Congress Wants To Push Dangerous Cybersecurity Bill After The Election, Says US Economy Depends On It

from the bad-ideas dept

Reports are coming out that Congress is looking to push forward with bad cybersecurity legislation after the election, but before the new Congress takes over in January. We've discussed the bill in question, CISA, before. The main idea behind it is to immunize companies from liability if they share certain information with the government. Supporters of the bill note that the information sharing is entirely voluntary, but by taking away the liability it also makes it a lot more likely that companies will choose to give information to the government, and it's not yet clear why the government really needs that information. But the FUD levels are high, with Senator Saxby Chambliss actually suggesting the entire economy is at stake here:

"If we wait another year, we are really risking the economy of the United States."

Oh, come on. People have been saying this for years -- along with the whole "cyber pearl harbor" claims -- but have failed to present any explanation or details of how (1) there's a real risk to the economy or (2) how current laws block necessary solutions. On top of that, no one seems willing to explain how further information sharing will actually help stop online attacks. Remember, this is the same federal government that didn't even notice that the White House's own network had been breached until some other country told us about it. And yet, we now believe that if only US companies were feeding more information to the NSA that they'd magically be able to stop attacks (and save the economy?). That seems unlikely.

It also sounds like there may be some sort of potential trade-off, in which Congress will try to lump this bill with the USA Freedom Act, as the White House is said to be focused on surveillance reform over the cybersecurity bill. But, the reality is that the two are in many ways attached. And there are increasing worries that the final result on the USA Freedom Act will, in some ways, actually (yet again) enhance the NSA, rather than hold it back. Combine that with a cybersecurity bill that will give the NSA even more ways to get our data, and the end result could be the surveillance state increasing, rather than shrinking, with no actual benefit to the American public. There would be fewer privacy protections and just some arm waving about saving the US economy.

Filed Under: cisa, cispa, cybersecurity, economy, fud, nsa, saxby chambliss, sharing, surveillance, usa freedom act

Hackers Breached White House Network... And Some Other Country Told The US About It

from the best-cybersecurity-folks? dept

So, there's a story in the Washington Post that's getting a bit of attention about how Russian hackers apparently breached a White House computer network (an unclassified network, so not as troubling as it could have been). And that story is kind of interesting, but it seems like the bigger deal is this:

U.S. officials were alerted to the breach by an ally, sources said.

Wait a second. After all we've been told about the brilliant minds at the NSA/US Cyber Command and their "cybersecurity" skills -- it seems immensely troubling that (1) the US didn't catch this themselves and (2) that some other country did catch it. So, uh, just why is some "ally" monitoring the White House's network?

As for the rest of the report, as the Washington Post notes, this isn't even that big of a deal. Foreign state hackers are always going to try to breach US government computers, and sometimes they're going to succeed. That's the nature of the beast. But, it does seem profoundly odd that it was discovered by some other country.

Filed Under: cybersecurity, hacking, network, nsa, russians, security, us cyber command, white house

FBI Director: The Internet Is The Most Dangerous Parking Lot Imagineable

from the james-comey:-bad-at-analogies dept

FBI Director James Comey was on 60 Minutes on Sunday, in a segment that will continue next week as well. Apparently next week is when we'll find out his views on mobile encryption and whether or not the FBI is spying on all of us, but this week, he gave us a tiny hint towards the end of the segment, in which he discusses why the internet is so dangerous. As far as I can tell, the summary is "don't open attachments" (i.e., the same advice that you've been hearing for a decade, and which has little to do with many internet threats today):

Scott Pelley: Do people understand, in your estimation, the dangers posed by cybercrime and cyber espionage?

James Comey: I don't think so. I think there's something about sitting in front of your own computer working on your own banking, your own health care, your own social life that makes it hard to understand the danger. I mean, the Internet is the most dangerous parking lot imaginable. But if you were crossing a mall parking lot late at night, your entire sense of danger would be heightened. You would stand straight. You'd walk quickly. You'd know where you were going. You would look for light. Folks are wandering around that proverbial parking lot of the Internet all day long, without giving it a thought to whose attachments they're opening, what sites they're visiting. And that makes it easy for the bad guys.

