How smart organizations implement security

There are a number of ways in which organizations can improve their cyber security - a few smart ones and many dumb and expensive ones. It is the role of an effective security leader to ensure that their organization gets the most out of the smart ways to improve security, and avoids the dumb ones as much as possible.

In the last decade, I have come across [1] four methods: three (dumb ones) seem to be in widespread use, and the fourth (smart one) seems to go largely unnoticed. The four methods are:

• The FUD bomb
• The Risk based strategy
• The Compliance strategy
• Guerilla tactics

The first three are the losing methods. The FUD bomb used to be popular with vendors of security technology, and in its normal incarnation consisted of hour-long sales talks in which the first half hour was devoted to scaring the pants off the potential client, after which the product to be hawked was delivered--deus ex machina fashion--as the savior with blinking lights to make it all go away. The security holes left by this approach do not need laying out to anyone who's spent more than a few months working in cyber security, executives have now cottoned on to and largely immunized themselves against this sales tactic, and it can be considered ineffective at this point.

The Risk based and Compliance based methods are sort of complementary in their effects, though both are failures. The problem with using Risk and Compliance as a driver to security spend is that it ties the security leader up in ROI [2] discussions which are impossible to win. Usually, the compliance-based discussion ends up with a certain percentage coverage of pre-set security controls, which is then deemed 'acceptable' from a risk perspective.

Even the run of the mill not-so-serious cyber security event cannot be tackled with the cyber defense resulting from a risk and compliance approach: this is the sort of cyber defense a good hacker usually runs rings around. Hackers just are experts in finding that 15% of your 'compliance' that is yet not covered by controls. A daily report of failed authentications, for instance, is utterly ineffective against an intruder who pivots hourly. Of course, in the event, you do not get the 'penetration testing report' to fix your problems at leisure. Instead, you're pwned, and it's up to you, whatever logs and data you have, and the victims to figure out what just happened.

Serious cyber security events with the potential to be company-terminating are typical long-tail, black-swan events that do not fit with risk frameworks at all. A company termination event is the moment at which the risk and compliance discussion is losing its meaning entirely, and is therefore 'out of scope' of such discussions.

This leaves us with the guerilla tactic to run a security team. I will have much more to say about that later, but for now, consider this: the main tactic of guerilla warfare is using someone else’s resources augmented with agile and highly pluggable minimal infrastructure to achieve your goals. Effective security teams work this way, and that is what makes an effective security a somewhat different beast in any IT organization.

[1] And have also tried to use, to my shame.
[2] Return on investment

What is philosophy of cyber security yet again?

The short answer to that question is that it's something that's not yet there but that ought to be invented. It is no secret that we have, in the last twenty years or so, built a world that is radically different from what came before, and that we are in the middle of some sort of technical curve to an unknown destination.

We now have the internet, and many of the 'disintermediations' that were driving the 'dotcom' boom of the late 1990s are now more or less reality. If you doubt this, ask your local author, musician or filmmaker (and yes, in New Zealand these sort of people are 'locals'). And where have all the bookshops gone?

Along the road we know that we have a problem with 'security' in that world, and it is unclear what to do about that and how a possible solution might work. To many it seems that the powers that be are always just asking for more and more control over data and metadata, and run undisclosed 'dragnet' operations on our connections. At the same time, judging only from our mail inboxes, virus and spam writers run unchecked. Little wonder that many feel that these 'powers that be' are asking for more control, and then delivering little.

It is a good question whether a philosophy of all of this is possible. I think it is. Like many good philosophical questions, this problem can be phrased in terms of a dilemma between two fairly easily understood extremes. The truth then at first seem to lie somewhere in the middle. But good philosophy usually gives it a little twist.

In the case of security versus surveillance I think the extremes are this:

1. A (Hobbesian) state of nature, in which each internet user is on their own. A lot of innovation happens, along with a lot of good self-organisation and a lot of bad stuff. The closest we have to something like this in real life is probably the deep web, or darknets. Contrary to public opinion, there is life on the deep web apart from weapons and drugs, but it's not a place to go (digitally) unarmed.
2. A total surveillance state, in which internet crime is quickly stamped out, along with dissent and free speech. The closest we would have to this world is the Chinese firewall. And there seems to be no shortage of politicians in the West who want to take us into this direction too.

