European digital sovereignty – but no adequate financial support for students in Germany?

Present discussions about European Digital Sovereignty underline the fact of an almost complete dependence of Europe and in particular of Germany on US technology – regarding

  • shear computational power (supercomputers, data centers),
  • classic IT, office and ERP applications (dominated by Microsoft, Google, Meta, …)
  • as well as AI models and related computational capacities
  • and, last but not least, the combination of robotics and defense systems with AI.

The standard recipe is a call for money to build more computation centers on European soil.

Actually, most of such centers presently under construction are planned to be eventually used by US companies. This is a sign of schizophrenia of European and German politicians or – even worse – a total lack of understanding of what happens in the fields of IT/AI and of what digital sovereignty really requires. Certainly not more data centers of Google, Microsoft or Meta in Germany. At least, this should not be a top priority item on an agenda for European independence of US monopolists.

Related concerns of European experts working in the fields of IT and AI culminated last week in the publication “https://europe2031.ai/“. The paper and the scenario described in it was triggered by the present failure of European governments to take and scale counter-measures against a coming US-dominance in the little remaining interval of time – if there is any at all. Visitors of this blog have probably read the paper, already.

From my perspective as a former IT consultant, I want to add three points which the scenario in the “Europe31.ai” paper does not cover to the extent these points deserve.

The first point is “education“:

AI is predominantly the result of certain types of SW, the development of artificial neural networks, the theory of artificial neural networks and advanced ideas about learning and learning algorithms. But, and this is sometimes totally underestimated, AI is also based on a lot of mathematics (in particular regarding Linear Algebra, analysis of data distributions in multiple dimensions, differential geometry, theory of graphs, optimization problems and advanced statistics). If you do not believe it, take a regular look at the papers published by American and Chines universities.

Top hardware is also an important aspect, but as China has shown with its recent CPU-based supercomputer LineShine and “DeepSeek” not a predominant factor. You can build sufficient supercomputer power also based on previous generations of hardware. What is much more important is the bundling and focusing of efforts in the field of AI – as well as the support of administrative institutions of solution oriented thinking and start-ups. Regarding these points we have, unfortunately, a lot to learn from China and investment companies in the US.

And: As in any high-tech field, real progress in the field of Machine Learning and LLM-based AI was and is achieved by clever ideas.

Proof: Consider the impact of transformer based neural networks on the development of present LLM systems. One idea, enormous consequences. And new emerging tech giants.

However and naturally: Clever ideas in turn require educated people.
Consequence: European AI Sovereignty requires at least as much investment in the education of people as in hardware.

Now, compare this with the fact that the present conservative government of Germany plans NOT to rise the state’s budget for supporting and helping students (Bafög) who do not have rich parents or parents with academic background.

A rise in support for extremely high costs for student apartments in German cities and a general increase of the support sum according to the inflation rate has been declined by a minister who – according to the press – made a paid career in their party and jobs in attached organizations already during their years as students; for related criticism see e.g. here, here and here and many more press articles. Its a shame – and I find no other word for it.

The decline came, although the level of financial support for students had and has already for several years been below minimum social standards guaranteed to other groups of citizens in Germany.

The obvious stupidity of such a budget planning remembers strongly of the Kohl era when theoretical physicists were told that Germany did not need theoretical researchers, but application oriented engineers. As if this had ever been a contradiction … My first diploma exam (in astrophysics) started with such a statement of the examining professors – uttered with a grain of pity for my generation. 15 years later the very same economy (not science) advisors, who once had told Kohl their “wisdom” about German engineering, suddenly found out that Germany did not receive enough Nobel prizes and that the best educated academic people had left Germany to work abroad. And advised chancellor Merkel to start initiatives on theoretical education and research. Well done …

Well, as a relatively old person with a PhD in physics, who can look back on more than 35 professional years in IT, you automatically think of the 5 apes in action, which unfortunately have become so characteristic of conservative German governments during the last 3 decades:

(1) Don’t hear and listen (to warnings of scientists), (2) don’t see (but ignore obvious developments in high tech realms), (3) don’t speak (about problems and long term strategy or e.g. about the self-inflicted dependency on Russian gas during the Merkel period and avoid any discussion about not having invested e.g. in digitization and AI), (4) don’t understand (because a substantial lack of MINT scientists among politicians), (5) don’t pick up ideas beyond a conservative ideology of the last century (let the market alone do its job).

As an elderly, rather conservative person, I do not utter this criticism lightheartedly. But the politicians of my generation (Merkel era) have totally failed to make my country, Germany, fit for the challenges of the time once called “future” – which now is the present time. Not to speak of today’s future …

Continue reading

New year – new operative system for desktops and laptops?

Some readers have noticed that I seldom write in this blog – at least compared to certain periods before 2023. One reason for this has been and is: Linux – in my case Opensuse Leap 15.x – has just worked well for me up to this very day. Small glitches, but on average Leap 15 and its subversions have always fulfilled my needs and requirements. (Another reason is that after retirement, I got more interested in math, physics, ML and politics.)

