Yogesh K Dwivedi
email: ykdwivedi@gmail.com

Raghav Sukumar
email: sukumar.raghav@gmail.com

Anastasia Papazafeiropoulou
email: anastasia.papazafeiropoulou@brunel.ac.uk

Michael D Williams
email: m.d.williams@swansea.ac.uk

ERP Implementation in an Indian Context: Examining Perceptions on Success Factors

Keywords: ERP, Implementation Factors, Locally-owned Indian Organizations, Multinational Organizations

This research aims to explore factors responsible for successful implementation of ERP systems in Indian organizations. The paper also aims to explore the similarities and differences in ERP system adoption between locally-owned and multinational companies in India. The data was collected from 56 project managers and business analysts with ERP expertise from both locally-owned Indian and multinational companies. The findings suggest that Business Plan and Vision, Project Management and Top Management Support were perceived as the three most important factors responsible for successful implementation. The result revealed no significant differences between Indian and multinational companies, hence indicating that both types of firms undertake the ERP implementations in the same manner.

INTRODUCTION

ERP is widely implemented by organisations in developed countries and is considered as the backbone of E-business [START_REF] Al-Mashari | ERP implementation: An integrative methodology[END_REF][START_REF] Rajapakse | Why ERP may not be suitable for organizations in developing countries in Asia[END_REF]. However, its implementation is less prevalent in the developing countries context. Although India is considered an important provider of IT services to other countries, its own organizations are comparatively slower in technology adoption. Considering India's position in IT development and the fact that it is a developing country, this study aims to examine the implementation of ERP systems in an Indian context. There have been numerous studies listing the critical success factors (CSF) for successful ERP system implementation for developed countries. However, very few studies have examined these factors from a developing country perspective and have compared the factors from locally-owned and multinational companies.

This paper therefore aims to explore factors responsible for successful implementation of ERP systems in an Indian context. The paper also aims to explore the similarities and differences in ERP system adoption between locally-owned and multinational companies in India.

The remaining paper is organized as follows: The next section will provide an overview of the research method utilized. The findings will then be presented and discussed in subsequent sections. The last section of this paper will outline the conclusions.

RESEARCH METHOD

To achieve the specified research aim, this research considered survey as an appropriate method to collect data on factors important for implementation of ERP in an Indian context. Considering the research context, it was decided to collect data from project managers and business analysts from Indian organisations that have experienced ERP implementation process. These are the two positions which play key roles in the ERP implementation process and generally are proficient in both business and technical knowledge. A total of 56 responses were received from contacted organisations.

Survey Questionnaire

Based on factors identified from a systematic literature review there were fourteen questions (representing 14 success factors listed in Table 5) in the questionnaire. The questions were Likert scale type and were designed to examine the respondents' perception of the importance of different factors (adapted from [START_REF] Arunthari | ERP System Adoption and Vendor Selection by Locallyowned and Multinational Companies in Thailand[END_REF][START_REF] Ehie | Identifying critical issues in enterprise resource planning (ERP) implementation[END_REF][START_REF] Nah | ERP implementation: Chief Information Officers' perceptions of critical success factors[END_REF]) that determines successful implementation of ERP in Indian organisations. The respondents were requested to rate each of the factors on a five-point scale: "1 = Neither critical nor important for success"; "2 = important but not critical/necessary for success"; "3 = somewhat critical and important for success"; "4 = critical and important for success"; "5 = extremely critical and important for success". The fourteen success factors included in the questionnaire are listed in Table 5. The first twelve factors are adapted from [START_REF] Nah | ERP implementation: Chief Information Officers' perceptions of critical success factors[END_REF], Cost/Budget from [START_REF] Ehie | Identifying critical issues in enterprise resource planning (ERP) implementation[END_REF] and Vendor Selection from [START_REF] Arunthari | ERP System Adoption and Vendor Selection by Locallyowned and Multinational Companies in Thailand[END_REF].

FINDINGS

Demography of Profile of Respondents

Considering the responses from an organization type perspective, as shown in Table 1, out of the total 56 responses, 41.1 percent (Count = 23) were locally-owned Indian companies and 58.9 percent (Count = 33) were from multinational companies in India. Considering the responses from the perspective of type of position held (by the respondent), as shown in Table 2, the total of 56 responses have been split into almost equal halves with 51.8 percent (Count = 29) coming from project managers and 48.2 percent (Count = 27) coming from business analysts. 1 and Table 2 gives a cross tabulation of both organization type and respondent type to better understand the break-up of the responses as shown in Table 3. The number of responses from project managers from locally-owned Indian companies and multinational companies are almost equal with 14 and 15 respectively. The number of responses from business analysts in multinational companies is 18, which is twice the number that came from Indian companies (see Table 4).

Descriptive Statistics: Importance of Examined Factors

Table 4 illustrates the number of responses, the mean score and the standard deviation for each of the identified success factors. It is evident from Table 5 that F2 (Business Plan and Vision), F10 (Project Management) and F12 (Top Management Support) are the three most important success factors as perceived by project managers and business analysts regarding the implementation of ERP systems (see Table 4). The t -test for equality of means for organization type (see Table 5) indicates that there is no significant difference in the perceptions of the success factors between the two types of companies. Among the 14 success factors, there is not a single factor with s significance value less than or equal to 0.05. This indicates that locally-owned Indian companies are weighing ERP implementation projects in the same lines as multinational companies.

DISCUSSION

Many organizations in developing countries may not be able to invest the initial cost of ERP implementations [START_REF] Rajapakse | Why ERP may not be suitable for organizations in developing countries in Asia[END_REF]. Hence cost is a critical success factor which needs to be considered during the start or proposal of ERP projects. In terms of a project, the business case should reflect rigorous cost benefit analysis to clearly illustrate viability of the project and to convince and gain management support. Top management support in terms of resource remittance and making major decisions is very crucial during ERP implementations [START_REF] Al-Mashari | ERP implementation: An integrative methodology[END_REF]. Considering the low regulation levels and unconventional business processes, it may be a challenge to find an appropriate fit between the business process and the ERP system, hence the business process re-engineering becomes crucial [START_REF] Rajapakse | Why ERP may not be suitable for organizations in developing countries in Asia[END_REF]. Training and education is an important factor and it may need extra emphasis in developing countries where ERP knowledge is less for end users [START_REF] Rajapakse | Why ERP may not be suitable for organizations in developing countries in Asia[END_REF]. The best human resources when used effectively lead to a successful implementation of ERP projects. Hence the composition and teamwork of an ERP project must be given importance and it is recommended that managers do not compromise on technical expertise when assigned to the project. Vendor selection is another fundamental key to success because a wrong decision in choosing a vendor may lead to aligning issues of the business process and the ERP system [START_REF] Arunthari | ERP System Adoption and Vendor Selection by Locallyowned and Multinational Companies in Thailand[END_REF]. "Software development, testing and troubleshooting" and "Monitoring and evaluation of performance" should run parallel as they are closely associated. However, the finding from Table 5 reveals that the level of importance given to software development, testing and troubleshooting is much higher than monitoring and evaluation of performance. The reason may be because India is one of the largest outsourcing hubs for IT development and the importance of software development has become a part of the culture. According to the findings, a business plan and vision are considered the most critical and important ingredients for success (Table 5). This study recommends that managers must make sure that the business plan and vision are transparent to all the members of the team. A successful ERP implementation is possible only if all the contributing members have a common business vision and goal.

CONCLUSIONS

This study made an initial attempt to understand the adoption of Enterprise Resource Planning Systems in an Indian context. The success factors identified from the literature review were rated on the level of criticality and importance of success by project managers and business analysts from locally-owned Indian companies and multinational companies in India. The findings illustrate that Business Plan and Vision, Project Management, Top Management Support, Software Development, Cost/Budget and Vendor Selection are the factors that play the most important role in ERP implementation. The results also revealed that there was no significant difference in the perception towards the success factors between locally-owned Indian companies and multinational companies. This information may be considered useful when locally-owned Indian companies and firms outside decide to implement ERP systems. However, there existed a significant difference in the level of importance given to two of the fourteen success factors by project managers and business analysts.

Table 1 .

 1 Organization Types: Locally-owned Indian vs. Multinational Companies

	Organization Type	Frequency	Percent
	Indian Companies	23	41.1
	Multinational Companies	33	58.9
	Total	56	100.0

Table 2 .

 2 Respondent Types: Project Managers vs. Business Analysts

	Respondent Type	Frequency	Percent
	Project Manager	29	51.8
	Business Analyst	27	48.2
	Total	56	100.0
	Consolidating Table

Table 3 .