Scott Pelley: So tell folks at home what they need to know.

James Comey: When someone sends you an email, they are knocking on your door. And when you open the attachment, without looking through the peephole to see who it is, you just opened the door and let a stranger into your life, where everything you care about is.

Scott Pelley: And what might that attachment do?

James Comey: Well, take over the computer, lock the computer, and then demand a ransom payment before it would unlock. Steal images from your system of your children or your, you know, or steal your banking information, take your entire life.

About the only thing I get from all this is that FBI Director James Comey is bad at analogies. Yes, you shouldn't click on attachments from unknown people, and you should even be careful about attachments from known folks. But that makes the internet the "most dangerous parking lot imaginable"? Perhaps the other thing I've learned is that James Comey doesn't have a very strong imagination.

Filed Under: attachments, cybersecurity, internet, james comey

Politicians Cynically Using JP Morgan Hack To Try To Pass Laws To Diminish Your Privacy

from the you're-doing-it-wrong dept

So, as you probably heard last week, JP Morgan revealed more details of how it had been hacked, noting that the number of households impacted shot up to 76 million, thus impacting a pretty large percentage of Americans. The hack involved getting access to customer names, addresses, phone numbers and emails. It doesn't appear to have gotten anything else, but that's plenty of information to run some sophisticated phishing attacks that could lead to some serious problems. It's expected that the fallout from this could be quite long lasting.

Almost immediately, politicians leapt into action... but not in any good way. They're cynically using this as an excuse to push questionable cybersecurity legislation. Specifically, Senator Angus King used it to push CISA, a bill that actually undermines privacy, rather than protect it, by giving companies incentives to share info more freely, opening up greater opportunities for leaks and breaches. CISA gives those companies a blanket get-out-of-jail-free card by taking away any liability in sharing such info.

What no one explains is how something like CISA would actually have helped stop the JP Morgan hack. That's because it wouldn't have helped. Congressional supporters of cybersecurity legislation keep playing the "something must be done!" card, without ever bothering to explain how the something (CISA) will actually help. They just make vague promises that by somehow letting companies share info without liability, we'll magically all be better protected. Given the recent revelations about how government has regularly abused access to information, it's hard to accept the "just trust us" explanation for why companies should just hand over more information.

Even worse is that King went for the FUD-based "cyber Pearl Harbor" claim -- one that's been trotted out regularly, usually by intelligence community folks who just want access to your data, when the reality is that even James Clapper has admitted that there's little real chance of such a thing happened. But that doesn't stop King:

“Congress must work to pass legislation that will improve our capabilities and protect us against more attacks like these,” King added. “The next Pearl Harbor will be cyber, and shame on us if we're not prepared for it.”

Okay, sure. Shame on us if we're not prepared, but how will this law help us prepare for it? This is a question that no one in Congress seems willing to answer. They just insist we have to "do something."

King wasn't the only one:

Sen. Ed Markey called the hack “yet another example of how Americans’ most sensitive personal information is in danger.”

"It is time to pass legislation to protect Americans against these massive data breaches,” he added.

Rep. Yvette Clarke tweeted that the U.S. “must keep up on cybersecurity.”

Right, but again, how will the proposed law actually help? The problem is that no one answers because the truth is that it's unlikely to actually help keep companies and your data secure, though it might just make it easier for the intelligence community to get their hands on your data.

Filed Under: angus king, cisa, congress, cybersecurity, hacking, privacy
Companies: jp morgan

Another Story Of A 'Fake' Brilliant Inventor? Is 'Scorpion Walter O'Brien' A Real Computer Security Genius?

from the more-of-this-crap? dept

There's apparently a new TV show on CBS called Scorpion that has received mixed-to-decent reviews. It supposedly is about some computer security geniuses/outcasts who help "solve complex, global problems." However, Annalee Newitz's description of the stupidest, most batshit insane hacker scene ever from the first episode, suggests that the show is not worth watching. In the past few years, it had been kind of nice to see Hollywood actually seem to have some clue about accurately portraying hacking in some situations, but that's all apparently been tossed out the window with Scorpion. Even if you don't read Newitz's story (or view the video clip), just know it involves an ethernet cable hanging from a flying plane with a car racing beneath it to download some backup software needed by the airport so planes can land. Yeah.