However, I also have to say that my private needs have become very limited. Significantly fewer server components due to a removal of LAMP/Postgre-SQL/JS/JQuery and Kolab stacks and keeping only a minimum of LDAP services. Only some virtualization for server-based mail services. Actually, I have become a desktop user, sometimes using a Python/CUDA stack for local Machine Learning experiments. Aside of mail services, my own servers have become simple data containers. And the few requirements some remaining customers of my wife have with respect to their web-installations do not require full-fledged development stacks.

Now, as a pure desktop user, I am approaching a point (EOL of Leap 15.6) at which I seriously have to decide whether I should turn to Opensuse Leap 16 or move to a completely different distribution as Debian.

The reason is that Leap 16 comes with a lot of fundamental changes and a significant reduction of supported application packages. A new installer (Agama), no Yast any longer, the container-based ALP-system mixed with RPMs, confusion about immutability and BTRFS, Myrlyn as an interface to package management, SE-Linux instead of Apparmor, no support for older Nvidia cards, Agama installer (according to some users) not fully working with Luks and LVM, … Well, what I read smells like a bunch of potential problems.

Regarding ALP and containers, I have used some applications like Blender for a long while now with Snap and/or Flatpak – and was always shocked about the additional disk space requirements. So, I am very skeptical regarding this aspect. It may be suited for Cloud based services – but for local installations in an environment with a mixture of desktop systems and small servers? The question is whether and in which form ALP affects small file server installations.

Aside of ALP, what is my present strategy regarding my desktops and laptops?

I will give Leap 16 a chance. As a fist step, I will install it freshly on an external USB disks for my various systems and see what the installation leads to. I will start with a mutable version for desktop usage. One objective is to install Leap 16 with multiple partitions, all encrypted with LUKS and, of course, using LVM. For desktop systems with relatively new Nvidia cards I expect full support (including CUDA).

As for an old Optimus laptop which has an Nvidia card that requires the version 470 Nvidia drivers, I will probably have to accept that its card is no longer supported. So, I will have to see how far one gets on such a system with the Nouveau driver and a Noveau-adapted version of prime-select. I hope that Blender runs with reasonable performance even on these systems. If everything works as expected, I will start with an upgrade of the existing 15.6 installations on desktops and laptops.

If I, however, run into serious trouble, I will definitely switch to Debian. Debian is my preferred alternative, based on very good experiences with Debian on servers and Kali Linux on KVM virtualized desktops.

The decision to keep Leap or not may depend on the kind of system and their age.

I will report about my experiences during February. So, stay tuned …

MS, the present attack on central MS systems – and the Bundeswehr

Some days ago I set up a list of questions regarding the Bundeswehr Leak of last week. During my discussion I touched the question that the BWI had praised its rollout of MS-based email-systems and Sharepoint platforms in large scale within the BW after Oct., 2021. Ironically I asked the question how the CCC would comment on this implementation of “notoriously insecure systems”.

Well, we do not need to ask the CCC any more. Yesterday, MS itself and the press informed the public once again that central key systems of Microsoft in the US are under attack. Probably a Russian hacker group is responsible. Actually, the present hacker activities continue and escalate an attack that already started in November 2023. It seems to be a fact that information gathered from core and central email systems is now abused systematically. Apparently, these emails have been stolen from executives and security staff. See also the article in the Washington Post about this topic.

You find more information at the following resources:

https://edition.cnn.com/ 2024/03/08/ tech/ microsoft-russia-hack/ index.html

https://abcnews.go.com/ International/ microsoft-russian-state-backed-hack-update/story ?id=107927553

https://www.reuters.com/ technology/ cybersecurity/ microsoft-says-cyber-threat-actor-has-been-able-access-internal-systems-2024-03-08/

https://www.washingtonpost.com/ technology/ 2024/03/08/ microsoft-hack-email-russia/

I hope that responsible managers at the BMVg or BWI read some of these information channels, too. And take notice of the comments of security officers of Sentinel One and CrowdStrike cited in the articles. And afterward reevaluate whether the broad rollout of MS-systems in the Bundeswehr really is a success story.

 

After the Bundeswehr Leak and the explanation of the Minister of Defense – some more questions …

Today I heard the explanation of the German Minister of Defense regarding the probable cause of the leak of last Friday. What I understood was:

  • WebEx is hosted in a special variant (WebEx BWI) on servers of the Bundeswehr.
  • Clear rules are in place, but were not followed. One participant attended the WebEx session via telephone.
  • Systems were not compromised.

Are these explanations sufficient? Do they cover all concerns described in my previous post
“Some simple questions after the Bundeswehr Leak …”
on this topic?

In my opinion some questions remained open:

  • Why and by whom was the WebEx session set up such that a participant could access it via telephone at all? With a zero-trust and MLS-based session this should have been excluded …
  • Did the participants get an invitation with an option that offered an access to the session via telephone? If yes: Who sent this information via which channels? Is it excluded that already the invitation was accessible to foreign powers?
  • Why did nobody check by which devices and communication channels the participants were attending the session? At the beginning and during the session? Why did a log- and intrusion system not react?
  • Why did none of the other participants react to the fact that the poor guy in Singapore talked over telephone? Despite the clear rules in place …
  • How did the eavesdropping happen? Were the telephone lines of the hotel tapped? Or did the participant use a wireless headset with Bluetooth?

