In: Raimo P. Hämäläinen and Esa Saarinen (eds.). 2004. Systems Intelligence – Discovering a Hidden Competence in Human Action and Organizational Life, Helsinki University of Technology: Systems Analysis Laboratory Research Reports, A88, October 2004.

Chapter 8
Internet Security and Systems Intelligence

Camillo Särs

There are roads, which must not be followed,
armies, which must not be attacked
towns, which must not be besieged,
positions, which must not be contested,
commands of the sovereign, which must not be obeyed.
Sun Tzu on the Art of War

Systems intelligence is pragmatic, active, and has a very personal emphasis. Its focus is on executing change through points of exceptional leverage. When we look at Internet security from the perspective of systems intelligence, we can learn a lot about the power of systems intelligence in action. To really understand its power, we must also look at the boundaries of what systems intelligence can achieve. Without an understanding of these boundaries our efforts at changing our systems may fail simply because we tried to change what cannot easily change, instead of starting anew, abandoning that which no longer is of use to us.
Introduction
Systems intelligence seems to be very powerful at its best. In this essay, I will try to describe what I see as some boundaries on the power of systems intelligence. My aim is not to downplay the potential impact of systems intelligence, but rather to illuminate the concept further by making you aware of some possible limitations. I hope that by being aware of the boundaries we can further enhance our capability to act in a systems intelligent manner.
I will approach the subject from an angle that I am personally very familiar with, please indulge me. I am working from the oft-repeated question “Why is the Internet so insecure?” – I am regularly asked this question, or questions that in essence mean the same thing. The question actually means very little taken out of context.
For this discussion, let us assume that the Internet simply is insecure, with blatant disregard of what that actually may or may not mean. Instead, I will attempt to take a closer look at what really amounts to fundamental systematic reasons for security problems on the Internet. To do this, I will have to take a detour into the concept of a “system”. This is, as it turns out, no trivial issue.
This essay may be of interest to two very different audiences – computer security specialists and researchers into systems intelligence. As far as I know the intersection of the audiences is very small, so I will necessarily have to state some “obvious” facts about both, while also leaving out a lot of relevant detail. Bear with me, and try to not be distracted by this.
Systems Thinking and Systems Intelligence
According to Peter Senge (1990), 
The essence of the discipline of systems thinking lies in a shift of mind:
–	Seeing interrelationships rather than linear cause-effect chains, and
–	Seeing processes of change rather than snapshots.
Saarinen et al. (2004) describe their effort to define systems intelligence as follows:
Systems Intelligence follows Systems Thinking in setting out from the primacy of the whole, from acknowledging interconnectivity, interdependence and systemic feedback as the key parameters.
Like Systems Thinking, Systems Intelligence wants to account for change.
Unlike Systems Thinking, Systems Intelligence is primarily outcome-oriented and not a descriptive effort; it is intelligence-in-action on its way to create successful systemic change.
Systems Intelligence reaches beyond Systems Thinking in its pragmatic and active, personal and existential emphasis.
They also point out that systems thinking is an expert discipline – making large parts of it useless to the non-expert in his daily life. So what is then the essence of systems intelligence? Currently, if I were to attempt a short definition, I would expand on Senge’s definition of systems thinking.
The essence of systems intelligence lies in a change of ways:
–	Seeing interrelationships rather than linear cause-effect chains, 
–	Seeing processes of change rather than snapshots, and
–	Executing change through points of exceptional leverage.
The emphasis of systems intelligence is on the capability to actually execute change, to not just see and describe systems. For systems intelligence to be useful, this capability cannot rely on an expert discipline, but on pragmatic and tangible knowledge.
Changes in a System
Recently I read one of Richard Dawkin's books on the theory of evolution, this one titled “The Blind Watchmaker” (1986). While reading a chapter called “accumulating small change”, I was struck by the apparent similarity to how computer software tends to change. This similarity actually applies to quite a few processes of change, as it is a fundamental component of cumulative selection. To avoid overextending the similarity beyond what could reasonably be justified, I will not go into any details of natural selection. However, the process of cumulative change or cumulative selection remains immensely powerful.
As I gather, for cumulative selection to be possible, at least the following things must exist. A number of different possible changes – variations – must exist, some element of selection must choose a suitable solution for a particular situation, and there must be a sequence of repeated change. If we think of any system that is undergoing a series of independent changes, we are essentially witnessing a process of cumulative selection. There is a very distinct difference, however, between cumulative selection as an evolutionary process and cumulative selection in a man-made system. In a man-made system, the choice of “suitable” can be made with hindsight and foresight. 