A big part of the show's marketing is the claim that the story is partially based on the life of one of the show's executive producers, Walter O'Brien. CBS News has an article talking up these claims of O'Brien's amazing feats, helping out its parent company, CBS, who broadcasts the show. But... for such a "genius," many of O'Brien's claims are coming under scrutiny, and they're not holding up well. Having just gone through the whole Shiva Ayyadurai / inventor of email crap, it's beginning to sound like a similar case of someone pumping up their own past for publicity purposes.

The claims about O'Brien are both odd and oddly specific. Here's CBS's reporting:

Walter O’Brien has the fourth highest IQ in the world.

Elsewhere, he claims that he was "diagnosed as a child prodigy with an IQ of 197." First off, there are significant questions about IQ as a particularly useful measurement of anything. Furthermore, the idea that there's some definitive list of those with the highest IQs seems equally questionable. A quick Google search will show you a whole bunch of "top 10 lists" of IQs -- all of them different, and none of them including anyone named Walter O'Brien.

O'Brien's story started unraveling when he made the somewhat unwise decision to do a Reddit AMA. Redditors are pretty good at sniffing out completely bogus claims, and it didn't take them long here. Also, Asher Langton has been doing a bang up job debunking basically every claim that O'Brien makes.

Among other things, O'Brien's story claims that he began Scorpion Computer Services in the mid-1980s and that "Scorpion has mitigated risk for 7 years on $1.9 trillion of investments and has invented and applied Artificial Intelligence engines to protect United States war fighters in Afghanistan." It's not even entirely clear what that means. It goes on:

Since 1988, Scorpion's team of world class experts partner with clients on a global basis, across industries, to add real measurable value in mission-critical initiatives from planning, to execution, to running the business. Scorpion's senior management has a collective knowledge of more than 413 technologies, 210 years in IT, and 1,360 projects. Scorpion himself has created over 177 unique technology inventions including ScenGen and WinLocX and is one of the world's leading experts in the application of computer science and artificial intelligence to solve complex industry challenges."

Again with the odd, and oddly specific claims. They have knowledge of 413 technologies? Do they have a list somewhere? Does it include the coffee machine in the lunch room? Did they send someone out to get the new iPhone 6 to make it 414? Either way, there are... just a few problems with these claims. As Langton points out, the "headquarters" of Scorpion Computer Services Inc. does not appear to be a particularly large or impressive company. Its headquarters is actually... a UPS store address That report notes that it has one employee, and revenue of $66k. It's possible that the report is inaccurate, but for such a big and successful company, you'd expect to see... at least a bit more historical evidence of its existence. But there is none.

And then there's this page (and here's the web archive version in case O'Brien figures out how to delete the old page), which apparently used to be the site for Walter's Scorpion computer Services, that, um, looks like it was built on GeoCities -- complete with the animated fire torches next to the dreadfully designed logo.

For a big, massively successful company... you'd expect, um, something a bit more professional. Walter's own Linkedin profile notes that he actually worked at Capital Group for a while, with redditors claiming he was just a QA guy there, though his profile says he was a "technology executive." Many other claims on the company's website read like self-promotional gibberish. "We saved $43 billion in opportunity risks over a five-year period." "We invented an efficiency engine that performs 250 human years of work every 1.5 hrs with over 99% improvement over human error." By the way, the "see how" link on that last one doesn't actually show you "how" it just takes you to a page about how the company is a value added reseller "for proven IT products." The entire website looks like gibberish from someone trying to sound like a real tech company. It reminds me of Jukt Micronics.

Langton also turned up that O'Brien appears to have another "company" called Strike Force, using the same UPS Store address, and with very, very, very, very similar website design and bullshittery. That site has a really bizarre "what others say" page, listing out random referrals for O'Brien, which are generally just the standard empty "personal reference letters" people without much experience tend to ask some former colleagues for when looking for a new job. The first one is from Steven Messino (with the date conveniently stripped off) which looks like the generic job reference letter:

Note that O'Brien claims that Messino is the co-founder of Sun. That's... not true. Anyone who knows anything about the history of Sun knows it was co-founded by Andy Bechtolsheim, Bill Joy, Scott McNealy and Vinod Khosla in 1982. Messino's own LinkedIn page shows he joined Sun in 1988. Six years after it was founded. Also, Sun had its IPO in 1986. So it's not like this was a small company when Messino joined... as a "regional sales manager."

