Question To Ask Anyone Who Supports CISA: What Breach Would It Have Stopped?

from the simple-questions dept

We've asked this before and no one answered. But with the faux "cybersecurity" CISA bill back on track for another vote, it's time to ask the question again: Can defenders of CISA explain what data breach it would have stopped? This is important, because many of the defenders of CISA keep pointing to things like the OPM hack as an example of why we need "cybersecurity regulations." Just yesterday, Senator John McCain used various recent high profile hacks as proof of why we need such a bill:

The chairman of the joint chiefs of staff is uncomfortable about the cyberthreats to this nation -- which just took place where millions -- MILLIONS! -- of Americans had their privacy hacked into. God only knows what the consequences of that are. And the other side has decided to object to proceeding with a bill that passed through the Intelligence Committee by a vote of 14 to 1. This is disgraceful.

But as policy counsel at the Open Technology Institute, Robyn Greene, recently noted on Twitter, none of the recent hacks would have been stopped if CISA was law.

When will Senators realize that NONE of the breaches (OPM, Sony, Anthem, Home Depot, etc.) would have been stopped is #CISA was law?

— Robyn Greene (@Robyn_Greene) August 4, 2015

It seems like a fairly important question, especially when politicians are pointing to those and similar hacks or data breaches as examples of why we must pass CISA. Yet they can't explain how the law would have stopped those breaches (because they can't, because it wouldn't have).

John McCain wants to talk about "disgraceful"? Isn't it more disgraceful to point to an attack that this bill would not have helped with as a key argument for why this bill needs to pass?

This is some pretty serious hand-waving on the part of the politicians. Of course, the truth is that they simply don't understand the details enough to know what they're doing. They just hear from surveillance/law enforcement types saying that we "need cybersecurity legislation" and then they hear about these breaches and they immediately connect the two. Yet, they don't know what the law really does or why it's needed, and certainly don't understand how breaches happen or what it would take to prevent them (if that were even possible). So they just say "well, cybersecurity!" as if that's good enough.

It's not.

The changes brought about by CISA could have a pretty serious impact on our privacy and security and if Congress is going to pass it by pointing to these breaches, they should first be required to explain how the law would have helped to stop any of those breaches. We'll wait.

Filed Under: breach, cisa, cybersecurity, hack, john mccain

Want To Know Why DHS Is Opposing CISA? Because It's All A Surveillance Turf War

from the it's-not-what-you-think dept

As it appears that the fake "cybersecurity" bill CISA is heading to a vote in the Senate, some were surprised this week to see the Department of Homeland come out against the bill with a letter expressing concerns that the bill "could sweep away important privacy protections" with its open ended definitions and provisions:

The authorization to share cyber threat indicators and defensive measures with “any other entity or the Federal Government,” “notwithstanding any other provision of law” could sweep away important privacy protections, particularly the provisions in the Stored Communications Act limiting the disclosure of the content of electronic communications to the government by certain providers. (This concern is heightened by the expansive definitions of cyber threat indicators and defensive measures in the bill. Unlike the President’s proposal, the Senate bill includes “any other attribute of a cybersecurity threat” within its definition of cyber threat indicator and authorizes entities to employ defensive measures.)

This has led to some surprise among people who don't follow this that closely, that "even Homeland Security" doesn't like the bill. But that's really ignoring history and what this fight has always been about. Going back many, many years we've been highlighting that the truth behind all of these "cybersecurity" bills is that it's little more than a bureaucratic turf war over who gets to control the purse strings for the massive, multi-billion dollar budget that will be lavished on government contractors for "cybersecurity solutions." That the bill might also boost surveillance capabilities is little more than a nice side benefit.

The key players in this turf war? The NSA and Homeland Security (with the Justice Department occasionally waving its hand frantically in the corner shouting "don't forget us!"). From the beginning, one of the key questions people have asked is "who gets the data?" Obviously, "none of the above" is probably the best answer, but of the remaining options, Homeland Security tends to be the least worst option out of a list of three really bad options. And, so far, the White House has repeatedly pushed to put DHS in charge, giving it more power over the budget. However, CISA does not put DHS in charge.

