Money And Power: The Real Reason For The NSA Spying On Everyone

from the money-money-money dept

More than four years ago, we wrote about all the buzz that you were hearing about "cyberwar" was little more than an attempt to drum up FUD to get the government to throw billions of dollars at private contractors. We noted that Booz Allen Hamilton (yes, the last employer of one Ed Snowden) had hired former NSA director and also Director of National Intelligence Mike McConnell as its Vice Chairman. He was the leading voice out there screaming about the threat of "cyberwar" getting on TV and having lots of opinion pieces in big name publications -- all of which mentioned his former government jobs, but almost none of which mentioned that his current employer, Booz Allen Hamilton, stood to make billions selling "solutions" to the government. And, indeed, Booz Allen has been raking in the cash on "cybersecurity."

This is worth keeping in mind as you read this fascinating interview with NSA whistleblower, Bill Binney, in which he lays this out plain and simple. The real reason for all this NSA surveillance is about money and power. "Stop terrorism" is secondary. After pointing out that all of this data collection has been basically useless in stopping terrorism (as confirmed by multiple independent accounts of the NSA's activities), the interviewer asks Binney why the NSA keeps doing it:

So why do they keep doing it?

Money. It takes a lot of money, you have to build up Bluffdale [the location of the NSA's data storage center, in Utah] to store all the data. If you collect all the data, you've got to store it, you have to hire more people to analyze it, you have to hire more contractors, managers to manage the flow. You have to start a big data initiative. It's an empire. Look at what they've built! Have you ever looked around all the buildings they've built up because of 9/11?

So that's what it's all about, expanding the budget for the intelligence community?

If you have a problem, you need money to solve it. But if you solve that problem, you no longer have the justification to get money. That's the way they view it - keep the problem going, so the money keeps flowing. Once you build up this big empire, you have to sustain it. ... Look at the influence and power the intelligence community has over the government. They [the government] are giving them everything they want, they're trying to cover up all their tracks and their crimes. Look at the influence and power they're gaining.

As Clay Shirky famously noted years ago, "Institutions will try to preserve the problem to which they are the solution." That appears to absolutely be the case here. It's why there's so much FUD. The NSA and the rest of the intelligence community has built up the threat to be this huge issue that requires huge dollars as well. And once they have the huge dollars and the giant staff, they have to keep that up. So they have to create a continuing problem for which they are the solution -- and since it's all (mostly) done in secret, you get this nefarious circle (as opposed to virtuous), in which more FUD is spread, more money flows in and everyone has to justify themselves to keep it all going.

Whistleblowers like Binney and Snowden actually disrupt that circle and put a threat to the money flows.

Filed Under: bill binney, contractors, cyberwar, lobbying, nsa, surveillance
Companies: booz allen

Author Claims We've Learned Enough From The Snowden Docs And The Rest Should Be Destroyed

from the huh? dept

Just recently Thomas Rid, the author of a new book entitled Cyber War Will Not Take Place, was on the Surprisingly Free podcast, and had a very interesting discussion about the fact that the whole concept of "cyberwar" is incredibly overhyped (as we've also discussed in the past many times). At best, it's often really about espionage, not war, and (on the good side) unlike war, the likelihood of serious physical harm and deaths is much more limited when it comes to technological attacks. I highly recommend listening to the podcast, because Rid does a nice job laying out his thesis, much of which I agree with.

However, I was then somewhat surprised to see him over at Slate arguing that the rest of the documents Ed Snowden leaked should be destroyed. Unlike some others, he's not arguing that the leak was evil and that Snowden was a traitor. Instead, the argument is somewhat more nuanced. He basically argues that a lot of good things have already come out of the leaks that have been published, but he's unsure of the marginal benefit of additional leaks, while much more worried about potential harm from continued leaks. I think this argument is wrong, but it does provide an interesting thought experiment.

