Your Tax Dollars At Work: How Commerce Dept. Spent $2.7 Million Cleaning Out Two Malware-Infected Computers

from the burning-a-hole-in-taxpayers'-pockets dept

The cyber-Pearl Harbor is upon us and the only way to defeat it is to sink our own ships at the first sign of invasion. This is the sort of thing that happens when the legislators and advisors with the loudest voices value paranoia over rational strategy. The Department of Commerce, aided by a tragicomic string of errors, managed to almost stamp out its malware problem.

The Commerce Department's Economic Development Administration spent almost half of its IT budget last year to remediate a cyber attack that barely happened.

EDA's drastic steps to limit the damage by shutting down much of the access to the main Herbert Hoover Building network ended up costing the agency more than $2.7 million to clean up and reconfigure its network and computers. The IG said the bureau destroyed more than $170,000 in IT equipment, including desktop computers, printers, keyboards and mice.

Also included in the mass destruction were cameras and TVs. It wasn't just cyber-paranoia that led to this hardware cull. There was plenty of miscommunication too, along with the usual doses of bureaucratic clumsiness. The Inspector General's report breaks down the chain of missteps, which all began with a response team member grabbing the wrong network info.

In an effort to identify infected components, DOC CIRT’s (Dept. of Commerce Computer Incident Response Team) incident handler requested network logging information. However, the incident handler unknowingly requested the wrong network logging information... Instead of providing EDA a list of potentially infected components, the incident handler mistakenly provided EDA a list of 146 components within its network boundary. Accordingly, EDA believed it faced a substantial malware infection.

Yes. Much like "Reply" and "Reply All" will both get the job done, only one is the correct choice when firing off a devastating critique of your soon-to-be-former coworkers. The same goes for network logs. One shows you the correct info. The other "indicates" that more than half the EDA's computers are suffering from a malware infection.

DOC CIRT did try to get this fixed, pointing out the error to the handling team and re-running the analysis using the correct network log. Turns out, the original estimate was slightly off.

The HCHB network staff member then performed the appropriate analysis identifying only two components exhibiting the malicious behavior in US-CERT’s alert.

This new data in hand, a notification was sent out ostensibly to clear things up, but this too was mishandled so badly someone unfamiliar with bureaucratic ineptitude might be inclined to suspect sabotage.

DOC CIRT’s second incident notification did not clearly explain that the first incident notification was inaccurate. As a result, EDA continued to believe a widespread malware infection was affecting its systems.

Specifically, the second incident notification began by stating the information previously provided about the incident was correct. EDA interpreted the statement as confirmation of the first incident notification, when DOC CIRT’s incident handler simply meant to confirm EDA was the agency identified in US-CERT’s alert. Nowhere in the notification or attachment does the DOC CIRT incident handler identify that there was a mistake or change to the previously provided information.

Although the incident notification’s attachment correctly identified only 2 components exhibiting suspicious behavior—not the 146 components that DOC CIRT initially identified—the name of the second incident notification’s attachment exactly matched the first incident notification’s attachment, obscuring the clarification.

For five weeks, things went from bad to worse to comically tragic to tragically comic to full-scale computercide. Looking at its list (2 components), DOC CIRT asked the EDA to attempt containment by reimaging the infected items. Looking at its list (146 components), the EDA responded that reimaging half its devices would be "unfeasible." Taking a look at the EDA's list (from the first, mistaken network log analysis), DOC CIRT assumed the EDA had received additional analysis indicating the malware had spread, and changed its recommendations accordingly.

Finally, both departments were on the same (but entirely wrong) page and scaled up the response accordingly. A copy went to the DHS, stating that "over 50%" of the EDA's devices were infected. The DHS then accepted this without seeking independent confirmation. The NSA cranked out its own concerned report, quoting heavily from the DHS report (which was still in draft form), both of which were based on DOC CIRT's first erroneous report. This went undetected for over a year, until the OIG informed the involved agencies of its findings in December 2012.

The end result? The EDA and DOC CIRT worked together, attempting to head off a "severe" malware threat before it spread to other connected government computers. Despite gathering more information from outside consultants that indicated the malware was neither "persistent" nor a threat to migrate, the two agencies began destroying devices in May of 2012, finally stopping three months later when the "break stuff" budget had been exhausted.

Fortunately for the agencies, taxpayers and the surviving equipment (valued at over $3 million), the OIG's findings were brought to the agencies' attention before the fiscal year began and a new "break stuff" budget approved. All in all, the EDA spent over $2.7 million fighting a malware "infection" confined to two computers.