 3 Organization Type and Respondent Type: Cross Tabulation

				Respondent Type
	Organization Type		Project Manager	Business Analyst	Total
	Locally-owned Indian Companies	Count % of Total	14 25.0%	9 16.1%	23 41.1%
		Count	15	18	33
	Multinational Companies	% of Total	26.8%	32.1%	58.9%
		Count	29	27	56
	Total	% of Total	51.8%	48.2%	100.0%

Table 4 .

 4 Descriptive Statistics of the 14 Success Factors

	Factors		N Mean S.D.
	Business Plan and Vision	F2	56 4.52 .786
	Project Management	F10	56 4.25 .769
	Top Management Support	F12	56 4.21 .986
	Software Development, Testing and Troubleshooting	F11	56 4.16 .804
	Cost / Budget	F13	56 4.09 .959
	Vendor Selection	F14	56 4.09 .996
	Effective Communication	F6	56 3.98 .842
	User Training and Education	F5	56 3.89 .947
	Business Process Reengineering	F3	56 3.73 .842
	ERP Teamwork and Composition	F7	56 3.66 .815

Table 5 .

 5 Group Statistics and t -test for Organization Type and Success Factors

					t-test for Equality of Means for
	FACTORS	Organization Type	N Mean	Std. Deviation	t	Organization Type Sig. (2-df tailed)
	F1	IC MN	23 3.57 33 3.67	1.080 .924	-.377	54	.708
	F2	IC MN	23 4.70 33 4.39	.559 .899	1.426	54	.160
	F3	IC MN	23 3.83 33 3.67	.576 .990	.694		54	.491
	F4	IC MN	23 3.61 33 3.48	.988 .972	.466		54	.643
	F5	IC MN	23 4.04 33 3.79	.706 1.083	.993		54	.325
	F6	IC MN	23 3.96 33 4.00	.767 .901	-.188	54	.851
	F7	IC MN	23 3.52 33 3.76	.665 .902	-1.066	54	.291
	F8	IC MN	23 3.26 33 3.55	1.054 .794	-1.153	54	.254
	F9	IC MN	23 3.39 33 3.55	.783 1.092	-.580	54	.564

Yogesh K. Dwivedi/Sukumar Raghav/Anastasia Papazafeiropoulou/Michael D. Williams

worked on an E-procurement project in junction with the Official Journal of European Union. He can be reached at sukumar.raghav@gmail.com Dr Anastasia Papazafeiropoulou is a lecturer in the Information Systems and Computing department at Brunel University, UK. Her PhD was awarded by Brunel University and she also holds a first degree in Informatics and a M.Sc. in Information Systems both from the Athens University of Economics and Business, Greece. She has been involved in a number of European and UK funded research projects with emphasis on electronic commerce and small and medium size enterprises (SMEs). She teaches information systems management and business integration at the postgraduate level. She also supervises researchers in the field of technology adoption by organisations with special interest in developing countries. She has 10 years of research experience on the study of diffusion and adoption of electronic commerce, broadband Internet, Enterprise Recourse Planning Systems (ERPs), Customer Relationship Management systems (CRMs), IP-telephony and mobile TV.

Michael D. Williams is a Professor in the School of Business and Economics at Swansea University in the UK. He holds a BSc from the CNAA, an MEd from the University of Cambridge, and a PhD from the University of Sheffield. He is a member of the British Computer Society and is registered as a Chartered Engineer. Prior to entering academia Professor Williams spent twelve years developing and implementing ICT systems in both public and private sectors in a variety of domains including finance, telecommunications, manufacturing, and local government, and since entering academia, has acted as consultant for both public and private organizations. He is the author of numerous fully refereed and invited papers within the ICT domain, has editorial board membership of a number of academic journals, and has obtained external research funding from sources including the European Union, the Nuffield Foundation, and the Welsh Assembly Government. He can be reached at m.d.williams@swansea.ac.uk


Ioanna Constantiou

Sabine Madsen
email: sabinem@ruc.dk

Anastasia Papazafeiropoulou
email: anastasia.papazafeiropoulou@brunel.ac.uk

Sabine Madson

/ Anastasia

Investigating the influence of information management practices on IS governance

Keywords: Information management practices, IS governance, knowledge workers

Information technology especially through Internet applications provides tremendous possibilities to knowledge workers, in any domain, to get access to vast amounts of data. This is a development with great benefits but also some challenging implications. In other words, as the information available increases, the knowledge workers' needs to make sense of information, i.e. for, prioritizing, organizing, and interpreting information intensify. Yet, the information management practices, which are based on the user's characteristics, have not been studied extensively. In this paper we suggest the examination and explication of the information management practices used by knowledge workers today in order to provide useful insights to managers involved in IS governance in the organisation. We also introduce specific theories which can be used as a lens to analyse the knowledge workers' practices and offer useful theoretical insights into the domain. We contend that such research could provide a set of guidelines that can be adopted by organisations in order to offer their employees a structured way to deal with information management which is supported by the information technologies and systems available. We argue that our results could be useful to knowledge workers looking to exploit available information while overcoming information overload.

INTRODUCTION

Internet and social networking systems emerge every day and Internet-based communication tools such as skype, facebook, twitter and on-line meeting spaces are part of every knowledge worker's life. Thus, finding a productive way to manage information coming from all those sources becomes paramount for preserving their productivity. As new communication software systems become available every day, knowledge workers are struggling to find ways to cope with information overload and survive the overwhelming amount of information that is available to them. This vast amount of data available to knowledge workers has been reported to create 'pathologies of information' which are hard to overcome [START_REF] Bawden | The dark side of information: overload, anxiety and other paradoxes and pathologies[END_REF]. It has been reported that as knowledge workers are exposed to an increasing amount of information, they lose their ability to concentrate, solve problems and handle every-day tasks. Consequences of the information overload may involve shrinking of creativity or even lead to a melt down of knowledge workers because of stress [START_REF] Hallowell | Overloaded circuits: Why Smart People Underperform[END_REF]. Multi-tasking and breaking down of attention to a number of different sources of information is a typical experience of people working in an office environment. Although it has been suggested that knowledge workers need easy access to information through a single interface [START_REF] Feldman | The high cost of not finding information[END_REF] as well as the use of software tools for filtering information, little has been done by organisations to tackle a problem as big as information overload (IEEE Spectrum, 2009).

The question raised is about how we can support knowledge workers information management practices through IS governance. We emphasise the importance of studying information management practices in relation to IS governance, a topic which has only been investigated by a limited amount of researchers. We contend that there is a need for introducing formal methods and practices, supported by information systems, to be used by knowledge workers in order to cope with information overload. This could enable the knowledge workers to use information provided by the information systems more efficiently and add quality rather than confusion to the workplace. In turn, this may increase the productivity and efficiency in the organisation.

PROPOSED THEOREATICAL APPROACH

We conceptualize information management as double-edged in the sense that it encompasses practices (a) for coping with information overload as well as (b) for benefitting from the use of information (information empowerment). Moreover, we draw on different theoretical approaches to address information management from different perspectives. We propose the use of three theoretical dimensions for the study of the knowledge worker information management practices and of how they are supported by the information technologies and systems available in the organisation.

1. How the knowledge worker creates meaning from online information (Sensemaking). Intention shapes attention [START_REF] Weick | Sensemaking in Organizations[END_REF]. It is to a large extent the way the person defines her motivations, goals, priorities, and tasks at a given point in time that makes her notice and act in accordance with certain cues while ignoring other cues completely (See e.g., [START_REF] Choo | The Knowing Organization: How Organizations Use Information to Construct Meaning, Create Knowledge and Make Decisions[END_REF][START_REF] Solomon | Discovering Information Behavior in Sensemaking, Time and Timing[END_REF][START_REF] Weick | Sensemaking in Organizations[END_REF][START_REF] Weick | Organizing and the Process of Sensemaking[END_REF]. In other words, intention strongly influences what kind of information the knowledge worker pays attention to and creates meaning from. The created meaning in turn affects the knowledge worker's decisions. 2. How the knowledge worker interacts with, and manage information available via Internet technologies, so as to make decisions (Decision-making). Humans are subject to bounded rationality which in turn affects their information processing abilities [START_REF] Simon | A behavioral model of rational choice[END_REF]). In the process of decision making people have to cope with the information available in a specific situation [START_REF] March | Bounded rationality, ambiguity, and the engineering of choice[END_REF]). Internet technologies increase information availability, which in turn may empower or impede the knowledge worker. The information management strategy is shaped by the knowledge worker's cognitive processes or intuitive approaches based on heuristics [START_REF] Kahneman | Maps of bounded rationality: Psychology for behavioral economics[END_REF]. The knowledge worker uses heuristics to reduce the cognitive effort required to deal with all the available information in the situation at hand [START_REF] Bazerman | Judgment in managerial decision making[END_REF]). However, the use of heuristics may create bounded awareness [START_REF] Chugh | Bounded awareness: what you fail to see can hurt you[END_REF] which in turn makes the knowledge worker ignore relevant, and available information (e.g., information in one's email inbox).

