NIST Tech Beat - November 6, 2003

Computer scientists at the National Institute of Standards and Technology (NIST) released on Nov. 3 an initial public draft of Recommended Security Controls for Federal Information Systems (NIST SP 800-53). The publication, which details controls that will become mandatory for most federal systems in 2005, is expected to have a wide audience beyond the federal government.

NIST invites public comments on the new draft guidelines for three months. The agency will hold an open, public workshop in March 2004 to share comments and discuss possible revisions to the draft.

The document is available at http://csrc.nist.gov/publications/drafts.html.

Security controls are the management, operational and technical safeguards, and countermeasures prescribed for a computer system that, taken together, adequately protect the confidentiality, integrity and availability of a system and its information. Management safeguards range from risk assessment to security planning. Operational safeguards include factors such as personnel security and basic maintenance of hardware and software. Technical safeguards include items such as audit trails and communications protection.

NIST SP 800-53 provides a method for categorizing security risk levels based upon another recent NIST document, the draft FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems, also available at the Web address above.

State, local and tribal governments, as well as private-sector organizations comprising the critical infrastructure of the United States, are encouraged to review the draft guidelines and may wish to consider using them once finalized. The guidelines are applicable to all federal computer systems, except those designated as national security systems.

Agreements to Facilitate World Trade Center Study

The National Institute of Standards and Technology (NIST) has reached an agreement with the City of New York (NYC) that will allow NIST to review additional information related to the Sept. 11, 2001, terrorist attacks on the World Trade Center (WTC). That information includes NYC 9-1-1 tapes and the transcripts of approximately 500 interviews of employees of the Fire Department of New York (FDNY) who were involved in WTC emergency response activities. The review of materials will take place at NYC offices.

A second agreement enables NIST to collect its own first-person data from New York City’s WTC first responders.

Data obtained from the 9-1-1 tapes, the NYC interviews and the NIST interviews will be used to study occupant behavior and evacuation, and emergency response as part of the agency’s federal building and fire safety investigation of the WTC disaster. Under the National Construction Safety Team Act (NCST), the NIST Director has taken action to protect the privacy of the information it receives by the two agreements. With the agreements in place, NYC will provide NIST investigators with access to the tapes and transcripts no later than Dec. 31, 2003. NIST expects to begin its interviews of FDNY and New York Police Department (NYPD) employees shortly.

NIST will conduct two types of interviews with FDNY and NYPD personnel: face-to-face and focus group. The National Commission on Terrorist Attacks Upon the United States (also known as the 9-11 Commission) will participate with NIST in the interview process.

A comprehensive Web site on the NIST WTC investigation is available at http://wtc.nist.gov.

Teaching Your Cell Phone Where It Is and How to Act

Future cellular telephones and other wireless communication devices are expected to be much more versatile as consumers gain the ability to program them in a variety of ways. Scientists and engineers at the National Institute of Standards and Technology (NIST) have teamed up with a variety of computing and telecommunications companies to develop both the test methods and the standard protocols needed to make this possible.

Programmable networks will include location aware services that will allow users to choose a variety of “context aware” call processing options depending on where they are and who they are with. For example, a cell phone that “knows” your location could be programmed to invoke an answering message service automatically whenever you are in a conference room or in your supervisor’s presence. Context aware, programmable cell phone or PDA networks also may help users with functional tasks like finding the nearest bank or restaurant. Within organizations, these capabilities might be used to contact people by their role and location (e.g., call the cardiologist nearest to the emergency room).

Before such capabilities can be realized on common commercial systems, groundwork must be completed to design and test open specifications of features, rules and procedures for programmable call control systems, and to develop protocols that will enable these systems to utilize context information. NIST, working with Sun Microsystems, has designed and developed new Java specifications (JAIN SIP) that provide a common platform for programmable communication devices. The NIST work is based on the Session Initiation Protocol, a specification for call control on the Internet. NIST’s open source implementation (NIST SIP) is a prototype that serves as a development guide and facilitates interoperability testing by early industry adopters of this technology.

New Superconductor Study Confirms, Extends Nobel Theory

The behavior of intermetallic superconductors, like the kind used in hospital MRI machines, is even more curious than recent Nobel Prize-winning physicist Alexei Abrikosov had theorized. In newly reported research,* scientists working at the National Institute of Standards and Technology (NIST) Center for Neutron Research have determined that so-called type II superconductors have the equivalent of a multiple personality—at least three distinct physical states, each with its own superconducting behavior. The result should help engineers design new materials for stronger, more efficient superconducting magnets.

Nearly 50 years ago, Abrikosov predicted that superconductors could retain superconductivity in a very strong magnetic field by forming tiny eddies of current. These vortices allow the field to pass through without disrupting the current, until a certain threshold is reached and the resistance-free flow of electrons ceases. Just before the collapse, however, the materials undergo a dramatic spike in current, called the peak effect.