Rid does point to the good things the leaks have done, namely: (1) kicking off a long-overdue debate on these issues, (2) informing the public about digital security issues that they've ignored for ages and (3) convincing many tech companies to take security much more seriously. We all agree those are three good things that have come out of the leaks. However, it appears that Rid isn't sure that future leaks will do much more than existing leaks to further any of those points. Of course, I'd argue that part of the problem is he leaves out the fourth important point: putting into motion events that hopefully will lead to more limited surveillance, less abuse of the surveillance infrastructure and much more respect for things like the 4th Amendment and basic privacy rights. And it seems pretty clear that continued leaks do help to drive that forward.

However, Rid seems to see limited upside to further leaks, and also significant downsides to existing leaks, which he thinks could get worse with more. I think he's wrong on the downsides, but let's go through them:

One is that intelligence capabilities are damaged. There is no doubt that signal intelligence agencies are an essential tool necessary for international statecraft as well as for maintaining the domestic constitutional order. Revealing capabilities and tactics often means they become worthless as a result. Measuring such tactical costs is hard, but the damage is significant.

This is overblown. Yes, intelligence and espionage are always going to be a part of the way things work, but that has never meant that we should make it easy. In fact, the likelihood of abuse is so high that we've always tried to make this very, very difficult. There are reasons that the 4th Amendment has requirements for things like probable cause, warrants (i.e., oversight by a third party) and reasonable and limited searches.

This means, secondly, that militants, violent extremists, and adversaries—think the Syrian regime—are already racketing up their communication security. In the future it will be harder to detect and foil terrorist attacks. In the future it will be harder to say if some regime possesses or used a specific weapon system. In the future it will be harder to unveil wealth-draining cyberespionage. This is very serious.

The history of signals intelligence is littered with the cat and mouse game of finding new ways to hide messages, followed by someone cracking them, and people moving on to other methods. Arguing there's some awful damage from this is an unsupportable statement. Out of what's been leaked so far, much had already been suspected by many -- meaning that the major terrorists and foreign enemies almost certainly were already using methods to try to avoid such systems. There is little evidence to suggest the damage is really that significant.

Meanwhile, thirdly, authoritarian states get a confidence boost. “Washington ate the dirt this time,” wrote China’s Global Times, an outlet sometimes called the Fox News of China. The U.S. administration “has long been trying to play innocent victim of cyberattacks” but now turned out to be “the biggest villain,” said Xinhua, the state-run news agency. This argument, of course, is hypocrisy. The National Security Agency is not spying in order to round up Obama's political opposition, and Government Communications Headquarters is not listening to Internet traffic to help London's banks—both of which stand in sharp contrast to China's own practices. Nevertheless, Snowden's revelations make it easier for the world's authoritarian regimes to crush dissent at home.

I agree with the impact here, but it's not the fault of the Snowden leaks. This is the fault of the US (and others) being overaggressive in its surveillance activities. The way to avoid losing the moral high ground is to, you know, stay on the moral high ground. It's fairly ridiculous to argue that Snowden's leaks are to blame here. It's the NSA's actions that are to blame.

A fourth result: Internet governance is creaking. Diminishing America and Britain’s diplomatic and moral standing is threatening the multistakeholder approach, so far a guarantor for a free and open Internet. A patchwork of smaller, sovereign "Internets" is becoming more and more likely. As a result, the Internet could now become more authoritarian, not less.

Finally, and perhaps most significantly, American and British Internet and telecommunication companies are under economic pressure, set to lose disgruntled customers at home and large contracts abroad. This last damage multiplies all previous ones.

Ditto my comment above. This is blaming the messenger. The problem here is not the leaks, but rather the actions of the NSA in going overboard with surveillance. Rid tries to cut off this argument with the following:

Some may retort that it was the NSA and its allies who created this damage in the first place, not Snowden and his allies. But this argument is problematic: Spy agencies spy, all of them. Suggesting that all secrecy is bad is plainly naive. Instead there is a moral case to be made for open democracies to have the most capable intelligence agencies, operating lawfully with robust oversight mechanisms. No liberal mind can want the NSA to sit in Beijing or Moscow.