The essence of systems intelligence lies in a change of ways:
Seeing interrelationships rather than linear cause-effect chains, 
Seeing processes of change rather than snapshots, and
Executing change through points of exceptional leverage.

There is another aspect of cumulative change that cannot be overlooked. Once a number of changes have been made, it is very difficult to “go back”. Even if we are only talking about an engineering project, reverting to “start” is very costly, and in reality the “start” is illusionary at best. The surrounding system has changed regardless of the project, and it has changed beyond our scope of control. What this means is that once a choice is made, be it however small, you are committed to it.
Regardless of the “finality” of choices, the power of goal-driven cumulative choice must not be underestimated. In evolution, no goal exists – every change is “only” submitted to natural selection. In contrast, at any given time, with hindsight and foresight we can make a change that aims towards long-term benefits instead of immediate gain. However, the definition of “long-term benefits” depends very much upon who is doing the choosing. 
If we lack the vision of long-term benefits, all choices will essentially be made only for their immediate benefits. In this case the finality of the choices we make can become a strictly limiting factor. As I noted earlier, undoing previous choices can be very difficult.
The role of cumulative selection is important to Internet security, because most of the computer systems connected to the Internet have actually been developed through a gradual process. This means that they carry a large legacy of previous choices, and those choices have most probably not made with the current Internet in mind.
Computer “Systems”
In information technology the term “system” is so heavily overloaded that it is virtually useless as a general-purpose term. For instance, a computer is often referred to as a “computer system” or just “system” for short. While technically often correct, this usage is completely obscure to the non-expert and a common source of confusion even amongst experts. 
Traditionally computer security has been seen as something very “linear”. In essence, you could describe a computer system, how it is to be built, and how it can interact with its environment. This description would include a number of “bad” things that could happen and ways to make the bad things disappear. With this approach it is thought that it would be easy to compare different systems and tell which one is best suited for any particular purpose. The underlying assumption is that nothing really significant will change, and that everything will behave as predicted. As we know, real life does not want to play by these rules. Things can, and do, change – sometimes very rapidly. To add insult to injury, not only does the environment change, but also the computer system itself will have many changes made to it. As a result, the “systems” described rarely ever make it out the door before their descriptions are already outdated.
The traditional view of computer security never claimed to solve every security problem. Rather it focused on describing the general security principles of the system – properties that were expected to stay fairly constant even under changing circumstances. Actually using the system requires constant attention to changing conditions – proper administration. This fairly straightforward way of thinking still has much impact on how computer security is built today. Unfortunately, much of the computers in use today have not even had the benefit of this during their design.

The important thing to understand about secure computer systems is that they do not really play a major role in the security of the Internet.

