# Presentation: 524834

## Tamper & Intrusion Detection(and other unsolved problemsin physical security) 

- Roger G. Johnston
- Vulnerability Assessment Team
- Los Alamos National Laboratory
- 505-667-7414
- _[rogerj@lanl.gov](mailto:rogerj@lanl.gov)_
- http://pearl1.lanl.gov/seals/default.htm

- LAUR-04-5680               Talk for the LANL Fellows Prize for Outstanding Research, October 6, 2004

## LANL News

**Sauer, Johnston and Sarrao honored as 2004 Fellows Prize winners**
**    **Nancy Sauer, Roger Johnston and John Sarrao were honored by the Laboratory Wednesday at a Fellows Prizes award ceremony in the Physics Building Auditorium at Technical Area 3. In his opening remarks, Director G. Peter Nanos commended the Fellows award-selection committee for "a job well done." He said "the quality of the Fellows award recipients this year is just outstanding." ...
-     Nanos then presented the 2004 Fellows Prizes for Research to Roger Johnston of Advanced Diagnostics and Instrumentation (C-ADI) and John Sarrao of Condensed Matter and Thermal Physics (MST-10). The Fellows Prize for Research honors individuals for outstanding research performed at the Lab, published within the past 10 years, and exerting a significant disciplinary or programmatic impact. It is open to all full-time staff members; however, fellows and postdoctoral researchers are ineligible for consideration.
-     Johnston received the Fellows Prize for Research in recognition of the scientific rigor and ingenuity his path-breaking work has brought to the often-overlooked area of physical security, especially as it relates to the vulnerability of critical facilities and materials to intrusion, theft or tampering. Fellows' Coordinator Merri Wood-Schultz of (X-2) emphasized that, "not only has Roger been a leading contributor to this field ... [but] he carried a major role in placing this field on a modern scientific basis, and the consequences of that shift have been enormous."
-     Johnston thanked the award committee for recognizing the topic of physical security as worthy of serious scientific study. "Anything that contributes to research and development in this field is a good thing," he said. "Physical security is not a slam-dunk," Johnston elaborated. Using everyday tools, methods and supplies, for instance, his team defeated 100 percent of all commercial tamper-detection seals, including those used in critical nuclear applications -- in less than 45 minutes (and more than half in under 60 seconds). In response, Johnston incorporated an "anti-evidence" / stored secret number approach to design more than 20 new seals offering better security and total reusability.
-     Johnston concluded that, "effective security management must be highly multi-disciplinary and integrate the technical and social sciences ... many major areas are largely unstudied, including international nuclear safeguards." The long-term solution, he said, lies in positioning physical security as a valid scientific field. To this end, Johnston's team recently established a scholarly peer-review publication, the Journal of Physical Security.

## C-ADI Vulnerability Assessment Team

- Eddie Bitzer, M.A.
- Alicia Herrera
- Jon Warner, Ph.D.
- Anthony Garcia
- Adam Pacheco
- Sonia Trujillo
- Leon Lopez
- Ron Martinez
- Roger Johnston, Ph.D., CPP

- The greatest of faults, I should say, is to be conscious of
- none.
-    -- Thomas Carlyle
-             (1795-1881)

## Thanks also for assistance, encouragement, support, collaborations, & advice...

**Wayne Danen****	****	****	****Ken Thomas ****	**
**Debbie Martinez ****	****	****Jim Doyle**
**George Eccleston****	****	****Josh Smith**
**Duncan MacArthur ****	****	****Maida Trujillo**
**Roz Newmyer****	****	****	****Frank Gac****	**
**Larry Parker****	****	****	****Greg Sheppard**
**Jozef Kuzminski****	****	****Anna Nogar****	**
**	****	****	****	****	****Kevin Grace**
**Morton Bremer Maerli,                                          *****Norwegian Institute of International Affairs***

## Terminology

**physical security:**  trying to protect valuable, tangible assets from harm.
- _Examples of assets_:  people, money, buildings, equipment, cargo, weapons, drugs, chemicals, hazardous materials, consumer products, museum artifacts.
- _Examples of harm_:  theft, vandalism, damage, sabotage, espionage, terrorism, tampering, counterfeiting.

- When choosing between two evils, I
- always pick the one I never tried before.
- 	        -- Mae West (1893-1980)

## Terminology (con’t)

**intrusion detection:**  immediate (real-time) detection of unauthorized access.
**tamper detection:**  delayed (after the fact) detection of unauthorized access.