Can the future lie somewhere between these two extremes? A first answer to this question would be that it has to - neither alternative is on its own acceptable as a future model for the internet.

A second answer, and one that I've heard given, is that it makes sense to give up some of our freedoms from the Hobbesian internet in order to have some security, and that a Hobbesian 'social contract' with a central power is required to keep the net relatively secure and free. For several reasons that answer - when it comes in the form of the Hobbesian deal - doesn't satisfy me. Hobbes was, for starters, not a democrat, so it is hard to see how such a future state of the internet will align with our wider democratic institutions. My hunch would be that it probably can't, and that a democratically uncontrolled central power would, little by little, take us into the total surveillance horm of the dilemma.

A third answer, and I think the right one, is that we need to rethink the notion of 'security', 'freedom', 'dissent' and so on for a digital world. We sacrifice a lot in the name of security, but to me it seems pertinent that we do not even have a robust philosophical candidate definition for what 'security' actually is. As such, the concept is woolly and vague, an ideal frame to attack all kind of ill-conceived notions of 'security measures' to.

So I think what's necessary is a philosophical twist. That twist has to start by asking some pertinent questions, and coming up with some new principles governing our digital beings. That is what philosophy of cybersecurity is about.

Wait, another new research area?

As time goes by, I'm sort of painfully aware that I'm using this blog to announce some new research topic, like this post on theoretical terms, that then subsequently doesn't happen. I could of course delete these posts, since I'm pretty sure they are interesting to no one and are not informative. However, I'll leave them for now - maybe in the future I may want to pick them up again.

With the increasing interest in cybersecurity, which is what I've been doing over the past 10 years or so, I find the spare time that I have to solve these sort of 'pure play' academic puzzles is sort of lacking.

That doesn't mean these puzzles are not interesting, but for now, they just are not interesting enough.

Operational Implications of the Cyber Security Threat Stack

Cross posted from the Leiden Safety and Security blog:

Looking back on 2014, one can say that 2014 has been the year of the hacker. The world over, cyber security agencies, and cyber securitycompanies, are reporting an increase in the number and the complexity of cyber-attacks. In University of Auckland's IT Security Team in 2014, we have had to deal with more, and with more complex, attacks than before. Such developments place significant demands on cyber security teams. If one thing stands out about cyber attacks, it is that they do not come in one variety. Another thing that can be said is that a single cyber attack is lonely: many incidents now consist of multiple ‘attacks’ using a variety of tools.

For people in business, universities, government and as individuals, the question then arises how we prepare for yet another increase in the number and complexity of cyber security incidents. One particular tool that we use in our team is the threat stack. Used with some caution, the threat stack allows forward planning of our defences against the sort of attacks that we can expect in the next 12 months.

The threat stack is a categorisation of attacks indexed by likely actor and motivation. As shown in the table, it indexes cyber threats from fairly innocuous experimentation, primarily by researchers, to advanced cyber crime and advanced persistent threat. In 2013, Richard Stiennon extended it by adding surveillance to it. At its simplest level, the threat stack can be interpreted as a measure of the motivation and sophistication of a particular group of attackers. It is also possible to attach an approximate timeline to the threats, indicating when these threats were most prominent, and the maturity level of the threat.

Hacker we can see you: getting through to security incidents

The announcement is simple:

"Time: 8 AM to 9 AM
Location: University of Auckland Business School
Event Date: Nov 13, 2014
Organization: New Zealand Information Security Forum (NZISF)

In this talk I will focus on how to detect the groups behind our incidents, and some of the methods that we use in the security team at the University to detect hacking early, preferably before it has done any damage. We have developed a number of ‘predictive controls’ that have proven successful in detecting and deterring compromises of University data. I provide an overview of some external research outlining why such predictive controls are now a necessity for any security team. I then discuss the sort of security skills and security operations that are required to implement and maximise the usefulness of predictive controls."