Basically, everywhere you look, O'Brien's claims are either massively exaggerated to downright ridiculous.

There are also some odd personal claims about "Homeland Security" coming to find him as a 13-year old boy for hacking into NASA. Except, when he was 13, there was no Homeland Security -- an agency established after the September 11, 2001 attacks. O'Brien also claims this:

Scorpion was born and raised in Ireland, and at 16, ranked first in national high speed computer problem solving competitions. At 18, he competed in the World Olympics in Informatics and has ranked as high as the sixth fastest programmer in the world.

Sixth fastest programmer in the world? Really? Some folks on Reddit noted that it doesn't appear Ireland competed in the "International Olympiad in Informatics" in 1993, though someone else found a report from the University of Sussex, which O'Brien attended, noting that O'Brien had come in 6th in a different contest, but in the Olympiad itself, he came in 90th. I mean that's great for an 18 year old, but it hardly makes him into some programming genius.

And we won't even touch the claims that his programming helped catch the Boston Marathon bombers, because... well... really?

Frankly, the parallels with Ayyadurai and the email story are there. It certainly appears that, like Ayyadurai, O'Brien was a bright kid who did some impressive programming as a teenager, but then didn't appear to amount to all that much noteworthy beyond that. Try searching for any news references or evidence of O'Brien doing anything other than in the last few months in the publicity leading up to this new TV show. However, he is trying to reinvent himself and rewrite his history as some sort of genius programmer responsible for all sorts of amazing things, very little of which seems directly supportable. Of course, CBS doesn't really care, so long as they have a fun TV show that people watch, but at the very least, they shouldn't continue to spread the exaggerated myths about O'Brien that appear to have little basis in fact.

Filed Under: cybersecurity, exaggeration, hacking, hollywood, scorpion, shiva ayyadurai, walter o'brien

New Zealand PM Releases Documents... That Don't Actually Discuss GCSB Mass Surveillance

from the wait,-what? dept

So we had just posted New Zealand Prime Minister John Key insulting the Pulitzer Prize-winning journalist Glenn Greenwald, referring to him as a "henchman" and "a loser" for showing up in New Zealand to reveal that, contrary to Key's own claims, the country's GCSB (local equivalent of the NSA) had been engaged in mass surveillance of New Zealand residents. The documents Greenwald revealed showed how the Kiwi government was being pressured by the NSA to pass a law to fully "legalize" the program for mass surveillance of metadata. Further support to Greenwald's claims was provided in an article written by Ed Snowden, discussing just how easy it was to go surfing through the metadata collected on New Zealanders by GCSB.

Over the weekend, Prime Minister Key had said that once Greenwald revealed what he had, he would declassify a set of documents proving that Greenwald was wrong. Well, now Key has, in fact, declassified a set of documents from the GCSB... and they don't actually discuss what Greenwald or Snowden were talking about. Instead, they look like some internal discussions of why GCSB needed a (dangerous) program that would allow GCSB to try to spot and deal with foreign cyberattacks (similar to what the NSA wanted to do in the US, but which banks on Wall St. rejected).

So, basically all that Key has revealed is that GCSB supported an overly broad cyberattack plan that would let the GCSB take it upon itself to deal with cyberattacks -- a plan so insane that even the US has rejected it -- in part because it would massively increase surveillance. So, Key has revealed secretly approved plans to increase GCSB surveillance, while pretending he's debunking increased GCSB surveillance. And, yet, the documents don't even address any of Greenwald and Snowden's actual claims. When asked about that Key appears to have done his standard childish pouting, refusing to answer about specifics:

"There is not, and never has been, mass surveillance of New Zealanders undertaken by the GCSB.

He would not discuss XKEYSCORE, ''we don't discuss the specific programmes the GCSB may, or may not use''.

