Obama Talks Toxic Clouds And Runaway Trains, But The Real Cybersecurity Solution Is Still Simple And Obvious
from the and-what's-blocking-that-now? dept
Even as we're encouraged by the direction of the latest cybersecurity bill (with significant caveats), lots of folks have been asking from the beginning for two things: an end to "Hollywood-style" FUD claims of planes falling from the skies, and a clear statement on what existing laws make the kind of information sharing the government desires impossible today. President Barack Obama took to the Wall Street Journal Op-Ed pages today to explain why we need cybersecurity legislation... and unfortunately he failed on both accounts. The opening part is positively cinematic:Last month I convened an emergency meeting of my cabinet and top homeland security, intelligence and defense officials. Across the country trains had derailed, including one carrying industrial chemicals that exploded into a toxic cloud. Water treatment plants in several states had shut down, contaminating drinking water and causing Americans to fall ill.He goes on to point out that some of the things mentioned have "already happened," except that's not quite true. It is true that some hackers accessed systems they shouldn't have had access to, but it's not clear if they were ever able to actually do any damage. Here's Obama's summary of the details:
Our nation, it appeared, was under cyber attack. Unknown hackers, perhaps a world away, had inserted malicious software into the computer networks of private-sector companies that operate most of our transportation, water and other critical infrastructure systems.
Last year, a water plant in Texas disconnected its control system from the Internet after a hacker posted pictures of the facility's internal controls. More recently, hackers penetrated the networks of companies that operate our natural-gas pipelinesWhat's amusing is that the story in Texas came about because a hacker was trying to show that the feds were ignoring and downplaying threats to critical infrastructure. From the details, it looks like the system was vulnerable because of poor password choices, and the stupid decision to connect the system to the internet. So the fact is that "disconnect its control system from the Internet" is the solution. Not more laws. Meanwhile, the story about targeting natural-gas pipelines involved some basic social engineering (spear phishing) rather than any technical hackery. In both cases, the issue appears to be the same: critical infrastructure like that which controls the functioning of water treatment plants and gas pipelines shouldn't be connected to the internet.
But do we need a 211-page law to share information just to recognize that?
The bigger problem is that while the President's Op-Ed highlights how we want to avoid the cinematic story he tells at the beginning, where it fails is that it never explains why the kind of information sharing he's talking about is blocked today. Which rules and regulations are blocking that from happening? No one seems to want to say. Instead, we get legislation that just assumes there must be regulations blocking information sharing and wipes them all away.
We appreciate that Obama says that he'll veto any bill that doesn't include strong privacy and civil liberties protections, but we should never be passing legislation based on made up scary stories.
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: cybersecurity, internet, obama, privacy, regulations, risks, threats
Reader Comments
Subscribe: RSS
View by: Time | Thread
Ahem.
[ link to this | view in chronology ]
Re:
So back on topic, the US is a pretty fcked up country if their companies security is so lax that a script kiddie can derail trains nation wide.
I'm not sure if the Govt realizes it but they are attesting their infra-structure setup incompetence if this scenario is likely to happen.
[ link to this | view in chronology ]
I can write that law in once sentence
"All critical systems related to the power grid, distribution of energy, or pertains to life safety shall not be allowed to connect their respective control systems to the internet, or share hardware that is connected to the internet."
[ link to this | view in chronology ]
Re: I can write that law in once sentence
[ link to this | view in chronology ]
Re: Re: I can write that law in once sentence
Hows that?
[ link to this | view in chronology ]
Re: Re: I can write that law in once sentence
23 words.
[ link to this | view in chronology ]
Re: Re: Re: I can write that law in once sentence
21 words.