- Terminology (con’t)

## Terminology (con’t)

**lock:**  a device to delay, complicate, and/or discourage unauthorized entry.
**seal:**  a tamper-indicating device (TID)   designed to leave non-erasable, unambig-     uous evidence of unauthorized entry or tampering.  Unlike locks, seals are not necessarily meant to resist access, just      record that it took place.
**tag:**  an applied or intrinsic feature that           uniquely identifies an object or container.

- Never answer an anonymous letter.    -- Yogi Berra

## Tamper-Evident Packaging

- On a bag of Fritos:  “You could be a winner!
- No purchase necessary.  Details inside.”

## Examples of some of the 5000+ Commercial Seals

## Ancient Seals

- Mohammed’s seal, ~620 AD

- Babylon cylinder seal (~1700 BC) shown with its clay impression

- Indus Valley stamp seal (right), with its clay impression,  2200-1800 BC

## a commonancient sealing mechanism

- a commonancient sealing mechanism

## Ancient Seals

- clay tablet in clay envelope,
- Turkey, 1600 BC

- seal impression,
- on handle of clay jar

## 14th century painting showing a sealed document

## Antiquity 75, 299-305 (2001)

*Antiquity* **75**, 299-305 (2001)

## Problem 1:  Existing tamper-indicating seals aren’t very effective.

- In theory there is no difference between
- theory and practice.  In practice there is.
- 	 	-- Yogi Berra

## Terminology (con’t)

**attacking a seal:**  undertaking a sequence       of actions designed to defeat it.
- Defeating seals is mostly about fooling people, not beating hardware (unlike defeating locks, safes, or vaults)!

- Terminology (con’t)

## (Yanking a seal off a container is not defeating it, because it will be noted at the time of inspection that the seal is damaged or missing.)

## Seals Vulnerability Assessment

-     We studied 213 different seals in detail:
- 	• 	government & commercial
- 	• 	mechanical & electronic
- 	• 	low-tech through high-tech
- 	• 	cost varies by a factor of 10,000
-       Over half are in use for critical applications,
-        and 16% play a role in nuclear safeguards.

## Percent of seals that can be defeated  in less than a given amount of time by 1 person using only low-tech methods

- 213 seals

## Defeat Time vs. Seal Cost

- _linear LS fit_
- r = 0.14
- slope:  1.6 sec/$

- 307 attacks

## Results for 213 Seals

| defeat time            for 1 person | 2.7 mins | 1 min |
| --- | --- | --- |
| cost of tools              & supplies | $144 | $5 |
| margin cost            of attack | 42¢ | 9¢ |
| time to devise successful attack | 5 hrs | 12 mins |

-      parameter                 mean       median

## The Good News:  Countermeasures 

-  	Most of the attacks have simple and  	inexpensive countermeasures, but the 	seal installers & inspectors must 		understand the seal vulnerabilities, 	look for likely attacks, and have 		hands-on training.
-  	Also:  better seals are possible!

## Problem 2:  What is fundamentally wrong with the design of existing seals?

- Inanimate objects can be classified scientifically into three major categories;
- those that don't work, those that break down, and those that get lost.
- 		   -- Russell Baker

## The Alarm Condition Problem: Tamper Detection

- It’s easy to detect tampering!
- But what do we do with the information
- that tampering has occurred?

**?**

## The Alarm Condition Problem: Tamper Detection  (con’t)

- Conventional seals store the
- ‘alarm’ condition until it is time
- to inspect the seal.
- But many attacks on seals involve
- simply hiding or erasing this stored
- information!

## Solution:  Anti-Evidence Approach to Tamper Detection

-  	Store secret information, such as a  		random number.
-  	Erase the number when tampering              	is detected.
-  	The ‘good guys’ can check the number by
-  	using a password, PIN, or combination.

- 1663

## Anti-Evidence Approachto Tamper Detection  (con’t)

-  	Any attempt by the ‘bad guys’ to enter the  	wrong password, PIN, or combination  		erases the number.
-  	Any attempt by the ‘bad guys’ to access 	the number (so they can counterfeit it)  	causes the number to be instantly erased.

## 20+ New Seals

-   better security
-   no hasp required
-   no tools to install or remove seal
-   no hardware outside the container
-   100% reusable, even if mechanical
-   can monitor volumes or areas, not just portals
-   can automatically verify the seal inspector 		actually checked the seal

- MagTag, Tie-Dye Seal, Magic Slate Seal, Glass & Powder Seal,
- Triboluminescence Seal, Plug Seal, Talking Truck Cargo Seal,
- Blinking Lights Seal, Time Trap...