''But the GCSB does not collect mass metadata on New Zealanders, therefore it is clearly not contributing such data to anything or anyone," Mr Key said.

Frankly, this is a bit of a let down. Given the documents that Greenwald revealed on Monday, there was still the slight possibility that changes had happened along the way and people had rethought a bad plan. So I was wondering if Key might actually reveal something miraculous like that. Instead, it seems like he's trying a sleight of hand trick by declassifying and releasing unrelated documents (that actually reveal a secret surveillance expansion different from the one Greenwald revealed) and hoping no one notices. Interesting strategy. It seems to assume that the New Zealand populace doesn't actually pay attention to any details, which seems like a risky move.

Filed Under: cybersecurity, ed snowden, gcsb, glenn greenwald, john key, kim dotcom, metadata, nsa, surveillance

Health And Human Services Ex-Cybersecurity Director Convicted Of Kiddy Porn

from the guarding-the-chicken-coop dept

There seems to be someone asleep at the wheel in the federal government's HR department, given how many questionable people have been put in high profile/high responsibility security positions. Kieth Alexander, uber-Patriot, locked his cyber-security expertise up with a patent. The White House's cyber-security guy can't wait to tell you how little he knows about his job. Homeland Security's former Inspector General was accused of a ridiculously long list of questionable behavior (in addition to having no qualifications for the job). And now, ex-director of cybersecurity for the U.S. Department of Health and Human Services has been convicted on kiddy porn charges.

Timothy DeFoggi, 56, formerly of Germantown, Md., is the sixth individual to be convicted as part of an ongoing investigation targeting three child pornography websites, the Justice Department said. He faces sentencing on Nov. 7 based on the findings Tuesday that he engaged in a child-exploitation enterprise, conspired to advertise and distribute child pornography, and accessed a computer with intent to view child pornography in connection with his membership in a child-pornography website.

Oh, well that's just great. The head cyber-security guy for a government organization that includes divisions for preventing child abuse and child support enforcement was a pedophile at best. Let's be clear: according to the evidence presented by prosecutors, DeFoggi is simply as bad as it gets.

"Through the website, DeFoggi accessed child pornography, solicited child pornography from other members, and exchanged private messages with other members where he expressed an interest in the violent rape and murder of children," prosecutors added. "DeFoggi even suggested meeting one member in person to fulfill their mutual fantasies to violently rape and murder children."

I'd like to take a moment to remind everyone reading this that the United States federal government has engaged in widespread surveillance on its own people. They're watching what you do, particularly online. They're intruding on our lives in ways Orwell couldn't have dreamed of. And they're doing it all under the notion that it's for our protection. If we must live with that kind of intrusion for the time being, is it too much to ask that the government manage to weed out violent child-rapists from their own ranks as some kind of accommodation?

Filed Under: child porn, cybersecurity, doj, health and human services, timothy defoggi

White House's Cybersecurity Guy Proud Of His Lack Of Cybersecurity Knowledge Or Skills

from the say-what-now? dept

So we were just writing about how the White House appeared to be going with a security by obscurity tactic in denying an Associated Press FOIA request concerning the security behind Healthcare.gov. Specifically, the request was denied because the White House claimed that revealing such info might help hackers. As we noted, if revealing the basic security plan you're using will help hackers, then you're not secure and chances are you've already been hacked.

Of course, perhaps the reason why the cybersecurity is so awful is because the White House's "cybersecurity coordinator," Michael Daniel, not only isn't a cybersecurity expert but thinks that's a good thing. I wish I was joking. After spending a few minutes talking about all his training at Princeton and the Kennedy School at Harvard taught him to communicate well and "break down problems" he dismisses the need for actual technical knowledge.

You don't have to be a coder to really do well in this position. In fact, actually, I think being too down in the weeds at the technical level could actually be a little bit of a distraction..... You can get taken up and sort of enamored with the very detailed aspects of some of the technical solutions. And, particularly here at the White House... the real issue is to look at the broad, strategic picture and the impact that technology will have.