How the knowledge worker maintains a balance between a focused mind and openness to emerging and contextual information (Mindfulness).

Mindfulness is a state of mind where the individual shows openness to new information and different points of view while remaining aware of the context and in control of the situation at hand [START_REF] Langer | Mindfulness[END_REF]. Being mindful as a knowledge worker demands a great deal of self-observation and development of decision-making strategies which are ad-hoc and always relevant to the context of work. Maintaining a mindful state of mind gives people the possibility to avoid a situation where information is either ignored or misinterpreted with adverse effects for decisionmaking [START_REF] Langer | Mindfulness[END_REF]. Being mindful means being aware of the diversity of tasks coming your way but also being open to experiences which have not been planned or organised. Mindfulness is also about keeping a focused attention to the task at hand and performing one-thing-at-a-time in order to keep the consecration going while welcoming new inputs if they arrive.

We use a simple case of information management, where the knowledge worker only has one task, in order to explain how the three theoretical perspectives interrelate. A knowledge worker always has a state of mind while performing a specific task. Mindfulness enables her to keep overview of all the relevant information, thus reducing the cognitive bias in accessing the necessary information for the task (i.e., be able see more information). Then, mindfulness enables her to focus on creating meaning from information relevant to the task. The next step is to evaluate the information and make a decision about the task, based on the created meaning. Here, mindfulness reduces the cognitive burden for the decision-maker because she focuses on the respective activity. It is clear that in practice, knowledge workers experience more complicated situations and multi-tasking is often required and this can be the context of our proposed study.

FUTURE RESEARCH PLAN

Our suggested research method involves a longitudinal study to investigate the proposed research problem. We have divided the research work in three phases:

In the first phase we will conduct a pilot study for understanding the knowledge worker's information management practices when using Internet-based applications. We will conduct interviews with knowledge workers from organisations in different domains. Moreover, we will conduct interviews at the top management level to identify the link between information management and organisational goals. The outcome of this phase will be the formation of the knowledge base about the empirical context.

In the second phase we will collect data about the knowledge workers' information management practices in the workspace. We will capture the knowledge workers' perceptions and behaviours using a triangulation of data collection techniques, such as observation, interviews and log files. Data collected over a period of time and via different techniques will allow us to understand information processing behaviour in context and to alleviate the discrepancy between intentions/perceptions and actual behaviours. Data analysis will be performed with a focus on the use of information in different processes (e.g., during project prioritisation) and the organisational implications. The outcome of the phase is a set of information management practices as well as a set of "new" heuristics that can be adopted in the organisation and used by knowledge workers.

In the third phase we assess the impact of the identified information management practices. We will invite a group of employees from the participant organisations and ask them to use the information management practices, identified in the research for a period of time. During this period we will use observations and interviews to followup on the knowledge workers' use of these practices. The observations and interviews will be structured around the information use as described in the first phase. The outcome of the phase will be a set of information management practices that are better aligned with individual and organisational goals and provide useful insights to managers involved in IS governance in the participating organisations.

AUTHOR BIOGRAPHIES:

Anastasia Papazafeiropoulou is senior lecturer at the department of Information Systems and Computing at Brunel University, UK. Her interest lie in the area of IT adoption and diffusion, e-commerce, SMEs and information management.

Ioanna Constantiou is assistant professor at the Institution for Informatics at Copenhagen Business School, Denmark. Her interests lie in the diffusion of innovation in the information and communications technologies-markets, using economic theories.

Sabine Madsen is associate professor at the department of communication, Business and Information technologies at Roskilde University, Denmark. Her interest lie in the study of user driven IT innovation


Mason Rice

Daniel Guernsey

Sujeet Shenoi

Chapter 1 USING DECEPTION TO SHIELD CYBERSPACE SENSORS

Keywords: Cyberspace sensors, deception, sensor shielding

The U.S. President's Comprehensive National Cybersecurity Initiative calls for the deployment of sensors to help protect federal enterprise networks. Because of the reported cyber intrusions into America's electric power grid and other utilities, there is the possibility that sensors could also be positioned in key privately-owned infrastructure assets and the associated cyberspace. Sensors provide situational awareness of adversary operations, but acting directly on the collected information can reveal key sensor attributes such as modality, location, range, sensitivity and credibility. The challenge is to preserve the secrecy of sensors and their attributes while providing defenders with the freedom to respond to the adversary's operations.

This paper presents a framework for using deception to shield cyberspace sensors. The purpose of deception is to degrade the accuracy of the adversary's beliefs regarding the sensors, give the adversary a false sense of completeness, and/or cause the adversary to question the available information. The paper describes several sensor shielding tactics, plays and enabling methods, along with the potential pitfalls. Wellexecuted and nuanced deception with regard to the deployment and use of sensors can help a defender gain tactical and strategic superiority in cyberspace.

Introduction

At 6:00 a.m., just before power consumption reaches its peak, a computer security expert at an electric power utility receives the text message, "Fireball Express," indicating that a cyber operation is being executed on the utility's assets. The expert is a covert government agent, who is embedded in the power utility to monitor cybersecurity breaches. Only the CEO of the company is aware of her status as a government agent.

Months earlier, the embedded agent created a honeynet at the utility to draw cyber operations conducted by adversaries. The honeynet presents an intruder with a carbon copy of the utility's SCADA systems. Meanwhile, to enhance situational awareness, U.S. intelligence has secretly implanted sensors in core Internet routers across America. The "Fireball Express" alert was triggered by correlating information gathered from the honeynet and the Internet sensors. The analysis indicates that the operations are being conducted by a nation state adversary.

U.S. officials must act quickly. Directly confronting the nation state adversary about the intrusion at the utility could reveal the existence of the honeynet and, possibly, the presence of the embedded agent. How can the U.S. maintain the secrecy of its sensors while responding strongly to the intrusion?

This paper presents a framework for using deception to shield cyberspace sensors from an adversary. In particular, it categorizes cyberspace sensors and their attributes, outlines sensor shielding tactics, plays and enabling methods, and discusses the potential pitfalls. Well-executed deception can shape the beliefs of the adversary to the advantage of the defender, enabling some or all of the sensor attributes to be shielded while providing an opportunity for the defender to confront the adversary about its cyber operations. The paper discusses several examples of deception and presents options for shielding sensors, including the sensors in the fictional Fireball Express scenario at the electric power utility.

Sensors and Deception

Sensors provide information about the state of an environment of interest and the activities of entities in the environment. Sensors are characterized by their modality, location, range, sensitivity and credibility. The modality of a sensor refers to its detection mechanism (e.g., electronic, thermal, magnetic, radiant and chemical) [START_REF] Patranabis | Sensors and Transducers[END_REF]. The location and range of a sensor specify the location and space in which the sensor can operate effectively. Sensitivity refers to the ability of a sensor to detect stimuli and signals; cyberspace sensors may be tuned to detect specific viruses and worms, rootkits and network probes. The credibility of a sensor is a function of its reliability and durability. Reliability refers to the ability of a sensor to correctly measure the parameter of interest while durability refers to the ruggedness of the sensor and its tamper resistance.

The attributes of a sensor determine its secrecy. In general, if one attribute of a sensor is classified, the existence and/or use of the sensor may be classified [START_REF] Bush | Executive Order 13292 -Further Amendment to Executive Order 12958, as Amended, Classified National Security Information[END_REF]. However, the existence of a sensor may be public knowledge, but its attributes could be classified. For example, the location, basic sensitivity, credibility and one of the modalities (magnetic) of the U.S. underwater sound surveillance system (SOSUS) may be known, but its true sensitivity and other modalities are closely guarded secrets [START_REF] Richelson | The US Intelligence Community[END_REF].

The importance of maintaining the secrecy of sensors cannot be overstated. Scholars believe that the shroud of secrecy surrounding U.S. and Soviet satellite reconnaissance capabilities may have led to the Strategic Arms Limitation Talks (SALT) I and II in the 1960s and 1970s. Shortly after one of the talks, the U.S. publicly acknowledged its use of satellite reconnaissance without providing details about the specific modalities (e.g., optical and electrical) and sensitivity. Although the Soviets released little information about their capabilities, it was widely believed that they had the ability to monitor U.S. compliance of the arms limitation agreements. As a result, the SALT documents used the ambiguous phrase "national technical means of verification" [START_REF] Laqueur | The Uses and Limits of Intelligence[END_REF]. Sensor secrecy and the resulting uncertainty in the monitoring capabilities of the two countries likely facilitated the SALT agreements during the height of the Cold War.

