Thursday, August 30, 2007

Global Policy Changes

From an Article on Slashdot on 8/30/2007:

Financial Services Firms Simulate Flu Pandemic

The U.S. Government is co-sponsoring a three-week exercise that will simulate the impact of a flu pandemic on financial services firms, including their ability to support telecommuters. The exercise is expected to be the largest in U.S. history and will involve more than 1,800 firms. From the article: 'The program will follow a compressed time frame that simulates the impact of a 12-week pandemic wave. Participants will be given information on how many absentee employees they can expect. Companies won't know exactly how hard they will be hit with sick-calls from employees until this data is made available ... In addition, participating firms won't be able to pick and choose the level of workforce reductions they get hit by.
I think you might be very surprised at how much value comes out of running these types of simulations. I work in the tech field and that side of the story is easy to imagine but as I worked with economists and academia it gave me a new appreciation that I would like to share with you.

Pre-Y2k, the government wanted to plan for the "Systemic Perturbations" that could come out of the Y2k bug. The US Gov't said to its top economists, military leaders: "Assume it is going to be bad, the worst case scenario." For once, perhaps the first time in history, we knew beforehand WHAT the vertical shock to the system was going to be and on what date and time it was going to happen. This gave the discussion a very real sense of importance because it wasn't hypothetical. In disaster planing, you don't know what the vertical shock is going to be-- think of a rock hitting a pond, you don't know how big the rock will be or when, where it will hit, and from a planning scenario it doesn't matter because what you need to plan for is how to deal with the huge splash it creates and the waves and ripples it creates. Once you have created plans to deal with the splash and ripples, what they term as "System Perturbations" you are then ready for any vertical shock (rock hitting pond) to the system. The rock can hit anywhere and be any size. We already know how to respond to the splash and run all the ripples to ground.

So, with Y2k, the Pentagon engaged with a global financial firm of Cantor Fitzgerald to plan for the vertical shock of Y2k and what sort of rule set resets are going to take place. If Y2k was going to be big, Banks failing, power outages, trading stops, mass chaos, martial law... what would be the GLOBAL impact of such massive chaos. Interestingly, Cantor Fitzgerald stated: "I think we've seen this before, in China, with SARS."

Huh? What does China and SARS have to do with Y2k bug?

The Chinese healthcare system, and by extension their entire government was very closed about revealing any of their internal problems. When the SARS outbreak happened, Chinese authorities ignored the problem. When SARS started spreading, the World Health Organization (WHO) started inquiring with China about the outbreaks and extent of the spread within China. China flat denied that any problem existed. When people started dying, the WHO shut down all flights leaving certain Chinese provinces suspected of spreading SARS. This had a DIRECT impact on the Chinese economy and government.

The Chinese immediately responded. "AH, roo mean SARS! Well, we have very much SARS!" To this day, there are police stationed at the airport that will approach any passenger and take their temperature on the spot. If you are running a fever, or you don't look 100% healthy, you don't fly. You've just won an extended 3 day vacation with all expenses paid by YOU because they don't ever want to run the risk of spreading disease and having their airports shut down again. This also started the Chinese equivalent of the CDC to start cooperating with the WHO, which is why we know about the H5N1 "Bird Fru" virus years before it has become a viable threat to humans.

The real lesson here was this: China received a vertical shock to their system. The direct result of that shock was rapid changes taking place to China's political system, changes that NEVER could have come about on their own absent the external influence. An external event causing internal change. Internal change that never could have come internally. Rapid policy changes that forever alter the way the country interacts with the outside world. This was huge.

The correlation to Y2k was the recognition that the vertical system shock to the global system would create unheard of system perturbations. The output of which would cause a permanent global policy change that would forever alter the rules by which governments interact with each other and how each government interacts with its own citizens. External events driving internal change.

Well, as we all know, on 01 January 2000 at 00:00:01 hrs: nothing happened. There was no vertical shock. We planned for the worst and the best happened, with the possible exception of the ten million pissed off network administrators that spent the party of the century sober watching server lights blink.

Then, a year and nine months later, something did happen. 11 September 2001 was a huge vertical shock to the global system. The result of which caused massive global policy change that forever altered the rules by which governments interact with each other and how each government interacts with its own citizens. For the first year after, every day you could pick up the paper and read about a NEW law being passed or policy being implemented that would forever change business-as-usual. To this day, you read any newspaper and you'll see some story that can be traced back to that event. It was a massive global rule set reset. It could be said that the reason that the USA recovered so well from 9/11 was a direct result of the system shock and perturbations that were planned for on Y2k.

Second major lesson was that you cannot predict the vertical shock, but you can plan for the horizontal output and how you'll run those situations to ground.

So, the impact on Information Technology is simply a very small, yet very important sub-component of these war games.

Tuesday, August 21, 2007

Wells Fargo Bank Offline - 48 hours and counting

Wells Fargo Bank, the nation's fifth largest bank with over 6000 locations, is now 48 hours into a total system collapse which started on Sunday, 19 August 2007. All transactions have stopped, dead cold. Deposits, withdrawals, online payments, ACH transfers, Fedwire, e-v-e-r-y-t-h-i-n-g is down.

They issued a press release yesterday, stating that they had experienced a "service disruption", an excuse that worked yesterday. Today, I want answers.

Where is my money? Is it safe? Can I access it?

I monitor the activities of online criminals, primarily Russians. In visiting their online forums, they're speculating what the problem is, but what they're really doing is gearing up for a massive phishing run unlike any other seen before. The criminals have now amassed databases of "fulls", a term they use to indicate they have the targets full personal information, all they need is access to the online banking.

Their increased sophistication is evident in the emails they're crafting for this scam.
=====================
Dear {firstname} {lastname},
Your primary email address for Wells Fargo Bank Online has been successfully changed.
Thank you for using Wells Fargo Bank Online Services

Save time and money by paying your bills online. Its safe, secure and easy to set up. For more information sign in to online banking center and click the 'Bill Pay' tab.

=====================

And that's it... this email combined with other tried and true techniques are sure to catch a few phish. Adding injury is that Wells Fargo customer service is already swamped with complaints, is going to be playing catch-up with millions of delayed transactions, and is sure to let transactions through and deal with the consequences later.

I will provide updates as this situation unfolds. The problem is already big, and its going to get a whole lot worse.

Joel Helgeson