Now there is some truth to the idea that it's important to be able to look at the bigger picture, but when you're talking about cybersecurity, part of the way that you can look at the bigger picture is to actually understand the technology. That's not "a distraction" it's part of the core and necessary knowledge to then do the job of a cybersecurity coordinator. People who don't spend much time with these things view cybersecurity and technology as a kind of "magic." But it's not. Nor is technology economics, but Daniel thinks it is:

But the other issue in my mind is that at a very fundamental level, cybersecurity isn't just about the technology but it's also about the economics of cybersecurity. Why companies choose to invest the way they invest. It's about the pscyhology of cybersecurity. You know, one of my sayings is that 'expediency trumps cybersecurity every time' meaning that people will prioritize convenience over being secure many times. So you need to have the understanding of those kinds of factors: the psychology, the economics, the broad policy, the politics with a little p, in addition to the technology. So you need to be more of a generalist than having a lot of expertise particularly in the technological side.

Yes, in addition to the technology. All of those things are important, but they're mostly useless if you don't understand the underlying technology. He's then asked what are the biggest challenges and... after talking about how important it is to understand the psychology and economics (more important than the technology) he admits that he doesn't actually understand the psychology and economics. Because, apparently, he wants to make sure that he has none of the job qualifications for the job.

There are a few [challenges] that I can identify. One is that we don't actually truly understand the economics and psychology behind cybersecurity. We know that a huge number of intrusions rely on known fixable vulnerabilities... We know that intruders get in through those holes that we know about that we could fix. The question is, 'Why don't we do that?' That clearly leads me to the conclusion that we really don't understand all of those economics and psychology well enough.

So there you have it folks. The White House's cybersecurity expert doesn't have the technological expertise, but insists it's okay because he's focused on the economics and psychology of the fact that people don't patch their computers -- and then admits he has no idea why that happens.

This doesn't make me feel any safer.

Filed Under: cybersecurity, cybersecurity coordinator, michael daniel, skills, white house

Snowden: NSA Was Building 'Automated' System To Hit Back At Perceived Cyberattacks

from the bad-ideas dept

One final story to highlight from James Bamford's really wonderful Wired profile of Ed Snowden. This one might not be that surprising, but the NSA was building an internal automated "cyberwar" system called MonsterMind, which would seek to detect an incoming "cyber attack" and then automatically launch a counterattack. Here's how Bamford describes Snowden's explanation in his article:

The massive surveillance effort was bad enough, but Snowden was even more disturbed to discover a new, Strangelovian cyberwarfare program in the works, codenamed MonsterMind. The program, disclosed here for the first time, would automate the process of hunting for the beginnings of a foreign cyberattack. Software would constantly be on the lookout for traffic patterns indicating known or suspected attacks. When it detected an attack, MonsterMind would automatically block it from entering the country—a “kill” in cyber terminology.

Programs like this had existed for decades, but MonsterMind software would add a unique new capability: Instead of simply detecting and killing the malware at the point of entry, MonsterMind would automatically fire back, with no human involvement.

Yeah, because false alarms never happen at all. Hell, just this week I was hearing about a series of false alarms when the US thought that Russia had launched thousands of nuclear missiles at the US. Imagine an automated system taught to respond to that?

And, of course, this only works... if the NSA has access to private company's networks:

In addition to the possibility of accidentally starting a war, Snowden views MonsterMind as the ultimate threat to privacy because, in order for the system to work, the NSA first would have to secretly get access to virtually all private communications coming in from overseas to people in the US. “The argument is that the only way we can identify these malicious traffic flows and respond to them is if we’re analyzing all traffic flows,” he says. “And if we’re analyzing all traffic flows, that means we have to be intercepting all traffic flows. That means violating the Fourth Amendment, seizing private communications without a warrant, without probable cause or even a suspicion of wrongdoing. For everyone, all the time.”

This puts into context some stories from last year, which noted that Keith Alexander seemed particularly focused on getting companies to give the NSA access to their networks. Last October, he gave a speech in which he pitched exactly that:

Drawing an analogy to how the military detects an incoming missile with radar and other sensors, Alexander imagined the NSA being able to spot "a cyberpacket that's about to destroy Wall Street." In an ideal world, he said, the agency would be getting real-time information from the banks themselves, as well as from the NSA's traditional channels of intelligence, and have the power to take action before a cyberattack caused major damage.