When using any instrument of national power -diplomacy, information, military and economics -it is often necessary to manipulate the response to sensor signals in order to mask one or more sensor attributes. Reacting in an obvious, unnuanced manner to sensor data about an adversary can compromise the sensor. For example, Al Qaeda was quick to recognize after attacks by U.S. forces in Afghanistan that the U.S. could track targets based on cell phone signals and other electronic transmissions. As a result, Osama bin Laden and other terrorists resorted to sending messages via courier [START_REF] Risen | A hostile land foils the quest for bin Laden[END_REF].

Historically, deception has been used very effectively when exerting instruments of national power [START_REF] Dunnigan | Victory and Deceit[END_REF][START_REF] Rowe | Two taxonomies of deception for attacks on information systems[END_REF]. Deception increases the freedom of action to carry out tasks by diverting the adversary's attention. Deception can persuade an adversary to adopt a course of action that potentially undermines its position. Also, deception can help gain surprise and conserve resources. This paper discusses how deception can be used to obscure one or more attributes of cyberspace sensors.

Deception Framework

A deception strategy should deliberately present misleading information that degrades the accuracy of the adversary's beliefs, give the adversary a false sense of completeness, and/or cause the adversary to misjudge the available information and misallocate operational or intelligence resources. With regard to preserving sensor secrecy, the goal of deception is, very simply, to cause the adversary to have incorrect or inaccurate impressions about the modality, location, range, sensitivity and/or credibility of the sensor.

Figure 1 illustrates the goal of a deception strategy that seeks to preserve sensor secrecy. The white squares at the bottom of the figure represent the true sensor attributes that are known to the defender. The black squares at the top of the figure denote a combination of true, assumed or false sensor attributes that the defender wants the adversary to believe. To accomplish this goal, the defender creates a "deception play," represented by the black circles in the middle of the figure . The deception play provides false information about the modality and location of the sensor, no information about the sensor range, and true information about the sensitivity and credibility of the sensor. Note that the adversary may already hold certain beliefs about the sensor attributes prior to the execution of the deception play by the defender.

Concealment

Concealment uses natural cover, obstacles or distance to hide something from the adversary. Concealment is the earliest form of military deception. An example in the cyberspace domain is the embedding of sensors in networking gear.

Camouflage

Camouflage uses artificial means to hide something from the adversary. Note that covering military equipment with vegetation is an example of camouflage rather than concealment. An example in the cyberspace domain is the generation of artificial network traffic by a honeynet to camouflage cyber operations such as intelligence gathering.

An example of the See-Think-Do methodology is Operation Bodyguard, the deception plan instituted in advance of the D-Day invasion [15]. The Allies conducted air raids, sent fake messages and even created a phantom army to convince the German High Command that the landing point would be Pas de Calais. The German High Command saw the deceptive operations (see), believed that Calais would be the target of the assault (think), and redirected forces that could have been placed in Normandy to defend Calais instead (do).

The scope of a deception play is limited by the time and resources available for its planning and execution, the adversary's susceptibility to the deception, and the defender's ability to measure the effectiveness of the deception. Additionally, the lack of accurate intelligence and cultural awareness can hinder a deception play. The best outcome for a deception play is for the adversary to fall for the deception. Note, however, that the defender may have a satisfactory outcome even if the play drives the adversary to believe something other than the truth.

Deception Constructs

This section discusses the principal deception constructs. These include the classes of deception, deception plays, deception principles and the types of information collected by the adversary.

Classes of Deception

Deception involves two basic premises, hiding something real and showing something false [START_REF] Dunnigan | Victory and Deceit[END_REF]. This gives rise to two classes of deception: passive and active.

Passive Deception: Passive deception focuses on hiding. It tends to be "safer" than active deception because it does not seek to instigate action on the part of the adversary [START_REF] Dunnigan | Victory and Deceit[END_REF]. Techniques for hiding include concealment and camouflage (Table 1).

Planting False Information

The adversary obtains information that results in an incorrect or inaccurate belief. An adversary can be fed false information, for example, via a newspaper article or an Internet posting.

Ruse

The defender impersonates the actions or capabilities of another entity to cause the adversary to have an incorrect or inaccurate belief. An example is the delivery of fake orders and status reports in the enemy's language. A cyberspace example involves spoofing the return IP addresses of packets.

Display

The defender makes the adversary see or believe something that is not there. An example is the positioning of fake artillery pieces and dummy aircraft. A cyberspace example is the generation of fake Internet traffic to create the illusion that a system has more or less capabilities than it actually has.

Demonstration

The defender conducts an operation that conveys an incorrect or inaccurate belief to the adversary. A cleverly orchestrated demonstration can lead the adversary to make a tactical or strategic error. During the year prior to the 1973 Arab-Israeli war, Egypt repeatedly moved its troops to the Israeli border, only to recall them. The Israelis were conditioned by the demonstrations, and were thoroughly surprised when the Egyptians invaded. A cyberspace example involves the defender performing repeated probes of the adversary's network before escalating its activities and corrupting a key asset.

Lying

The defender tells a lie, which causes the adversary to have an incorrect or inaccurate belief.

Active Deception: Active deception focuses on showing something (e.g., knowledge and capabilities) that is not real [START_REF] Dunnigan | Victory and Deceit[END_REF]. It tends to be more "risky" than passive deception because it seeks to instigate action on the part of the adversary. Active deception techniques include planting information, ruses, displays, demonstrations and lying (Table 2).

Deception Plays

Insight into the thought process of the adversary enables the defender to outthink the adversary [START_REF] Dunnigan | Victory and Deceit[END_REF][START_REF] Fowler | Tactical deception in air-land warfare[END_REF]. An example of engaging insight is the use of absolute truth in a deception play. Absolute truth involves telling the truth in a situation where the adversary is unlikely to believe the truth -perhaps because of a strong prior belief. Another example is omission, which involves the exclusion of some information. Omission is common in politics, especially during an election campaign when a partial revelation of an opponent's voting record can gain votes. Omission also can be used to hide contrary evidence and create ambiguity, especially when the adversary is predisposed to certain beliefs.

Active and passive techniques can be used individually or in combination to create plays that are intended to deceive an adversary. Masking, misleading, mimicking and confusing are four of many possible plays that can hide the real and show the false [START_REF] Bell | Cheating and Deception[END_REF][START_REF] Gerwehr | Unweaving the Web -Deception and Adaptation in Future Urban Operations[END_REF]. Masking may involve camouflage and concealment, while misleading may involve planting information, ruses, displays, demonstrations and lying. Misleading could be as simple as transmitting a clear, unambiguous false signal or as complex as planting information for an adversary to find, lying to a third party who will pass the information on to the adversary and conducting ruses under the guise of the adversary. Mimicking involves copying some object or behavior (i.e., ruse). Techniques for confusing an adversary include raising the noise level associated with a specific act or acts to create uncertainly and/or paralyze decision making, or to purposely depart from an established pattern of activity by inserting random actions in a well-known activity.

Figure 2 presents four historical deception plays. Each deception play is expressed -as in Figure 1 -in terms of the actual sensor attributes, the deception play and the desired adversary beliefs.

Metox During World War II, the British could approximate the location of German U-boats using highly sensitive communications intelligence (COMINT) and then pinpoint their exact locations using radar [START_REF] Fowler | Tactical deception in air-land warfare[END_REF]. The Germans installed Metox radar detectors on their U-boats to enable them to evade British attack vessels. In response, the British changed the frequency of their tracking radar, and used deception to protect their COMINT sources. The British also arranged for German agents to acquire two pieces of spurious intelligence. One was that the Royal Navy had abandoned radar in favor of infrared detectors; the other was that Metox produced a signal that RAF planes could target.

The Germans acted on the spurious intelligence. They developed a paint that reduced the infrared signatures of U-boats, and worked to suppress the Metox emissions. Eventually, the Germans realized that the British had merely changed their radar frequency, and they attributed the U-boat sinkings exclusively to the British radar systems. The deception play enabled the British to preserve the secrecy of their COMINT sources.

Figure 2 shows that the deception story provided inaccurate information about the modality and location of the sensor, omitted range information, and revealed information about sensor sensitivity and credibility.

Melody The 1972 Anti-Ballistic Missile (ABM) treaty between the United

States and the Soviet Union prohibited the development and testing of ABM systems. Soon after the treaty was ratified, the U.S. detected Soviet cheating via a highly classified feature of Project Melody that intercepted Soviet missile tracking radar signals [START_REF] Poteat | The use and abuse of intelligence: An intelligence provider's perspective[END_REF]. During subsequent negotiations in Geneva, then Secretary of State Henry Kissinger confronted his Soviet counterpart with the dates and times that the Soviets had cheated on the treaty. The cheating stopped and the Soviets began a "mole hunt" for the spy who gave the information to the United States. America got its way without compromising its Melody sensors.