But that's not responding to the actual argument. While I'm sure some are arguing against any and all espionage, most of us are not. We're arguing against overly broad surveillance, often for no legitimate reason, with little oversight and no actual threat to deal with. We're not saying that "all secrecy is bad," but rather that there has been massive overreach here, and little benefit. That seems worth discussing, and the Snowden documents keep revealing just how bad that overreach really is. Rid is responding to a strawman here, rather than the actual argument most people are making.

As Julian Sanchez notes, Rid seems to be basing the entire article a belief that is unsupported: that terrorism is a threat to democracy, when the reality is that it's authoritarianism and surveillance that are the real threats to democracy. Yes, terrorism can do tremendous damage, but it's difficult to believe that terrorism alone harms the democratic process. A surveillance state is simply antithetical to democracy. Rid seems to not understand that, which is too bad, given his recognition of how much the claims about "cyberwar" are overhyped.

Filed Under: cost-benefit, cyberwar, ed snowden, impact, leaks, thomas rid

Blind Fear Of Cyberwar Drives Columnist To Call For Elimination Of The Internet

from the wait,-what? dept

Every time I think I've read the least well-thought out luddite argument, someone comes along to top it, and today we have columnist Robert Samuelson in the Washington post with what might be the silliest, most lacking-in-thought argument for why we should get rid of the internet. The short version: yes, the internet has provided us with some good stuff, but because there's a yet unproven risk that it might also lead to some cyberattacks that might lead to as yet undetermined problems, we should scrap the whole thing. Oddly, the WaPo had put different titles on the piece online and in the print newspaper. Online, it's entitled: "Beware the Internet and the danger of cyberattacks." In the physical paper, they apparently went with the much more ridiculous: "Is the Internet Worth It?" with the clear implication being a fulfillment of Betteride's Law that the answer is "no, the internet is not worth it." It's almost as if the WaPo realized how stupid that headline was, and thinks that its online readers might actually mock them for such a ridiculous headline.

If I could, I would repeal the Internet. It is the technological marvel of the age, but it is not — as most people imagine — a symbol of progress. Just the opposite. We would be better off without it. I grant its astonishing capabilities: the instant access to vast amounts of information, the pleasures of YouTube and iTunes, the convenience of GPS and much more. But the Internet's benefits are relatively modest compared with previous transformative technologies, and it brings with it a terrifying danger: cyberwar. Amid the controversy over leaks from the National Security Agency, this looms as an even bigger downside.

Leaving aside the anachronism of GPS (er, that's not the internet, Robert), this makes no sense. Samuelson brushes aside the vast benefits of the internet, and the fact that "instant access to vast amounts of information" leads to all sorts of opportunities for positive change in the world, including social and cultural enrichment, as well as economic growth. But none of that matters, because of the threat of an undefined "cyberwar." Samuelson, later in the piece, even seems to admit two things: that there's no evidence that "cyberwar" has done any real damage to date, and that many people think that it never will.

No matter, just because it might possibly happen and might possibly cause some problems, we should ditch the entire internet and everything that came with it.

I don't know the odds of this technological Armageddon. I doubt anyone does. The fears may be wildly exaggerated, as Thomas Rid of Kings College London argues in his book "Cyber War Will Not Take Place" (already published in Britain, due out this fall in the United States). In living memory, there are many threats that, with hindsight, seemed hyped: the "missile gap" in 1960; the Y2K phenomenon in 2000 (the date change was allegedly going to disable many computer chips); and, so far, the prophecies of widespread terrorism after 9/11.

But... I'm still going to assume that the risk is so great, that we should just kill off the entire internet.

Really, when you think about it, the argument is so self-defeating to be insane: Samuelson is arguing that because bad people might take down parts of the internet, we should take down the whole entire thing to beat them to it. How does that make any sense at all.

