Author: Philip

A letter to the legislative Representatives of our Government – be they Local, State or Federal

First an ask to all those who read this. Please share. I will start a personal campaign to send this to my senators and representatives through their contact page. Maybe even a few by snail mail.

To those that are empowered as the representatives of the “We the People”. As I write these three words I immediately think I need to hold true to what originalists would expect. This said I hope we can all agree that in the Declaration of Independence one word is out of place.

“We hold these truths to be self-evident, that all men are created equal, that they are endowed by their Creator with certain unalienable rights, that among these are Life, Liberty and the Pursuit of happiness.”

The word “men”. This word I hope you all would agree should instead be “people”, “male or female” or “men and women”. I would also hope that when we think people or “men and women” we mean all entities that can be called Homo Sapiens,

no matter, their color

, place of birth, sexual orientation, age, religion or other descriptive variable.

If we are suggesting that we must read this literally! Then we have a major issue and this would explain why some of you explicitly exclude women from much of the deliberations. I do hope I am wrong, in writing this last statement!

The declaration then goes on to argue why we needed to declare our independence.

“That whenever any Form of Government becomes destructive of these ends, it is the Right of the People to alter or to abolish it, and to institute new Government, laying its foundation on such principles and organizing its powers in such form, as to them shall seem most likely to effect their Safety and Happiness.”

We are at a time in the history of this great nation when one must wonder if we should seriously considering altering the nature of our Government. The 45th President has no interest in representing “We The People”. He panders to his base, not the majority as demonstrated by the populate vote and the results of multiple polls since he took office.. You, the legislative branch of our government have divided yourselves divisively into two tribes and as have demonstrated an inability to to work together as one body. This might suggest a need to alter how our government operates.

I would plead with all of you to find a bipartisan way to restore the dignity of the various legislative bodies you are a member of.

This country stands divided and if it cannot restore unity it is at great risk. It is incumbent on all members of the legislative branches of our governments to restore balance, as one set of bodies and not as multiple sets of tribes and parties.

The Future of EMVCo Next Gen

Back in 2011, when I was part of American Express, I was part of the team responsible for our involvement in the work of EMVCo.  At this stage in the work of EMV the discussion had turned to the confusion the multiple contactless kernels was creating in the market and more importantly the challenges we would face as the external threats increased demanding that the length of the RSA keys increase accordingly.  Ultimately we collectively determined the best course of action was to begin the work on what began know as “Next Gen”.  From the beginning it was well understood the migration from where we are today to the “Next Gen” technology solution, both in the card and on the terminal, would be complex and expensive.  In September of 2014 an initial specification was released and my understanding is that a draft has been issued to subscribers and Associates for review and feedback.

This post stems from a conversation with a good friend, he asked me if I thought there was still relevance to what is now being called 2nd Gen.  In that discussion we reviewed the genesis of the work, the baseline for EMV and the unfortunately reality of how contactless was implemented.  Our conversation then turned to the question of what makes the most sense live with what we have today or suffer the expense of the migration to a new solution.

Thinking back to the original reason for “Next Gen” was to consolidate the 7 contactless kernels into one common kernel and replacement  RSA with what was called XDA or Elliptic Curves.  When I think about these two requirements one can only wonder why in the most recent EMVCo Stated EMV® 2nd Generation there is no  reference to enhanced cryptography.  In fact the only thing the document describes is the creation of one unique kernel.

Referring back to the September 2014 Net Gen Specification there is clear reference to enhanced security with specific call out of “an elliptic curve Diffie-Hellman key establishment protocol with blinding applied by the card”.  I then remember hearing about issues with Elliptic Curves and wonder why there is no reference to enhanced cryptograph in this most recent EMVCo document.

Back to the question raised in our conversation.

Do I see value in the world investing in the migration to 2nd Generation?

The answer is I am not sure anymore. 

When EMV started we had four agreed requirements, summarized on this slide I initially created back in 1994.  Offline Authorization, in other words, the issuer’s ability to securely approve a transaction without requiring the terminal to request an expensive online authorization request was the reason Offline Authentication was part of the original design of EMV.

  • If the value of offline authentication, given the ubiquity of wired and wireless telecommunications networks, is deprecated.
  • If  the performance efficiencies, original seen in Elliptic Curves, is no longer as significant, given the increased threats and vulnerability.

Then why make the investment in changing the software in both the card and the terminal to support XDA?

Next

  • If most if not all terminal manufacturers have addressed the complexity of the multi-kernel configurations, compounded by the existence of various unique national contactless kernels.

Then why demand the investment in supporting a complex migration from multiple kernels to a single EMVCo Licensed kernel?

Finally

The threat of quantum cryptograph suggests that most if not all asymmetric cryptographic algorithms commercially available will be broken.

It does beg the question.

What is the business case for driving the world into a expensive, long and complicated migration?

What we created in 1994, and EMVCo has maintained, is a very effective Online Authentication mechanism, the ARQC.  A mechanism based on symmetric cryptography which, as far as I can tell, will remain under the control of the Issuer and is not, as of yet, threatened by quantum computing.

I look forward to your feedback.

 

 

 

 

 

 

A Letter to Karen Webster of PYMNTS.COM

Karen, you come to mind off and on, especially when I’m try to keep up with what is happening in the wild world of payments, block chain, cryptocurrency, identity, authentication, trust, identification and who knows what else.

One thing is clear.  Lot’s of companies are investing significant sums of money in these various “opportunities”.  Yet are we, as a society, on the right path?

We could look to Washington DC, and the other capitals around the world, and this same question would apply.  But, not to get distracted.

Let’s start with identity and authentication in the digital space

As you may remember, EMV was something I got deeply involved with, both here in the USA and back when we originally conceived of the specification.  We the three founding payment associations had one goal – solve for counterfeit.  And, when the issuer or country so desired address lost and stolen fraud.  Focused on the physical world of commerce, the Point of Sale.  Our original goal was simple.  Assure global interoperability by defining a global migration path away from the magnetic stripe.  We mutually agreed we had to select a technology capable of protecting the physical token, the card, well into the 21st century.

Simultaneously, as was so beautifully captured by the Pete Steiner’s famous 1993 New Yorker cartoon, we knew there would be an issue in the digital space, that thing we then call the World Wide Web.  MasterCard and Visa set out to define the Secure Electronic Transactions SET, then Visa patented a concept called 3D Secure and more recently  worked together with the other owners of EMVCo to create EMV 3D Secure.  Each of these, attempts to find a meaningful way of  authenticating the cardholder when they paid with a credit or debit card.