Figure 2 shows the components of Kissinger's deception play. Note that the play omitted the modality and location of the sensors, but it was effective because the Soviets were paranoid about spies in their midst.

Weapons Seizure Deception was likely used in 2005 when the Bush administration disclosed that it worked with other nations to intercept weapons systems bound for Iran, North Korea and Syria [START_REF] Sanger | Rice to discuss antiproliferation program[END_REF]. In particular, senior Bush administration officials stated that Pakistan had "helped" track parts of the global nuclear network. By naming Pakistan as the source of the information, the U.S. hid the true modality of its sensor, omitted the sensor location and revealed its range, sensitivity and credibility (Figure 2).

Osama bin Laden

The final example, involving the decision of Osama bin Laden and other terrorists to send messages by courier instead of via electronic means, cannot be characterized as deception because the U.S. had no intention of hiding its COMINT capabilities [START_REF] Bamford | The Shadow Factory[END_REF]. However, the example shows how a defender can use a deception play (Figure 2) that exaggerates its sensor capabilities, bluffing an adversary into using another mode of communications that it may have already compromised.

Deception Principles

Fowler and Nesbitt [START_REF] Fowler | Tactical deception in air-land warfare[END_REF] identify six general principles for effective tactical deception in warfare: (i) deception should reinforce the adversary's expectations; (ii) deception should have realistic timing and duration; (iii) deception should be integrated with operations; (iv) deception should be coordinated with the concealment of true intentions; (v) deception realism should be tailored to the setting; and (vi) deception should be imaginative and creative. These principles were developed for tactical deception in warfare [START_REF] Rowe | Two taxonomies of deception for attacks on information systems[END_REF], but they are clearly applicable to shielding cyberspace sensors.

Several other deception principles have been developed over time. Three of the more pertinent principles that are part of the U.S. military doctrine are:

Magruder's Principle: It is generally easier to reinforce an adversary's pre-existing belief than to deceive the adversary into changing a belief. The German Army applied this principle in the Wacht am Rhein (Watch on the Rhine) Operation during the winter of 1944. The code name led U.S. forces to believe it was a defensive operation, when in fact it was offensive in nature.

Exploiting Human Information Processing: Two limitations of human information processing can be exploited in deception plays. The first is that humans tend to draw conclusions based on small data sets, although there is no statistical justification for doing so. The second is that humans are often unable to detect small changes in a measured parameter (e.g., size of opposing forces), even though the cumulative change over time can be large.

Jones' Dilemma: Deception generally becomes more difficult as the number of sources that an adversary can use to confirm the real situation increases. However, the greater the number of sources that are manipulated, the greater the chance that the adversary will fall for the deception.

Interested readers are referred to [15] for additional details about these and other deception principles.

Adversary Information Gathering

A clever adversary is always collecting information about the defender. The information collected by the adversary can be categorized as: (i) known facts, (ii) secrets, (iii) disinformation, and (iv) mysteries [START_REF] Berkowitz | Strategic Intelligence for American National Security[END_REF].

Known Facts: A known fact is information that is publicly available or easily confirmed. In the past, the U.S. intelligence community would rarely release known facts. Typically, the State Department would serve as a conduit for the release of intelligence, such as Khrushchev's "secret speech" of 1956 that denounced Stalin. In contrast, the intelligence community now routinely releases information for public consumption, such as the World Factbook on the CIA's website. The defender could use known facts to bolster its deception play with elements of truth.

Secrets: A secret is information that is not intended to be known to the adversary. Examples include economic data and sensor attributes. Secret information collected by the adversary invariably contains gaps and ambiguities. It may be beneficial for the defender to design a deception play that leads the adversary to believe that a secret collected by the adversary is disinformation.

Disinformation: Disinformation can be expected to be discarded by the adversary once it is identified as disinformation. Therefore, it is imperative that the deception play be as consistent as possible to convince the adversary of the authenticity of the information.

Disinformation can distort the adversary's confidence in its intelligence channels [START_REF] Berkowitz | Strategic Intelligence for American National Security[END_REF]. This, in turn, may affect the credibility of other adversary assessments. Paradoxically, the damage usually occurs when disinformation is successfully exposed. For example, in the late 1950s, the Soviets deliberately exaggerated their ballistic missile numbers. The deception was revealed when the first U.S. reconnaissance satellites showed that the Soviets had only deployed a few SS-6 missiles. The discovery of the deception caused U.S. analysts to doubt the credibility of other (most likely true) information they had gathered about Soviet military strength.

Mysteries: A mystery cannot be resolved by any amount of secret information collection or analysis [START_REF] Berkowitz | Strategic Intelligence for American National Security[END_REF]. This can occur, for example, when multiple outcomes are probable, and the number of outcomes cannot be reduced by any means available to the adversary.

Cyberspace Sensors

Cyberspace sensors may be used for a variety of purposes, including system monitoring, fault detection and data collection. Our focus is on sensors that detect cyber operations -the attack, defense and exploitation of electronic data, knowledge and communications.

In the context of cyber operations, sensors may be placed in assets belonging to the defender, adversary and/or third parties. The sensors may be located in communications channels and networking devices such as routers, switches and access points. Sensors may also be placed in computing platforms: servers (platforms that provide services); hosts and edge devices (clients and mobile devices); and SCADA devices (e.g., programmable logic controllers and remote terminal units).

It is important to recognize that sensors may be positioned external to computing and communications assets. Examples include human beings located at control centers, and mechanical devices and physical systems that are connected to computing and communications assets. Sensors may also integrate and correlate data received from other embedded sensors.

Several types of sensors can be defined based on the adversary's knowledge and beliefs about the values of the sensor attributes:

Open Sensor: All the attributes of an open sensor are known to the adversary.

Covert Sensor: All the attributes of a covert sensor are not known to the adversary. The very existence of the sensor is hidden from the adversary.

Phantom Sensor: A phantom sensor does not exist. However, the adversary believes that the sensor exists and knows some or all of its attributes. In other words, the adversary believes it to be a non-covert sensor.

Obfuscated Sensor: An obfuscated sensor is a non-covert sensor for which the adversary has incorrect or incomplete information about at least one attribute.

Shielding Cyberspace Sensors

This section discusses several tactics, plays and enabling methods for shielding cyberspace sensors.

Shielding Tactics

A shielding tactic involves a single action on the part of the defender. The tactics are categorized according to the actions and their relation to reality. Active and passive deception techniques are employed to hide and/or reveal certain sensor attributes.

Revealing Tactic: A revealing tactic exposes one or more sensor attributes to the adversary.

Masking Tactic: A masking tactic uses a passive deception technique (e.g., camouflage or concealment) to hide one or more sensor attributes.

Misleading Tactic: A misleading tactic uses an active deception technique (e.g., planting false information, implementing a ruse, display or demonstration, or lying) to falsify one or more sensor attributes.

Distraction Tactic: A distraction tactic distracts or redirects the adversary's activities. This play should not reveal any of the sensor attributes.

Shielding Plays

Shielding plays implement one or more shielding tactics. A shielding play is categorized according to the sensor attribute values that are believed by the adversary to be true after the play is executed by the defender.

The four plays described below are in conformance with the See-Think-Do methodology.

Open Sensor Play: An open sensor play reveals the correct values of all the sensor attributes to the adversary. Complete knowledge about a sensor serves as a deterrent because the adversary knows that the defender can detect an unfriendly act and may retaliate. Of course, complete knowledge about a sensor enables the adversary to take countermeasures.

Covert Sensor Play: A covert sensor play hides the existence of a sensor, including all its attribute values. Such a sensor is similar to the "gatekeeper" submarine that was secretly positioned near a Soviet port to collect data about Soviet nuclear submarines. A covert sensor has limited use (on its own) because it is often the case that the adversary needs to know that some type of sensor exists to detect an unfriendly act on the part of the adversary.

Phantom Sensor Play: A phantom sensor play is designed to convince the adversary that the defender has a sensor that, in reality, does not exist. A phantom sensor play could implement a misleading tactic that involves the defender being told about the adversary's activities by a third party, but revealing to the adversary that the activities were detected by a sophisticated sensor.

Sensor Obfuscation Play: A sensor obfuscation play releases some (correct or incorrect) information about the sensor to the adversary but hides enough information so that the adversary cannot subvert detection by the sensor. An example involves the defender's sensors detecting Trojans placed by the adversary on several computing assets, some owned by the defender and some owned by third parties. However, the defender confronts the adversary with the Trojans discovered on its assets, but does not mention the Trojans placed on the third party assets. This play shields the sensors on the third party assets by not revealing information about their location and range.