And that's it. The topic is not so simple, but unfortunately much of it is not something I'd post on my blog. The upshot is that if you run a security team, and do your security operations well, then you'll know what I'm talking about. Many organisations, prior to getting hacked, discover that they had the data pointing to an impending attack all along. But it is searching for, and operationalising this data that is the hard bit.

The key to doing this well is to abstract from incidents. Incidents are one-offs, which you open when they happen and close when done. But the majority of our 'incidents' is generated by groups who keep coming back for more. My talk is about how to identify these groups, and then how to use your incidents in a constructive manner to predict when they'll strike next.

A revival and a shift of focus

If further evidence was needed that our lives seldom unfold according to plan, here is some. Thinking I would safely disappear into writing about theoretical terms and similar niceties about scientific theories, I've become very interested in the philosophy of cyber security. So this post marks a shift of focus, and also serves as an announcement (and promise!) that I'll blog more regularly from now on.

New Project: Theoretical Terms

With the thesis now more or less done, the book on the Tractatus well underway, and (with the exception of one) all the material that didn't make it into the thesis turned into papers, submitted and partially accepted, I can turn some initial attention to my next project: a book and some spin-off papers on Theoretical Terms.

As I've written on my 'About' page over at academia.edu, this project is currently a gleam in my eye more than anything concrete. I've decided to blog about planning and progress of this project, for three reasons: first, it provides some motivation to go and get the project done, and second, it will help keeping some sort of structure to the project. Lastly, looking back, it may be interesting to see how such as (largish) project can be undertaken in the half-academic world. I say ha;f-academic, becuase with my recent job-change, it probably would no longer be a good idea to identify as post-academic. Perhaps (very perhaps) more about that later.

The working title of the project at the moment is something along the lines of 'Theoretical Terms - what theories tell us about nature', and its theme is to give an account and characterisation of the theoretical core of theories of physical science (while the aim is more or less general, it's just that I know most about the latter). I plan to start with Kant, and end with a computational characterisation of theories.

Chemical objects as iterated Kantian objects

In a previous post, I referred to iterated Kantian objects, without really explaining what they were. I can remedy that now. The iterated Kantian object is the end result of my thinking on what theoretical terms and objects featuring in chemical theories really amount to, and hence it is my proposal for how I think the ontology of chemistry might just function.

The idea starts with the discussion that we've had recently, in book length form, on Kant's transcendental idealism. For non-philosophers, transcendental idealism is really how to conceive of the relation between the 'thing in itself' and the 'thing as it appears to us', or, in Kant's terms, the noumena and the phenomena. For Kant, we don't have access to the thing in itself, and our access to the thing as we perceive it is epistemically mediated by what our mind brings to the table in our perception. Here's the discussion point: The 'thing in itself' is only minimally accessible, if at all. I know, I do gross injustice to Kant here, on several levels.

This is where the trouble starts. For one might argue that if the thing in itself is not accessible, then by the same token we don't know that it exists. In Henry Allison's 'Transcendental Idealism' he argues that the 'thing in itself' and the thing as we perceive it' really refer to two modes in which we may reflect on concepts and objects. The 'thing in itself' is what there is beyond the appearances, so to say. In Rae Langton's 'Kantian Humility' she argues that the 'thing in itself' and the 'thing as we perceive it' really refers to two non-overlapping sets of properties of an object -- the intrinsic properties which are inaccessible to us, and the relational properties, which we perceive through our process of receptivity to the thing observed.

All this degenerates pretty quickly into a debate on what Kant might have meant exactly when he made the distinction. This discussion is of historical interest, but as a philosopher of chemistry, with a nasty ontological problem to solve, I propose that we read Kant here in the sense in which Derek Parfit proposes we read him in his 'On What Mattters' -- roughly as a philosopher with a large amount of creative ideas, but also one that sometimes lacks in coherence.

Specifically, I propose that we read the 'thing in itself' as an interesting scientific challenge, and read Kant as a philosopher inviting us to do some probing, even while he maintains that we're trying to peel an onion with an infinite amount of layers. As a scientist, I'm happy with that. I am still somewhat uncertain of how much exactly of Nineteenth-Century science may be read as a debate between scientists probing for this 'thing in itself' and neo-Kantian's admonitions that such probing was somehow inadmissible. I think the development of atomic theory and the tetrahedral carbon atom pose some interesting examples, but for now I digress.