Today billions of identities have been compromised.  The techniques used during an enrollment process online, to verify who you, are no longer viable.  Identifiers like our social security number and Person Account Number (PAN), unfortunately, became authenticators, a role they were never designed to support.  As EMV was deployed criminal shifted their focus to the Internet and PCI had to be introduced to address the challenges of criminals acquiring payment card and PII data.

As the World Wide Web morphed and grew in value and importance, the potential of monetizing the vast amount of data companies where collected began to scare people;  as this recently found comic so aptly demonstrates.  People, governments and corporations started to struggle with their desire for privacy offset against the value of data corporations are collecting.

Way back then, an opportunity to address the issue was offered by Bill Gates.  As is always the case, Microsoft the then technical giant  wanted something to support what society would ultimately need.  The idea of the social good was lost to the value of corporate profit and control.

As the Internet grew to become this marketplace, library, museum, cinema, place to play and place to meet and connect; we imposed well understood enterprise security techniques (username and password) to the consumer space.  The password thus became our challenge.  How do we convince customers (let alone employees) of the importance of complex, hard to remember passwords – unique to every security conscious relationship we establish on the World Wide Web.

Are biometrics the answer, has the FIDO Alliance and W3C created a set of authentication standards we can all embrace?  Hopefully.  Unfortunately, most opportunists are seeking to monetize their often proprietary solution, creating what they think is a best of breed consumer experience.

My fear, we are moving from the familiar experience of typing our user name and password; to multiple unique experiences at the front door of each and every web site we seek to log-in to. 

As an example my Samsung Android phone has a fingerprint sensor and is FIDO certified.  There is a Samsung Pass Authenticator, Microsoft Authenticator, Google Authenticator and several demo versions of various other authenticators.  I also receive SMS messages with one time tokens I am asked to enter onto the screen.  My PC it also is enabled with a FIDO U2F set of dongles.

Unfortunately my tablet has none of these and assumes I will simply remember, thank you Norton Identity Safe, my various passwords.  What a mess we are created all with monetization and the desire to offer a unique consumer experience as the justification.

With all those already installed, I await the introduction of WebAuthN, within the various browsers installed in my PC, tablet and phone. 

Moving to Block Chain and Cryptocurrencies

The wild west.  The makings of a speculators dream.  The realm of the incomprehensible, built on complex mathematical concepts and the desire to remove the man in the middle and replace them with the miners and nodes distributed around the center.  Or, is the idea of the distributed ledger the solution to the challenges of trust in an every expanding universe of connected people and things.  One can only wonder?

People speak of removing central governments.  Yet, they remind us that there is a governing body, book of rules and set of code that is designed to assure immutability.  If I understand their, logic we should not trust Governments instead we  trust these new open societies and digital enterprises?  they speak of removing intermediaries and replace them with nodes and miners.  New players responsible for creating and signing the new blocks and distributing it all those who maintain a current copy of the chain.

Is there potential, Absolutely.  The challenge is to understand why one would wish to move data from a trusted central repository to a distributed trustless environment.  Cost and latency should be part of the discussion and most importantly the level of trust the parties have with each other, identified intermediaries and governing bodies involved in the ecosystem.

Finally Payments

Barter, gold sovereign, IOU, government or bank back notes and coins, checks, cards, account based solutions, digital coins and what next.  Payments have been this ever evolving space.  Some seek to monetize the methods businesses, consumers and governments use to pay for the good and services they seek to acquirer, use or explore.  Others argue that the cost of payment should not be a source of profit.  The interesting twist here is more about the stage an economy is at in their migration from one from of payment to another.  Questions of legacy and history limit a markets ability to embrace the new and retire the old.

We could shift the conversation and focus on the store of funds: be it the safe in the wall, the checking or savings account at an institutions or digital coins stored in digital memory.  We could talk about the entities that focus on the experience and employ the already existing mechanisms.  We could think about block chain, crypto currency, identity and authentication.

Does the consumer care? or would we be pleased to simply hear the merchant say thank you for your payment.   The frictionless experience of get out of an Uber car or when we click the buy button on Amazon we know the payment will be made and that we will see a receipt in our email.  Remove the friction and make sure that only what I owe is paid, that is the experience we seek.  We the consumer are not interested in the detail.  We just want to know we successfully paid, using the source of funds we set up as our default.

In Conclusion

Yesterday, with this blog incomplete, I listened to  The Economist article titled Rousseau, Marx and Nietzsche – The prophets of illiberal progress – Terrible things have been done in their name.  What grabbed my attention is that it spoke to the depth of my wider concerns.  The article concludes with the following:

The path from illiberal progress to terror is easy to plot. Debate about how to improve the world loses its purpose—because of Marx’s certitude about progress, Rousseau’s pessimism or Nietzsche’s subjectivity. Power accretes—explicitly to economic classes in the thought of Marx and the übermenschen in Nietzsche, and through the subversive manipulation of the general will in Rousseau. And accreted power tramples over the dignity of the individual—because that is what power does.

As I think of our capitalist environment, I am concerned and wonder if the publication of the Economist article is  timed to educate and alarm.  The reality is we are experiencing a concentration of power leading to an increase in the distance between those in the upper 1% and those we call the middle class.  Therefore, there is a need to about what is good for the whole, yes a tiny bit of socialism, to restore balance to make sure the wealth and benefits accrue to all and not just the few.

As identification, authentication and payment systems, discussed above, evolves we need to think about the structure of how these solutions will be offered to the market.  Are we seeking to address a social issue like crime or terrorism? Are we seeking to improve confidence?  Are we attempting to focus on the consumer, citizen and employee needs?  Or, is it all about shareholder value and the search for profit?

Like in the article discusses, my fear is Profit will create confusion and complexity.  Not more convenient and frictionless experiences.

Ten steps to making a project successful

Wednesday September 5th, 2018 I had the opportunity to speak to a Information Technology class about my ten successes and learning as a project and program manager.  Below is the presentation I used with this I hope interested room full of student of Kennesaw State University.

Project Management Kennesaw 180905

 

 

From Nothing is there Something

Recently I was reading a blog and ran into an interesting statement

“In the beginning, there was nothing, and there was something.”

The blog goes on to talk about the binary construct or what we know as the world of computers.  Three basic concepts are the foundation of all that a computer can do:

The most basic logic functions are the NOT, AND and OR gates.

IF something is FALSE, then it is NOT TRUE.
IF some OR another value is TRUE, the result is TRUE.
IF some AND another value is TRUE, the result is TRUE.