There's nothing in this report that makes the EDA look good. A chart on page 8 shows the EDA has persistently ignored the OIG's recommendations on agency computer security, with some assessments going back as far as 2006. It's no surprise it managed to (along with the Dept. of Commerce's response team) transform a 2-computer infection into a nearly $3 million catastrophe.

Filed Under: commerce department, malware, miscommunication

Let The Judiciary Committee Know That Creating A Mini-SOPA Without Public Participation Is Unacceptable

from the speak-up dept

Yesterday, we wrote about how Lamar Smith was rushing through a new bill that looked to approve a piece of SOPA that would spend taxpayer money to expand the diplomatic corp with a bunch of people whose job it would be to spread Hollywood's special copyright interests around the globe... and to set up a special agency for this in the Commerce Department. Despite the public rebuke Lamar Smith got for his efforts to write SOPA in secret and then to rush it through, he apparently didn't learn much and chose to do this bill the same way. It was put on the schedule to be marked up without the bill even being announced -- basically a way to rush it through in secret.

It appears that this plan is falling apart. The markup did not happen this morning, and we're hearing that support for the bill is wavering. Some of the named co-sponsors have made it clear that they're just as unhappy that the bill was being rushed out this way without public comment and were uncomfortable with some of the specifics in the bill -- and that these concerns mean that the bill may actually be delayed. It may be a very temporary delay, but it does sound like some of the "co-sponsors" may have changed their minds and won't be supporting the bill. And, for the time being, the markup has been called off.

There is still a lot of back and forth going on, and it's still important to speak up. Public Knowledge pointed out that the House Judiciary Committee and Lamar Smith need to learn that secret bills are a non-starter, and they're absolutely right.

Before getting to the substance of the bill, perhaps the most shocking thing about it is how it is being handled by Committee Chairman Smith (who was a driving force behind SOPA). If Congress learned no other lesson from SOPA and PIPA, you would think that they got the message about not developing IP-related laws in secret. But you would be wrong. This bill leaked, fully formed, over the weekend and was scheduled for markup today. Needless to say, this came as a surprise to just about everyone not directly involved with drafting it and provided a very limited opportunity to meaningfully participate in the markup process. Step zero for any new IP bill should be a transparent drafting process.

Given that this is still a highly fluid situation, if you're represented by any of the members of the House Judiciary Committee, you might want to give them a call and let them know that you opposed SOPA and you're shocked that the HJC might push through a piece of SOPA in a process that was even more secretive than the one for SOPA itself.

Filed Under: commerce department, diplomatic corp, house judiciary committee, lamar smith, sopa, ustr

Lamar Smith Looking To Sneak Through SOPA In Bits & Pieces, Starting With Expanding Hollywood's Global Police Force

from the learned-anything? dept

While it didn't get nearly as much attention as other parts of SOPA, one section in the bill that greatly concerned us was the massive expansion of the diplomatic corp.'s "IP attaches." If you're unfamiliar with the program, basically IP attaches are "diplomats" (and I use the term loosely) who go around the globe pushing a copyright maximalist position on pretty much every other country. Their role is not to support more effective or more reasonable IP policy. It is solely to increase expansion, and basically act as Hollywood's personal thugs pressuring other countries to do the will of the major studios and labels. The role is literally defined as pushing for "aggressive support for enforcement action" throughout the world. A few years ago, we detailed how, at a meeting of these attaches, they bitched and complained about how copyright "activists" were making their lives difficult and were a "threat" who needed to be dealt with.

In other words, these people are not neutral. They do not have the best interests of the public or the country in mind. Their job is solely to push the copyright maximalist views of the legacy entertainment industry around the globe, and position it as the will of the US government.

It was good that this was defeated as a part of SOPA... but now comes the news that Lamar Smith is introducing a new bill that not only brings back this part, but appears to expand it and make it an even bigger deal. Politico has a short blurb:

SMITH, OTHERS UNVEIL IP BILL -- House Judiciary Committee chief Lamar Smith and other members are unveiling today their new Intellectual Property Attache Act, which realigns the Commerce Department a bit. The measure as proposed would move the current attache program housed with the USPTO to the full agency, complete with an assistant secretary of Commerce for Intellectual Property. The proposal is slated for full committee markup on Tuesday. Named as supporters on the measure are a number of panel Dems and Republicans: Reps. Bob Goodlatte, Mel Watt, Darrell Issa, Howard Berman, Howard Coble, Steve Chabot, Jason Chaffetz and Adam Schiff

You can see the current draft of the bill (pdf and embedded below), but it has not yet been officially introduced. However, the House Judiciary Committee is scheduled to mark it up in the morning, suggesting that it's on the fast track, with almost no public scrutiny. In fact, I've heard from people worried about this bill that they were only told of its existence on Saturday.