Adam Thierer has written a detailed response which is worth reading, but I think the best response so far has come from David Weinberger, who reformulates Samuelson's opening paragraph to cover a couple of other things we might as well repeal:

If I could, I would repeal the First Amendment. It is the governmental marvel of the age, but it is not — as most people imagine — a symbol of progress. Just the opposite. We would be better off without it. I grant its astonishing capabilities: the TV talking heads, the bumperstickers, the op-eds that have to overstate their case to get published, and much more. But First Amendment's benefits are relatively modest compared with previous speech rights, and it brings with it a terrifying danger: free thinking. Amid the controversy over leaks from the National Security Agency, this looms as an even bigger downside.

[.....]

If I could, I would repeal oxygen. It is the chemical marvel of the age, but it is not — as most people imagine — a symbol of progress. Just the opposite. We would be better off without it. I grant its astonishing capabilities: the way it’s used by cigarette lighters, the buoyancy of kiddie swim fins, the infomercials that entertain us with how it helps remove cranberry juice from table cloths. But oxygen’s benefits are relatively modest compared with previous chemicals, and it brings with it a terrifying danger: life on Earth. Amid the controversy over leaks from the National Security Agency, this looms as an even bigger downside.

Thierer also points out that you could easily substitute automobiles, airplanes or basically almost any other modern technology. Yes, each of them creates some new risks and threats, but most of the world believes that the tremendous benefits and positives that come with them outweigh the theoretical risk. We don't seek to ban cars and planes because they tend to crash and kill people. Will recognize the benefits, and the risks, while seeking to minimize the risks while improving the benefits. Apparently, in the world of Robert Samuelson, there is no cost-benefit analysis, there's just "cost" and the cost is too damn high.

Update: The Disruptive Competition Project jokingly suggests that Samuelson's piece was obviously satire:

Samuelson drops clues, however, that his tongue is firmly in cheek. The defective internal logic is the first. The Internet ‘merely’ provides us with email, Facebook, YouTube, and GPS, the column contends. The Internet’s “upside” is small. Yet we are so dependent upon it for communications and critical infrastructure such as energy, and health care that it constitutes a vulnerability. Moreover, Samuelson seems to contend, it is so essential to modern communications that it is a virtual attractive nuisance for warrantless surveillance by NSA. Thus, the Internet’s “downside” is under-appreciated.

Filed Under: cyberwar, fear fear fear, internet, luddism, robert samuelson

US's 'Cyberwar' Strategy: Making The Public Less Secure In The Name Of 'Security'

from the adding-up-wrongs-to-make-a-right dept

The US government seems to be responding to "cyber Pearl Harbor" by heading out on bombing runs of its own. All the concern for the safety of the American public displayed in Congress during the CISPA push seems to have been nothing more than the empty words we expect from our representatives. Americans and American companies are now being caught in the crossfire -- some of it "friendly."

The US government is waging electronic warfare on a vast scale — so large that it's causing a seismic shift in the unregulated grey markets where hackers and criminals buy and sell security exploits, Reuters reports.

Former White House cybersecurity advisors Howard Schmidt and Richard Clarke say this move to "offensive" cybersecurity has left US companies and average citizens vulnerable, because it relies on the government collecting and exploiting critical vulnerabilities that have not been revealed to software vendors or the public.

"If the US government knows of a vulnerability that can be exploited, under normal circumstances, its first obligation is to tell US users," Clarke told Reuters. "There is supposed to be some mechanism for deciding how they use the information, for offense or defense. But there isn't."

I'm not sure how increasing user vulnerability helps win a cyberwar, but no doubt any home team casualties will be written off as sacrifices for the greater good. Even more troubling than the government's willingness to sacrifice security for security (??) is the fact that it's unwilling to share this information. What good are those provisions in CISPA and President Obama's recent cybersecurity executive order about the government sharing cybersecurity info with companies, if the government hoards the information for their own hacking purposes? More details from the Reuters report.