I immediately reflected back on a course in the Apologetics and remember the lecturer speaking the idea that SOMETHING cannot come from NOTHING.  Somewhere between these two discussions is a rift.  In that simple statement “In the Beginning” we immediately are drawn to think of the BEGINNING and the unimaginable be it “The Almighty” – “The Creator” – “God”.  For the apologetic his argument is that something, our universe cannot emerge from the nothingness of nothing.  There was something before call it the creator.  Like the Big Bang what was before it? a previous universe that had collapsed into a Black hole.

We then think about Binary logic.  It is built on the idea there is either nothing A Zero or there is Something A One.

There is something inherently missing from this

 

 

NYTimes: Transaction Costs and Tethers: Why I’m a Crypto Skeptic

Transaction Costs and Tethers: Why I’m a Crypto Skeptic https://nyti.ms/2NYYSdw

As a technologist with an understanding of cryptography and very aware that in order to remain secure and tamper proof we increasingly increase the complexity of the work to assure the integrity of what we are using cryptography to protect. I wonder why so many people got so excited about Bit coin and Blockchain. As I have written before the cost to assure the integrity of the ledgar. Be it the original work to calculate the nonce or the subsequent work to confirm that the nonce the miner calculated was the right one, there is a need to spend money buying work specific computers, renting or building a facility to houses these work units and the power to cool and run these computers.

Mr. Krugman properly outlines the challenges. He effectively focuses on two issues. The cost and the idea of tethering.

It is this need to identify the value of the coin. Governments help to stabilize their defined currency. The intrinsic value or use of Gold, establishes its value.

Understanding and being able to clearly articulate how cryptocurrencies are valued and how then can achieve the stability necessary to support commerce is essential. This is what tethering is about. How do we establish and more importantly share the nature of the valuation.

An Identifier is not an Authenticator

Not too long ago, the House Ways and Means committee learned about and understood the difference between Identifiers (such as the PAN SSN, Driver License number, Email, User name, or account number) and an Authenticator.

A recent document produced by the Identity Coalition speaks to the challenge of identity. Found on their website https://www.betteridentity.org/

One paragraph reads

As a general rule, to be useful across multiple systems a widely used identifier must be persistent, meaning that it stays constant over time. The complexities induced by shifting an identifier to one that is not  persistent – but revocable – are significant.

This is a pivotal thought and one we should embed in our thinking.

This report starts with a discussion about who can play a role and who has established coherent verification and proofing mechanisms that can be used as a root of trust.  The Social Security number, given its pervasive place among the data stored about us, became an area of focus:

There are five steps that the government should take to change – and improve – the way we treat the SSN.

  1. Frame every proposal about the future of the SSN on the basis of whether it looks to impact the use of the SSN as an authenticator, an identifier, or both.
  2. Stop using the SSN as an authenticator. Use of the SSN as an authenticator rests on the idea that the SSN is a “secret” – and that knowledge of an SSN can thus be used to prove that someone is who they claim to be.
  3. Preserve use of the SSN as an identifier – but look to reduce its use wherever feasible.
  4. Consider changing laws and regulations that require companies to collect and retain SSN.
  5. The government should not seek to replace the SSN.

As I read through these choices, I replace the acronym SSN with PAN or any other identifier and I end up with the same concern.  We have allowed identifiers to become authenticators and now struggle to replace them with something else (i.e., a token).  When what we should have done is recognized that authentication was the missing element of the identity puzzle.

The report then continues with a set of recommendations including two areas of personal interest.

Strong Authentication Equals Multi-Factor Authentication

Promote and prioritize the use of strong authentication. Inherent in any policy change that prohibits use of the SSN as an authenticator is a way to replace it with something better. Here, the problem is not just with SSNs, but also with passwords and other “shared secrets” that are easily compromised by adversaries.

…

Multi-stakeholder efforts like the Fast Identity Online (FIDO) Alliance, the World Wide Web Consortium (W3C), and the GSMA have developed standards for next-generation authentication that are now being embedded in most devices, operating systems and browsers, in a way that enhances security, privacy and user experience.

International Coordination and Harmonization.

This one has particular meaning to me.  My family lives in two countries, we are citizens of a third and we have lived in four.  I want to be assured that whatever the process is to authenticate our identities in one will meet the basic requirements of all.

An interesting read and one I strongly recommend we work to promote.

 

Could a US Cryptocurrency Prevent Systemic Harm to the Underbanked and Underserved?

I recently absorbed the following article  and offer the following reflections.

Frankly, it disturbed my social consciousness.

http://paymentsjournal.com/there-are-an-estimated-how-many-million-smartphones-in-the-hands-of-us-consumers/

An article answering the question can now be found at this link.
http://paymentsjournal.com/could-a-us-cryptocurrency-prevent-systemic-harm-to-the-underbanked-and-underserved/

After reading the article, I thought about this graph derived from the US Census.  What income level equates to that of the un-banked?  I think of my expenses and about the expenses most people are dealing with.  Health issuance for two people in Georgia is $1,100 a month.  That’s a lot of people struggling to make sure they at least have health insurance!  If $53,700 is the median income and $13 thousand is spent on health Insurance, and then we consider all the other daily expenses we need to live: food, medicine, co-pay, gas, utilities …

Then I remember an economics report which claimed that the hourly wage required to afford a place to live in the least expensive part of the US was something just over $15/hour.  All of this causes me to ask the question – At what income do people find it of value to have a banking relationship, e.g. a card?

Those who argue that we should migrate from Cash to Card should remember the primary motivation for credit cards is directly related to the profits and revenue the banks, processors and other players who touch the flow of money earn from processing the payment transaction, and the revenues earned by lending money (i.e., a credit card) or by holding your money (a debit card).

Sure, we could propose giving the poor pre-paid cards, as some of the Government’s entitlement programs already do.  But then who will be responsible for the fees to manage the program and who will earn the interchange from each transaction?

The service fees, OK, maybe we the taxpayer will cover, given the perceived social value of supporting the poor.  On the other hand, entitlement is perceived by many to be a scheme to support the lazy, therefore many would say that the fees are part of what the entitlement should cover.

Let’s get back to the real subject at hand:  What is the most economic form of payment and are crypto-currencies the future?