That approach can, I think, make sense of some puzzling issues in current philosophy of chemistry. For the ontological issue plaguing philosophy of chemistry is that in a sense we have two cooperating -- or some might say, competing -- theories of matter: chemistry and physics.

From the viewpoint of Kantian objects, and taking Kant as a creative, but perhaps not entirely coherent philosopher, we can then develop the view that chemistry and physics form two different sets of epistemic conditions placed on matter, and hence develop a different set of pointers to the 'thing in itself'.

The suggestion is that chemistry, as a theory of 'transformation' and 'stuff', does not probe as deeply into matter as physics, which is trying to delve deeper into a foundational theory. These are gross oversimplifications, but will have to do for now. What this suggests is that what's lacking in the Kantian object is a notion of depth, or, more precisely, an account of how things in themselves may sometimes break through their shells of epistemic conditioning if we ask the same question in a different way and then compare notes.

To develop the notion of depth, it is useful to get to some concepts from object oriented programming. In object oriented programming a large complex program is split up into 'objects', say, transactions in a banking system, or personal records, which perform certain functions. The object 'person' in the computer program may 'expose' certain methods, such as 'age', 'address', 'sex', 'income' (if the program in question is run by the IRD) and so on. Other parts of the program can 'consume' these methods, but do not have to know how they are implemented, the 'method' itself is 'encapsulated'. The internal definition is hidden from view, but the results are accessible to the component that wants to use the method.

This is what the idea that I'm developing on chemical objects amounts to: both chemistry and physics populate their relevant concepts -- say, atom -- with encapsulated methods. Physicists developed 'orbitals', 'nucleus', 'electron' etc., chemists developed the concept of 'valency', 'directed bonding', and so on. From inside the science itself this makes sense, but ultimately, these concepts get 'imported' to somewhere else in encapsulated state, and relevant context is lost in the process. By the way, at the epistemic level, I think that Brown and Priest's 'Chunk and Permeate' approach is one example of what I mean here.

The concept of 'iteration' really means that this importing and exporting over time serves to refine the concepts, and develop further relevant contexts to this process. That is, at some point the process iterates out to a more or less coherent view of nature. A large part of the ontological problems currently existing in the philosophy of chemistry are because this process is not finished, though a significant amount of ontological debate also ensues (orbitals, I'm looking at you here) because the philosophers involved have no clue of what they're dealing with. I've read more silliness about the ontology of orbitals in the last year than I care to mention.

So, in a nutshell, this approach depends on a number of things:

• A reading of Kantian 'things in themselves' and 'things as they appear' that's more like Allison's than Langton's
• The idea that some of Nineteenth-Century science may be read as an attempt to probe the inaccessible 'thing in itself'
• The idea that chemistry and physics place different epistemic conditions upon how we perceive objects
• The idea that 'deeper' concepts are encapsulated in the ontology of the object.
• The idea that progress is made through a process of iterating the imports / exports.
  

By the way, programming has a few more terms that are of interest to this sort of philosophy of science. To get a sense of how suggestive some of them are, consider 'refactoring' and 'reverse engineering' (the last is not from object oriented programming, but is a key hacking / security technogy).

Speculative Realism and the Chemical Object

A few weeks ago I became interested in the subject of speculative realism and what the speculative realists might have to contribute to the philosophy of chemistry. At first sight, it seems not too much: speculative realists take the latest French philosophical fashions as their model, and some of the self-important pompous braying-ass ness that are all too often found in French philosophical thought seem to be much in evidence here (the writing style is dominated by superlatives, but I think I can make up my own mind here).

Then on second thought, speculative realism seems involved in travelling from the work of Latour more or less back to earth. If one's starting point is intertwined with the world-weary

'turns' of Bruno Latour, I somehow think it will take a while before one lands back on earth, but it's a journey well worth following, if even from a distance.