So that is why DHS is complaining. Yes, the "privacy" concerns are there, but DHS's true concern is that it's not DHS running the show (and controlling the budget). Reread the DHS letter with this as background, and it appears a lot more understandable:

The Administration has consistently maintained that a civilian entity, rather than a military or intelligence agency, should lead the sharing of cyber threat indicators and defensive measures with the private sector. The National Cybersecurity Protection Act of 2014 recognized the NCCIC to be responsible for coordinating the sharing of information related to cybersecurity risks and to be the federal civilian interface for multi-directional and cross-sector sharing of information about cybersecurity risks and warnings. The NCCIC has representatives from the private sector and other federal entities involved in cyber information sharing, from those with whom we have an agreement and share consistently, to those that passively receive information from the center.

Equally important, if cyber threat indicators are distributed amongst multiple agencies rather than initially provided through one entity, the complexity–for both government and businesses–and inefficiency of any information sharing program will markedly increase; developing a single, comprehensive picture of the range of cyber threats faced daily will become more difficult. This will limit the ability of DHS to connect the dots and proactively recognize emerging risks and help private and public organizations implement effective mitigations to reduce the likelihood of damaging incidents. DHS recommends limiting the provision in the Cybersecurity Information Sharing Act regarding authorization to share information, notwithstanding any other provision of law, to sharing through the DHS capability housed in the NCCIC. This would not preclude sharing with any federal entity (indeed, DHS maintains an obligation to share rapidly with federal partners independent of any legislation), and it would further incentivize sharing through the NCCIC.

There's a lot more like that in the letter as well.

Don't get me wrong. Having DHS come out against CISA and speaking out about the privacy concerns the bill raises is great. But don't think that DHS is against these kinds of "information sharing" bills at all. It is not. It just wants to make sure that it's the queen bee when it comes to who's in charge of cybersecurity information... and, with it, who gets to control the budget.

Filed Under: cisa, cybersecurity, dhs, dod, doj, homeland security, nsa, privacy, turf war

FBI Wants To Lead The Nation's Cyberbattalions, But Can't Seem To Recruit Enough Cannon Fodder

from the dodgy-agency-dodged-by-respectable-parties dept

The FBI's cyber-initiatives may be doomed to fail. While it seems to have little problem acquiring and deploying new technology and techniques, it's finding it very hard to talk people into running all of it, as Alexander Martin at The Register points out.

The Federal Bureau of Investigation is struggling to hire computer scientists, according to a Department of Justice audit of the feeb's attempts to implement its Next Generation Cyber Initiative.

A 34-page audit report (PDF) from the DoJ notes that, while making considerable progress, the FBI has "encountered challenges in attracting external participants to its established Cyber Task Forces".

The Inspector General's report provides additional details on how far behind the agency is falling on its hiring goals. Even the hiring process itself is holding the FBI back.

While the process may start with a recruitment event attended by 5,000 interested candidates, the inability of candidates to meet the FBI’s specific eligibility criteria reduces that number to approximately 2,000 eligible candidates. Subsequently he told us that only about 2 candidates out of such a group are actually hired by the FBI. Another FBI official told us that the FBI loses a significant number of people who may be interested because of the FBI’s extensive background check process and other requirements, such as all employees must be United States citizens and must not have used marijuana in the past 3 years, and cannot have used any other illegal drug in the past 10 years. Another factor may be that private sector entities are able to offer technically trained, cyber professionals higher salaries than the FBI can offer.

The whitehat hackers the FBI would like to hire are looking for more pay and a less-intrusive hiring process. The FBI's hiring process and wage scale are unlikely to be responsive (though the latter is far more flexible than the former) to these demands. As long as coders can get better pay from employers that don't subject them to this level of pre-hire intrusion, the FBI will always find its staffing trailing its capabilities.

While the Five Eyes partners mentioned in the report have expressed their support of the FBI's cyber-focused joint task force, it's clear the public has not. But that part of the equation isn't mentioned in the OIG report. It may have been discussed off the record, but there's no acknowledgment that the post-Snowden climate -- combined with the exposure of FBI misconduct ranging from national security letter abuse to its series of entrapment-esque terrorism busts -- have made the FBI a less-than-desirable employer. Its reputation isn't entirely toxic, but it has managed to alienate a large portion of the tech crowd it wishes to hire. Director James Comey's continued assault on encryption isn't helping anything.

It's doubtful the deployment of a G.I.-bill-but-for-coders will fix this, but that's what the agency is looking to do.

One FBI official explained that the FBI is offering several incentives to recruit individuals including school loan repayment, reimbursement for continuing education, and hiring at higher salary levels on the general pay scale. He also added that the FBI is providing training opportunities for existing personnel including certifications and enrollment in the Carnegie Mellon University Master’s program in Information Technology as retention tools. In addition, in December 2014, the FBI announced to its employees a similar program at the New York University Polytechnic School of Engineering.

