News for hackers. Stuff that matters.
Re:Deliberately optimizing for harm by at_a_remove on Wednesday March 16, 2022 @10:56AM (#30699598)
At the risk of putting myself on a watchlist, They already know that, so They have an eye on certain kinds of labware, different precursors, and such. And They already have antidotes to some of these poisons.

One could optimize for compounds with hard-to-monitor precursors. Compounds that can be transported with low vapor pressure and volatility, so they cannot be easily sniffed out.

Or imagine a lethal compound with a high delay factor. Or something with specifically panic-inducing effects, perhaps hemorrhagic with a side effect of your skin sliding off in great slick sheets. Another interesting high delay factor compound might induce psychosis: have fun tracking where these gibbering maniacs were a week ago.

With a sufficiently dark imagination, "needs" could be identified for all sorts of compounds.

Remember, the goal is to throw a monkey wrench into the gearwork of an opposing civilization, not necessarily to kill. Fear of the unknown is very effective for this.

Re:Deliberately optimizing for harm by logifail on Wednesday March 16, 2022 @11:11AM (#30699763)
> At the risk of putting myself on a watchlist, They already know that, so They have an eye on certain kinds of labware, different precursors, and such. And They already have antidotes to some of these poisons.

Errm, maybe They Do.

On the other hand, I used to work in an organic chemistry research lab, and at least within my ex university's context, we could basically order anything we wanted from the standard chemical suppliers without anyone batting an eyelid. Pre-signed but otherwise blank order forms were freely handed out, you just filled in what compounds you wanted and handed it over, two days later it arrived and you collected it from Stores.

I personally ordered a compound for a reaction I was planning and it was only after it arrived - when I read the safety data sheet - that I realised just quite how toxic it was.

I backed carefully away from that particular bottle, and left it in the fridge, still sealed. Then found another - safer - way to do the reaction instead...

Re:Deliberately optimizing for harm by emaginniss on Wednesday March 16, 2022 @11:22AM (#30699913)
Right, and if you had ordered 3 barrels of the stuff, you'd get a visit from the feds.
Re:Deliberately optimizing for harm by logifail on Wednesday March 16, 2022 @12:14PM (#30700679)
> 3 barrels of the stuff

Barrels? Based on what the LD50 was / what the data sheet said, the bottle I briefly had in my hands - and yes, they did start shaking - would have done for a good proportion of the residents of a small city had it managed to be spread around in a form that would have been ingested.

Chemistry labs are typically well-stocked with quite a lot of fairly unpleasant things. They're also the places where a lot of genuinely amazing and potentially live-saving work gets done!

Re:Deliberately optimizing for harm by tetsusaiga on Wednesday March 16, 2022 @02:08PM (#30702063)
You can't just tease us like this! If not the actual chemical... maybe an analogue or something? Chemistry is one of my great fascinations lol.
Re:Deliberately optimizing for harm by kortex on Thursday March 17, 2022 @09:12AM (#30710760)
Not GP but one time we did a cyanation reaction (attaches a -CN group) in the pilot plant involving trimethylsilyl cyanide (TMS-CN). We had what looked honest to god like an 8lb propane tank of the stuff ("cyanide and cyanide accessories" lol), with an air-free delivery siphon, typical for air-free, pyrophoric, and toxic reagents.

Normally we'd do this in the high potency suite but the reaction scale was too big so we did it in the conventional GMP pilot plant. Bunny suits and cyanide meters for all three chemists.

I calculated that dose-wise, it was enough to kill tens of thousands, were it directly delivered, however if it were merely vaporized, it would only kill those in the immediate area, and would hydrolyze quickly. There's a great article linked elsewhere in thread about the ineffectiveness of chemical weapons, I've added it for convenience because it's a great read. Air is big, the distance-cubed law really dilutes any toxic agent beyond dangerous limits quite fast (comparing pound for pound lethality of conventional explosives).

https://acoup.blog/2020/03/20/collections-why-dont-we-use-ch...

Re:Deliberately optimizing for harm by hoseja on Thursday March 17, 2022 @08:53AM (#30710606)
Maybe azides.
Re:Deliberately optimizing for harm by dekhn on Wednesday March 16, 2022 @11:23AM (#30699926)
Is that toxic bottle still sealed, in the fridge, after you've left the institution? I've had to deal with a few EHS situations like that.
Re:Deliberately optimizing for harm by logifail on Wednesday March 16, 2022 @12:09PM (#30700596)
> Is that toxic bottle still sealed, in the fridge, after you've left the institution?

