Snowden: NSA Was Building 'Automated' System To Hit Back At Perceived Cyberattacks
from the bad-ideas dept
One final story to highlight from James Bamford's really wonderful Wired profile of Ed Snowden. This one might not be that surprising, but the NSA was building an internal automated "cyberwar" system called MonsterMind, which would seek to detect an incoming "cyber attack" and then automatically launch a counterattack. Here's how Bamford describes Snowden's explanation in his article:The massive surveillance effort was bad enough, but Snowden was even more disturbed to discover a new, Strangelovian cyberwarfare program in the works, codenamed MonsterMind. The program, disclosed here for the first time, would automate the process of hunting for the beginnings of a foreign cyberattack. Software would constantly be on the lookout for traffic patterns indicating known or suspected attacks. When it detected an attack, MonsterMind would automatically block it from entering the country—a “kill” in cyber terminology.Yeah, because false alarms never happen at all. Hell, just this week I was hearing about a series of false alarms when the US thought that Russia had launched thousands of nuclear missiles at the US. Imagine an automated system taught to respond to that?
Programs like this had existed for decades, but MonsterMind software would add a unique new capability: Instead of simply detecting and killing the malware at the point of entry, MonsterMind would automatically fire back, with no human involvement.
And, of course, this only works... if the NSA has access to private company's networks:
In addition to the possibility of accidentally starting a war, Snowden views MonsterMind as the ultimate threat to privacy because, in order for the system to work, the NSA first would have to secretly get access to virtually all private communications coming in from overseas to people in the US. “The argument is that the only way we can identify these malicious traffic flows and respond to them is if we’re analyzing all traffic flows,” he says. “And if we’re analyzing all traffic flows, that means we have to be intercepting all traffic flows. That means violating the Fourth Amendment, seizing private communications without a warrant, without probable cause or even a suspicion of wrongdoing. For everyone, all the time.”This puts into context some stories from last year, which noted that Keith Alexander seemed particularly focused on getting companies to give the NSA access to their networks. Last October, he gave a speech in which he pitched exactly that:
Drawing an analogy to how the military detects an incoming missile with radar and other sensors, Alexander imagined the NSA being able to spot "a cyberpacket that's about to destroy Wall Street." In an ideal world, he said, the agency would be getting real-time information from the banks themselves, as well as from the NSA's traditional channels of intelligence, and have the power to take action before a cyberattack caused major damage.And in a Washington Post profile of Keith Alexander from over a year ago, a similar idea was discussed:
His proposed solution: Private companies should give the government access to their networks so it could screen out the harmful software. The NSA chief was offering to serve as an all-knowing virus-protection service, but at the cost, industry officials felt, of an unprecedented intrusion into the financial institutions’ databases.This all should probably make you wonder why those very same financial institutions seem willing to shell out somewhere between $600,000 and $1 million per month for Alexander's "patent-pending" solutions to "cybersecurity."
The group of financial industry officials, sitting around a table at the Office of the Director of National Intelligence, were stunned, immediately grasping the privacy implications of what Alexander was politely but urgently suggesting. As a group, they demurred.
“He’s an impressive person,” the participant said, recalling the group’s collective reaction to Alexander. “You feel very comfortable with him. He instills a high degree of trust.”
But he was proposing something they thought was high-risk.
“Folks in the room looked at each other like, ‘Wow. That’s kind of wild.’ ”
Furthermore, this should shed some light on why the NSA was so in favor of CISPA and now CISA -- cybersecurity bills in Congress that would give private companies liability protections if they... shared network data with the NSA (and other parts of the federal government). The NSA needs those liability protections to get some companies to be willing to open up their networks to do this kind of MonsterMind offering, or they won't participate. It's also why Congress shouldn't pass such a bill.
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: access, automated, cisa, cispa, cyberattack, cybersecurity, ed snowden, keith alexander, monstermind, nsa, private networks
Reader Comments
Subscribe: RSS
View by: Time | Thread
-Joshua
[ link to this | view in chronology ]
WarGames
Stephen Falken: Hello, Joshua.
Joshua: A strange game. The only winning move is not to play. How about a nice game of chess?
[ link to this | view in chronology ]
I think that should just about cover most things. Perhaps others could add to the list.
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
another leak?
[ link to this | view in chronology ]
Strangelovian Indeed
"...the whole point of the doomsday machine is lost... if you KEEP IT A SECRET!"
[ link to this | view in chronology ]
This kind of trouble has happened before
The way the anti-spam software worked that one company made, if someone emails you a message their software sees as spam, their software will email 50 emails back to that person saying "Please take me off of your mailing list" or something to that effect, to spam the spammers back with useless junk so they don't email you again.