## Problem 3:  What is fundamentally wrong with conventional intrusion detection methods?

- Men do not like to admit to even momentary imperfection.
- My husband forgot the code to turn off the alarm.  When the
- police came, he wouldn't admit he'd forgotten the code...
- he turned himself in.           --Rita Rudner

## The Alarm Condition Problem: Intrusion Detection

- It’s easy to detect intrusion!
- But what do we do with the
- information that intrusion has occurred?

**?**

## The Alarm Condition Problem: Intrusion Detection  (con’t)

- Simple conventional intrusion detectors
- send an alarm once intrusion is detected.
- But it is easy to block an alarm.

## The Alarm Condition Problem: Intrusion Detection  (con’t)

- More sophisticated, conventional intrusion
- detectors rely on encryption/authentication
- and/or two-way communication or polling
- of sensors.
- This is complicated, and not very practical,
- especially for monitoring moving cargo.

## Solution: Anti-Evidence (“Town Crier”) Approach to Intrusion Detection

-  	Send a periodic “All OK” signal if no intrusion 	is detected--a different secret signal each time 	that only the good guys know.
-   Send gibberish if intrusion _is_ detected.              	(The bad guys won’t know the difference.)
-  	Allows for great simplicity & security.

## Anti-Evidence (“Town Crier”) Approach to Intrusion Detection  (con’t)

-  	Requires only one-way, extremely low 	  	bandwidth communication  (1 byte/sec to 1 bit/min)
-  	Can be used to simultaneously monitor  	many moving vehicles or containers, all
-    using the same radio frequency.

## Anti-Evidence (“Town Crier”) Approach to Intrusion Detection  (con’t)

-  	We only listen, we don’t try to communicate
- 	with the cargo.
- 	The low bandwidth signal can be hidden	in amongst general communications traffic.

## “Town Crier” Monitoring  -  Smart Container

## “Town Crier” Prototypes

- Generation 2  ($30)

- Generation 1 ($1600)

## Problem 4:  Too often, high-technology is thought to guarantee high-security.

- If you think technology can solve your security problems,
- then you don't understand the problems and you don't
- understand the technology.      -- Bruce Schneier

- The more sophisticated the technology, the more vulnerable
-  it is to primitive attack.  People often overlook the obvious.
- 		 --  Dr. Who in *The Pirate Planet * (1978)

## Why High-Tech Devices Are Usually Vulnerable To Simple Attacks

- Still must be physically coupled to the real world
- Still depend on the loyalty & effectiveness of user’s personnel
- The increased standoff distance decreases the user’s attention to detail
- Many more legs to attack

## Why High-Tech Devices Are Usually Vulnerable To Simple Attacks (con’t)

- The high-tech features often fail to address the critical vulnerability issues
- Users don’t understand the device
- Developers & users have the wrong expertise
-     and focus on the wrong issues
- The “Titanic Effect”:  high-tech arrogance

## Problem 5:  Too often, inventory is confused with security.

- Not everything that can be counted counts, and not everything that counts can be counted.
-             --  attributed to Albert Einstein (1879-1955)

## Inventory

-  	Counting and locating our stuff.
-  	No nefarious adversary.
-  	Will detect innocent errors by insiders,         	but not surreptitious attacks by 		insiders or outsiders.

## Security

-  	Watch out for mission creep:  inventory 	systems that come to be viewed as 	security systems!

##  	bar codes

-  	bar codes
-   rf transponders (RFIDs)
-   contact memory buttons

- High-Tech Tags:  Classic examples of confusing           Inventory & Security, High-Tech & High-Security

- _Usually easy to:_    *  lift                         *  counterfeit            *  spoof the reader

- These are excellent for *inventory*,
- but problematic for *security*!

## GPS: Another classic example of confusing Inventory & Security, High-Tech & High-Security

-  	The private sector, foreigners, and 90+% of
-  	the federal government must use the _civilian_
- 	GPS satellite signals.
-   	These are unencrypted and unauthenticated.
-   	They were never meant for critical or
-  	security applications, yet GPS is being
-  	used that way (e.g., cargo security).