Top U.S. officials told Congress this year that poor Internet security has surpassed terrorism to become the single greatest threat to the country and that better information-sharing on risks is crucial. Yet neither of the two major U.S. initiatives under way - sweeping cybersecurity legislation being weighed by Congress and President Barack Obama's February executive order on the subject - asks defense and intelligence agencies to spread what they know about vulnerabilities to help the private sector defend itself.

When a U.S. agency knows about a vulnerability and does not warn the public, there can be unintended consequences. If malign forces purchase information about or independently discover the same hole, they can use it to cause damage or to launch spying or fraud campaigns before a company like Microsoft has time to develop a patch. Moreover, when the U.S. launches a program containing an exploit, it can be detected and quickly duplicated for use against U.S. interests before any public warning or patch.

Is it any surprise the public distrusts the government? It claims to be fighting a cyberwar in order to make us more secure and yet, when it goes on the attack, it values its own secretive efforts over the security of the public.

As the government purchases more of these exploits to help fight its cyberwar, the lines on the battlefield are continuously redrawn and obscured. Buying exploits from independent hackers leaves them free to sell to other high bidding countries when not using the exploits themselves. This arms race also creates a perverse set of incentives. As the demand for new exploits increases, security companies and contractors that used to release information to those affected are now keeping their discoveries to themselves to preserve "market value."

The Reuters report also notes that this new breed of security contractor is offering up, among other things, keys to criminal botnets. Endgame, a heavily funded tech startup with close ties to the intelligence community, is more than willing to hand over control of thousands of zombie computers for the right price.

Some of Endgame's activities came to light in purloined emails published by hackers acting under the banner Anonymous. In what appear to be marketing slides, the company touted zero-day subscriptions as well as lists of exactly which computers overseas belonged to specific criminal "botnets" - networks of compromised machines that can be mobilized for various purposes, including stealing financial passwords and knocking websites offline with traffic attacks.

The point was not to disinfect the botnet's computers or warn the owners. Instead, Endgame's customers in the intelligence agencies wanted to harvest data from those machines directly or maintain the ability to issue new commands to large segments of the networks, three people close to the company told Reuters.

So, we're engaged in a cyberwar that's going to help us by hurting us, is that it? I understand that no one wants to be outgunned when facing the enemy, but what's being detailed here looks like a whole lot of collateral damage in the pursuit of unattainable goals. The same exploits will be used on both sides of the battle, and with end users and the companies they rely on being cut out of the loop, it will be the civilians who fare the poorest. We'll just be asked to pretend the government's saving us from something even worse.

Filed Under: cybersecurity, cyberwar, hacks, security, us government, zero day

NATO 'Cyberwar' Manual Says Hacktivists Must Wear A Uniform

from the dressed-to-kill dept

Last year, Techdirt wrote about an interesting article suggesting that we should welcome "cyberwar" since it would be so much less painful than the ordinary kind. Of course, that begs the question what we actually mean by "cyberwar", since some forms are probably less humane than others. As we have pointed out, the use of the totally embarrassing "cyber" prefix is really just an excuse for more government controls and for security companies to get fat contracts implementing them.

Against that background, the following news from The Verge about an attempt to pin down what exactly "cyberwar" might be, is particularly interesting:

A landmark document created at the request of NATO has proposed a set of rules for how international cyberwarfare should be conducted. Written by 20 experts in conjunction with the International Committee of the Red Cross and the US Cyber Command, the Tallinn Manual on the International Law Applicable to Cyber Warfare analyzes the rules of conventional war and applies them to state-sponsored cyberattacks.

The Tallinn Manual on the International Law Applicable to Cyber Warfare is a fascinating, if rather dry read: it consists of 95 key statements or rules about "cyberwarfare", each followed by pages of academic argument about what that statement means, and why. Mostly, it's about transposing existing law on warfare into the online world, defining things like "sovereignty", "attack", "force", "proportionality" etc. But there's one area where old ideas don't help: that of "hacktivists", defined in the Manual as "A private citizen who on his or her own initiative engages in hacking for, inter alia, ideological, political, religious, or patriotic reasons."