So, assuming we have a “securely built” computer, how do we administer it properly? There is a set of well-known best practices in this field as well. All it takes is a few highly trained specialists that can define and run an effective information security management process. Additionally, all users of the computer system must also know their part in using it securely. If this sounds complicated, it is because it is complicated. Designing, constructing, maintaining, operating, and administering a secure computer system is something that requires a considerable effort. The actual “computer system” is only a small part of the overall system at work here.
The important thing to understand about secure computer systems is that they do not really play a major role in the security of the Internet. There are much larger “systems” at work, and to understand those systems, we need to take a look at ways of working with such systems.
Systematic Implications of Networking
Essentially, the Internet is a large number of intelligent devices connected by a complex but stupid network. This view of the Internet, however, is not really interesting when I try to explain what many see as the insecurity of the Internet.
Another view of the Internet is that of a network that allows a very high degree of interconnectivity between different systems and processes. By “systems” I do not mean computer systems, but instead the “systems” of systems thinking. As soon as a connection to the Internet is added to a system, the potential connectivity of that system increases exponentially. This is a fundamental change – if this explosive increase in connectivity is not managed properly, we can quickly lose the ability to understand and control the system.
The fundamental issue is that we may no longer know what our system is. This is actually what often lies behind the original question “Why is the Internet so insecure?” There are a number of ways that an Internet connection can change a system; here is a list of examples.
–	Huge number of possible contacts – users.
–	Contacts are suddenly international.
–	Contacts are suddenly global – time zones cause delays and confusion.
–	Interactions can happen at any time, any day.
–	Interaction can be almost instantaneous.
–	“Metcalfe’s law of networking” causes exponential growth. (Increasing returns)
–	Computer security – attacks are suddenly not only possible, but also probable.
The list could go on, but I hope you get my point. The impact of being networked is easily underestimated – this is also one direct consequence of Metcalfe’s law. Understanding this is fundamental to understanding the systematic effects.
Metcalfe's Law is expressed in two general ways:
The number of possible cross-connections in a network grows as the square of the number of computers in the network increases.
The community value of a network grows as the square of the number of its users increase.
The original statement from Robert M. Metcalfe, inventor of Ethernet, was apparently (hard to confirm):
The power of the network increases exponentially by the number of computers connected to it. Therefore, every computer added to the network both uses it as a resource while adding resources in a spiral of increasing value and choice.
The Internet does not only affect the interrelationships between systems. The processes of change can also benefit from Metcalfe’s law. This means that self-reinforcing loops can reach avalanche proportions very rapidly, but also that the different forces that oppose change can have incredible magnitude.
Dawn of Internet Security
Most computers in use today on the Internet were originally designed for an environment that was not networked. Competition between both hardware manufacturers and operating system designers was fierce, and this in turn led to an arms race in which the list of features was crucial to the success of a product. At the same time, customers were not willing to sacrifice old investments when upgrading their systems – backwards compatibility became a key success factor. Today, personal computers are still able to run most software that was produced twenty years ago, despite an incredible advance both in computing power and capabilities.
To me, the process of change that PCs have undergone seems to be incredibly close to cumulative selection. Both consumers and producers of PCs have committed to an ever-increasing amount of features, locked in a self-enforcing arms race. The consumer wants a PC that can perform the task at hand as well as possible, as cheaply as possible.  The producer wants to outsmart its competition by shipping the feature faster than anyone else. Until recently, neither has seen security as a major concern.
Enter Metcalfe’s law. Once enough PCs were networked, the system started to change rapidly, and beyond the control of either consumers or producers. You may think that this should not be a problem – after all, are not the remaining producers the ones that were able to outsmart all the others in the race for ever more features. Why should they have a problem coping with the effects of networking?
Challenges to Internet Security
Understanding the current challenges to Internet security, or “Why the Internet is so insecure” requires that you look at the motives of the different actors.
Consumers want multi-purpose PCs that perform a number of tasks well, and at a competitive price. They are not willing to limit the capabilities of their PCs too much, except under a clear and present threat that would compromise their capability to use their PCs as desired.

What is very interesting is that an increase in the number of features seems to be in the apparent interest of all parties.