The good news is that once someone's hired by the FBI, they tend to stay, despite more lucrative opportunities elsewhere. But that's of little use when the problem is acquisition, rather than retention.

As of January 2015, however, 52 of the 134 Computer Scientist positions remained vacant and 5 of 56 field offices did not have at least 1 computer scientist, as planned.

Working for the FBI isn't like working for another tech company. The job also has a social cost that won't be addressed by student loan assistance and training opportunities. To work for the FBI, especially for someone who identifies as a "hacker," is to say goodbye to a large number of your colleagues. While the private sector doesn't lack for non-disclosure agreements, the FBI's disapproval of "shop talk" with friends and family carries hefty federal weight behind it. Normal small talk starts to resemble a series of probative queries. This may only exist in the minds of those interacting with friends and colleagues who have taken jobs at the FBI, but it's enough to make things uncomfortable.

The FBI may believe its problems are mostly of the pay scale variety, but there's more to it than purely fiscal concerns. The agency may do good work, but it has engaged in questionable investigations and activities almost since its formation. Leaks and FOIA documents have done further damage to its reputation in recent years. The FBI, despite its technical prowess -- appears to be anti-tech, at least in terms of fighting against any advances that impede its surveillance techniques. The agency, for the lack of a better word, is untrustworthy. The FBI appeals to candidates' idealism during the recruitment process, but over the years, it has repeatedly acted without integrity. Because of that, it will always have a problem finding whitehats willing to work for an entity that often seems to be in the "blackhat" camp.

Filed Under: cybersecurity, doj, expertise, fbi, recruitment, technology

Reminder: When Ron Wyden Says There's A Secret Interpretation Of A Law, Everyone Should Pay Attention

from the how-many-times-do-we-need-to-do-this dept

Years before Ed Snowden revealed how the NSA and DOJ had reinterpreted the PATRIOT Act and the FISA Amendments Act to allow the intelligence community to spy on Americans, Senator Ron Wyden tried to warn the public that this had happened:

We're getting to a gap between what the public thinks the law says and what the American government secretly thinks the law says.

For a couple of years after he said that, privacy and civil liberties advocates were forced into something of a guessing game to figure out what that secret law actually said. Eventually, the details were spilled by Ed Snowden who is, of course, now being threatened with a lifetime in prison for blowing the whistle.

This is not the only time that Wyden has made these kinds of warnings, and he's doing it again right now -- this time over CISA, the faux-"cybersecurity" bill that Wyden has made clear is really about surveillance. Recently released papers from the Snowden archives have made it clear why he's saying this, because it showed that, contrary to what's been said in the past, the NSA is using "cyber signatures" to sniff through upstream collections (their taps into the fiber backbone) under Section 702 of the FISA Amendments Act. And this opens up the information collected to so-called "back door" or "incidental" searches by the NSA. The whole point of CISA is to actually encourage companies to give the government more such "cyber signatures" which they can use to monitor the internet.

However, there's likely more going on as well, and in particular, Senator Wyden has been strongly hinting about an important Justice Department memo that remains classified, but which he implies would change the debate.

Wyden... claims that a classified Justice Department legal opinion written during the early years of the George W. Bush administration is pertinent to the upper chamber's consideration of cyberlegislation—a warning that reminds close observers of his allusions to the National Security Agency's surveillance powers years before they were exposed publicly by Edward Snowden.

[....] "I remain very concerned that a secret Justice Department opinion that is of clear relevance to this debate continues to be withheld from the public," Wyden said in his written dissent against CISA, which cleared the Senate Intelligence Committee 14-1 in March. "This opinion, which interprets common commercial service agreements, is inconsistent with the public's understanding of the law, and I believe it will be difficult for Congress to have a fully informed debate on cybersecurity legislation if it does not understand how these agreements have been interpreted by the Executive Branch."

Last year, based on some breadcrumbs that Wyden dropped during the confirmation hearings for Caroline Krass as the CIA's new top lawyer, Marcey Wheeler dug into some more details about this document, and notes that it comes from the same period of time when the Bush administration was twisting itself into knots to justify warrantless wiretapping and torture. In other words, this document seems ridiculously relevant to the debate.

And while it appears that the vote on CISA has likely been delayed yet again, it seems like this is a fairly important detail.