That's because conventional war makes a distinction between combatants -- those fighting in regular armies -- and those who are "unprivileged belligerents". The difference is crucial: the former enjoy important rights, for example to be treated as prisoners of war if captured, whereas "unprivileged belligerents" do not. The distinction between the two groups is relatively obvious in traditional warfare, where combatants are organized and subject to clear command structures. Hacktivists, by contrast, may decide to defend their country by taking part in group attacks from their home or from a local café, say; the issue then becomes whether or not they are to be considered combatants with rights, or "unprivileged belligerents" without them.

The following section from the Tallinn Manual shows the experts floundering here -- and just how hard it is to come up with sensible rules for this "cyberwar" stuff:

Combatant status requires that the individual wear a 'fixed distinctive sign'. The requirement is generally met through the wearing of uniforms. There is no basis for deviating from this general requirement for those engaged in cyber operations. Some members of the International Group of Experts suggested that individuals engaged in cyber operations, regardless of circumstances such as distance from the area of operations or clear separation from the civilian population, must always comply with this requirement to enjoy combatant status.

So if you're ever tempted to engage in a little patriotic hacking into enemy computers, please don't forget to put on your uniform first...

Follow me @glynmoody on Twitter or identi.ca, and on Google+

Filed Under: cyberwar, hacking, hactivism, nato, rules, uniform

Stop Calling Electronic Espionage Cyberwar

from the because-it's-not dept

Cyberwar. Cyberwar never changes, mostly because it has never existed. Since the dawn of the new millenium, when the movie Hackers was still Congress's best approximation of the threat of compromised computers, thoughts have been spilled in the name of expunging this stupid hyperbole, this made-up threat with a trumped-up enemy. We're told the threats are everywhere, from an Iranian government that provides more laughs than danger, to a pirate wing of the Chinese military, to simple psychotic terror-hacking wings. Sadly, it is left to a pathetically small few media members to push back against the nonsense.

If stealing secrets is an act of war then America is currently at war with all of its allies. Espionage is what governments do so they don’t have to go to war...directly. What appears to be upsetting the Congressman is that the Chinese are using espionage to make money in a way that the United States didn’t think of first.

In the year 2013, after millenia of technological progress coupled with man's fear of it, the tidal wave of a complicit mainstream media could hold itself back no longer. As such, the world has been plunged into an abyss of cyber-nuclear threats, and bullshit.

The Times wasn’t content with using other peoples’ reports based on circumstantial evidence so it went out and got one of its own. The study by Mandiant has come under some fairly withering criticism.

-It doesn’t appear to say anything new. CEO Kevin Mandia: "Mandiant’s not the first company to blame China for the hacks, but it was our turn to carry the ball for a little bit." Translation = “We were working for the NYT and that’s some golden PR.”

-Did I mention it was based on circumstantial evidence? Jeffrey Carr does a superb job of explaining why Mandiant saw exactly what it expected to find and then offers several other equally valid possible perpetrators, including Russia, France and Israel.

But this threat has not, as some have predicted, caused the end of the world. Instead, the fake apocalypse was just the prologue to another crappy chapter of human history. For man had succeded destroying the fourth estate for the betterment of the cyber-defense industry.

Here is my boilerplate response on the security weakness of U.S. utilities in regards to cyber attacks: "Yes, there is a problem. It is not a crisis. To do any significant damage any such attack would most likely have to be associated with a physical attack." (The sky is not falling, Chicken Little, but I bet I could make a whole lot of money convincing you otherwise.)

Cyberwar. Cyberwar never changes, because it has never existed.

Filed Under: cybersecurity, cyberwar, espionage, exaggeration

White House Declares It Has 'Broad Powers' When It Comes To Cyberattacks

from the well,-of-course dept

In a bit of news that will shock just about no one, the Obama administration did a legal review over what it's allowed to do in making use of "cyberweapons," and concluded that it has "broad powers" to do all sorts of stuff. The specifics, of course, will remain classified:

That decision is among several reached in recent months as the administration moves, in the next few weeks, to approve the nation's first rules for how the military can defend, or retaliate, against a major cyberattack. New policies will also govern how the intelligence agencies can carry out searches of faraway computer networks for signs of potential attacks on the United States and, if the president approves, attack adversaries by injecting them with destructive code - even if there is no declared war.