Enabling Methods

Sensors are shielded by executing plays based on the deception framework and constructs described above. Numerous variations of the plays exist, giving the defender considerable leeway to demonstrate to the adversary that the defender knows about some asset or activity by revealing incorrect or no information about one or more of the sensor attributes.

Two enabling methods, shepherding and distraction, are especially useful in situations involving multiple sensors.

Shepherding: Shepherding involves convincing the adversary and/or other parties to adjust their activities to the advantage of the defender. Shepherding has at least three variants. One is to convince the adversary to shift its activities so that they can be detected by an open sensor. Another is to move a non-covert sensor to where the adversary is conducting activities. A third is to shepherd a third party sensor to where the adversary is conducting activities. A honeynet can be used as a shepherding tool. Note that the defender can use the honeynet to implement an open sensor play on one sensor and other plays on the other sensors.

Distraction: Distraction is designed to progressively divert the adversary's attention from secret sensor attributes. This method can be used to create confusion (possibly panic) inside the adversary's network. Consider a situation where the adversary releases a worm that tunnels into the defender's network. In response, the defender conducts a display (or ruse) that releases the same worm in the adversary's network -intending for the adversary to believe that the worm was erroneously released in its own network. To reinforce this belief, the defender plants information in the media that the adversary's experiments with cyber capabilities infected its own network with a worm.

Shielding Play Pitfalls

The efficacy of a shielding play is limited by the amount of time and resources available for its planning and execution, and the adversary's susceptibility to deception [15]. Despite the best efforts of the defender, a shielding play can fail for many reasons. The adversary may not see all the components of the play, may not believe one or more components, be unable to act, or may decide not to act or act in an unforeseen way even if all of the components of the play are believed; also, the adversary may simply discover the deception [15].

The failure or exposure of a shielding play can significantly affect the adversary's operations. For this reason, the defender should understand the risk associated with an action that is based on the assumed success of a shielding play. In general, there are two broad categories of deception failures: the defender does not design or implement the shielding play correctly or the adversary detects the deception.

Even if a shielding play is successful, it is possible for the adversary to compromise the defender's feedback channels [15]. Another problem is that unintended third parties may receive and act on the deceptive information intended for the adversary. The risks associated with these eventualities must be weighed carefully against the perceived benefits of the shielding play.

A shielding play can be discovered by the adversary via direct observation, investigation or indirect observation [START_REF] Yuill | Using deception to hide things from hackers: Processes, principles, and techniques[END_REF][START_REF] Yuill | Designing deception operations for computer network defense[END_REF].

Direct Observation: Direct observation involves sensing and recognition. The adversary relies on one or more sensors (e.g., a network port scanner or packet sniffer) to discover the shielding play.

Any attempt to defeat the adversary's discovery process must consider how, when and where the adversary receives information. The defender must then target the adversary's detection capabilities and/or information gathering processes. For example, the installation of a firewall can prevent the adversary from conducting a port scan. Alternatively, the deployment of a honeypot can compromise the port scanning process by providing incorrect information.

Investigation: Investigation involves the application of analytic processes to the collected evidence rather than direct observation. An investigation helps discover something that existed in the past, or something that exists but cannot be observed directly. Note that an investigation relies on the analysis of evidence; it cannot be used for predictive purposes because evidence of future events does not exist.

An investigation can be thwarted by compromising the adversary's evidence collection and/or analysis processes. Actions can be taken to alter the available evidence, or to diminish or misdirect the adversary's analytic capabilities. These actions are simplified if the adversary has a bias or predisposition that aligns with the shielding play.

Indirect Observation: Indirect observation involves a third party (human or machine) that has discovered the deception either by direct observation or by investigation. Indirect observation is defeated by compromising the third party's ability to make a direct observation and to conduct an investigation. Alternatively, the defender could target the communication channel between the third party and the adversary.

Fireball Express Reprise

The Fireball Express dilemma involves three (initially) covert sensors: the embedded agent, honeynet and Internet sensors. If the U.S. decides that it must respond to the adversary's cyber operation, it must acknowledge that something was detected by one or more of its sensors. Three possibilities (of many) are:

(i) open the honeynet sensor; (ii) obscure the honeynet and embedded agent sensors; and (iii) obscure the embedded agent and honeynet sensors, and create a phantom sensor.

The first option involves conducting an open sensor play on the honeynet sensor. The play could involve one or more revealing tactics. One revealing tactic could be the public announcement by the U.S. that it caught the adversary "red-handed" accessing the honeynet, which was installed as a defensive measure to secure the critical infrastructure. This play would reveal the existence of the honeynet and its corresponding sensor attributes to the adversary.

The second option, obscuring the honeynet and embedded agent sensors, involves using a sensor obfuscation play coupled with shepherding. The sensor obfuscation play may be accomplished by employing a revealing tactic and a misleading tactic. The revealing tactic discloses the sensitivity, range and location of the honeynet and the embedded employee. One approach is for U.S. authorities to publicly announce that "anomalous activity" was discovered at the utility and request blue team assistance. The blue team is a shepherded open sensor that assumes the credit for detecting the adversary's activities via the misleading tactic.

The third option, obscuring the embedded agent and honeynet, and creating a phantom sensor, involves an obfuscation play, a phantom sensor play and a distraction method. The obfuscation play uses a revealing tactic that blocks the adversary's entry into the honeynet by implementing strong access controls. The play reveals the sensitivity, location, range and credibility of the embedded agent and honeynet sensors, but it does not reveal their modalities. The adversary is deceived via a distraction tactic and a misleading tactic. The distraction tactic is a brief denial-of-service (DoS) implemented by ARP poisoning the adversary's network. The misleading tactic plants information that indicates the U.S. has placed sensors in the adversary's network. The planted information is designed to make the adversary believe that the DoS attack was a side-effect of the sensor placement. The distraction and misleading tactics are designed to make the adversary believe that a phantom sensor exists in its core network. This phantom sensor could have the effect of deterring the adversary from conducting cyber operations until the sensor is detected.

The Internet sensors are intended to remain covert in the three U.S. response options. Thus, each option corresponds to a covert play conducted on behalf of the Internet sensors. Note that many other combinations of tactics, plays and enabling methods can be used to achieve the same outcome.

Conclusions

The global reach of the Internet and the difficulty of detecting and attributing attacks make sensors invaluable in defensive operations. Maintaining the secrecy of key sensors and their attributes is vital for several reasons. Adversaries can bypass or develop countermeasures for known sensors. Secret sensors with exaggerated capabilities can create confusion, even fear, on the part of the adversary.

Deception can be used very effectively to shield cyberspace sensors. The deception-based shielding tactics and plays presented in this paper provide the defender with broad situational awareness and the flexibility to respond to adversary operations. Moreover, the tactics and plays enable the defender to shape the adversary's beliefs about the sensors, helping the defender gain tactical and strategic superiority in cyberspace.

Note that the views expressed in this paper are those of the authors and do not reflect the official policy or position of the U.S. Department of Defense or the U.S. Government.

Figure 1 .

 1 Figure 1. Deceiving the adversary.

Figure 2 .

 2 Figure 2. Example deception plays.

Table 1 .

 1 Passive deception techniques.

Table 2 .

 2 Active deception techniques.


Paul Ngo

Duminda Wijesekera

ENHANCING THE USABILITY OF THE COMMERCIAL MOBILE ALERT SYSTEM

Keywords: Emergency response, cell broadcast service, CMAS, alert messages

The U.S. Department of Homeland Security initiated the Commercial Mobile Alert System (CMAS) to inform the general public of emergencies. CMAS utilizes the commercial telecommunications infrastructure to broadcast emergency alert text messages to mobile users in an area affected by an emergency. Because CMAS uses cell broadcast service, the smallest area that CMAS can broadcast messages is a cell site, which is usually quite large for local emergencies. This paper proposes an enhancement that uses CMAS as a transport protocol to distribute local emergency alerts to areas smaller than a cell site. The paper also conducts an investigation of the Common Alerting Protocol (CAP), the current emergency protocol standard, and suggests an enhancement to the CAP message structure for CMAS emergency alerts. The viability of the approach is demonstrated using a prototype implementation, which simulates broadcasts of emergency alerts to confined areas such as a city block or an apartment complex.

Introduction

Emergencies that require the services of specially-trained emergency personnel range from trivial injuries to major disasters such as flash floods, hurricanes, earthquakes, forest fires, tsunamis and terrorist attacks. Due to the unique characteristics of emergency situations, preparing for, responding to and recovering from them is always a challenge.