In short, haven't we, as a country, learned enough to note that, when Senator Wyden points out that there's a secret interpretation of the law that is at odds with a plain reading of it, we should all be demanding answers?

Filed Under: cisa, cybersecurity, doj, information sharing, ron wyden, secret law, surveillance

Senate, Once Again, Looks To Bring Back CISA: Surveillance Expansion Bill Pretending It's A Cybersecurity Bill

from the information-sharing-with-whom dept

We've discussed the "cybersecurity" bill, CISA, that's been making its way through Congress a few times, noting that it is nothing more than a surveillance expansion bill hidden in "cybersecurity" clothing. As recent revelations concerning NSA's surveillance authorities have made quite clear, CISA would really serve to massively expand the ability of the NSA (and other intelligence agencies) to do "backdoor searches" on its "upstream" collection. In short, rather than protecting any sort of security threat, this bill would actually serve to give the NSA more details on the kind of "cyber signatures" it wants to sniff through pretty much all internet traffic (that it taps into at the backbone) to collect anything it deems suspicious. It then keeps the results of this, considering it "incidental" collections of information.

In an incredibly cynical move, supporters of the surveillance state have seen OPM hacks as a ridiculous excuse to push to pass this bill. Senator Mitch McConnell tried to include it in the defense appropriations bill by pointing to the OPM hack. That gambit, thankfully, failed.

But that's not stopping the supporters of the surveillance state. During recent Congressional hearings, surveillance state supporter Senator John Cornyn claimed that CISA would be back for a vote before the end of the month, despite having failed multiple times in previous attempts. And, earlier this week, McConnell similarly announced plans to bring it up for a vote soon -- and, again in the context of the OPM hack. Here's McConnell being interviewed on Fox News by Bret Baier:

BAIER: Senator, you mentioned cybersecurity. Hackers broke into the U.S. Office of Personnel Management, stealing background investigation forms, fingerprint records, Social Security numbers for more than 22 million people....

[....]

MCCONNELL: This is a total mess. It's no wonder they had a hard time with the Web site which they launched Obamacare. These cybersecurity issues are enormously significant. What we're going to do is before August, take a step in the direction of dealing with the problem with information sharing bill that I think will be broadly supported. This is an administrative disaster that the president needs to get a hold of and get straightened out soon.

What no one asks McConnell (of course) is how CISA would have had any impact on the OPM hack. Or, hell, how it would help stop a single online attack anywhere. Because that's a question no one seems willing to answer. Because the answer was already made abundantly clear by Senator Ron Wyden in opposing this bill. It's not about cybersecurity at all. It's about surveillance.

Filed Under: cisa, cybersecurity, information sharing, john cornyn, mitch mcconnell, opm, opm hack, surveillance

China Surprises No One By Passing Cybersecurity Law That Gives It More Control Of The Internet

from the also-religion,-culture,-space,-the-ocean,-etc. dept

It appears the Chinese government is concerned it doesn't censor the internet enough already.

China has adopted a new national security law that aims to make internet, IT infrastructure and systems, and data in certain sectors "secure and controllable", state-owned news agency Xinhua said in a notice on the National People's Congress (NPC) website.

More control of the world's greatest communication tool is what's being sought, despite its best efforts to deflect this inevitable conclusion with the deployment of impenetrable jargon.

Zheng Shuna of the NPC's Legislative Affairs Commission told reporters that cyberspace sovereignty is "the embodiment and extension of national sovereignty" and an important part of national infrastructure, Xinhua said in a separate report.

This is more of the same for China, which has sought increased control of the internet for years. It has also shifted towards hardware homogeneity -- partially due to the state's protectionist tendencies, as well as strong hints that foreign hardware is arriving on its shores pre-compromised by intelligence services.

It's not just the hardware. It's also the information flowing to and from it. China can certainly restrict imports of IT hardware and regulate internal infrastructure and systems, but the internet is much more ethereal and, for the most part, can't be stopped at the borders and searched for violations of Chinese sovereignty.

But that's not all the Chinese government is seeking to control.

As well as cyber security, the law covers defence, finance, science and technology, culture, religion, space, ocean depths and polar regions.

And, in only the way one can when defending a very powerful state that takes a dim view of dissension (read: sends out the tanks), the Commission's spokesperson has provided a completely incredulous statement attempting to downplay the power grab.

Zheng rejected suggestions that the definition was "too broad", Xinhua said.