Quite possibly!

The previous occupant of my bench area (and hence adjoining fridge space) left some barely-labeled custom radioactive compounds(!!) in the fridge me to find shortly after I took over that space, so I know how that feels.

After consulting suitably-trained personnel, the contents of the vials were then disposed of ... by pouring down a standard sink, with lots of running water.

Those were the days :eek:

Re:Deliberately optimizing for harm by danuker on Wednesday March 16, 2022 @11:31AM (#30700051)
How did you deal with it? I would expect they don't take returns.
Re:Deliberately optimizing for harm by throwaway0a5e on Wednesday March 16, 2022 @11:46AM (#30700249)
The same thing that happens when someone quits.

The people finding these things have the same skill sets and access to the same handling/disposal facilities as the people leaving these things so it's very much a "oh my former coworker forgot to/didn't have an opportunity to dispose of X before departing, I'll just do it myself in the same manner he would have". Furthermore, these people have lives, they go on vacation and cover each other. The institutional knowledge of how to handles dangerous organic things necessarily exists in the institutions that do so.

Re:Deliberately optimizing for harm by dekhn on Wednesday March 16, 2022 @11:55AM (#30700393)
No bench chemist should attempt to cleanup this stuff. Go to your university or company EHS, and if you don;'t have that, your city does. The history of chemistry is filled with responsible and intelligent organic chemists who nonetheless died terrible deaths. EHS has strategies to avoid this.
Re:Deliberately optimizing for harm by throwaway0a5e on Wednesday March 16, 2022 @11:59AM (#30700455)
Humor us all and think another few steps ahead. And what's EHS gonna do?

They're gonna CC the guy who's office is right beside yours because (surprise surprise) the departments and teams who's work results in them having weird nasty stuff buried in the back of the walk in fridge are the same people who know how to handle it.

EHS is just a coordinator. They don't have subject matter in everything. So they contact the experts. If your biology department fridge with Space AIDS(TM) in it it's because your department is the experts so you'll be getting the call.

Re:Deliberately optimizing for harm by dekhn on Wednesday March 16, 2022 @12:05PM (#30700534)
Yes, I know how these things work, as my coworkers were those EHS people. The point is that they had training, and they are working within an official university context (laws, etc).
Re:Deliberately optimizing for harm by throwaway0a5e on Wednesday March 16, 2022 @12:08PM (#30700581)
So why not save everyone the week of back and fourth emails while nothing gets done and ask them directly how they want to deal with it rather than putting tons of people on blast and substantially constraining their options by bringing intra-organization politics into the mix?
Re:Deliberately optimizing for harm by QuercusMax on Wednesday March 16, 2022 @02:24PM (#30702247)
Sounds like a great way to get Normalization of Deviance[1]. One senior person says "I know how to dispose of this, so it's OK if I don't go through proper channels." Then the next person, following their lead without understanding the implications, says "Joe Senior over there disposed of something scary they found without wasting time going through EHS, so I'll do the same." Maybe it goes fine for a while, but eventually you'll end up with a situation where you've poisoned the groundwater or released dangerous chemicals into the air, because nobody is following the proper channels any more.

1. https://en.wikipedia.org/wiki/Normalization_of_deviance

Re:Deliberately optimizing for harm by throwaway0a5e on Wednesday March 16, 2022 @04:11PM (#30703421)
Telling your boss or relevant colleague instead of going over everyone's heads from the get go isn't normalization of deviance and we both know it.

I really dislike these sorts of "name drop" comments. They're just equivalent of "F" or "the front fell off" with a high enough brow for HN veneer on top.

Re:Deliberately optimizing for harm by QuercusMax on Wednesday March 16, 2022 @04:43PM (#30703820)
You're suggesting that people bypass official procedures and/or laws in order to save time. This is a bad path to start down. The fact that you're posting this as a throwaway indicates that you don't want your HN account associated with these proposals.

Here's a relevant software-related analogy:

I work in a situation where if we receive certain types of data, we have to go through proper procedures (including an official incident response team). It would be very easy for me to say "I've verified that nobody accessed this data, and we can just delete it," instead of going through the proper channels, which are VERY annoying and require a bunch of paperwork, possibly meetings, etc.

