Ex-NSA Boss Defends Patenting His Totally Brand New, Not Developed On Gov't Time, Patent-Pending Cybersecurity Brilliance

from the yeah-that's-believable dept

We recently wrote about Keith Alexander claiming that he's worth as much as $1 million a month (actually, the number is now being lowered to $600k) because he's magically come up with a totally brand new anti-hacking concept that will have many patents. As we noted, this story raised all sorts of questions. First, if he had such a brilliant idea to stop hackers, why didn't he use it back when he was in charge of the NSA and the US Cyber Command? His answer to that was that he magically came up with it after he left office in March. Of course, if that's the case, it's difficult to see how it can be worth many hundreds of thousands of dollars per month because it's a totally untested and totally brand new idea. He can't both be claiming that his years of NSA experience make it worthwhile and that this idea has nothing to do with his work at the NSA -- but he seems to be doing exactly that.

Either way, he's given an interview to the Associated Press in which he tries (and fails) to defend himself concerning the new operation, IronNet Cybersecurity:

"If I retired from the Army as a brain surgeon, wouldn't it be OK for me to go into private practice and make money doing brain surgery?" he asked. "I'm a cyber guy. Can't I go to work and do cyber stuff?"

The "brain surgery" analogy is not even close to be analogous. This is more like he was the administrator of an army hospital who has now retired and says, despite never having personally done a brain surgery, he's now invented a miraculous new way to do brain surgeries so powerful people have only dreamed of them before. Naturally, most people should be skeptical of such claims.

And, of course, most actual cybersecurity folks I know don't consider Alexander to really be a "cyber guy." He's not. Yes, he managed various groups that could hack into systems, but that doesn't make him any sort of expert on cybersecurity. Just the fact that he's diving into the murky waters of "behavioral modeling" as his anti-hacking technique should raise some flags. It's an area that has been talked about a lot, but solutions haven't been any good at all.

Is it possible that Alexander has broken through on an idea that has stumped many people who actually do spend all their time hacking away at systems, looking for security holes and how to fix them? Sure. It's possible, but it's improbable. And the claims by themselves should require significant proof before they're taken seriously. As we've said for years, ideas are one thing. Execution is another, and Alexander has shown no evidence that his solution is actually any good. So why are companies paying him upwards of six figures a month? Good question. It seems unlikely that they truly believe he has found the holy anti-hacking grail. It seems more likely that they like his government connections.

Filed Under: behavior modeling, cybersecurity, hacking, keith alexander, nsa, patents
Companies: ironnet cybersecurity

Keith Alexander: I'm Worth $1 Million Per Month Because I'm Patenting A Way To Stop Hackers (Which I Didn't Tell The NSA)

from the say-what-now? dept

The Keith Alexander story just keeps getting more and more bizarre. Almost immediately after retiring from the top position at the NSA, where he oversaw the total failure of the NSA's supposed "100% auditing" system, allowing Ed Snowden (and who knows how many others) to escape with all sorts of documents, Alexander announced that he had set up a cybersecurity firm -- with the ridiculously Hollywood-ish name of IronNet Cybersecurity. A month ago, it was revealed that he's going around asking banks to pay him $1 million per month for his "expertise." That caused a few to wonder if he's selling classified info, because really, what else could he offer?

Alexander has a new answer: Patents! Yes, Keith Alexander is claiming that he has an amazing new anti-hacker technique that is brilliant and wonderful and deserving of at least nine patents. According to Shane Harris over at Foreign Policy:

Alexander said he'll file at least nine patents, and possibly more, for a system to detect so-called advanced persistent threats, or hackers who clandestinely burrow into a computer network in order to steal secrets or damage the network itself. It was those kinds of hackers who Alexander, when he was running the NSA, said were responsible for "the greatest transfer of wealth in American history" because they were routinely stealing trade secrets and competitive information from U.S. companies and giving it to their competitors, often in China.

Of course, this leads to all sorts of questions. If Alexander had such a brilliant, patentable solution for stopping hackers, why didn't he, you know, use it while he was at the NSA. His response? He and an unnamed "partner" just came up with it in the last couple months after leaving office:

Asked why he didn't share this new approach with the federal government when he was in charge of protecting its most important computer systems, Alexander said the key insight about using behavior models came from one of his business partners, whom he also declined to name, and that it takes an approach that the government hadn't considered. It's these methods that Alexander said he will seek to patent.

The report also notes that Alexander is a named inventor on seven patent applications filed while he was at the NSA (the US government keeps those), but that these new ones are totally separate.

Now, it is entirely possible that Alexander and his partner magically came up with some new way to deal with cybersecurity -- though I'm skeptical. Cybersecurity work involves an awful lot of trial and error in the real world, and Alexander is insisting already that his "fundamentally new approach" will "jump" ahead of existing technology. That's a bold claim for someone who hasn't ever actually done work in the commercial field. One thing that we've pointed out for years, is that people who have no experience in actually building a technology business almost always overvalue the idea, and undervalue the execution. It certainly looks like Alexander is doing exactly that. He thinks that based on the idea alone -- which is totally unproven -- he's worth $1 million per month. He claims three companies have already paid up, though he doesn't say who (or how much they're really paying). It seems likely that any actual payments are more because of Alexander's connections, rather than his brilliant "idea."

Harris spoke to another expert who notes that the approach Alexander is talking about (behavioral modeling) is one that's been talked about and tried for years without success. In other words, it's a perfect example of where ideas sound good, but execution matters. And yet, Alexander insists that his ideas alone -- which haven't been proven yet (and on which he hasn't even filed these supposed patents) -- are so amazing that they will change the nature of cybersecurity?

When Harris asks for more detail about the solution, Alexander wouldn't tell him any more "given the sensitive nature of the work." Except, of course, if he's filing patents on it, the details are supposed to be revealed the public in fairly short order (18 months at most). And, really, if the solution is so great, they should be getting it out there and testing it. Security by obscurity is not the best proving ground. Actually having your solution tested is.

Filed Under: behavior modeling, cybersecurity, hackers, keith alexander, nsa, patents, surveillance
Companies: ironnet cybersecurity