One shudders to think what China's NPC Commission would consider to be "too broad." But as worrying as China's martial-law-but-with-computers push is, the law seems resistant to interpretation. (Presumably intentionally…)

Hong-Kong based Jolene Reimerson of Pinsent Masons, the law firm behind Out-Law.com, said: "It is not yet clear how China intends to 'ensure cyberspace security' or to make the internet and data 'secure and controllable' under the new national security law."

It is probably not clear to the Chinese government, either, as much of the control sought will remain mostly out of its grasp. The new law doesn't specify what domestic IT providers will have to do to comply with the government's unstated demands, but considering its recent attempts to codify hardware/software backdoors, it will problably be something along these lines.

"Secure and controllable data" seems almost noble when placed into certain contexts, but tying it to national security and expanding the coverage to include the internet certainly isn't. "Security" and "control" aren't strange bedfellows. The first is often used to justify the latter. China isn't the only country to expand government powers and domestic surveillance in the name of "security." (In fact, you could replace the word "China" in this article's headline with the name of almost any large Western country and it would be equally unsurprising.) It just doesn't bother with the nicety of pretending to care about its citizens' rights.

There's some lip service being paid to "cooperation" with other countries for better cybersecurity, but the official talking points discuss things like "establishing a multilateral, democratic and transparent international Internet management system." It only sounds promising if you ignore China's multiple attempts to censor the internet. Or its own statements on the new law:

"Internet space within the People's Republic of China is subject to the country's sovereignty," [Zheng] said.

"Cooperation" in this context presumably means other countries and their internet-based platforms being asked to comply with filtering and blocking orders or risk losing access to a very large market. When the Chinese government says "multilateral," it's just saying it wants one internet for its people and one internet for the rest of the world and an impenetrable wall between them.

Filed Under: china, control, cybersecurity, surveillance

Computer Security Experts Release Report Slamming Proposals To Backdoor Encryption, As FBI Makes Latest Push

from the bad-ideas dept

Later today, FBI director James Comey will testify before two separate Senate panels about "going dark", the buzz phrase for law enforcement's ridiculous fear of strong encryption. In preparation for this, Comey has posted an article claiming that he's not "a maniac" and recognizes the value of strong encryption... but.

1. The logic of encryption will bring us, in the not-to-distant future, to a place where devices and data in motion are protected by universal strong encryption. That is, our conversations and our "papers and effects" will be locked in such a way that permits access only by participants to a conversation or the owner of the device holding the data.

2. There are many benefits to this. Universal strong encryption will protect all of us—our innovation, our private thoughts, and so many other things of value—from thieves of all kinds. We will all have lock-boxes in our lives that only we can open and in which we can store all that is valuable to us. There are lots of good things about this.

3. There are many costs to this. Public safety in the United States has relied for a couple centuries on the ability of the government, with predication, to obtain permission from a court to access the "papers and effects" and communications of Americans. The Fourth Amendment reflects a trade-off inherent in ordered liberty: To protect the public, the government sometimes needs to be able to see an individual's stuff, but only under appropriate circumstances and with appropriate oversight.

He ends the piece by noting that he's just encouraging debate on the topic:

Democracies resolve such tensions through robust debate. I really am not a maniac (or at least my family says so). But my job is to try to keep people safe. In universal strong encryption, I see something that is with us already and growing every day that will inexorably affect my ability to do that job. It may be that, as a people, we decide the benefits here outweigh the costs and that there is no sensible, technically feasible way to optimize privacy and safety in this particular context, or that public safety folks will be able to do their job well enough in the world of universal strong encryption. Those are decisions Americans should make, but I think part of my job is make sure the debate is informed by a reasonable understanding of the costs.

But, of course, this suggests that there hasn't been much debate on this. There has been. There was a giant debate twenty years ago and people realized how important strong crypto is and how dangerous it is to undermine it. And yet, now he's claiming we need a new debate. We don't. It's been concluded and forcing everyone to retrace their steps from two decades ago is just a waste of time, especially considering that many of these people could be working on more important things, like better protecting us and our data.