In the world of cards, interchange is a cost to the merchant and revenue to the Banks.  Therefore, since merchants end up loading their processing costs into their price, the consumer pays.  Those who advocate migration away from cash recognize and argue cash has costs, for intance:

  • Cost of Employee pilferage
  • Cost to store and carry to the bank
  • Cost to handle and count

Many would agree that a card is cheaper.  Others would argue they are not.  This becomes a question of faith in your employees, the cost of a safe and a visit to the bank and the fun of sitting up at night counting your earnings.

Are crypto-currencies an answer?  At whose cost?  The nodes or miners who maintain the Blockchain need to be paid to ensure the immutability and consensus inherent in the Bitcoin model.  Someone must pay.

This begs the question: Which is more expensive to society?

  • Cards
  • Crypto-currencies
  • Checks
  • Cash
  • Coins
  • Certificates – in other words, tokens

 

 

Could a US Cryptocurrency Prevent Systemic Harm to the Underbanked and Underserved?

cryptocurrencies

A toll on the Massachusetts turnpike is $4.00, unless you can’t afford an EZPass then it will cost you $7.35*.  This article published in Convenience, the web site of National Association of Convenience Stores (NACS), points out that restaurants are also increasingly eliminating cash and that the impact this has on the poor has finally started to create some pushback in D.C.:

“As more restaurants go cashless, a backlash is building, especially in the nation’s capital, where an increasing number of fast-casual eateries are only accepting credit or debit cards and mobile payments, the Washington Post reports. Sweetgreen, a national chain, doesn’t accept cash at most locations, including its Washington, D.C., unit, while Menchie’s, Barcelona Wine Bar, The Bruery, Jetties and Surfside in the District also refuse cash payments.

‘By denying the ability to use cash as a payment, businesses are effectively telling lower income and younger patrons that they are not welcome,’ said D.C. Council member David Grosso, who has introduced a bill that would require retailers to let customers pay in cash. Chicago didn’t pass a similar bill last year, and Massachusetts has a 1978 law on the books that’s for cash payments but it hasn’t been enforced regularly, according to the state retailers association.” (Emphasis by Payments Journal)

I was unaware of the 1978 Massachusetts law described here, but clearly MassDOT and the Massachusetts legislature are more interested in how it will spend the money saved and the new revenue generated than it is in old laws. The fact that the policy to go all electronic will also increase late payment fines from the poor, perhaps even putting some in jail for non-payment, is just icing on the cake.

In our rush to save money we have ignored the systemic biases this action creates against the poor (if you doubt this statement reread the Justice Department’s report on Ferguson Missouri and how the town’s cost cutting measures created that very same bias). My dollar bill states that “THIS NOTE IS LEGAL TENDER FOR ALL DEBTS, PUBLIC AND PRIVATE” and yet nobody is considering how this is becoming less true every day and the impact that reality will have and it isn’t just the poor.

It is ludicrous to think that paper currency can survive even as everything around us shifts to electronic bits that are controlled by software. But we mustn’t ignore the ramifications of this shift. Consider what the future would be like if all payments are electronic utilizing our existing payments infrastructure. It is likely the cost burden would move from the Federal government (that prints money) to all the entities that need to send or accept money (because they pay the network and processing fees). In this scenario a) the government will see significant savings, b) the entities making a payment will see increased costs, and c) payment networks will receive increased revenue and profits.

If we would prefer to keep the status quo then the Federal government should support an electronic form of tender, establishing a cryptocurrency that replaces paper but is also recognized as “LEGAL TENDER FOR ALL DEBTS, PUBLIC AND PRIVATE”.

If not done relatively soon, say in the next 5-8 years, then every state and private payment network will be so entrenched that it would likely prove too difficult and costly to switch.

* The difference described above is for anyone driving 113 miles between Natick and West Stockbridge according to MassDOT’s toll calculator

The case for Identification and Authentication

As we continue to explore the case for Identification and Authentication I share the below article.

What is becoming clear is standards are being embraced.

In the Payment space

Will it be W3C WebAuthN, 3DC and Webpayments or EMVCo SRC & Tokenization?

My guess depends on if standards bodies can play well together. EMV (contact or contactless) will remain the many stay for physical world commerce, until the App takes over the Omni Channel shopping experience. then the merchant will properly authenticate their loyal customer and use card on file scenarios for payments. The question of interchange rates for CNP will see a new rate for “Cardholder Present&Authenticated/ Card Not Present.”. In time when a reader is present I can see an out of band “tap to pay” scenario emerging using WebPayments and WebAuthN.

In the identity space

I contend the government and enterprise market will go for a pure identification solution with the biometric matched, in the cloud, in a large central database. In order to maintain a unique and secure cloud identity, they might probably make use of various opportunities that come their way (you can hover over at this website to learn more).

However, does that mean it includes what you know username, email address or phone number? Maybe! If it is simply the captured image or behavior, then it is a 1 to many match. If it is with an identifier, it is classic authentication with a one-to-one match.

In the pure authentication space where the relying party simply wants to know it is the person they registered. Then, the classic FIDO solutions work perfectly and will be embedded into most of our devices. Additionally, the use of a visitor sign in sheet synced with the security database could expedite the sign-ins of visitors. It could also see its applications with employee log authentication and verification. Or, as we’ve seen with some enterprises, the relying party will embrace U2F with be a FIDO Key, like what Yubico and Google recommend.

The classic process needs to be thought about in respect to what can be monetized.

  • Enrollment = I would like to become a client or member
  • Proofing = Ok you are who and what you claim, we have checked with many to confirm your Identity – This is where federation comes in.
  • Registration – Verification = Ok, now we confirm it is you registering your device(s)
  • Authorization & Authentication = Transaction with multiple FIDO enabled relying parties using your duly registered authentication.

How Microsoft 365 Security integrates with the broader security ecosystem-part 1

by toddvanderark on July 17, 2018

Today’s post was coauthored by Debraj Ghosh, Senior Product Marketing Manager, and Diana Kelley, Cybersecurity Field CTO.

This week is the annual Microsoft Inspire conference, where Microsoft directly engages with industry partners. Last year at Inspire, we announced Microsoft 365, providing a solution that enables our partners to help customers drive digital transformation. One of the most important capabilities of Microsoft 365 is securing the modern workplace from the constantly evolving cyberthreat landscape. Microsoft 365 includes information protection, threat protection, identity and access management, and security managementproviding in-depth and holistic security.

Across our Azure, Office 365, and Windows platforms, Microsoft offers a rich set of security tools for the modern workplace. However, the growth and diversity of technological platforms means customers will leverage solutions extending beyond the Microsoft ecosystem of services. While Microsoft 365 Security offers complete coverage for all Microsoft solutions, our customers have asked:

  1. What is Microsofts strategy for integrating into the broader security community?
  2. What services does Microsoft offer to help protect assets extending beyond the Microsoft ecosystem?
  3. Are there real-world examples of Microsoft providing enterprise security for workloads outside of the Microsoft ecosystem and is the integration seamless?