## Attacking Civilian GPS Receivers

**Blocking:** 	just break off the antenna, or shield it with 		metal;  not surreptitious.
**Jamming:** 	easy to build a noisy rf transmitter from 		plans on the Internet;  not surreptitious.
**Spoofing:**	surreptitious & (as we’ve demonstrated) 		surprisingly easy for even unsophisticated 		adversaries.  *There are simple **	**	**	**countermeasures.*
**Physical attacks:**  appear to be easy, too.

## Time Vulnerabilities

- Many national networks (computer, utility, financial, & telecommunications) are somewhat prepared for loss of time synchronization due to GPS jamming.  But they are not prepared for spoofing, which is easy and could crash them.
- The alternate time standard (NIST atomic clock) is also not authenticated or encrypted.

## Problem 6:  The Insider Threat, especially from disgruntled employees, is often overlooked or underestimated.

- No one can build his security upon
- the nobleness of another person.
- 	-- Willa Cather  (1873-1947)

- We have met the enemy and he is us.
-             -- Walt Kelly, the words of Pogo 	in Earth Day 1971 cartoon strip

## Disgruntled Workers

- 	Most experts agree employee disgruntlement
- 	is increasing worldwide.
- 	Research shows that employee disgruntlement
- 	is associated with perceptions of unfairness &
- 	inequity, not necessarily objective conditions.
- 	Disgruntled employees are known to be
- 	a risk for espionage, theft, sabotage, and
-  	workplace violence.

- What has posterity ever done for me?
-           -- Groucho Marx (1890-1977)

- President Merkin Muffley:  “Gentlemen, you can't fight in here! This is the War Room!”    -- From the movie *Dr. Strangelove or How I Learned to Stop Worrying and Love the Bomb * (1964)

## Workplace Violence (USA)

-   ~ 1 million victims of workplace violence
-  	each year
- 	>1000 workers killed each year due to
- 	workplace homicide
- 	Homicide is the number one cause of
- 	on-the-job deaths for females
-  						        Source:  NIOSH

- Always go to other people’s funerals.  Otherwise they might not come to yours.            	 --Yogi Berra

## Disgruntlement Countermeasures

-  	 Allow employees to freely offer suggestions
-  	& concerns--and take them seriously.
-  	Deal with unhappy/upset employees by listening, 		acknowledging, validating, & empathizing.
-  	Have legitimate complaint resolution processes.
- 	Treat departing employees & retirees well.

- Sincerity is everything.  If you can fake that,
- you've got it made.
-           -- Comedian George Burns (1896-1996)

## Problem 7:  Physical security is difficult; the bad guys have most of the advantages.

- Evil is easy, and has infinite forms.
-               -- Blaise Pascal (1623-1662)

## Why Physical Security is Difficult

| clear objectives | vague objectives |
| --- | --- |
| success is measurable | success is defined as nothing happening (pathological metric) |
|  individual vision;  may be highly creative | linear, non-creative, bureaucratic groupthink |
| multi-dimensional,     higher-level thinking | binary thinking |

- typical bad guys

- typical good guys

- You’ve got to be very careful if you don’t know where you are going, because you might not get there.    -- Yogi Berra

- 0 1

## Why Physical Security is Difficult  (con’t)

| realistic view of vulnerabilities | wishful thinking:  tend not to see vulnerabilities because they don’t want them to exist |
| --- | --- |
| aware of the power          of using insiders | ignore or underestimate the insider threat |
| attacks & preparation     are fun and exciting | many routine &        tedious responsibilities |

- typical good guys

- typical bad guys

- Nothing is easier than self-deceit.  For what each man wishes, that he also believes to be true.
- 	    -- Demosthenes (382-322 BC)

## Vulnerabilities are often obvious to outsiders...

- To see what is in front of one's nose needs
- a constant struggle.
-   	-- George Orwell (1903-1950)

## Why Physical Security is Difficult (con’t)

| fully understand security personnel, tools & methods            (Shannon’s Maxim) | poorly understand the  identity, resources, & motivation of adversaries |
| --- | --- |
| need attack only at 1 point & at the time of their choice | must continually defend         extended assets |
| need to exploit only 1            or a small number of vulnerabilities | must manage many vulnerabilities, including unknown ones |

- We have to get it right every day and the terrorists only have to get it right once.  So we have to be ahead of the game.
-                       --TSA Spokeswoman Lauren Stover

- typical good guys

- typical bad guys

## Other Reasons Why Physical Security is Difficult

- Society & employees often do not like security.
- Effective security management is highly multi-disciplinary:  technical & social sciences.
- Major areas are largely unresearched.  Examples:  2-person rule, access control, security guard psychology, social engineering, biometrics, polygraphs, nuclear materials transport, **international nuclear safeguards**.