The specifics of the bill appear to go further than the version in SOPA. It is clear that the bill itself is framed from the maximalist perspective. There is nothing about the rights of the public, or of other countries to design their own IP regimes. It notes that the role of the attaches is:

to advance the intellectual property rights of United States persons and their licensees;

The bill also "elevates" the IP attaches out of the US Patent and Trademark Office, and sets them up as their own agency, including a new role: the Assistant Secretary of Commerce for Intellectual Property. Yes, we'll get another IP Czar, this time focused in the Commerce Department.

When even the USTR is recognizing the importance of limitations and exceptions to copyright, to have Congress push a bill that basically ignores limitations and exceptions and only looks to expand Hollywood's special thugs within the diplomatic corp. seems like a huge problem.

But the even bigger issue is a simple one of process. Shouldn't Lamar Smith have learned by now that you don't try to sneak through SOPA or any of its components without first getting widespread public opinion on these things?

Filed Under: commerce department, diplomatic corp, lamar smith, sopa, ustr

Commerce Department's Own Study Debunks Commerce Department's Defense Of Said Study

from the *sigh* dept

So, back in April we wrote about a bizarre report from the US Commerce Department and the US Patent and Trademark Office, which tried to sum up the "jobs" in "IP-intensive" industries, as a measure of how important those laws were. As we noted last week, the White House reached out to us and offered up the experts behind the report for an interview -- but when we submitted some questions (as they asked us to do prior to setting up the final interview), they suddenly rescinded that offer and offered up this bizarre and nonsensical statement about how Steve Jobs had lots of patents and Steve Jobs created cool products, so patents are important. They did nothing to refute the insane methodology of the study that attributes all of the jobs of people working in grocery stores, insurance companies, clothing stores and more to "IP intensive industries." Nor do they explain why the report is useful in suggesting why we need more copyright laws to protect all those jobs -- when copyright really barely touches on any of the jobs in the list.

Instead... they focus on this bizarre Steve Jobs example.

All evidence suggests that patents continue to drive innovation in technology. At the time of his death, innovator Steve Jobs had more than 300 patents. Companies such as Apple have made transformative changes in our lives, made possible by massive investments made by intellectual property. But while such companies develop brand-new technologies and services, they also perform incremental innovation. Thus, IP conflicts arise as the byproducts of a very healthy overall innovation environment. The tech industry is characterized by extremely sharp drops in costs over time, extremely strong increases in performance, and multiple changes in market leads, with different companies leading at different points in time. That tremendously competitive marketplace is a sign of the critical role IP rights play in driving technology companies to invest, compete, create jobs, and drive exports.

Of course, as a friend pointed out, since the report covers trademarks, copyright and patents, it's a little strange that they focused solely on patents in their "defense" of the report. After all, as the "grocery store" discussion points out, the vast, vast majority of the "jobs" counted in the report are related to trademarks. And, so far, nearly all of the policy efforts that are highlighting the report are around copyright issues.

Oh, and then there's this: That's figure 2 from this very same report. And, as you might notice, it seems to show that, on an indexed basis, jobs in "patent intensive" industries have been on the decline relative to everything else. In fact, it seems to suggest that since about 1998 (hmmm... right at the point in which the Federal Circuit appeals court deemed software patentable in the infamous State Street case), relative employment in patent-intensive industries has gone down. Pretty massively.

Lets add to it another chart, one we published a year and a half ago, put together by the folks at Patently-O. Note the big jump in patents in 1998, and the continued growth all the while jobs in "patent-intensive industries" seemed to be on the decline? Yeah. Isn't that interesting?

Yes, these are also correlation figures, possibly not causal. But the correlation can be useful in showing that something doesn't add up from the story (it's not so useful for explaining causation, but rather just for indicating that a causal relationship doesn't appear to be present). So it seems even more bizarre and more questionable that the Commerce Department is waving around "Steve Jobs had patents" as the defense of the report -- when the data from their own report doesn't even seem to agree with their own conclusion.