But... instead, the debate is happening. And now a large group of folks who lived through the last debate have published a fantastic report on why backdooring encryption is monumentally stupid. The report is written by a who's who of computer security folks:

Harold Abelson, Ross Anderson, Steven M. Bellovin, Josh Benaloh, Matthew Blaze, Whitfield Diffie, John Gilmore, Matthew Green, Peter G. Neumann, Susan Landau, Ronald L. Rivest, Jeffrey I. Schiller, Bruce Schneier, Michael Specter, Daniel J. Weitzner

The paper highlights that this debate was done decades ago:

Twenty years ago, law enforcement organizations lobbied to require data and communication services to engineer their products to guarantee law enforcement access to all data. After lengthy debate and vigorous predictions of enforcement channels “going dark,” these attempts to regulate the emerging Internet were abandoned. In the intervening years, innovation on the Internet flourished, and law enforcement agencies found new and more effective means of accessing vastly larger quantities of data. Today we are again hearing calls for regulation to mandate the provision of exceptional access mechanisms. In this report, a group of computer scientists and security experts, many of whom participated in a 1997 study of these same topics, has convened to explore the likely effects of imposing extraordinary access mandates.

We have found that the damage that could be caused by law enforcement exceptional access requirements would be even greater today than it would have been 20 years ago. In the wake of the growing economic and social cost of the fundamental insecurity of today’s Internet environment, any proposals that alter the security dynamics online should be approached with caution. Exceptional access would force Internet system developers to reverse “forward secrecy” design practices that seek to minimize the impact on user privacy when systems are breached. The complexity of today’s Internet environment, with millions of apps and globally connected services, means that new law enforcement requirements are likely to introduce unanticipated, hard to detect security flaws. Beyond these and other technical vulnerabilities, the prospect of globally deployed exceptional access systems raises difficult problems about how such an environment would be governed and how to ensure that such systems would respect human rights and the rule of law

As the paper notes, beyond the technical problems with these proposals, there's also the fact that other governments are going to want this same capability and that opens up all sorts of problems:

The greatest impediment to exceptional access may be jurisdiction. Building in ex- ceptional access would be risky enough even if only one law enforcement agency in the world had it. But this is not only a US issue. The UK government promises legislation this fall to compel communications service providers, including US-based corporations, to grant access to UK law enforcement agencies, and other countries would certainly follow suit. China has already intimated that it may require exceptional access. If a British-based developer deploys a messaging application used by citizens of China, must it provide exceptional access to Chinese law enforcement? Which countries have sufficient respect for the rule of law to participate in an international exceptional access framework? How would such determinations be made? How would timely approvals be given for the millions of new products with communications capabilities? And how would this new surveillance ecosystem be funded and supervised? The US and UK governments have fought long and hard to keep the governance of the Internet open, in the face of demands from authoritarian countries that it be brought under state control. Does not the push for exceptional access represent a breathtaking policy reversal?

And there's still the technical problems. Government officials still seem to think it's possible to build a golden key that only government can access. This is technologically ignorant:

[B]uilding in exceptional access would substantially increase system complexity. Security researchers inside and outside government agree that complexity is the enemy of security — every new feature can interact with others to create vulnerabilities. To achieve widespread exceptional access, new technology features would have to be deployed and tested with literally hundreds of thousands of developers all around the world. This is a far more complex environment than the electronic surveillance now deployed in telecommunications and Internet access services, which tend to use similar technologies and are more likely to have the resources to manage vulnerabilities that may arise from new features. Features to permit law enforcement exceptional access across a wide range of Internet and mobile computing applications could be particularly problematic because their typical use would be surreptitious — making security testing difficult and less effective.

[E]xceptional access would create concentrated targets that could attract bad actors. Security credentials that unlock the data would have to be retained by the platform provider, law enforcement agencies, or some other trusted third party. If law enforcement’s keys guaranteed access to everything, an attacker who gained access to these keys would enjoy the same privilege. Moreover, law enforcement’s stated need for rapid access to data would make it impractical to store keys offline or split keys among multiple keyholders, as security engineers would normally do with extremely high-value credentials. Recent attacks on the United States Government Office of Personnel Management (OPM) show how much harm can arise when many organizations rely on a single institution that itself has security vulnerabilities. In the case of OPM, numerous federal agencies lost sensitive data because OPM had insecure infrastructure. If service providers implement exceptional access requirements incorrectly, the security of all of their users will be at risk.

There's a lot more in the report itself, which is worth reading. As Kevin Bankston, the director of the Open Technology Institute, notes, we've had this debate and it's time to end it. It's over.

Tech companies, privacy advocates, security experts, policy experts, all five members of President Obama’s handpicked Review Group on Intelligence and Communications Technologies, UN human rights experts, and a majority of the House of Representatives all agree: Government-mandated backdoors are a bad idea. There are countless reasons why this is true, including: They would unavoidably weaken the security of our digital data, devices, and communications even as we are in the midst of a cybersecurity crisis; they would cost the US tech industry billions as foreign customers — including many of the criminals Comey hopes to catch — turn to more secure alternatives; and they would encourage oppressive regimes that abuse human rights to demand backdoors of their own.