Comforting, huh? And, by comforting, I mean "terrifying." While we've already talked a few times about the US using "cyber weapons" against Iran (hello Stuxnet, Flame, etc.) this NY Times report suggests that the White House is being freed up to do much more, though one "concession" is that the use of such tools must be approved by the President, rather than allowing various agencies (Defense Department, mainly) to run off and starting attacking others electronically without first getting it approved by the President.

In the meantime, this looks like yet another case of the White House not minding leaks that make it look good. As we've noted, whenever there are leaks that embarrass the White House, they come down like a ton of bricks on whoever did the leaking as being guilty of espionage. But when the White House itself leaks information about how awesome and powerful they themselves are, no one ever seems to get arrested.

Filed Under: administration, cyberattacks, cyberwar, powers, white house

Cyber War: A One-Sided Battle Against A Trumped Up Enemy

from the what-is-it-good-for?--absolutely-nothin' dept

You would have to be a deaf and blind person with a penchant for head-burying to have missed the drum beats of a supposed cyber war the American government has been touting over the past year or so. It's a one-sided conversation that has been hyperbolic on a level normally associated with sketch comedy. Terms like "Cyber Pearl Harbor" are thrown around without any sense of historical context. In fact, many are questioning whether the entire production is simply a political game, with no real threat existing at all. Unfortunately, many more Americans have now incorporated this manufactured fear into their psyches. Still, the drum beat continues, with the United States labeling Iran as our chief enemy in this inevitable, or perhaps already occurring, cyber war.

The problem, of course, is that anyone who spends a couple minutes studying what's actually happening realizes that this is a one-sided war, likely started by the West, and our opponent is fighting against our tanks with pea-shooters.

The first shot was probably the release of Stuxnet sometime during or before 2009. Even though no one has officially claimed responsibility everyone knows who was behind it. Stuxnet hit with a bang and did a whole lot of damage to Iran's uranium-enrichment capabilities. The United States followed that up with Flame–the ebola virus of spyware.

What did the Iranians fire back with? A series of massive, on-going and ineffective DDoS attacks on American banks. This is a disproportionate response but not in the way military experts usually mean that phrase. It's the equivalent of someone stealing your car and you throwing an ever-increasing number of eggs at his house in response.

That's what makes all of this seem so monumentally silly. The government is making use of an American public, which is massively ignorant about who and what Iran is and is capable of, to go legislatively nutbars in our own country. Don't ask me why they're doing it, but they are. Perhaps more importantly, we're being told that we need legislation to protect against an incapable enemy in a war that we started. If that makes sense to you, chances are you need psychiatric care.

And even more problematic, and frustrating for me personally, is that our government isn't even putting in the effort to fool me properly. It's one thing to have Colin Powell waving a test tube at Congress and shouting "We're all going to die!", but it's quite another to have folks like Gen. William Shelton talking about potential risks in a potential war that we potentially started with a potential threat that we created by attacking it. That's entirely too much potential and not enough blatant falsehood. If the government wants to bullshit us, they can't go in half way. I need real creative lying, not nonsense reports that they have to subsequently pull because they're...you know...made up.

ProPublica reported yesterday that a widely cited Defense Department study claiming Iran's Intelligence Ministry constitutes "a terror and assassination force 30,000 strong" has been "pulled for revisions." It seems there's no proof whatsoever that the 30,000 number wasn't pulled out of thin air.

See, it's not that I'm siding with the pea-shooters here, it's that I'm more scared of the guys that started this war with their tanks. Particularly when the result is poorly-conceived legislation.