Maybe nothing bad happens. But next time this happens, one of my junior colleagues remembers that the 'correct' thing to do was what I did (clean it up myself after verifying nobody accessed the data). Except they screwed up and didn't verify that nobody had accessed the data in question - and now we are in legal hot water over a data privacy breach.

And then people go back through the records, and both the junior engineer and I get fired for bypassing the procedures which we've been trained on, all because I wanted to save some time.

Re:Deliberately optimizing for harm by throwaway0a5e on Wednesday March 16, 2022 @04:58PM (#30704006)
>You're suggesting that people bypass official procedures and/or laws in order to save time. This is a bad path to start down.

You are assuming rules say what they mean and mean what they say (and are even written where you're looking, and if they are that they're up to date). If it's your first week on the job, by all means, do the most literal and conservative thing. If it's not, well you should know what your organization actually expects of you, was is expected to be reported and what isn't.

There's a fine line to walk between notifying other departments when they need to be notified and wasting their time with spurious reports.

When maintenance discovers their used oil tank is a hair away from being a big leaking problems they just fix it because they are the guys responsible for the used oil and keeping it contained is part of their job.

Your bio lab or explosives closet isn't special. If the material is within your department's purview then that's the end of it.

Not every bug in production needs to be declared an incident.

>Maybe nothing bad happens. But next time this happens, one of my junior colleagues remembers that the 'correct' thing to do was what I did (clean it up myself after verifying nobody accessed the data). Except they screwed up and didn't verify that nobody had accessed the data in question - and now we are in legal hot water over a data privacy breach.

You can sling hypothetical around all you want but for every dumb anecdote about informal process breaking down and causing stuff to blow up I can come up with another about formal process leaving gaps and things blowing up because everyone thought they had done their bit. It's ultimately going to come down to formal codified process vs informal process. Both work, both don't. At the end of the day you get out what you put in.

>The fact that you're posting this as a throwaway indicates that you don't want your HN account associated with these proposals.

This account is how old? Maybe I just use throwaways because I like it.

Re:Deliberately optimizing for harm by dekhn on Wednesday March 16, 2022 @04:42PM (#30703811)
It sounds like you may have had a bad time with EHS in the past. I found that by making friends with everybody involved ahead of time, I suddenly had excellent service.

sadly, after 30 years of training to be a superhacker on ML, my greatest value is actually in dealing with intra-organizational politics.

Re:Deliberately optimizing for harm by QuercusMax on Wednesday March 16, 2022 @04:45PM (#30703856)
I work in a regulated software space, and my experience is that treating quality and regulatory folks as adversaries is a great way to have your projects take way longer than they should and cause immense frustration. Understanding the hows and whys of the way things work makes life easier for everyone. I haven't worked with EHS in the past, but I imagine it's much the same - if you're seen as somebody who's trying to cut corners and take shortcuts, yeah, you'll probably have a bad time.
Re:Deliberately optimizing for harm by ISL on Wednesday March 16, 2022 @07:07PM (#30705304)
Great EH&S people are amazing.

At the root of researchers' reactions to EH&S are two things:

1) EH&S will frequently be the source of unfunded and unresourced mandates. "You must stop your research until you've properly tidied up all of your electrical cords" is, in the short term, an impediment to forward progress. Researchers frequently under-budget for safety/disposal costs when submitting proposals, leaving nobody with money to foot the bill for expediting the resolution for a safety stoppage.

2) The statistical likelihood of a single accident is greater for a large organization than for a single research group. One group can get away with a lethal practice for a hundred years before the first death. A hundred labs will only get away with a similar practice for a year.

If you find a competent and reasonable EH&S auditor, they are a great resource. They may ding you for some safety violations, but they'll be able to point the way toward safer practices. In the best case, even if they don't have mitigation funds for longstanding problems, their voices carry real weight and can expedite the allocation of scarce resources toward real safety concerns.