- We spend all our time searching for security, and then we hate it when we get it.
-               -- John Steinbeck  (1902-1968)

## Domestic Nuclear Safeguards:  conventional security applicationInternational Nuclear Safeguards:everything is backwards

- Bottom line:  The 2 kinds of “safeguards” are so different, that we should expect the hardware,  personnel, and strategies to differ dramatically.  But they don’t.

## 
Physical Security scarcely a “field” at all!

	-  	You can’t (for the most part) get a degree in it.

	-  	Not widely attracting young people, females,                                         	the best and the brightest.

 	-  	Few peer-review, scholarly journals or R&D conferences.

 	-  	Lots of snake oil salesmen.

 	- 	Shortage of models, fundamental principles, metrics, rigor, 		standards, guidelines, & critical thinking.

- Physical Security scarcely a “field” at all!
- 	-  	You can’t (for the most part) get a degree in it.
- 	-  	Not widely attracting young people, females,                                         	the best and the brightest.
-  	-  	Few peer-review, scholarly journals or R&D conferences.
-  	-  	Lots of snake oil salesmen.
-  	- 	Shortage of models, fundamental principles, metrics, rigor, 		standards, guidelines, & critical thinking.

- The only security is the constant practice of critical thinking.
- 		-- William Graham Sumner  (1840-1910)

- Other Reasons Why Physical Security is Difficult  (con’t)

## A new scholarly, 

**peer review journal:**
**The Journal of Physical Security**
**	****http://jps.lanl.gov**

**JPS**

## Problem 8:  Security & Safety have similar attributes. So can Security methods help us with Safety?

- Without deviation from the norm,
- progress is not possible.
-           -- Frank Zappa (1940-1993)

## Security & Safety have a lot in common...

-   all about protection & prediction
-   failures can cause enormous problems
-   need to be proactive, but usually are reactive
-   hysteria typically ensues after major incidents
-   involve complex psychological/organizational,
-    motivational, and communication issues
-   can be hampered by bureaucracy, groupthink,
-    lack of creativity, & employee resistance

- If people don’t want to come to the ballpark,
- how are you going to stop them?
- 		     --Yogi Berra

##   Safety & Security Parallels

-   security survey  ≈  safety “walkaround”
-   security risk management  or “design
-    basis threat”  ≈  safety “what if?” exercises
-   security vulnerability assessment  ≈
-    “adversarial” safety analysis???

- We made too many wrong mistakes.
-   	          -- Yogi Berra

## Nonproliferation Review  

-   • Safeguarding This and Verifying That:  Fuzzy Concepts, Confusing Terminology, and Their
-     Detrimental Effects on Nuclear Husbandry
-   • Tamper Detection for Safeguards and Treaty Monitoring:  Fantasies, Realities, and Potentials
_**J Homeland Security**_** **
-   •** **Efficacy of Tamper-Indicating Devices
-   • GPS Spoofing Countermeasures
_**J Nuclear Materials Management**_
-   • An Annotated Taxonomy of Tag and Seal Vulnerabilities
-   • Vulnerability Assessment of Passive Tamper-Indicating Seals
_**Disarmament Diplomacy**_
-   • International vs. Domestic Nuclear Safeguards
_**Science & Global Security**_
-   • A Proposed Approach for Monitoring Nuclear Warhead Dismantlement
-   • Tamper-Indicating Seals for Nuclear Disarmament and Hazardous Waste Management
_**ASTM J Testing & Evaluation**_
-   • Effective Vulnerability Assessments of Tamper-Indicating Seals
_**J Security Administration**_
-   • Cryptography as a Model for Physical Security
-   • Vulnerability Assessment of Security Seals
-   • A Simple Demonstration that the Global Positioning System (GPS) is Vulnerable to Spoofing
_**Other Journals**_
-   • The ‘Town Crier’ Approach to Monitoring
-   • Effective Vulnerability Assessments for Physical Devices, Systems, and Programs
-   • New Approaches to Tamper and Intrusion Detection for Safeguards and Transport Security
-   • Adversarial Safety Analysis:  Borrowing the Methods of Security Vulnerability Assessments

## The End

**Tamper & Intrusion Detection****(and other unsolved problems****in physical security) **