Sounds fine, until you take into account
1) false alarms that mark legitimate emails as spam
and
2) the fact that the person who sent the 'spam' email might also have the exact same anti-spam software installed...
Needless to say, that company's anti-spam software managed to take down a few servers. Their software viewed their own 'please take me off of your mailing list' emails as spam, which caused an infinite loop of those emails to get sent back and forth, constantly increasing 50-fold because each new spam email had to get 50 new responses.
That company was later fined over their anti-spam software, for violating anti-spam laws.
[ link to this | view in chronology ]
Re: This kind of trouble has happened before
3) Spammers started spoofing the "From" header field to point to innocent others they happen to be mad at.
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Bright side
[ link to this | view in chronology ]
Re: Bright side
T-800: Because it knew the Russian Business Network would wipe out its enemies over here.
[ link to this | view in chronology ]
I'd forgotten that bit of crazy
Ah yes, that mysterious single packet that could wipe out Wall Street. I'd forgotten. I think the cybermen will find it sitting right next to the unicorn that pisses lemonade and shits jellybeans.
[ link to this | view in chronology ]
Re: I'd forgotten that bit of crazy
Really, if he was just an obnoxious blowhard, he'd be using the technical terms just to show off. The fact that he keeps using made-up words ("cyberpacket"? really?) shows that he's a complete sham.
[ link to this | view in chronology ]
Re: I'd forgotten that bit of crazy
[ link to this | view in chronology ]
Grasp at straws much, Drama Queen?
[ link to this | view in chronology ]
Re:
An automated cyber system automatically responds to an infected machine at the New York Stock Exchange and takes down the whole system instead of just blocking that traffic? Sounds BRILLIANT!
[ link to this | view in chronology ]
Re:
I'm curious: do you honestly believe that such systems wouldn't be subject to false alarms and false retribution? If so, how much computer programming have you done?
[ link to this | view in chronology ]
Re: Re:
I'm curious: do you honestly believe that such systems wouldn't be subject to false alarms and false retribution? If so, how much computer programming have you done?
No, but equating the potential harm to global thermonuclear warfare is a bit over the top, don't you think.
[ link to this | view in chronology ]
Re: Re: Re:
[ link to this | view in chronology ]
Re: Re: Re:
[ link to this | view in chronology ]
Re:
But of course you're too dishonest to admit that.
[ link to this | view in chronology ]
Re: Re:
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
Re: Re:
[ link to this | view in chronology ]
[ link to this | view in chronology ]
This suggests
OR that the corps didnt want to enable them. just to have someone ELSE to blame for their OWN incompetence..
[ link to this | view in chronology ]
it's also why there should be no way to financially influence politics and both the donor and the recipient facing serious charges if they do. then add in an end to lobbying money and maybe, just maybe we could get some real politics and decision making done that genuinely benefits country and citizens!
[ link to this | view in chronology ]
Check this out, fellas:
http://www.zerohedge.com/news/2014-08-13/cisco-quarter-nutshell-terminating-6000-while-buying-bac k-15-billion-stock
I wonder why Cisco is having problems? Could it be no-one trusts their products any more, for some strange reason?
Just another hint of the economic damage being done by the NSA to the US economy.
[ link to this | view in chronology ]
Re: Check this out, fellas:
[ link to this | view in chronology ]
There are two ways to launch an attack
This can be very expensive and tedious, not to mention personally risky and subject to interruption by people who would very much NOT like you to develop a weapons system. Fortunately, there is another way:
2. Let someone else do everything in (1), and then deceive/provoke them into attacking the target of your choice. This is far cheaper and easier, plus they'll probably be blamed for it.
Offensive network/system attacks are a very stupid idea, which is people like me have been saying for decades that it is never appropriate to respond to abuse with abuse. Automatic offensive attacks are an insanely stupid idea. Apparently some of the slow learners in the class need some remedial education basic security principles.
[ link to this | view in chronology ]
Why are we hiring Alexander again?
...and then when you resign you are just as certain that interfering with NSA's aims and goals is "good and profitable business" and that you are a lily-white patriot?
So it seems either he's a dyed in the wool hypocrite, or you can't trust him near any of your company's computers. If I owned a company, and he told me the sky was blue or that hammers released in a gravity field fall, I'd triple-check before I paid him a dime.
Soooo...now let's take a second look at the companies that signed up for his services. Maybe they're hiring him knowingly to set up company (and government) surveillance on their customers? Military-industrial complex in action?
[ link to this | view in chronology ]
[ link to this | view in chronology ]