Re:Deliberately optimizing for harm by mcguire on Wednesday March 16, 2022 @02:26PM (#30702263)
This is how you wind up spending many, many $ remediating a building. And getting those weird questions like, "Inventory says we have 500ml of X, anyone know where it is?"
Re:Deliberately optimizing for harm by logifail on Wednesday March 16, 2022 @04:23PM (#30703567)
> This is how you wind up spending many, many $ remediating a building

Oh yes, and this isn't a new phenomenon, for instance:

"When Cambridge's physicists moved out of the famous Cavendish laboratories in the mid-1970s, they unintentionally left behind a dangerous legacy: a building thoroughly contaminated with mercury. Concern about rising levels of mercury vapour in the air in recent months led university officials to take urine samples from 43 of the social scientists who now have offices in the old Cavendish. The results, announced last week, show that some people have exposure levels comparable to people who work with mercury in industry."[0]

[0] The mercury the physicists left behind https://www.newscientist.com/article/mg12817450-800-the-merc...

Re:Deliberately optimizing for harm by dekhn on Wednesday March 16, 2022 @11:33AM (#30700078)
You call your university's EHS department and tell them as much about what you know about the contents of the bottle (which may not be what is on the label). They seal off the lab, remove it, and using what they can determine about the contents, destroy it safely.
Re:Deliberately optimizing for harm by david422 on Wednesday March 16, 2022 @11:35AM (#30700102)
> I backed carefully away from that particular bottle, and left it in the fridge, still sealed. Then found another - safer - way to do the reaction instead...

I've wondered how manufacturing plants handle this. You back away because you're afraid of touching the stuff - how does a giant factory that produces and ships the stuff handle it?

Re:Deliberately optimizing for harm by detaro on Wednesday March 16, 2022 @01:53PM (#30701878)
It clearly can be handled, the question is what's the procedure to handle it correctly and do you trust your procedure? Manufacturer or someone regularly working with this kind of thing does know and trust, if you suddenly realize it wasn't quite what you signed up for backing off is clearly the better choice than trusting your guess at procedure. But risk can be managed a lot.

Although certainly over-confidence can also happen on the other end, e.g. if something that's quite similar to other dangerous things you work with suddenly has an additional trap. And Safety Datasheets are notorious for not necessarily representing actual in-use risks well.

Re:Deliberately optimizing for harm by 323 on Wednesday March 16, 2022 @12:34PM (#30700935)
The same way other dangerous stuff is made?

There is plenty of dangerous chemicals made on a huge scale - sulfuric acid, cyanide, explosives, ...

Re:Deliberately optimizing for harm by marcosdumay on Wednesday March 16, 2022 @12:35PM (#30700955)
"They" are not proactive, because they know people hiding bad things need time and coordination. So, only taking notice (and notes) and investigating strange patterns is enough.

But also a lot of what the GP says doesn't apply, because on the case of terrorism, "They" is either the police or random people, so "They" definitively do not have antidotes or training on how to handle known poisons.

Re:Deliberately optimizing for harm by jhart99 on Thursday March 17, 2022 @06:23PM (#30716543)
I've also worked in chemistry research labs and there are certain compounds (in the US) at least that will need approval. Anything on the DEA precursor list will do it. There are certain chemicals that are dual use for chemical weapons and chemotherapy synthesis (things to make melphalan for example). Those required some extra forms to order.
Re:Deliberately optimizing for harm by Enginerrrd on Wednesday March 16, 2022 @01:44PM (#30701775)
Flourine compound? Organic heavy metal? I'm curious.
Re:Deliberately optimizing for harm by Enginerrrd on Wednesday March 16, 2022 @01:39PM (#30701728)
>Another interesting high delay factor compound might induce psychosis

This kind of exists already. BZ gas is the well-known delirium-inducing compound with a delay of several hours: (https://en.wikipedia.org/wiki/3-Quinuclidinyl_benzilate#Effe...)

The effects are probably mostly temporary though.

Re:Deliberately optimizing for harm by VLM on Wednesday March 16, 2022 @12:02PM (#30700499)
> Or imagine a lethal compound

You'll get nuked (or similar WMD) for that.

Imagine a somewhat more realistic set of applications for hot new research chemicals.