Producers want to sell as many units as possible, with as little customization as possible. That is, every copy sold is the same, reducing costs and increasing profits. Ideally the same product would fit every conceivable customer need.
Attackers may have a number of motives, but essentially they want to misuse the PCs of others for purposes they were not intended for. The more features a PC has, the more likely an attacker is to succeed.
The brief analysis above would serve as a good starting point for a systems analysis of Internet security, using the methods of systems thinking. I would rather highlight the fact that all three parties may very well already behave in a systems intelligent manner from their own perspective. What is very interesting is that an increase in the number of features seems to be in the apparent interest of all three parties. This is a very strong driving factor.
The immediate reaction might be that a systems intelligent person would work to change the rules of the game so that adding more features no longer would be so important. Though alluring, I believe this conclusion to be wrong. While it may be warranted to question some, or even many, new features, the need for new features seems to be a fundamental property of the entire system. The growth in features also benefits from Metcalfe’s law, which means that with increased connectivity we can expect ever more ingenious applications.
Conclusions
It seems that the answer to why the Internet is so insecure is very fundamental. The Internet has “evolved” through a process of cumulative selection in which security has played a very minor part. Changing this will be very time-consuming, because of the properties of cumulative selection. Furthermore, what is “secure” to one person is not secure to another, as the very concept depends very much on what is desired. The unpredictable nature of highly networked systems also means that new security problems can be expected to appear in the most surprising places. This tendency for surprises is amplified by the basic desire for ever more features.
The pragmatic nature of systems intelligence limits the amount of systems thinking that can go into any given situation. This means that the systems intelligent person needs to have an intuitive capability to avoid trying to change that, which does not easily change. There are many aspects of a system that can limit the changes that can easily be made.
A systems intelligent security engineer would probably not go about trying to make the Internet secure. Instead he would seek to make the insecurity of the Internet mostly irrelevant to the security of his own systems. This would entail avoiding legacy components, reducing the effects of networking, and controlling what features are included into his system.
I have identified three potential limiting factors – cumulative change, the unpredictability of networked systems, and fundamental systematic properties. These are just arbitrary choices drawn from my area of experience, but they serve to illustrate some boundaries of systems intelligence.
–	Cumulative change puts a boundary on what changes can easily be made to a system.
–	The unpredictability of networked systems puts a boundary on how well you can understand a system.
–	Some properties of a system seem to be fundamental, which puts a boundary on what change can be reasonably expected.
Knowing that such boundaries may exist is critical to the ability to act systems intelligently.
References
BSI. 1998. BS7799-1, Information Security Management. Part 1. Code of Practice for Information Security Management, BSI.
BSI. 2002. BS7799-2, Information Security Management. Part 2. Specification for Information Security Management Systems, BSI.

Bäckstöm Tom, Brummer Ville, Kling Terhi ja Siitonen Paula (Eds.). 2003. Systeemiäly! Helsinki University of Technology, Systems Analysis Laboratory Research Reports B23, April 2003.
Common Criteria Project. 1999. Common Criteria for Information Technology Security Evaluation.
Dawkins Richard. 1986. The Blind Watchmaker, Penguin Science, Penguin Books. 
Saarinen Esa, Hämäläinen Raimo P. and Turunen Sakari. 2004. Systems Intelligence: A Programmatic Outline, in Systems Intelligence: Discovering a hidden competence in human action and organizational life, E. Saarinen and R.P. Hämäläinen (Eds.), Helsinki University of Technology, Systems Analysis Laboratory Research Reports, A88, June 2004, pp.
Senge  Peter M. 1990. The Fifth Discipline, The Art and Practice of the Learning Organization, New York, Doubleday Currency.
Sun Tzu. 1988. The Art of War, Translated with Introduction and Notes by Thomas Cleary, Boston, Shambhala Publications.
Internet Sites
Systems Intelligence Research Group, 2004:  http://www.systemsintelligence.hut.fi/
Authors
Camillo Särs holds an M.Sc. in Computer Science from Helsinki University of Technology; he specialized in network and operating systems security. His research interests focus on problems where trust and authorization play a significant role, and how such systems can be potentially be abused. He currently works for F-Secure Corporation.