[ link to this | view in chronology ]
Re: Re: Re: I can write that law in once sentence
[ link to this | view in chronology ]
Re: I can write that law in once sentence
[ link to this | view in chronology ]
Re: Re: I can write that law in once sentence
[ link to this | view in chronology ]
Re: Re: I can write that law in once sentence
[ link to this | view in chronology ]
Re: Re: Re: I can write that law in once sentence
[ link to this | view in chronology ]
Re: I can write that law in once sentence
"one"
[ link to this | view in chronology ]
The bill will be used against whistleblowers.
The Cybersecurity Act of 2012
SEC. 702. VOLUNTARY DISCLOSURE OF CYBERSECURITY
THREAT INDICATORS AMONG PRIVATE ENTI3
TIES.
(a) AUTHORITY TO DISCLOSE.— Notwithstanding any
other provision of law, any private entity may disclose law
fully obtained cybersecurity threat indicators to any other
private entity in accordance with this section.
==============
A newspaper publishes a story about illegal activity by a corporation. Then the corporation can contact the email-provider of the journalist who wrote the story, and say the information in the article was based on unauthorized computer access, and therefore they need to read the journalist's emails to find out who contacted him. Then the corporation can fire the whistleblower and may even press charges against the whistleblower.
The law removes all privacy protection with the phrase "Notwithstanding any
other provision of law." Emails, passwords, and medical records can all be distributed under it without the users permission, and without the user ever being told.
[ link to this | view in chronology ]
Can anyone who thinks we NEED CISPA or something like it explain how CISPA can protect our electric companies and other critical infrastructure from cyber attacks if private businesses running said critical infrastructure are allowed to continue to leave access to the nations power grid and other stuff accessible on the Internet with zero password protection or other basic security measures?
Without requirements that businesses must follow to protect themselves from cyber attacks the whole thing is just for show to make politicians look like they're doing SOMETHING and taking a security issue seriously.
[ link to this | view in chronology ]
Short and Sweet
Where can we read, edit and comment on the 211-pages?
Our government is obviously broken and needs help from the people.
[ link to this | view in chronology ]
Re: Short and Sweet
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Nearly all were condemnation of Obama's hidden agenda, critical thinking ability and past record.
And then I realized, the target audience is typically (Not always, I know.) well read, educated and better than average awareness of national issues. These were the majority of those lambasting him for a shallow diatribe on how the US needs to enforce cyber security.
I am not really clear on what the president is trying to accomplish. To be honest, I do not trust him and that affects my view of him and his motives.
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
Mars, perhaps?
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
Fear Mongering will sell their BS to the uninformed masses.
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Should have been followed by:
"I then fired my cabinet and top homeland security, intelligence and defense officials for being stupid enough to allow anyone to connect this shit to the fucking Internet."
[ link to this | view in chronology ]
Re:
Great things Obama will never say #2
[ link to this | view in chronology ]
Hey Prez Obama, why such a drama llama?
Hope you feel less hysterical tomorrow.
[ link to this | view in chronology ]
3 big cyberattacks
Perhaps the US Government understands what is possible because it is alleged to be behind 3 of the biggest attacks?
Gas Pipeline - http://www.zdnet.com/us-software-blew-up-russian-gas-pipeline-3039147917/
Software supplied to run a Russian pipeline was deliberately planned to go haywire, causing the biggest non-nuclear explosion the world had ever seen, says a book published today
Then you have Stuxnet and Flame - both have had parties claim the US has had a hand in them.
[ link to this | view in chronology ]
[ link to this | view in chronology ]
To all the armchair industrial control experts out there
Given the two options:
1. Connect your instrumentation to the corporate network & internet. Be able to check status and diagnose from your office desktop. Find it trivially easy to fix issues before they lead to production stops.
Or
2. Make a 400 mile round trip everytime you or a production manager suspects that there is an issue with your kit. Face hostile questions about your expenses and the need to travel at all.
What would you rather do ? Note that in all cases management are far more concerned with immediate costs than future risks.
It is very easy to say "keep your industrial control gear off the internet", rather harder in practice.
[ link to this | view in chronology ]
[ link to this | view in chronology ]