Most of these arguments are not new or surprising. Indeed, it was for many of the same reasons that the US government ultimately rejected the idea of encryption backdoors in the 90s, during what are now called the “Crypto Wars.” We as a nation already had the debate that Comey is demanding — we had it 20 years ago! — and the arguments against backdoors have only become stronger and more numerous with time. Most notably, the 21st century has turned out to be a “Golden Age for Surveillance” for the government. Even with the proliferation of encryption, law enforcement has access to much more information than ever before: access to cellphone location information about where we are and where we’ve been, metadata about who we communicate with and when, and vast databases of emails and pictures and more in the cloud. So, the purported law enforcement need is even less compelling than it was in the 90s. Meanwhile, the security implications of trying to mandate backdoors throughout the vast ecosystem of digital communications services have only gotten more dire in the intervening years, as laid out in an exhaustive new report issued just this morning by over a dozen heavy-hitting security experts.

If only someone would explain that to Comey, everyone could get back to work. Yet, unfortunately, it looks like he wants to rehash this debate over and over again, despite the fact that the basics aren't going to change.

Filed Under: backdoors, computer security, cybersecurity, encryption, going dark, james comey, mobile encryption, security

Kenya's Ingenious Solution To Cybercrime: Register Every Wi-Fi User And Device With The Government

from the criminal-masterminds dept

Good news! Kenya has developed an ingenious, foolproof plan to put an end to the menace of cybercrime as we know it: they'll soon be requiring that all Wi-Fi users register with the government before going online. Since most of us realize that hacking or tricking Wi-Fi authentication systems is impossible, and, as we all know, criminals aren't capable of stealing other peoples' Wi-Fi credentials, Kenya will be at the very forefront of landing a killing blow on internet-based crime as we know it for decades to come. It's simply amazing that someone didn't come up with this idea sooner.

The new head of Kenya's Communications Authority, Francis Wangusi, last week stated in a speech that Kenya has taken over chairmanship of Association of Regulators of Information and Communications for Eastern and Southern Africa (ARICEA), a body that fights cybercrime within member nations. A new mandate of the group will require that every single Wi-Fi device in each and every member nation be registered with KENIC for the good of internet users everywhere:

"He added that Kenyans will also be required to register their mobile devices with Kenya Network Information Centre (KENIC) in new rules aimed at fighting cyber- crime. "We will license KENIC to register device owners using their national identity cards and telephone numbers, the identity of a device will be known when it connects to Wi-fi," said Mr Wangusi at the ARICEA annual general meeting Tuesday in Nairobi. CA is also committed to conduct a detailed study on the depth of web hackings in the country. Wangusi said cyber-attacks are on the rise with the banking sector suffering most, followed by government officials."

Other reports seem to indicate the well-formed plan could just involve users having to plug in a passport or other ID number before being able to access the internet whatsoever:

"We are considering the idea of ensuring the Public Wi-Fi is not accessed without a log in. The logging in of the public domain will require one’s passport number, ID Number or telephone number," he said. "The unique number of a device is identified on the internet but we can’t identify who is owning it, if you don’t use the right identification numbers. That’s why we insist on logging in the Public Wi-Fi with personal credentials. This will help us in securing the cyber space, in case of cybercrimes,” he said."

Since MAC spoofing apparently doesn't exist in the alternate dimension I'm currently writing this story from, it should be relatively easy to get everybody voluntarily registered while constantly monitoring and thwarting any attempt to bypass the system. Similarly, since fighting the ambiguous menace known as "cybercrime" is never used as a pretense to expand government surveillance and brick-and-mortar oppression, Kenya will likely spearhead this bold new assault on internet skulduggery without any negative repercussions whatsoever for the public at large. Amazing!

Filed Under: cybersecurity, kenya, registration, wifi

Feds Who Didn't Even Discover The OPM Hack Themselves, Still Say We Should Give Them Cybersecurity Powers

from the really-now? dept

We already described how the recent hack into the US federal government's Office of Personnel Management (OPM) appears to be much more serious than was initially reported. The hack, likely by Chinese state hackers, appear to have obtained basically detailed personal info on all current and many former federal government employees.