In this series of blogs, well address these topics, beginning with Microsofts strategy for integrating into the broader security ecosystem. Our integration strategy begins with partnerships spanning globally with industry peers, industry alliances, law enforcement, and governments.

Industry peers

Cyberattacks on businesses and governments continue to escalate and our customers must respond more quickly and aggressively to help ensure safety of their data. For many organizations, this means deploying multiple security solutions, which are more effective through seamless information sharing and working jointly as a cohesive solution. To this end, we established the Microsoft Intelligent Security Association. Members of the association work with Microsoft to help ensure solutions have access to more security signals from more sourcesand enhanced from shared threat intelligencehelping customers detect and respond to threats faster.

Figure 1 shows current members of the Microsoft Intelligent Security Association whose solutions complement Microsoft 365 Securitystrengthening the services offered to customers:

Figure 1. Microsoft Intelligent Security Association member organizations.

Industry alliances

Industry alliances are critical for developing guidelines, best practices, and creating a standardization of security requirements. For example, the Fast Identity Online (FIDO) Alliance, helps ensure organizations can provide protection on-premises and in web properties for secure authentication and mobile user credentials. Microsoft is a FIDO board member. Securing identities is a critical part of todays security. FIDO intends to help ensure all who use day-to-day web or on-premises services are provided a standard and exceptional experience for securing their identity.

Microsoft exemplifies a great sign-in experience with Windows Hello, leveraging facial recognition, PIN codes, and fingerprint technologies to power secure authentication for every service and application. FIDO believes the experience is more important than the technology, and Windows Hello is a great experience for everyone as it maintains a secure user sign-in. FIDO is just one example of how Microsoft is taking a leadership position in the security community.

Figure 2 shows FIDOs board member organizations:

Figure 2. FIDO Alliance Board member organizations.

Law enforcement and governments

To help support law enforcement and governments, Microsoft has developed the Digital Crimes Unit (DCU), focused on:

  • Tech support fraud
  • Online Chile exploitation
  • Cloud crime and malware
  • Global strategic enforcement
  • Nation-state actors

The DCU is an international team of attorneys, investigators, data scientists, engineers, analysts, and business professionals working together to transform the fight against cybercrime. Part of the DCU is the Cyber Defense Operations Center, where Microsoft monitors the global threat landscape, staying vigilant to the latest threats.

Figure 3 shows the DCU operations Center:

Figure 3. Microsoft Cyber Defense Operations Center.

Digging deeper

In part 2 of our series, well showcase Microsoft services that enable customers to protect assets and workloads extending beyond the Microsoft ecosystem. Meanwhile, learn more about the depth and breadth of Microsoft 365 Security and start trials of our advanced solutions, which include:

Naturally I assumed you had stolen the car

A man is being tailgated by a stressed-out woman on a busy boulevard.  Suddenly, the light turns yellow, just in front of him.  He does the honest thing, and stops at the crosswalk, even though he could have beaten the red light by accelerating through the intersection.   The tailgating woman hits the roof, and the horn, screaming in frustration as she misses her chance to get through the intersection with him. As she is still in mid-rant, she hears a tap on her window and looks up into the face of a very serious police officer.  The officer orders her to exit her car with her hands up.

He takes her to the police station where she is searched, fingerprinted, photographed, and placed in a cell.

After a couple of hours, a policeman approaches the cell and opens the door. She is escorted back to the booking desk where the arresting officer is waiting with her personal effects.

He says, “I’m very sorry for this mistake.  You see, I pulled up behind your car while you were blowing your horn, flipping the guy off in front of you, and cussing a blue streak at him. ”

“I noticed the “Choose Life” license plate holder,
the “What Would Jesus  Do” bumper sticker,
the “Follow Me to Sunday School” bumper sticker,
the chrome plated Christian fish emblem on the trunk. “

“Naturally I assumed you had stolen the car”.

Something to wonder about

What You Have

The Two Sided Market

When we think of investing in various macro business needs e.g. revenue. We see that establishing relationships with customers to stimulate sales is why we create the goods and services, hopefully, others want.

If the buyer has something the seller wants, in exchange for the good or service they desire, then a transaction occurs. The challenge is simple, each party defines the value of what they are providing or exchanging and presto the trade occurs.

When society grows and the complexity of what each of us produces and when our needs are not aligned to this process called barter, a means of monetization is established. Society creates a trusted form of exchange – pebbles, coins, money, a promissory note or now even cyptocurrencies.

In other words, society creates an answer to enable the exchange of goods and services between parties who do not have goods and services the other party seeks in exchange.

With cash, coins or other trangible representations of value, commerce is easy. When we complicate things and worry about carrying cash and seek to buy things with debt. A need for a Network emerges.

These payment networks, by necessity, add complexity. They create the need to establish two sides to the market, one focused on the relationship with the buyer and the other with the seller.

Issuance and Acceptance. Two words to descibe the two sides of a network. It’s only when the two sides of the market have sufficient participants. Only at the tipping point, enough critical mass exists, to create a self sustaining network. This is the network. At this moment the network blossoms. If either side of the market does not achieve critical mass, the network collapses.

Any two entities familiar and trusting in the Brand, or each other, can easily establish a temporary relationship. Adding anonymity to the requirements, increases the leave of trust and recognition the Brand must establish.

In a digital environment we have to define mechanisms to share and establish trust across trillions of electrons. The two sides will not pursue understanding of nor focus on security. Until the risk exceeds a threshold unique to each party on either side of the market.

To often in the past, the idea of the individuality of the individual or the need to design security in from the beginning. Has left us with a legacy of system all needing design of custom approaches to how to integrate security with requisites necessary to capture, calculate and manage risk.

The Artifact of Trust

When a mutually trusted set of parties gives the citizen, consumer, employee or courtier a card, a device or an object and provides every acceptor with a reader capable of recognizing the trusted thing; then the two parties are in a position to establish “trust”. The consumer has a thing which is recognized and trusted by the acceptor. This is often referred to as “What You Have”.

Once the thing is recognized by the acceptor, then, the process of identification and authorizations (the transaction) can take place. The object – the artifact – carries an identifier. It possesses characteristics that establish its unique character. The object also posesses a means of assuring the acceptor the presentation of that identifier repreents a unique entity.