Filed Under: cyberwar, hype, iran, us

Should We Want A 'Cyberwar'? It's A Lot Less Bloody Than A Real War

from the one-way-to-think-about-things dept

We've certainly written an awful lot about the ridiculousness of the concept of "cyber war." Even with things like Stuxnet and Flame, it seems silly to compare what amounts to either electronic espionage or a little hacking as "war." But perhaps we were looking at it the wrong way. In a Foreign Policy article by John Arquilla, he argues that perhaps we should be embracing this kind of "cool war" as it can be effective at stopping threats (even distributed ones like terrorist operations, rather than just centralized ones like governments), while causing minimal bloodshed:

On balance, it seems that cyberwar capabilities have real potential to deal with some of the world's more pernicious problems, from crime and terrorism to nuclear proliferation. In stark contrast to pitched battles that would regularly claim thousands of young soldiers' lives during Robert E. Lee's time, the very nature of conflict may come to be reshaped along more humane lines of operations. War, in this sense, might be "made better" -- think disruption rather than destruction. More decisive, but at the same time less lethal.

And, indeed, if we believe that reports of "cyber attacks" being used to make planes fall from the sky are greatly exaggerated, perhaps we should welcome a "war" that mainly involves hackers vs. hackers trying to disrupt each others "real" warfare capabilities. But, of course, there are plenty of other issues that come up here as well -- such as how secret hacking programs can be abused. If it gets governments to stop physical battles that lead to real lives lost, that does seem like an improvement, though I'm not sure anyone should think that continuing to attack each other through computers is ever a "good" situation overall.

Filed Under: cybersecurity, cyberwar, flame, stuxnet, terrorism

The Politicians Who Cried 'Cyber Pearl Harbor' Wolf

from the tough-to-believe-them-any-more dept

With all the talk lately about cybersecurity legislation, we've still yet to see anyone lay out an actual scenario for a real "cyber security" threat (or, at least one that goes beyond your everyday malware or corporate espionage, which are covered by existing laws just fine). However, we have heard lots of fear mongering about planes falling from skies and electric grids being shut down -- despite no evidence that there is any such threat (and, if there is, the concern should be focused on why those things are hooked up to the internet in the first place). And, of course, in all this fear mongering, there's one phrase that stands out: "Digital Pearl Harbor," as in, "we must protect ourselves before there's a digital Pearl Harbor."

David Parera, over at FierceGovernmentIT, has done the dirty work of tracing the history of the phrase, and suggesting that these Chicken Littles have been warning about the "imminent" digital Pearl Harbor for many years now.

The earliest public reference appears to be in a June 26, 1996 Daily News article in which CIA Director John Deutch warned that hackers "could launch 'electronic Pearl Harbor' cyber attacks on vital U.S. information systems."

The next month, then-Deputy Attorney General Jamie Gorelick told the Senate Governmental Affairs permanent subcommittee on investigations that "we will have a cyber-equivalent of Pearl Harbor at some point, and we do not want to wait for that wake-up call," according to the Armed Forces Newswire Service.

Thereafter the term appears to have gone into a hiatus, apart from some offhand or derivative references to the original sources cited above. But, not to worry, Sen. Sam Nunn (D-Ga.) used it again in the spring of 1998, being quoted in a March 19 South Bend Tribune article warning that "We have an opportunity to act now before there is a cyber-Pearl Harbor...We must not wait for either the crisis or for the perfect solution to get started."

There's a lot more where that came from, so go hit the link, read it, and be amazed.

Of course, as Parera notes, just because every single one of those fearmongering reports turned out to be false, it's still possible that the "Digital Pearl Harbor" is right around the corner. But, still, it at least raises significant questions of how important it is that we rush through the bill without an explicit explanation of the true threat. Of course, that won't really matter, as everyone's basically playing a giant game of musical chairs, trying to be ready to claim they "called it" should these horrible things ever actually happen.

Filed Under: cia, cybersecurity, cyberwar, jamie gorelick, john deutch, pearl harbor, sam nunn