Philosophy of chemistry tends to sit more in the analytic tradition, but it has a couple of problems inside this analytic tradition where some thoughts from speculative realism might just help.

For instance, philosophy of chemistry has a large ontological problem, which has been keeping me busy for a few years now. I think I'm close to a solution, and no, it's not a solution that even remotely resembles speculative realism (it has more to do with the notion of encapsulation of properties inside an iterated Kantian object, but maybe more about that in a later post). But there is something intuitively attractive for a philosopher of chemistry about a philosophical position that has the following to say about reality, for instance by Graham Harman in The Speculative Turn [1]:

Radical philosophy is never weird enough, never sufficiently attentive to the basic ambiguity built into substance from Aristotle onward. Radical philosophies are all reductionist in character. Whether they reduce upward to human access or downward to more fundamental layers, all say that a full half of reality is nothing more than an illusion generated by the other half. Objects by contrast are the site of polarization, ambiguity, or weirdness. (p.24)

There is a strange connection here with what I've always found attractive in chemistry over physics: the green lab coats that some people in our lab had, coloured with self-made pigments of course, the dabbling with stuff like thermite in front of a classroom full of astounded kids, the strong coffee, the home brew and distillation (the latter not strictly speaking legal), the fact that, as my own university told me on their careers day, with a chemistry degree one could do everything: they had a graduate who'd started a bicycle repair shop, one that started a mini brewery, and oh, some went into research. All were life-long learners. If speculative realism is somewhere capable of capturing that, there is a lot of French philosophy I'd be prepared to put up with.

[1] Graham Harman, On the Undermining of Objects: Grant, Bruno, and Radical Philosophy, in Levi Bryant, Nick Srnicek and Graham Harman, The Speculative Turn: Continental Materialism and Realism re.Press, Melbourne, 2011)

Innovation in New Zealand

Here's a nice announcements from one of New Zealand's biotechs:

Genesis Research and Development Corporation Ltd (NZSX/ASX: GEN) today reported a cash balance at 30 June 2011 of $178,000 (31 December 2010: $338,000) and a Net Loss for the period of $148,000 (30 June 2010: Net Loss $511,000).

The net loss was substantially reduced following the termination of all staff. Costs include stock exchange and share registry fees, insurance, legal and other corporate costs.

In other words, it's just a shell with just another 6 months to run (HT one of my non-academic colleagues, who pointed this one out to me while swapping share market trading stories, I trade as well, for the record). But of course we need to train more scientists and engineers, yadda, yadda, yadda.... Why the NZX doesn't put this out of its misery is a mystery to me.

Why I'm not an Apple user (and never will be)

This, this, this and this.

One minute of bliss - BWV 573

The Fantasia in C for organ BWV 573 is about 1 minute of pure bliss. Some think Bach never finished this piece, and that it is in fact one of the many unfinished pieces he left. Somehow I doubt that. This piece says about all that can be said in less than a minute.

Whatever happened to the 25.000 word philosophy of science paper?

I read a lot of philosophy of science from the 1950s, 1960s and 1970s. That's not to say I don't keep up with current trends, it just means that I think in many cases there are interesting and unexplored issues in there.

One thing that stands out from this era in the philosophy of science is format. Put that more correctly: length. A lot of the early philosophy of science was done in 70 - 120 page review papers which  reviewed current literature from the philosophy of science and other areas in significant detail, and which were interventionist in the sense that these papers also contained new insights and new work. I found I quite like this format for several reasons:

1. A paper can be read in an afternoon or so
2. Papers can, and often do, contain the relevant details of the points they're trying to make
3. The argument can be developed in sufficient scope and breadth

One of the striking aspects of more recent philosophy for me is that this format has all but disappeared. Most journals are after contributions at around the 8000 word mark or even less and resist 'series' of articles. I suspect that what would have been a 70-120 page paper in the past now often takes the form of a puffed up book, with another 120 pages or so added to round out the manuscript. That is not a criticism of their authors, but it is a criticism of the publishing environment in which we now operate.