The simplest artifact of establishing “trust” is a hand held thing, be it a key, fob, card, watch, pendant, phone, ear piece. It does not matter what it is, all that counts is that the merchant recognizes it and that the consumer is willing to carry and present it.

Trust, for the merchant, means they can, according to the rules, recognize and authenticate the thing. They are then in a possition to pursue a temporary and trusted relationship. What can be achieved during the time the relationship of trusted is bounded, is the constrained by an additional layer. In this layer the consumer, the acceptor and any third parties address which the rights and privileges are to be granted or pursued. This is when the exchange, sale, conversation, tranaction, event or access is granted.

Two sides meet several common mediums of exchange are available.

[contact-form][contact-field label=”Name” type=”name” required=”true” /][contact-field label=”Email” type=”email” required=”true” /][contact-field label=”Website” type=”url” /][contact-field label=”Message” type=”textarea” /][/contact-form]

Legacy the American disease

When we look at what this market have done my own journey parrallels.

The adoption of something new it is a human process influenced by culture.

1976 first programming job and exposure to OCR and timeshare

1978 cash management, electronic money transfer, ACH & Wire

1982 Digital, video and voice integration.

What happened to Marginal Satisfaction?

1986 fiber across the Atlantic

The wall

1994 Stir EMV, drive WWW payments, cryptography, MFA

1996 Convergence of leather and technology

2001

2003 EMV in Canada

2008 Lehman went bankrupt

2015 US EMV Liability Shift

2018 WebauthN Web payments Web of things

Now we think next. What next?

Digital Identity

Question for all those who advocate migration from card to electronic

We all are aware and many of us dream of a time when all of our physical identity artifacts are digital. We dream of consolidating these credentials in our electronic wallet, otherwise known as our mobile phone.

Today while visiting an outpatient imaging center, I was asked for my driver’s license. She would only accept the physical document, I offered to send an image by email. Her goal to scan my identity document into the electronic patient file she was creating. The idea of an image of the driver’s license in an email, well.

Sure the system could easily be changed to record digital credentials delivered by NFC or BLE. The first question, given the expensive medical system we have here in America; at whose cost?

Time could not be argued as a saving, she would only have saved a second or three of time to pass the card back to me.

People discuss contactless cards and contrast them to the convenience of a Mobile Wallet. What we often forget is the reality. As long as we need to carry other physical identity artifacts, the convergence of our leather wallet into our electronic device is not happening.

In my humble opinion, it is an all or nothing situation. Yes, I will add digital credentials into the mobile wallet. But, unfortunately, the leather wallet is still part of my attire.

Better still, it does not need to be recharged. My leather wallet still works after the phone’s battery has died.

Sunday Sermon July 8

Ashley stood before us.

The life of a small town, 2000 plus the 1500 students attending the University 9 months of the year, sets a scene for a conversation.
A conversation about community and who we are.

Do those that knew us then, know us now?
The issue of going back is hard.
There is clearly a difference between those that have roots and those like me without.
Who, save family, do I still know from then?
Who knows me, where?

The story of Jesus Mark 6:1-6 as he emerges and his mission becomes clear this passage reminds us.
When he went home he was ridiculed by many,
People who had known him then did not appreciating who he had become.

The story teaches us that we simply need to  stand up and go forth.
As he did we simply must continue forward.
The power of Jesus, therefore what each of us must do, is exemplified in the next section mark 6-7-12.
He simply instructs his disciples out to go out into the world and share in the glory of God.

Do we fit in a box because others think so?
Or, do we like Jesus simply continue in the direction?

Constantly moving forward?

We all belong, yet where is it we belong?

Who is God calling us to be?
Is it who we know we are?
No, it is who we are here to be.
Who is God calling each of us to be?
Who is God calling me to be?

It is the discernment I struggle with.

Who Am I

Letter to the American President

President Donald John Trump
White House
1600 Pennsylvania Avenue
Washington, DC 20500
United States of America

July 6, 2018 Ref. Mine thoughts and Those of My Canadian Friend

Dear Mr. President, Tuesday, June 19, 2018

Mr. President as an American who had the opportunity to work in five states (NYC, NJ, Georgia, MN, & NC), four countries (USA, UK, Belgium and Canada), two super cities & three major cities (Manhattan, London, Brussels, Toronto and Atlanta); I have had the chance to see and hear about our great country from multiple angles and perspectives.

August of 2008, after 23 years away, I returned home, after spending 7 years in Toronto; in a 35-foot motor home. Parked across the river from the town of my birth, near Liberty State Park and with the Statue of Liberty as my morning view. I learned about and had to accept the misfortunate of the recession. A recession resulting from the creation of those mortgage backed derivatives. Compounded by the devious behavior and the greed of the speculators, I brand “Wall Street”.

I will remember September 15th 2008, the day Dick Fuld, who I had worked with while with Shearson Lehman, made that fateful announcement. Newly returned to the United States, I had to learn about what 8 years of Republican control of the Executive branch of our country had achieved, what the heightened religious fault lines across this country were and the anxiety of the terror emanating from the middle east had done to this nation. Like 9/11, we were swept into another spiral of despair and anger.

We have been a great nation; for most of my life, we were seen as the great white hope. A country willing to stand up to tyrants, bullies, jihadists and anarchists. A great nation capable of reaching any part of the world. Strength built on the military and diplomatic respect we established with both our enemies and most importantly our allies and friends. I will admit I am an urban dweller. I have lived a good life. I found success in the world of Financial Services and the application of technology. I do not appreciate the struggle those in the manufacturing and agricultural economy feel.

Words like labor arbitrate, outshore resources and outsourcing are familiar. What stands behind these words has much to do with the state of our nation and the situation in most of the developed world. It is the result of these actions so many people in middle America feel left behind.

In 1982, when I first began to build a Wall Street trading room for Bankers Trust, I saw how Shareholder value not Stakeholder value, had become the most important factor within our capitalistic system.

People, be they customers or employees, no longer mattered. What I learned and frankly was disheartened by is that the only thing that matters anymore is the returns, as seen from the superrich executives, the shareholders’ and the financial analysts’ perspective. We had become a nation focused on the balance sheet and the quarterly report.

Yes, I have my views and recommendation as to the state of this nation and what we need to do to make sure we remain the great nation we live and believe in.