In the aftermath of the terrorist attacks of September 11, 2001, communications was identified as a major bottleneck for emergency activities. The telecommunications infrastructure experienced an extremely high overload of calls into and out of the targeted areas, which caused congestion at access points and in the core networks. While many calls were blocked and rejected, mobile users were still able to text message each other [START_REF] Stout | Emergency Preparedness and Emergency Communication Access: Lessons Learned Since 9/11 and Recommendations, Northern Virginia Resource Center for Deaf and Hard of Hearing Persons[END_REF]. However, text messaging did not see much use at the time because it was still rather expensive.

In 2006, the U.S. Federal Government established the Worker Adjustment and Retraining Notification (WARN) Act that supported research and development related to the Common Mobile Alert System (CMAS). CMAS is designed to use the existing commercial telecommunications infrastructure to broadcast emergency alerts and warnings to specified geographic areas. However, the smallest granularity of a CMAS broadcast is a cell, which is too large for smallscale emergencies whose effects are confined, such as a major car accident or a burning building. While CMAS is still in the design and development phases, we have identified two shortfalls in the CMAS cell broadcast service specification [START_REF]Organization for the Advancement of Structured Information Standards[END_REF]. One is that CMAS cannot send alerts to confined areas. The other is that the protocol standard does not provide enough information to facilitate effective emergency communications.

We address the first limitation by constructing an Android mobile application that filters CMAS alerts using global positioning system (GPS) data and only displays the alerts to users who are inside the affected area. The second limitation is addressed by enhancing the message structure of the Common Alerting Protocol (CAP) version 1.2 [START_REF]Organization for the Advancement of Structured Information Standards[END_REF] by adding XML tags to facilitate emergency communications.

SMS for Emergency Handling

Informing the general public about emergencies has been a problem for many years. Traditionally, television and radio network broadcasts have been used to alert the public to emergencies. However, television and radio only reach a small percentage of the population at any given time. Americans aged fifteen years and older spend only 6.12% of their time watching television [START_REF]American Time Use Survey -2008 Results[END_REF]. Americans aged twelve years and older spend 11.2 % and 7% of their time listening to commercial radio [START_REF] Arbitron | Public Radio Today: How America Listens to Public Radio[END_REF] and National Public Radio (NPR) [START_REF]Project for Excellence in Journalism, The state of the news media: An annual report on American journalism[END_REF], respectively.

On the other hand, more than 91% of the U.S. population subscribes to a wireless service [START_REF] Foresman | Wireless survey: 91% of Americans use cell phones[END_REF], which is an extremely effective means of communicating information to the general public. Users carry their wireless devices almost everywhere they go. With the proliferation of Internet services, emergency information can be published on news websites and delivered right to a user's wireless device after a simple registration process. Moreover, various alert settings such as the vibration mode and special ringtones can attract attention almost immediately.

A survey conducted after the 9/11 terrorist attack in Washington, DC revealed that, although telephone service into and out of the area was highly congested, people were still able to use text messaging to communicate with each other [START_REF] Stout | Emergency Preparedness and Emergency Communication Access: Lessons Learned Since 9/11 and Recommendations, Northern Virginia Resource Center for Deaf and Hard of Hearing Persons[END_REF]. Ten years later, Short Message Service (SMS) is an extremely popular mode of communication, especially among the younger generation [START_REF]Young prefer texting to calls[END_REF]. SMS used to be expensive in the past -as much as 20 cents per text message sent or received. However, at this time, many service providers offer SMS as a low-cost or free service to attract new customers.

CMAS Overview

Recognizing the importance of SMS [6], the U.S. Department of Homeland Security initiated the Commercial Mobile Alert Service (CMAS) [START_REF]Commercial Mobile Alert Service Architecture and Requirements, Version 0.6[END_REF] to broadcast emergency alert text messages to the general public. Service providers and equipment vendors are actively involved in defining CMAS standards and implementations. Unlike sender-to-receiver SMS, CMAS uses a dedicated primary broadcast control channel (BCCH) to broadcast text messages, which can reach millions of wireless subscribers in minutes.

CMAS is still in the design and development phase. However, it inherits some weaknesses due to its reliance on cellular broadcast service and the existing emergency communications protocol: CMAS alert messages cannot be broadcasted to an area smaller than a cell site, which is defined in the Federal Information Processing Standard (FIPS) code [14]. The area covered by a cell site varies according to population density, but it is too large for broadcasting alerts about smallscale emergencies.

According to the CMAS specification [2], the Common Alerting Protocol (CAP 1.2) is to be used to communicate CMAS emergency alerts. However, CAP 1.2 was designed for emergency communications between government entities of various levels (federal, state and local departments and agencies). Consequently, much of the CAP 1.2 message structure is not relevant to emergency mobile broadcasting. Also, the information carried in the CAP 1.2 message structure does not fully address the essence of local emergencies.

CMAS is designed to disseminate three types of alerts: Presidential alerts, imminent threat alerts and America's Missing: Broadcast Emergency Response (AMBER) alerts [23]. CMAS is not designed to broadcast alerts about local (i.e., small-scale) emergencies.

Cell Broadcast Service for Local Emergencies

This section describes the CMAS enhancement that enables the delivery of alert messages to areas smaller area than a cell site or FIPS code equivalent.

Enhancement Considerations

In 2003, OASIS sponsored the Common Alerting Protocol (CAP) initiative with the objective of providing fundamental messaging protocols to facilitate interagency emergency communications. The OASIS Technical Committee on Emergency Management has developed a set of standards [START_REF]Organization for the Advancement of Structured Information Standards, Emergency Data Exchange Language (EDXL) Distribution Element, v1.0[END_REF][START_REF]Organization for the Advancement of Structured Information Standards[END_REF] that involve a set of XML tags for exchanging information needed to handle emergencies. However, CAP is intended for communications involving emergency responders, operators and other officials; it was not designed to broadcast emergency alerts to a large population. For example, the Sender ID value in CAP is not relevant to members of the public who would receive broadcast alert messages.

Our investigation of the technical specifications of the GSM and UMTS cell broadcast service [START_REF]Alliance for Telecommunications Industry Solutions, Implementation Guidelines and Best Practices for GSM/UMTS Cell Broadcast Service[END_REF] revealed that there are no features or options that could be configured to support the broadcast of alert messages to an area smaller than a cell site. However, given the computing power and functionality provided by modern mobile devices, we opted to build an emergency response application (ERApp) to intercept CMAS alert messages and filter them based on the proximity of users to the location of an emergency. To accomplish this, it was necessary to enhance the CAP message structure to include additional tags. Interested readers are referred to [START_REF] Ngo | Using Ontological Information to Enhance Responder Availability in Emergency Response[END_REF] for our preliminary work on enhancing the CAP message structure.

CMAS Alert Message Structure

A CMAS alert message can be sent in one of two ways. The first is to send the message as raw text, where the values are separated by delimiters. However, this method does not provide enough space to squeeze the necessary information into the message. The second method uses the CAP 1.2 emergency messaging standard [START_REF]Organization for the Advancement of Structured Information Standards[END_REF]. However, a CAP message is in XML format, which requires additional space to store an XML alert message.

Figure 1 shows the CAP 1.2 alert message structure. As mentioned above, CAP 1.2 was designed for emergency communications between officials. For example, when a tornado strikes Louisville, Kentucky, the City of Louisville sends an alert message to the State of Kentucky requesting resources for rescue operations. Officials at the state's emergency operations center then verify that the message is not a hoax. The verification is performed using data such as the message id, sender id, date/time sent, scope, etc.

On the other hand, a mobile user receiving a CMAS alert message would not need any data for message verification. Instead, the user would require information about the emergency such as its nature, location and the precautions to be taken. Much of the information in the CAP 1.2 schema is not relevant to CMAS alert messages. To address this limitation, we have enhanced the CAP 1.2 message structure for CMAS alert messages. Figure 2 shows the enhanced message structure.

We focused on extracting relevant information from the existing emergency messaging standard CAP 1.2 that would be beneficial to mobile users. Also, we created three tags: affected area, spreadable and location. The affected area tag holds the radius of the affected area measured in meters from the emergency location. The value would depend of the specific emergency and would be entered by the emergency coordinator. All mobile users within the affected area would receive CMAS alert messages. The spreadable tag is important in environmental emergencies such as pollution alerts, toxic gas releases, and biological or radiological attacks. The alert might urge users to seek shelter and use gas masks. The location tag holds the latitude and longitude of the emergency, which is easily shown on a map. Figure 3 shows a sample CMAS mobile message corresponding to a tornado alert.