So, if it was a human failure it may have happened due to mistakes and unawareness on multiple sides – on the side of IT-administrators responsible for the session setup, on the side of the person which sent the respective invitation, on the side of the participant who did not use a BWI- or SINA-device to access the session.

Well, and I would say that when a session running through servers of the Bundeswehr was overheard by Russia, at least the session was compromised. And if someone can access an audio-session, which is enabled by and via a Bundeswehr server and which is intended to be secure, via an open telephone line then something is severely wrong in the overall security measures.

So, my dear Minister, as a concerned citizen I still do not sleep well. More explanations have to follow …

 

Some simple questions after the Bundeswehr Leak ….

I am following the present discussion about the leak of a communication between some generals of the German Air Defense from abroad. It really feels extremely embarrassing that the Russians could overhear a communication of high-ranked German army officers. And I do not know how to answer questions of retired Norwegian IT-specialists (of my age) here in the north of Europe … With German troops participating right now in huge Nato maneuvers in northern Norway. And believe me I have often criticized my Norwegian friends for a lack of IT-security awareness, in particular regarding the use of Microsoft and Zoom. And now this disaster in my home country …

From my point of view establishing a formal Untersuchungsausschuss (investigation committee) of the German parliament is only one of the necessary steps required to clarify what has happened. But it is an important one, together with internal and technical investigations within the Bundeswehr.

In this post I want to ask some simple questions which, in my opinion, should be answered. Any IT-guy having worked with or for public governmental institutions in Europe could ask them. None of the links I give below is classified.

Why WebEx at all?

The first point in all the TV and newspaper discussions is that there seems to be no doubt that the communication is authentic and that WebEx was used. Now, anyone with a basic idea about information security would ask the following question:

Why for heavens sake did the German officers use Webex at all? A product of Cisco, i.e. of a commercial US company? With published security problems during the Corona years? Why does the German military not have its own security protocols and measures in place?

Well, we and the US are allies, but … Yeah, but, … and Trump on the horizon.

It is a German company, “Secunet”, who has developed mobile systems (SINA workstations) compliant with for NATO certifications on different levels of security. See e.g.:
https://www.secunet.com/ loesungen/ sina-workstation-s
https://www.ia.nato.int/ niapc/ Product/ SINA-Workstation-S_730
https://www.bundeswehr-journal.de/2020/mehr-als-6000-geraete-sina-workstation-s-fuer-die-bundeswehr/
https://www.secunet.com/ueber-uns/presse/artikel/sicheres-mobiles-arbeiten-bwi-beschafft-sina-workstations-s-fuer-die-bundeswehr
https://www.secunet.com/ueber-uns/presse/artikel/secunet-beliefert-die-bundeswehr-mit-sina-sicherheitstechnologie-fuer-schnelle-eingreiftruppe-der-nato

These systems were bought by the Bundeswehr in relatively large quantities.

So, my first two open question are:

  • Why was WebEx used at all? Did the generals not have SINA-workstations available? If they had not, why not?
  • Under what conditions is the usage of WebEx regarded secure by the the responsible IT-specialists of the Bundeswehr?

Actually, the answer to the second question may not be independent of the answer to the first one … as WebEx may be hosted on servers of the Bundeswehr.

Addendum, 05.03.2024: Another point which comes up during TV discussions is that some “experts” say there is reason to believe that the WebEx-session was set up without any end-to-end-encryption. This is really implausible. What is more plausible is that the session was set up with standard encryption and Cisco’s standard management of encryption keys. And maybe – due to mistakes – with allowance for some participants to use a telephone. Making the session insecure again …

A success message of the BWI of 2021 regarding the rollout of Cisco’s WebEx in the Bundeswehr

What did we read in 2021 as a success message regarding the digitalization of the German defense and public institutions?

” … Zusammen und in Echtzeit an Dokumenten arbeiten, E-Mails austauschen, gemeinsame Termine planen, Webkonferenzen mit und ohne Video abhalten, chatten und telefonieren – wenn alle Services komplett ausgerollt sind, ermöglicht Groupware Bw dies auf einer einheitlichen technischen Plattform und über alle zivilen und militärischen Bereiche hinweg. Die BWI startete am 1. Oktober den Rollout mit den Produkten Cisco Jabber und Webex. In einem zweiten Schritt werden im kommenden Jahr auch die Services E-Mail und Enterprise Content Management mit Microsoft Outlook und SharePoint ausgerollt.”

See: https://www.bwi.de/ magazin /artikel/ groupware-bw-bei-der-bundeswehr-perfekt-vernetzt-von-chat-bis-videokonferenz

Even without translation the combination of tools praised here would make a security aware person more than nervous. And one can only hope that the introduction of these systems only concerns the civil sector of the Bundeswehr. If not, well, … just ask the CCC what they would think of it.

Continue reading