If I think about the economy. We do not need to bring the manufacturing or restart coal mining. We need to embrace the fact that our nations wealth is now in our service economy. A national of American healthcare works taking care of the sick and wounded, American call center operators serving Americans, American programmers developing systems for our digital world, American innovators creating for all and American business leaders is what we need. Yes, we need to rebuild our infrastructure and address public transportation. Yes, since 2010 our economy is growing, I hope we can sustain that growth and assure the people good wages, good jobs and a bright future.

If I think about healthcare. I felt the most exposed when I returned to the USA and discovered I did not have healthcare. I was unemployed and did not have the funds to simply go out and buy an individual healthcare plan. Healthcare was a big topic on the news as Washington worked through what ended up being a terrible mess of a healthcare plan. In my immediately family there are 5 Doctors. four practicing and one just finishing med school. As you can imagine it has been a topic of conversation since I was very young. Now the conversation is about how broken our system is. I take the view of someone who has lived within multiple national health programs. It bothers me that this great nation cannot figure out how to assure the health of every American, affordably.

If I think about education. We as a nation should make sure that every person living in this country is WELL EDUCATED. There should be no excuses. There should be no bias. Property taxes tend to pay for primary schools. It is primary education we must make the best in the world. Unfortunately, the way our system works the poor get poor schools – the rich have great schools. We need to figure out how to assure everyone an equal chance with a GREAT PRIMARY EDUCATION. Your idea of apprentice programs is exactly what our primary education system should assure exist. Everyone should be able to walk into the world with a set of skills at age 18. Graduating from primary school everyone should be able to go our and find a job, join an apprentice program, join the military or decide to invest in higher education. A college degree should not be required to succeed. A University education should be there to allow those who are gifted the ability to excel.

If we think about the environment. Please listen to the majority of scientist who know we are affecting the environment. It is the pollution we create and the materials we inject into our environment that is responsible for the state of our environment. We the people and our corporations are responsible for all the islands of floating plastic, all the Carbon, Sulphur or who knows what we inject into the atmosphere and all those chemicals we pour into our rivers and oceans. We must continue the good work, you and I saw, when we cleaned up the rivers around Manhattan. Environmental work making it possible to breath the air in central park, swim in the Hudson river or taking a cruise from the East 23rd street mooring, you used all those years ago.

If we think about our military and our role as the defender of peace. We need a strong and well-funded military. Not too much and not too little. We need to make sure we have strong alliances. Frankly, Mr. President, I would hope we would discourage other country form investing in military hardware. Our goal should be to have the best. Our goal should be to watch and gain as the cost of maintaining the peace and avoiding war and conflict falls to zero.

If we think of our role as a global leader. What more is there to say. We need to be diplomatic. We need to pursue the growth of democratic societies. We need to focus on quelling violence and protecting human rights. We need to be the partner everyone wants to have on their side and the enemy those who seek to do us harm; do not want to enter into a conflict with the United States of America, because they know they will lose, before they start.

If we think about the Statue of Liberty. She stands proud in the harbor of New York beaconing people to our shores. Yes, we need to manage the flow of immigrates into this great nation. We must remember those that come seek the opportunity this nation promotes. We need to accept all with kindness, grace and dignity. When necessary only then should we return those, who have not followed the published policy, back from where they came, gently.

We must also remember they come because they know they can find work. As long as employers can hire people who do not have the right to work in this nation they will come. Stop American companies from hiring illegal immigrants and they will stop coming. Simple economics – reduce the demand will eliminate the supply.

If we think of our nation and its people. You must lead by example. You are the President of all of us. Whatever our color, race, religious views, social position, economic situation or sexual preferences you are the President and you must be an example for our children and our nation.

We do not want our children to believe lying is OK. We do not want our children to believe bullying is ok. We do not want our children to shun someone because they are different. It is your role to bring the parties together, to lead the left and the right back to the middle ground and restore civil discourse.

On these next pages is the note my Canadian friend wrote.

Given you are into social media I will also post this via Twitter, Facebook and on my own website.

Yours sincerely,

Philip Andreae

Dear Mr. President:

I am writing you as an outsider, someone who has always loved your country for the values it represents and has fought for.

I was going to write you to express my appreciation for your efforts to dial down the risk of nuclear war by meeting with Kim Jong-Un and initiating a peace process which should make life less stressful for our Asian neighbours as well as for us here in North America.

But the euphoria didn’t last long, only because of the children. The ones separated from their parents at the US/Mexico border. You see them on either the front pages of the major newspapers or on the various media outlets and you know, this is not going away.

Children are ever the fly in the ointment which disturb our individual and collective conscience. Riding in the back seat of a car downtown on any New York or Toronto street and they are the ones asking, ‘Why is that man sleeping on the sidewalk?’ or ‘See that military vet begging in front of Dunkin Donuts? Is that the way we treat our soldiers?’

The children are invariably the ones who ask how did we let our world become so uncaring that we confine the elderly to institutions where nobody visits them, or send our street youths to jail when they had no opportunity to succeed?

And now they are congregating at the border asking ‘why are we being separated from our parents?’ ‘Is that how America treats its most vulnerable people?” ‘Isn’t this the land of the free, the land of opportunity, the land who has inscribed on its Statue of Liberty:

“Keep, ancient lands, your storied pomp!” cries she

With silent lips. “Give me your tired, your poor,

Your huddled masses yearning to breathe free,

The wretched refuse of your teeming shore.

Send these, the homeless, tempest-lost to me,

I lift my lamp beside the golden door!”

However, it has occurred that there are now over 2000 children separated from their parents along your southern border, you are the one person who can fix this. It doesn’t mean you have to allow them all in – which would be my preference – or decide to send them all back home.

That’s not the issue. The issue here is the trauma your administration and by extension, all freedom loving grown-ups, are foisting on innocent children for which there are lifelong implications.

That is the issue which you alone can change.

Unzero the Zero in Attorney General Session’s Tolerance Policy, so the one thing that isn’t being tolerated is the confinement of children in cages and gymnasiums separated from the people who love them and who have risked everything, in the hope of a better life here.

Again, whoever is to be blamed for things ending up the way they are now is not the issue. The issue is – what is happening now is wrong, and you are the one person who can make it right.

I know as someone who relies on Christians of sincere conviction to help shape the bigger decisions one has to make in life, the one thing devout Christians all agree on is that God so loved the world, not that we would put our children in cages, but love them in such a way that regardless of who they are or where they are from, our treatment and care for them would reflect God’s thinking about them, that ’theirs in the kingdom of God.’

I can assure you, that kingdom does not include a cage. Nor should ours.

Thanks for hearing me out on this.