I, for one, would really like to see the older 70 - 120 page format revived. Many key papers in the philosophy of science were written in this form, and I somewhere suspect we've lost something with its disappearance. In the age of the Internet and open access publishing, this also shouldn't be too hard.

Reading "On what matters"

One thing I haven't blogged about much is that one of the things I like to read about is ethical theory and political philosophy. This might seem a strange interest for a philosopher of science, but it becomes less strange if we start seeing some of the professional commitments of scientists - such as truthfulness, openness, willingness to revise one's beliefs and so on as ethical commitments in the sense that that's what scientists ought to do. I also believe that these professional commitments have a bearing on how we believe theories to be true, and what we believe our theories tell us about the world.

(As an aside, my problem with the sociological approach to science, such as for instance in the work of Latour, is not primarily that I think Latour is wrong, but that he takes the pathological, unprofessional behaviour as the norm in science, and then seeks to build a theory of 'nature' on that. My problem with this approach is not merely that I think Latour is wrong (I believe he is) but that he is so cynical.)

Being somewhat, though not entirely, continental in philosophical outlook, I am also not a big fan of utilitarian approaches to ethics, but see more value in a deontological approach.

Anyway, I just this week got my new copy of Derek Parfit's 'On what Matters' and am now up to about Chapter 3. The interesting bit about Parfit's view on ethics is of course that he believes (and builds arguments in favour of) the idea that the consequentialist and deontological approach eventually lead to the same mountain peak - that, in the words of the manuscript version of the book, both approaches climb the same mountain.

To achieve this, Parfit re-engages with Kant in a way that I find ultimately very refreshing. He states upfront that Kant's writing is messy and in many places incoherent (unlike many other works on Kant I've read, or even my undergraduate lectures on Kant, who often try to unify the mess by lengthy discourse) and Parfit is the only philosopher I've read who states outright that Kant is prone to emotional outbursts. I've always found these outbursts in Kant too - such as his boast that the philosophy of the Kritik deals definitively with the problems of epistemology ('endgültig gelost zu haben'), his characterisation of New Zealand as one of the seats of radical evil, or his dry wit in answering Woellner's attempt at censorship in the Battle of the Faculties (at least I hope it's dry wit, otherwise that passage is unbearably servile).

So, right, I'm engaged.

What he said

Iain Pears sums up my thoughts on A.C. Grayling's 'New College' exactly here, but says it much better than I could.

More stuff on Synthese

Leiter has a post up here where he asks 'what to do now' after the response of the Editors in Chief of Synthese was published. As far as I'm concerned, not too much. Enough digital ink has now been spilled over this issue, and I would suspect most people now have more or less a position on the issue and the matter will fall where it falls. From my perspective, no further organised action is required. Leiter having posts such as this one or this one for instance, is just beating a dead horse, and quite frankly smacks of an unhealthy Schadenfreude. And so do his suggested smears against 'European formal philosophers'.

For the record, here is my personal position. Yes, I did sign the petition. I did so because I believe that the Editors in Chief made a serious error of judgment in publishing the disclaimer, and one that ought to be rectified. The response of the Editors is in my view not a sufficient response to the demands of the petition, and the website on which it was published was surely strange (set up specifically for the purpose in such a way that the content is not searchable).

But I will not be signing on to some organised boycott of the journal. I somehow expect that to achieve little. Individuals will submit to Synthese and referee for it as they see fit, and given that journals such as Synthese play a key 'career making' role for starting and established philosophers I somehow expect that the journal will continue to stagger on on its present course for a few decades more. Philosophers are not people who like change, and matters of pedigree, prestige and reputation play a key role in the discipline.

Privately, I had already made a decision to look elsewhere for a number of reasons, among which are the following

• 'Career making' in philosophy is unimportant to me, which diminishes the attraction of high profile journals with all their attendant issues;
• Last time I looked, Synthese had an enourmous backlog of material only published on line, and the print journal was way behind;
• My last experience refereeing for the journal was not a good one, and I had already resolved to decline any such requests from them in the future;
• I believe initiatives such as sympoze will over time prove to be a better repository for the effort I put into academic work.

So in my case, the current hullabaloo only serves to reinforce a decision I had already made.

