Doug Lhotka

Technical Storyteller

Opinions and commentary are mine, and do not reflect those of my employer.

(C) Copyright 2019-2023
Doug Lhotka.
All Rights Reserved.
Use of text, images, or other content on this website in generative AI or other machine learning is prohibited.

Cognitive Fuzziness – Getting the definition right

By

(c) www.123rf.com / Benjamin Haas

There’s a ton of hype about cognitive security in the marketplace these days, and the marketing departments are operating in full force.  So beyond the hand waving, cheerleading and me-too-ing, what do we actually mean by cognitive?

Cognitive involves three things:  The ability to mine data for information, the ability to recognize patterns in that data, and the ability to understand natural language.   The key component across all of these is an ability to reason and infer on a probabilistic basis from the context of the information.  But it’s not Lt. Commander Data from Star Trek fame – cognitive isn’t artificial intelligence.  It’s more like the library computer in the original series, that is, a machine that can answer questions put to it.  Cognitive is a foundational technology for AI, but we’re a long way from real AI – 2001 came and went without HAL, and so will 2017.

Machine learning, which is often confused with cognitive (sometimes deliberately) has been around for years, and while it’s an enabling technology, there’s no magic there.   It can be extremely useful, but also some limitations to keep in mind.  The models created are only as good as the data inputs and variables selected.  Poor input data yields models that may appear to work, but diverge over time, and you’d best hope that the data isn’t already compromised when the model is built.  Even when you have a good baseline, continuously updated models can be either spoofed (reset the ‘normal’ baseline over time), or destabilized by a persistent, and patient attacker.    There’s techniques to combat the attacks, so it’s worth asking about which ones are used.

Cognitive uses machine learning as a training tool when it’s being taught to understand a particular set of vocabulary and grammar – cybersecurity for example.   Traditional unstructured information systems simply operate on keywords and often metadata, but cognitive systems understand the context of the information components in relation to each other.  For example, if I talked about Apple’s CEO eating an apple while negotiating a contract with Apple, most engines would return the document based on a keyword – Apple, or potentially from tags or metadata a human added to the document.  A cognitive engine with a large corpus might return that document for questions about computer companies, fruit that grows on trees, and the Beatles’ record company, depending on how the question was worded.

So when using terms like machine learning, cognitive, or artificial intelligence applied to cyber security, it’s important to be crisp about which one is used, and what it implies. We’re not quite in snake oil territory here, but there is a lot of both intentional fuzziness and casual laziness in the press and marketing.  Regardless of which term though, remember that there’s no silver bullet that will solve your security challenges.  Cognitive is a force multiplier, but not a magic army.

Friday Photo – Koala in Melbourne

By

This week’s Friday Photo comes from down under.  In 2007, we went to Victoria, Australia on vacation.  The day we landed we were pretty much zombies, and found a nature preserve right in Melbourne.  This guy was curled up in the notch of the tree, and the lines of his face with the wood caught my eye.  We saw wild Koala’s later in the trip, but this captive one was the the best picture.

Voting Fraud – Back to the Future

By

(c) www.depositphotos.com / roibu

We’ve forgotten that things like stuffing ballot boxes, buying votes with alcohol, missing and broken voting machines, and all other manner of manipulation occurred in the past (some more recent than others).  I’d argue that on balance, our elections today are the most fraud-free that they’ve ever been, but with the advent of more and more electronic voting equipment (and, heaven forbid, internet voting), the risk may be again growing.

Many of the current systems use a single machine where votes are registered and counted.  Most have a paper audit trail, though at least one model uses thermal paper, which is not remotely archival.  Those audit trails are rarely machine readable, often consolidate a large number of issues into tiny font, or worse, scroll part of the ballot off because it’s too long.

Combining the voting selection and counting into a single system makes those machines a key risk for failure, either through fraud, hacking, or simple failure. I had a friend that worked for an IV&V company certifying voting equipment.  She’d worked in aerospace and the procedures were as good as any I’ve ever seen, but even with all that, issues still got through – new vulnerabilities, failure to patch machines, or simply insecure design are all problems that still plague us today.  There’s simply no way to ‘prove’ that the machines are secure – even through formal validation methods.  There’s too many machines, too many locations, too many opportunities for tampering, and too much code to test.

So what to do?  I believe that looking to the past provides the answer – paper ballots.  But let me explain the nuance here.  Build a one machine on which the voter makes their choice, and then have it print out a paper ballot using good old-fashioned pigment ink/toner so it’s archival.  By having the machine print the ballot, rather than a human marking the form, it eliminates the ‘hanging chad’ or ‘improperly marked’ ballot, because the machine prints them.

Once printed, the voter can validate that the printed votes match their intent, and deposit into a separate machine that tabulates the votes.  The paper ballot remains the legal record, and can be preserved for hand counts as long as needed.  Splitting the system into two separate machines separates the most complex code – the user interface to cast votes on a lower risk level, because the voter can verify the output.

The counting machine does need integrity checks and a higher level of validation, but we can mitigate that by using two different machines from different vendors and compare the results.  Of course, that only works if there’s a durable, voter self-validated paper ballot as the legal record, and manual transit between machines.

It won’t help with mail ballots (which have a whole separate set of risks), and isn’t exactly cool and modern.  But it’ll work.  One last thing: let’s keep voting off the internet.  That’s, as we say in the business, a bad idea.