And here's the amazing thing: the federal government wasn't the one who figured out they'd been hacked. Instead, it's now coming out that it was discovered during a product demo from a cybersecurity company (guess their product works, huh?). According to the Wall Street Journal:

But four people familiar with the investigation said the breach was actually discovered during a mid-April sales demonstration at OPM by a Virginia company called CyTech Services, which has a networks forensics platform called CyFIR. CyTech, trying to show OPM how its cybersecurity product worked, ran a diagnostics study on OPM’s network and discovered malware was embedded on the network. Investigators believe the hackers had been in the network for a year or more.

That may go down as one of the most effective product demos ever.

But, what's really sickening about all of this is that the federal government is already using this hack -- which it failed to discover -- as an excuse to pass new cybersecurity legislation, whose sole purpose is to give the feds more information, in the (faulty) belief that they'll "help" prevent future attacks. Within days of the initial report of the hack, Senator Mitch McConnell pointed to it as the reason to push cybersecurity legislation:

“It might or might not deal with every aspect of what apparently happened a few days ago. But Congress is going to act on cybersecurity on this bill in the very near future.”

Thankfully, cooler heads -- including Senator Patrick Leahy -- prevailed in pointing out that the OPM hack is no reason to rush into cybersecurity legislation -- but it's even more ridiculous than that. The entire premise of these cybersecurity bills is that we need this kind of information sharing so that government folks can "help" to better protect "critical infrastructure." But these same guys are so clueless they can't even protect their own staff files -- and then need outside help to even discover that they were hacked a year ago?

Perhaps it's time to move in the other direction and take away the government's mandate over "cybersecurity" because it's shown little indication that it can handle the problem.

Filed Under: cisa, cybersecurity, fud, hack, information sharing, mitch mcconnell, office of personnel management, opm
Companies: cytech services

Hack Of Federal Gov't Employee Info Is Much, Much Worse Than Originally Stated: Unencrypted Social Security Numbers Leaked

from the because-that's-how-this-works dept

Over a decade ago, I pointed out that every single time there were reports of big "data leaks" via hacking, a few weeks after the initial report, we would find out that the leak was even worse than originally reported. That maxim has held true over and over again. And, here we go again. Last week, we noted that the US government's Office of Personnel Management had been hacked, likely by Chinese hackers. And, now, it has come out that the hack was (you guessed it) much worse than originally reported.

The President of the union that represents federal government workers, the American Federation of Government Employees (AFGE) sent a letter to the director of the OPM, claiming that the hackers got away with the Central Personnel Data File, which includes full information on just about everything about that employee -- including (get this) unencrypted social security numbers.

Based on the sketchy information OPM has provided, we believe that the Central Personnel Data File was the targeted database, and that the hackers are now in possession of all personnel data for every federal employee, ever federal retiree, and up to one million former federal employees. We believe that hackers have every affected person's Social Security number(s), military records and veterans' status information, address, birth date, job and pay history, health insurance, life insurance, and pension information; age, gender, race, union status, and more.

Oh, and then there's this:

Worst, we believe that Social Security numbers were not encrypted, a cybersecurity failure that is absolutely indefensible and outrageous.

The letter further points out -- as we did last week -- that the 18 months of credit monitoring the government has offered everyone is a complete joke. It's unlikely that the hackers are looking to do identity fraud for financial gain -- and quite likely this is for espionage purposes.

But, let's go back to the Social Security numbers being unencrypted for a second. Remember, this hack is already being used by intelligence system defenders to argue for why we need stronger "cybersecurity" laws that will give the NSA and FBI much greater access to Americans' data.

And, yes, this would be the very same FBI that has actively argued against encryption. And the NSA has always hated encryption and insists it needs backdoors into any encryption.

Both of these organizations strongly support "cybersecurity" legislation, claiming that it's necessary so that the US government can "help" companies dealing with "critical infrastructure." And yet, here we are, with the government's own personnel files being held in a system without encryption that was hacked and copied by (likely) foreign hackers. And we're supposed to trust two government agencies who have been going around cursing encryption, that we should give them more access to "protect us" when another government agency's attack likely could have been prevented if they'd just used encryption?

As plenty of cybersecurity experts will tell you, the problem in the security realm is not "information sharing." It's people doing stupid things in how they setup their systems. Not encrypting the employee files for every government employee seems to fit into that category. Perhaps, rather than focusing on bogus "cybersecurity" legislation to give more power to the idiots shouting against encryption, we should have the government focus on getting its own house in order, including encrypting employee data.

Filed Under: cybersecurity, federal government, leaks, opm, social security numbers, unencrypted