Two identities

My two CV's pushed through Wordle (click on images for larger graphic).

First the real job

and the academic CV

Two different worlds.

The academic CV has a publication list attached, which is is, I'm sure, why it appears to be all about me rather than about what I can do.

A better wordle is the one with my research interests in it:

On some future directions in the philosophy of chemistry

My academic interests are primarily in the philosophy of chemistry. Since I'm fairly familiar with the literature in this field, and have a few academic hobby-horses running around here too, it's maybe a good idea to sum up some of the currently unsolved problems that I think philosophy of chemistry will run into. Of course, this list is biased and not entirely without any personal interest -- I hope to make some contributions in these areas in the future too.

With that out of the way, here's what I think some of the larger looming problems and directions are

1. The relationship of philosophy of chemistry to the wider philosophy of science. Mohan Matthen has an insightful post on the (lack of) direction of philosophy of science here, which I think is somewhere close to the mark as to the general demise of philosophy of science. I only have one additional comment to make to that post: working in the general philosophy of science increasingly requires in-depth knowledge of one of the sciences, as opposed to more general knowledge. I can see the philosophy of chemistry contributing to some of the wider questions in the philosophy of science on the basis of more realistic theories of chemistry, such as (for example) Eyring's theory of absolute reaction rates, Fukui's theory of frontier orbitals, and Prigogine's ideas on non-linear reactions as mature theories of chemistry that can add new insights to the philosophy of science.
2. The relationship of quantum chemistry to quantum theory. The foundations of quantum theory is a much discussed topic, which I won't go into here. But the basic problem posed in Primas' 'Chemistry, Quantum mechanics and reductionism', which came out in 1981 and again in 1984, is still in my opinion unsolved. Primas argues that quantum mechanics, due to its interpretational problems, is not a good theory to reduce to. Philosophers of chemistry have not really examined how newly proposed interpretations of quantum mechanics, such as in terns of einselection or decoherence have a bearing on this problem. I see the theory of decoherence as a real contender in this area.
3. Chemical ontologies. We have had a lot of discussion about the use of the causal theory of reference in the construction of chemical ontologies, but it seems to me that there is still a large amount of open questions on how to connect chemical theories to ontological theories, such as truthmaking or Quinean quantification. In the wake of this, we might just be able to put paid to the idea of 'ontological reduction' which in my opinion is a particularly unlucky invention that has plagued the philosophy of chemistry for about a decade.
4. Theory formation and theoretical terms in chemistry. There is a paper by Roald Hoffmann in Synthese arguing that chemists do not engage in theory formation in the sense in which it could be argued that physicists do. The question of course is what it is then that chemists' engage in. Hoffmann has his set of answers, but these still have, in my opinion, to be tested against a wider range of examples from chemistry to be useful.
5. Anything having a bearing on inter-theory relations and unity of science with theories of chemistry on one end and biology / physics on the other.
6. Bonding, density, orbitals and observables. This is starting to some degree based on the theories of Richard Bader, but I don't think that the real surprising conclusions of Bader's theory are as of yet fully appreciated - that they allow the calculation of properties on a 'per atom' or even 'per functional group' level. Also this comes back to some of the problems mentioned above below 2.

Open access - free as in gratis or free as in libre

In my post yesterday, I referred to the distinction between free and libre in academic open access publishing, and the four freedoms of the open source software movement.

Today I  came across an open access model for publishing that is much closer to the libre model than the invitation I turned down.

http://www.sympoze.com/ is a website that aims to set up open access publishing in philosophy, with crowdsourced refereeing. I am sympathetic to the idea, but also see a few hurdles along the way. In no particular order, these are

1. Reputational issues tied to funding. With research funding in much of Europe and New Zealand now firmly tied to the number of pages you can get into a top ranked journal, it is very hard for non-established journals to get off the ground. Quite simply, if you work at a university, publishing in an upstart journal is a risk. In your evaluation, only the publications of the last five years count, so if you have a good paper that would be publishable in, say, top journal A, it is a risk to submit to upstart journal B unless you're sure that upstart journal B will make it to the top rank within 5 years. That is unlikely to happen, so most academic will duly submit to top journal A and leave upstart journal B along the wayside, thus further diminishing its chances to get to top rank.
2. Protection against kooks and cranks. In a number of Synthese polls we have seen the activists coming in pretty quick after the poll opened to try and swing the vote in a certain way. Publication of politically contentious issues by refereeing through a crowd sourcing model is going to be, eeerm, interesting.