And in a Washington Post profile of Keith Alexander from over a year ago, a similar idea was discussed:

His proposed solution: Private companies should give the government access to their networks so it could screen out the harmful software. The NSA chief was offering to serve as an all-knowing virus-protection service, but at the cost, industry officials felt, of an unprecedented intrusion into the financial institutions’ databases.

The group of financial industry officials, sitting around a table at the Office of the Director of National Intelligence, were stunned, immediately grasping the privacy implications of what Alexander was politely but urgently suggesting. As a group, they demurred.

“He’s an impressive person,” the participant said, recalling the group’s collective reaction to Alexander. “You feel very comfortable with him. He instills a high degree of trust.”

But he was proposing something they thought was high-risk.

“Folks in the room looked at each other like, ‘Wow. That’s kind of wild.’ ”

This all should probably make you wonder why those very same financial institutions seem willing to shell out somewhere between $600,000 and $1 million per month for Alexander's "patent-pending" solutions to "cybersecurity."

Furthermore, this should shed some light on why the NSA was so in favor of CISPA and now CISA -- cybersecurity bills in Congress that would give private companies liability protections if they... shared network data with the NSA (and other parts of the federal government). The NSA needs those liability protections to get some companies to be willing to open up their networks to do this kind of MonsterMind offering, or they won't participate. It's also why Congress shouldn't pass such a bill.

Filed Under: access, automated, cisa, cispa, cyberattack, cybersecurity, ed snowden, keith alexander, monstermind, nsa, private networks

Ex-NSA Boss Defends Patenting His Totally Brand New, Not Developed On Gov't Time, Patent-Pending Cybersecurity Brilliance

from the yeah-that's-believable dept

We recently wrote about Keith Alexander claiming that he's worth as much as $1 million a month (actually, the number is now being lowered to $600k) because he's magically come up with a totally brand new anti-hacking concept that will have many patents. As we noted, this story raised all sorts of questions. First, if he had such a brilliant idea to stop hackers, why didn't he use it back when he was in charge of the NSA and the US Cyber Command? His answer to that was that he magically came up with it after he left office in March. Of course, if that's the case, it's difficult to see how it can be worth many hundreds of thousands of dollars per month because it's a totally untested and totally brand new idea. He can't both be claiming that his years of NSA experience make it worthwhile and that this idea has nothing to do with his work at the NSA -- but he seems to be doing exactly that.

Either way, he's given an interview to the Associated Press in which he tries (and fails) to defend himself concerning the new operation, IronNet Cybersecurity:

"If I retired from the Army as a brain surgeon, wouldn't it be OK for me to go into private practice and make money doing brain surgery?" he asked. "I'm a cyber guy. Can't I go to work and do cyber stuff?"

The "brain surgery" analogy is not even close to be analogous. This is more like he was the administrator of an army hospital who has now retired and says, despite never having personally done a brain surgery, he's now invented a miraculous new way to do brain surgeries so powerful people have only dreamed of them before. Naturally, most people should be skeptical of such claims.

And, of course, most actual cybersecurity folks I know don't consider Alexander to really be a "cyber guy." He's not. Yes, he managed various groups that could hack into systems, but that doesn't make him any sort of expert on cybersecurity. Just the fact that he's diving into the murky waters of "behavioral modeling" as his anti-hacking technique should raise some flags. It's an area that has been talked about a lot, but solutions haven't been any good at all.

Is it possible that Alexander has broken through on an idea that has stumped many people who actually do spend all their time hacking away at systems, looking for security holes and how to fix them? Sure. It's possible, but it's improbable. And the claims by themselves should require significant proof before they're taken seriously. As we've said for years, ideas are one thing. Execution is another, and Alexander has shown no evidence that his solution is actually any good. So why are companies paying him upwards of six figures a month? Good question. It seems unlikely that they truly believe he has found the holy anti-hacking grail. It seems more likely that they like his government connections.

Filed Under: behavior modeling, cybersecurity, hacking, keith alexander, nsa, patents
Companies: ironnet cybersecurity