Enhancement for Small-Scale Emergencies

Enhancing the cell broadcast service itself is a complex and time-consuming task. However, given the computing power and functionality provided by modern mobile devices, it is simpler, far less expensive and just as effective to create an emergency response application (ERApp) that would assist mobile users in times of emergency. ERApp is a mobile application (app) written in Java for the Google Android API 2.2 platform. The current version of ERApp intercepts CMAS alert messages and filters them based on the proximity of users to the location of an emergency. It is designed to work in conjunction with ERAlert, a CMAS prototype implementation that simulates the broadcasting of CMAS alert messages to mobile phones using the email texting feature.

When a mobile user launches ERApp, it: (i) updates the local repository; and (ii) retrieves and displays the user's current GPS location on a map on the mobile device. The GPS location of the user is updated periodically based on !"##$%&'" ()"*+",-.$/0-1'&0, 233"-'"4$2*"1 time and distance, which are set to default values of 60 seconds and 50 meters, respectively. The user can adjust these parameters to reduce the frequency of GPS location queries in order to conserve power.

Under the default settings, the location update is triggered when the 60second time period has expired or the user has moved 50 meters from the last recorded location. GPS data is used to estimate the movement of the user assuming that the user carries the device all the time. Thus, a user headed towards the emergency location could be advised to leave the area immediately.

ERApp receives an alert message from the ERAlert system in a byte-encoded XML format. ERApp decodes the message into its original XML form. It then locates and displays the emergency on the map using the location tag information. In addition, ERApp displays the user's current position with respect to the location of the emergency. If the mobile device is within the affected area, ERApp alerts the user according to the device alert settings (e.g., vibration mode or ringtone) and displays the alert message. The user must acknowledge the alert within a configurable time period or ERApp will continue to alert the user about the emergency. If the user is outside the affected area and ERApp detects that the user is moving towards the affected area, it alerts the user and displays the alert message. Upon acknowledging the alert, the user can view his/her current position on the map along with the location of the emergency and the affected area (Figure 4).

Prototype Implementation

Our prototype system is implemented in Java. The client GUI was developed as a Java Applet. The service engine was developed in Java Web Services running on a JBOSS Community Server 5.1.0 GA with MySQL Server 5.1 as the backend database. The entire ERAlert project was developed using NetBeans IDE 6.9.1. All the Java archive (JAR) files are self-signed with our own certificate to ensure that the files come from a trusted source.

Cell broadcast service has been a standard for many years, but it has not yet been implemented by U.S. carrier networks. Therefore, in order to test our prototype, the only option was to simulate the cell broadcast service functionality. To simplify the testing process, we used the email texting feature offered by service providers.

In the following sections, we describe the various phases involved in the operation of our system. The emergency scenario considered is a tornado touchdown in Arlington, Virginia.

User Login

The user is registered with the ERAlert System by an emergency coordinator. The registration process involves recording the user's information and saving the PKI keys. The PKI keys are used to encrypt and decrypt messages between the web interface and the backend server to mitigate security threats such as man-in-the-middle attacks and password hijacking attacks. The PKI certificate is saved on the local system in our prototype merely to demonstrate that two-factor authentication is implemented. However, in a deployed system, the PKI certificate would be stored on a common access card (CAC) or on a secured universal serial bus (USB) thumb drive. By default, passwords are required to have two lowercase alpha characters, two uppercase alpha characters, two numeric characters and two special characters. The password restrictions can be strengthened or weakened depending on the requirements of the deployed system.

Figure 5 shows the login screen for a registered user. The user enters his user id and password and clicks the Login button. The system then prompts the user to locate his PKI-key file. Once the user locates the file, he clicks the Open button. Upon successful login, ERAlert map screen is displayed as shown in Figure 6. Figure 8. Login error message.

Local Alert Generation

During an emergency, the emergency coordinator enters the event location and clicks the Go button, which pinpoints the emergency location on the map. The coordinator then enters all the necessary information about the emergency such as alert type, event type, message, spreadable nature, affected area, expired time, category, status, urgency level, severity and certainty. As soon as the of the affected area is entered, a red transparent circle appears around the emergency location on the map (Figure 7). Finally, the emergency coordinator clicks the Send button to broadcast the alert message to all the mobile users in the affected area.

ERApp Alert Handling

After the emergency alert is broadcasted to a particular cell site, all the mobile phones in the cell site receive the alert [2]. At this point, ERApp, which listens to the broadcast control channel, decodes the alert to extract the emergency location, affected area, event type, etc., and proceeds to display the location of the emergency, the user's current location and the affected area. ERApp calculates the distance between the user's current location and the location of the emergency. If the user is outside the affected area, ERApp stores the alert on the mobile device until the alert expires (left-hand side of Figure 9). If ERApp detects that the user is moving into the affected area and the alert is still in effect, it sounds the alert until the user acknowledges it. If the user is inside the affected area, ERApp sounds the alert until the user acknowledges it (right-hand side of Figure 9).

AMBER Alert Generation

The prototype also handles other CMAS alert types such as Presidential alerts, imminent threat alerts and AMBER alerts. Due to the amount of in- formation included in an AMBER alert, sending one broadcast message is not enough. Consequently, the prototype breaks up the AMBER alert information and inserts it into smaller CMAS AMBER alerts, which are broadcasted. Upon the smaller CMAS AMBER alerts, ERApp assembles to create the original CMAS AMBER alert and displays it as shown in Figure 10.

Related Work

In April 2007, the Integrated Public Alert and Warning System (IPAWS) [START_REF]Federal Emergency Management Agency, Integrated Public Alert and Warning System (IPAWS)[END_REF] was established by the Federal Emergency Management Agency under Executive Order 13407 signed by President George W. Bush on June 26, 2006. IPAWS seeks to ameliorate public safety at all levels of government by providing integrated and interoperable services to communicate timely alerts and warnings to help conserve life and property. IPAWS uses two communication modes, radio broadcast and mobile broadcast. IPAWS also promotes a standard protocol to communicate alerts and warnings across all government emergency systems. In addition, IPAWS focuses on modernizing and expanding the legacy Emergency Alert System (EAS) to take advantage of cutting-edge technologies. CMAS, which focuses on mobile devices, is one of the major IPAWS projects.

Several universities such as George Mason University [START_REF] Mason | Mason Alert: An emergency messaging system[END_REF] and Louisiana State University [START_REF]PAWS: Emergency text message system (subscribe)[END_REF] have implemented alert mechanisms that require cell phone and/or email registration by users. These systems leverage the existing telecommunications and Internet service provider infrastructures to deliver emergency alerts to users. During an emergency, however, these systems potentially place extreme loads on the associated networks that can lead to service disruptions [6]. Consequently, these alert messages are not guaranteed be delivered to user devices in a timely manner.

In a recent publication [START_REF] Ngo | Using Ontological Information to Enhance Responder Availability in Emergency Response[END_REF], we proposed an enhancement to the Emergency Data Exchange Language (EDXL) [START_REF]Organization for the Advancement of Structured Information Standards, Emergency Data Exchange Language (EDXL) Distribution Element, v1.0[END_REF] and to CAP by adding tags to ensure the availability of responders during an emergency. The tags capture the roles and tasks of emergency personnel. Each emergency responder is associated with his/her role and list of relevant tasks, all of which can be searched in a flexible manner. The search results include a default contact, a list of alternate contacts, even a contact for registering complaints. The search results may also be accessed by a private branch exchange (PBX) to automate the process of contacting emergency responders.

Conclusions

CMAS suffers from two major limitations. The first is that it cannot send alerts to confined areas. The second is that the protocol standard does not provide enough information to facilitate effective emergency communications. We address the first limitation by constructing an Android mobile application that filters CMAS alerts based on GPS data and only displays the alerts to users who are inside the affected area or are moving towards the affected area. We address the second limitation by adding XML tags to the CAP 1.2 message structure to hold the additional information that must be passed to the general public during small-scale emergencies. The viability of our solution is demon-strated by a prototype implementation that simulates broadcasts of emergency alerts to confined areas such as a city block or an apartment complex. Our future research will attempt to leverage advanced mobile device capabilities to advise users during emergencies. In particular, we will extend ERApp to provide intelligent assistance to users.

Figure 1 .

 1 Figure 1. CAP 1.2 alert message structure.

Figure 2 .

 2 Figure 2. Enhanced CMAS CAP 1.2 alert message structure.

Figure 3 .

 3 Figure 3. CMAS mobile alert message (tornado example).

Figure 4 .

 4 Figure 4. Typical emergency scenario.

Figure 5 .

 5 Figure 5. ERAlert login screen.Figure6. ERAlert map screen.

Figure 6 .

 6 Figure 5. ERAlert login screen.Figure6. ERAlert map screen.

Figure 7 .

 7 Figure 7. ERAlert CMAS alert message.Figure 8. Login error message.

Figure 9 .

 9 Figure 9. Alerts outside and inside the emergency affected area.

Figure 10 .

 10 Figure 10. CMAS AMBER alert.