Over a wide range of temperatures and magnetic field strengths, Brown University and NIST scientists tracked the movements of current eddies in a prototype type II superconductor, niobium. Their experiments yielded a phase diagram, a kind of a map that shows how current vortices rearrange in response to changes in temperature and magnetic field.

The study confirmed an earlier set of the team’s findings, but also revealed richer, more complex behavior. The recent work verified that the peak-effect jump in current corresponds to an abrupt change in the vortex arrangement—similar to the transformation that occurs when ice melts. They also provide the first experimental confirmation of Abrikosov’s prediction that a smooth phase transition occurs for conditions that don’t produce the peak effect.

*S.R. Park, S.M. Choi, D.C. Dender, J.W. Lynn, X.S. Ling, “Fate of the Peak Effect in a Type-II Superconductor: Multicriticality in the Bragg-Glass Transition.” Physical Review Letters, 91, 167003 (2003)

Md. Weathers Hurricane Isabel With Backup Fuel Cell Power

When Hurricane Isabel tore through the East Coast last month, it left more than 3.5 million people without power—but not the emergency services communication system for the Maryland state government. Thanks to backup power provided by an innovative fuel cell system, the agency didn’t miss a beat.

As Isabel lashed eastern Maryland, grid power failed at Elk Neck State Park, site of a state government microwave relay tower used by the Maryland Institute for Emergency Medical Systems Services, the Maryland State Police, the Department of Natural Resources and other critical official communications. Then a backup generator had to be taken offline.

Fortunately Maryland had a backup backup. An innovative fuel cell system—developed by Avista Labs (Spokane, Wash.) and installed by havePOWER, LLC, (Washington, D.C.)—kicked in to keep emergency communications on-line. “The fuel cell system carried the day,” said State of Maryland Director of Communications Tom Miller.

The Avista Labs/havePOWER system uses a unique modular proton exchange membrane (PEM) design developed with co-funding from the NIST Advanced Technology Program (ATP). PEM cells, first introduced in the 1960s, use a thin, hydrogen-permeable polymer sheet as the critical electrolyte separating anode and cathode. Unlike other fuel-cell electrolytes, the PEM is small, lightweight, and works well at low temperatures. Avista Lab’s innovations include a modular design that makes the fuel cell easily scalable to meet different applications and allows the user to swap modules out for troubleshooting or repair without interrupting service, both valuable features for emergency power.

NIST Chemist Receives Rare Forensics Award

John Butler, a research chemist at NIST, has been awarded the Scientific Prize of the International Society for Forensic Genetics (ISFG) for outstanding work on standardization and pioneering work on new DNA analysis technologies for forensic applications.

Few scientists have ever received the prize. The ISFG can award it as often as every two years, but only two other winners have been named during the past 12 years. The ISFG (www.isfg.org) promotes scientific knowledge in the field of genetic markers analyzed with forensic purposes. The society membership includes more than 900 scientists from 54 countries.

Butler was selected unanimously by the ISFG board based on his career achievements. He leads NIST’s forensics/human identity testing project team and has been involved in the development of new methods and technologies for forensic DNA analysis at NIST and other organizations for the past 10 years. The ISFG specifically cited his work in improving analysis of single nucleotide polymorphisms, tiny variations in DNA that can be used to identify individuals. He also was recognized for developing standards that have helped improve the reliability of DNA analyses by commercial, forensic and other laboratories. Most recently, Butler developed a concept for reducing the size of DNA fragments needed for a definitive identification,* which has proven useful in analyzing damaged or degraded DNA (see www.nist.gov/public_affairs/newsfromnist_DNA.htm). Butler is the author of a leading textbook in the field, and in 2002 he received the Presidential Early Career Award for Scientists and Engineers.

*Butler, John M., Yin Shen, and Bruce R. McCord. 2003. “The Development of Reduced Size STR Amplicons as Tools for Analysis of Degraded DNA.” J Forensic Sci, September 2003, Vol. 48, No. 5.

Nanosized Magnetic Sensors—Measurement results presented at a technical conference by National Institute of Standards and Technology (NIST) scientists do not corroborate reports of dramatic changes in electrical resistance attributed to ultra-small magnetic sensors that exploit a quantum phenomena regarded, by some, as the next big thing in magnetic-data-storage technology. For details see www.nist.gov/public_affairs/releases/BMReffect.htm

Draft Federal Guidelines Issued for Computer Security

Agreements to Facilitate World Trade Center Study

Teaching Your Cell Phone Where It Is and How to Act

New Superconductor Study Confirms, Extends Nobel Theory

Md. Weathers Hurricane Isabel With Backup Fuel Cell Power

NIST Chemist Receives Rare Forensics Award