Open Access, spam and Academic scams (just say no)

Today I got an email from an 'open access' publisher called InTech asking me for a chapter for an upcoming book on quantum chemistry. While asking me to write something about quantum chemistry is not completely out of the question, it didn't take long to spot the scam:

1. There seemed to be no direction for what the book was about. If I've got anything to do with quantum chemistry these days I'm a philosopher of quantum chemistry, not a working quantum chemist (anymore)
2. The editor of the volume was someone I'd never heard of, and I know many quantum chemists by name.
   
3. The editor of the volume, from his affiliation, doesn't seem to work in quantum chemistry at all
   
4. The volume is not referenced in the major scientific citation indexes
   
5. I need to pay €590 to get published. Huh? I already write for free.
   

So here is the text of the mail, with some comments in between, and XXXXX's to protect the guilty:

Dear Dr. Hettema,
As a specialist in your field of research, we are pleased to invite you to contribute to our forthcoming Open Access book, "Quantum Chemistry", ISBN XXX-XXX-XXX-XXX-0

Didn't that just tickle you. More please!

The book will be published by InTech, Open Access publisher of books and journals in the fields of science, technology and medicine.

Oooh, I like open access. Cue Homer Simpson spotting a doughnut… But it is unclear to me that what you are proposing will meet my definition of open access, which is based on the 'four freedoms' of the open software movement, and firmly on the 'libre' end of the spectrum. What I'm seeing here is more along the lines of 'gratis sponsored by author'.

InTech is a pioneer in the publication of Open Access books, with a collection currently comprising over 400 books written by more than 25,000 renowned authors. The complete collection is available for free full-text download on our reading platform, www.intechopen.com.

Wow, so this is my chance to be one of the 25,000 renowned, provided of course that I pass your stringent quality criteria…what are these?

This will be a reviewed book that will cover the latest research in the field, and will serve as a free, open access resource for scientists and researchers around the world. The book will be edited by Dr. XXXXXX, an experienced scientist in the field and written by a team of international experts.

Tickle, tickle. I've never heard of Dr X, and if he really is an experienced scientists in the field as you claim, that's odd (not impossible, just a tad improbable). I've been around in quantum chemistry for long enough to have a pretty good sense of who's who.

When you publish with InTech, you make your paper freely available online. Additionally, you:
- Increase your visibility, impact and citation rates;

Eeerm, do I really? You mention google as one of your major citation indexes….

- Keep the copyright to your work;
- Receive a hard copy of the complete book;

For the simple fee of €590 to get my paper in I'm sure that's a bargain.

- Help speed up research;
- Make your work freely available to everyone, benefiting the whole of society.
You have been invited to contribute based on your paper "Explanation and theory formation in quantum chemistry", your publishing history and the quality of your research. However, we are not asking you to republish your work, but we would like you to publish a new paper on one of the topics this book will cover.

Tickle, tickle….

I am the Publishing Process Manager for this book […]

Nice title. I work in business and haven't come across this one before and I've seen a few. I can stop it here. So now for some more fact finding.

The 'easy one click' links they provide in the email track you so they keep track of who visited their page to see the 'invitation'. At least they didn't hide the tracking in the URL., it's there in plain sight:

http://www.intechweb.org/welcome/3b179faa717d8e2afea0e75835c0d4b1/<you@your.institution>

I classify these sort of things as a scam preying on vulnerable junior scientists. Getting a chapter published in this travesty of an open access journal will not enhance your career one iota, you'll be out of pocket by €590 (which is a big deal for an 'indie' like me; the taxman will pay his share, but it's still a lot of money).

I think there are better models to get your stuff out than this one, for instance the one I'm quietly piloting at the moment: self arranged peer review with publication via Createspace.