How about aircraft or shells or covert actors spray some "thing" that shorts out electrical insulators 1000x more often than normal. Or makes the vegetation underneath power lines 1000x more flammable than normal vegetation. Our power is unreliable causing a major economic hit both directly and via higher electrical bills. If "they" want to invade now the civilians won't have power and be more likely to get out of the way long before the front line troops arrive. I mean you could probably put nano-particles of graphite in a spray can right now, then stand upwind of a power station or substation, but I bet extensive research would do better. A lot of high power electrical "Stuff" relies on plain old varnish being inert for a long time ... what happens if it wasn't? Again you shut down a country they gonna nuke you, but what if electrical power transformers and switching power supplies only last one year on average instead of ten? Thats a huge economic and maybe military strategic advantage but would you get nuked back because some nation's TVs burn out in one year instead of the carefully value engineered ten years?

How about a spray or microbe or whatever that screws up air filters. Who cares, right? Well most troops (and cops) in most countries have gas masks. Zap their masks via whatever new magical method, then drop simple plain old tear gas the next day or until logistics catches up, which will take awhile assuming they even know they're damaged. Normally when hit with CS, they'd mask up and the CS would have no effect on mask wearers other than reduced vision, but now the side that didn't get their masks ruined has a HUGE tactical advantage.

If you make a bioweapon and kill half the population, they gonna be PISSED and you're gonna get nuked. So try something a little more chill. If your vitamin A reserves are gone, your night vision is temporarily essentially gone. Yeah for long term vit A deficiency you'll get long term skin, general growth, and infection risk problems, but if someone sprayed you with some weird compound that made you pee out all your bodies stores of Vit A before tomorrow morning, the only real short term effect would be night blindness, and that would go away in a couple days with a normal-ish diet or by taking a few days of multivitamin pill or a couple supplement vit A pills. So spray the enemy (and/or the civilians) and they can't see in the dark so magical automatic curfew for the civvies and attack the night blind military and absolutely pound them because they're night blind and can't see your guys. If they have NVGs then hit them at dawn/dusk when the NVGs won't work completely correctly but they can't see without them because of night blindness. Its temporary and never hurt no one other than the opfor "owning the night" until the victims figure it out or naturally recover, so at a strategic / diplomatic level would a country nuke another country because they couldn't see at night for a couple days? Naw probably not. And you can imagine the terror attack / psych warfare potential of leaflets explaining, "we turned off your night vision for a couple days, now obey or we shut off cardiac function next time" Either for the government to use against civilians (think Canada vs truckers) or governments to use against each other (China vs Taiwan invasion or similar). Or give them temporary weird fever sweats or turn their pee robins-egg blue or all kinds of fun.

Now the above is all sci fi stuff I made up and AFAIK I'm not violating any secrets act, unless this post magically disappears in a couple hours LOL.

Think of the new non-lethal battlespace like computer virus attacks. Yeah, we could "EMP" Russia to shut off most of their computers and they'd be really pissed off and nuke us right back so thats a non-starter. But release "windoze annoyance virus number 31597902733" and that could have real world effects. Especially if you release 20,30,4000 new zero-days on the same day.

Re:Deliberately optimizing for harm by KineticLensman on Wednesday March 16, 2022 @02:04PM (#30702005)
> How about aircraft or shells or covert actors spray some "thing" that shorts out electrical insulators 1000x more often than normal.

Dropping anti-radar chaff strips is a very good lo-tech way of shorting transformers and power lines. I can't find a link, but IIRC the USAF discovered this accidentally when training missions led to power outages in nearby towns.

Re:Deliberately optimizing for harm by aerostable_slug on Wednesday March 16, 2022 @08:28PM (#30706011)
The US has a dedicated submunition for this mission called the BLU-114/B. It has been highly effective in past uses, though I imagine cleanup after the conclusion of hostilities was a serious pain. There's been research into even smaller conductors that would get inside fan-cooled equipment, though a.) one might imagine potentially negative health impacts on persons exposed to these materials, and b.) it might be difficult to occupy an area previously hit with these types of munitions given the proliferation of fan-cooled equipment in the military.

https://commons.wikimedia.org/wiki/Category:Graphite_bombs#/...

Re:Deliberately optimizing for harm by whatshisface on Wednesday March 16, 2022 @12:32PM (#30700911)
>Especially if you release 20,30,4000 new zero-days on the same day.

Interesting example of how cyber attacks could blow back. Anything you put in a virus can be taken out and used against you.

Re:Deliberately optimizing for harm by kbelder on Thursday March 17, 2022 @03:07PM (#30714762)
Release a highly communicable airborne disease with a low fatality rate, but which noticeable reduces the IQ of a large portion of the infected group.