that the cannon is indeed of Chinese government origin. The Great Cannon and Great Firewall share a number of technical similarities that suggest a common origin. And they are located within the same network address space – somewhere within both the state-run firms of China Telecom and China Unicom.

If these forensic conclusions are correct, why would the Chinese government not hide both the existence and use of this capability better, particularly given that attacks of this nature flout international norms and are illegal in most jurisdictions?

How the Great Firewall and Great Cannon are linked Citizen Lab

Sabre-rattling on the world stage

The first possibility is that these attacks serve a short-term objective of countering the actions of entities China considers threats to its national security. This is a long list, that includes virtual private network and proxy providers, various non-governmental organisations and the Western media.

GreatFire for example has been significantly affected by the attack and its ability to conduct what it calls “collateral freedom” is greatly diminished. This might be considered a success by elements of the Chinese state apparatus, although any tactical gains are likely to be short-lived. Perhaps showing its hand so early in the game will make its Great Cannon less useful in the future, as other organisations are alerted to its characteristics.

At the same time, that the Chinese are prepared to weaponise the traffic passing through their networks into forming the Great Cannon demonstrates both the state’s capability and its willingness to deploy that capability. These are essential components in any attempt to deter opponents, state or non-state, who might attempt to degrade or circumvent Chinese state censorship. “Firing” the cannon may be an attempt to establish it as a credible deterrent – GreatFire’s web hosting costs rocketed to US$30,000 per day due to the explosion of traffic.

The Citizen Lab researchers also note that the Great Cannon can be used to deliver other payloads, more malicious ways of targeting and compromising foreign internet addresses than the relatively crude DDoS attacks launched in March. This must concern other states, although we do not know how it might affect their actions.

Casting a pall over international relations

Someone or, more likely, some committee, within the Party apparatus may have made a strategic decision that the benefits of demonstrating this capability outweigh the costs of attracting international condemnation for doing so. The only response the Chinese government has offered is its well-worn line that China is itself a target of foreign computer attacks – which while true hardly deflects criticism or allays suspicion.

China knows well that the US National Security Agency and UK GCHQ have already been found guilty of interfering with foreign networks but an appeal to this precedent no more exonerates China than it would any other country.

China and the US, its peer-competitor, have been trading blows in this fashion for many years. Far from dampening this mutual distrust, these latest actions only serve to heighten it. Given the global importance of China-US relations, this is not a development to be welcomed.

Atmospheric water may be giving Saturn its spots

In 2010, a massive storm broke out in Saturn’s northern hemisphere. Researchers hypothesize that circulating water may be behind the squalls that seem to appear on the planet every few decades.

NASA/JPL-Caltech/Space