Sincerely,

John Deacon

Authentication or Identification

Two words Authentication and Identification.

Reading what Wikipedia had to say about authentication leads to an interesting array of discussions across a wide set of sciences and other social segments. The exploration led to a search for a definition of Identification:

  • The act of identifying, or proving to be the same.
  • The state of being identified.
  • A particular instance of identifying something.
  • A document or documents serving as evidence of a person’s identity.

Next exploring what Wikipedia had to say about Authentication leads to a much richer discussion aligned around the idea of assuring the truth of a particular attribute, someone is claiming to be true. Seeking to assure a degree of parallelism to the discussion:

Authentication is

  • something which validates or confirms the authenticity of something
  • computing proof of the identity of a userlogging on to some network

These two words: authentication and identification, some think represent the same act, yet when we bring into the conversation – privacy the two words have very different meanings.

We then have to think about the how and the what we are attempting to do.

In the physical world there are a set of situations and considerations. We will leave those for another article.

When we think about the digital world, this place were our physical presence is not present. We must find solutions that prove we are who we are without necessary needing another to vouch for our identity each time.

As a consumer we want the freedom to visit multiple sites and believe that where we visit and who we interact with is not open to all to know.

As I write, I can hear some say, all our stuff is known so why try to hide. They are correct and then they miss the concern – who knows. Not to get distracted.

Verification, a third word must enter into the discussion. In order for anything associated with only serving or sharing with a clear and identified party one needs to be able to provide Identity.

Trust – the truth of our identity

Such a big word.

This Sunday our minister spoke of Mark 5:20-43 and how we must trust in Jesus.

Her evocative sermon provoked a wider or is it broader question,

“What is Trust”.

First we must ask the classic question what does the Dictionary and Wikipedia say. This then leads us to have to think of the use of the term. Are we using it to describe a legal structure, the nature of a business, a computational concept or the name of a film, song or other human creation?

Given this discussion started as a result of a sermon, the best approach is to consider the social and emotion context of trust. Understand the sociology, psychology, philosophy, economics and systems perspective, may offer clarity to the words “we trust … “. In the first paragraph the Wikipedia authors condensed a lot of thought into a short paragraph. {formatting of my doing}.

Definitions of trust typically refer to a situation characterized by the following aspects:

  • One party is willing to rely on the actions of another party (trustee); the situation is directed to the future.
  • In addition, the abandons control over the actions performed by the trustee.
  • As a consequence, the is uncertain about the outcome of the other’s actions; they can only develop and evaluate expectations.
  • The uncertainty involves the risk of failure or harm to the trustor if the trustee will not behave as desired.

In this flow of thought it is clear this word trust carries with it risk. It assumes we are thinking of tomorrow and there is an expectation the trustee will act in a manner that is consistent with our “the trustors” wishes, hopes and desires.

Vladimir Ilych Lenin expressed this idea with the sentence “Trust is good, control is better”.

In the field I have spent the better part of my life, computers have played a big part. Be it as a tool we programmed to perform a function or task. Or, the systems supporting the products and services we sought to promote. More recently, as we look to this global village we are a member of. We think about the need to establish mechanisms to assure trust between parties. Parties who probably will never meet, in person or even by chance speak to. We must therefore establish acceptable social and psychological mechanism with machines which we inherently are wary of.

Looking to the sociology of trust set of sentences stands out

“It does not exist outside of our vision of the other. This image can be real or imaginary, but it is this one which permits the creation of the Trust.” … “Because of it, trust acts as a reductor of social complexity, allowing for actions that are otherwise too complex to be considered (or even impossible to consider at all); specifically for cooperation.”

All of this leads one to wonder how in a anonymous world can trust be established.

Trust is specifically valuable if the trustee is much more powerful than the trustor, yet the trustor is under social obligation to support the trustee.

In a social context this thought offers a view as to the dominance a position the trustee must have in society. It also frames the responsibility and the obligation established by the trustor in the trustee.

This then leads one think about Multi-Factor Authentication. MFA is emerging as the standard method companies are used to assure one of degree of “trust”. Trust in a claim of the identity of another, be it a customer, employee, citizen or recognized guest.

Is this enough? How can a company be assured of the identity of an individual? How can we, a third party, accept the claims or attributes offers when they are presenting themselves to us. Especially when they present themselves across a global digital highway, prone to the nefarious acts of those who seek to take advantage and profit.

Proof of identity therefore becomes the primary means of establishing trust in an seemingly anonymous space – Cyber Space. This need for proof of identity is the role of the Trustee. These parties who we instinctively have faith in can give us the ability to trust in the claims of identity and the associated attributes representing the characteristics, assets and relationships a person has.

For now I will stop. The next step is to think of and look at words. enrollment, proof, identification,registration, identifier, authentication, rights, privileges, claims, certificates and authority.

What Explains U.S. Mass Shootings?

In a NYTIMES article “What Explains U.S. Mass Shootings? International Comparisons Suggest an Answer” the following statistic jumped out

Americans make up about 4.4 percent of the global population but own 42 percent of the world’s guns. From 1966 to 2012, 31 percent of the gunmen in mass shootings worldwide were American, according to a 2015 study by Adam Lankford, a professor at the University of Alabama.

The article then goes on to show that most of the assumed contributor to why America has such a high rate of mass shooting. after demonstrating how none of these can be identifed as the contributor it makes th following statement

Rather, they found, in data that has since been repeatedly confirmed, that American crime is simply more lethal. A New Yorker is just as likely to be robbed as a Londoner, for instance, but the New Yorker is 54 times more likely to be killed in the process.

Our love of guns seems to be the major contributor.

More gun ownership corresponds with more gun murders across virtually every axis: among developed countries, among American states, among American towns and cities and when controlling for crime rates. And gun control legislation tends to reduce gun murders, according to a recent analysis of 130 studies from 10 countries.

The article relies on data to establish its argument. The net result, America is a culture unlike any other with a second amendment right, which one can argue, is the reason we are such a dangerous country to live in.

After Britain had a mass shooting in 1987, the country instituted strict gun control laws. So did Australia after a 1996 shooting. But the United States has repeatedly faced the same calculus and determined that relatively unregulated gun ownership is worth the cost to society.

The article concludes with the following statement that cause one to wonder who are we this country called the United States of America

“In retrospect Sandy Hook marked the end of the US gun control debate,” Dan Hodges, a British journalist, wrote in a post on Twitter two years ago, referring to the 2012 attack that killed 20 young students at an elementary school in Connecticut. “Once America decided killing children was bearable, it was over.”