Filed Under: commerce department, patents, steve jobs, uspto, white house

Commerce Department Postpones 'Africa IP Forum' After People Point Out How One-Sided It Is

from the all-stakeholders?-you-mean-we-have-to-hear-from-the-other-side? dept

A couple weeks ago, we pointed to an absolutely ridiculous "Africa IP Forum" that was being organized by WIPO and the US Department of Commerce, where it appeared the entire event was around forcing extreme IP enforcement on Africa, despite plenty of evidence that developing nations, such as most of those in Africa, are hurt by such enforcement. The whole schedule was one-sided with speakers who mainly supported extreme enforcement over looking for the most reasonable overall solutions for different economies. After widespread outcry concerning this rather non-subtle attempt to export US-style copyright maximalism to the African continent, the US Commerce Department has announced that the event has been postponed.

The African Intellectual Property Forum, originally slated for April 3-5, 2012 in Cape Town, will be rescheduled. Organizers are committed to ensuring that all stakeholders – in government, private business, the arts and the development community – are represented and engaged in the conference organization and agenda.

The organizers apparently also sent emails to those who had registered, apologizing to people who had already made travel arrangements.

While it's nice that the Commerce Department has recognized that the original program was no good and that all stakeholders should be heard from -- it would have been much nicer and a hell of a lot more convincing if they had done so originally, rather than just a few weeks before the scheduled event when people started protesting...

Filed Under: africa, commerce department, copyright, enforcement, ip forum, patents, wipo

Commerce Department Releases Useless, Biased Report On Trademark Bullying

from the that's-what-happens-when-you-only-ask-one-side dept

Trademark bullying is a big problem, and it's one that we regularly discuss here on the blog. It involves a trademark holder threatening and/or suing another company claiming infringement, where there's really none. It's quite effective and can have serious chilling effects. After Monster Energy Drink went after Vermonster beer for trademark infringement (yes, a trademark bullying cases that had nothing to do with one of the biggest trademark bullies, Monster Cable), Vermont Senator Patrick Leahy suddenly took an interest in trademark bullies. A report on the issue was requested, and the typically useless Commerce Department took on the task and did a ridiculous job at it. This is a commerce department that seems to think copyright, patent and trademark laws are wonderful and should only be expanded.

You can read the full report (pdf), but you won't get much useful out of it. Eric Goldman's detailed summary of the report's massive failings is much more educational. Basically, much of the "research" for the report came from big trademark holders -- who are often the biggest bullies -- rather than the victims of trademark bullying. So, of course, they said there really wasn't much of a problem at all, and the Commerce Department parroted that position.

The worst part, however, was in the whole discussion on the "duty to police." This is an issue that is regularly raised whenever we talk about trademarks, where people claim that you have to enforce your trademark or you can lose it. As we've explained many times, that's a bastardization of what the law and case law seem to actually say. It's only true that you need to enforce it in situations where there's an actual likelihood of confusion and/or it's being used in direct competition. The tangential or totally unrelated uses don't require you to enforce. Furthermore, there are alternative actions rather than threatening or suing -- such as offering up free or cheap licenses.

Goldman's section about this "duty to police" delves in even further, and basically shows why the Commerce Dept. report is useless:

Second, the report says "a trademark is a property right that an owner has a duty to police." WHOA! Many folks would dispute the characterization of trademarks as "property"; and many folks (including me) insist that the "duty to police" is massively overstated. Later, the report says, "In view of the mark owner’s obligation to police violations, aggressive enforcement of one’s trademark rights does not automatically equate to abuse or bullying." In effect, the report says that it doesn't see any problem at all; but if there is a problem, it's just the natural consequence of that pesky duty to police....oh well, c'est la vie.

Given its apathetic nature, the report doesn't make the logical jump that any intellectually curious person would instantly make: if the "duty to police" might be driving trademark owners to be (over)zealous in their enforcement efforts, maybe we should fix the duty to police. After all, this "duty" isn't in the statute at all; it's barely in the caselaw; and it could be easily remedied with a statutory clarification that might very well be welcomed by both trademark owners and secondary trademark users because it might eliminate ambiguity plaguing both communities. C'mon, guys--that conclusion isn't exactly rocket science.

From my perspective, the "duty to police" is like the proverbial monster under a child's bed. It's not actually there, but boy, it sure seems scary. My academic writing queue is too thick right now to tackle this issue immediately, but I don't recall seeing a good comprehensive academic article grokking the duty to police (if I'm forgetting something, please let me know). That would be an excellent paper topic. I would be happy to work with someone on this project so that we can demonstrate just how massively the "duty to police" is overstated--typically as a business development tool for trademark litigators trying to afford their kids' private school tuition. Naturally, the Department of Commerce report undertook no such research effort into the trademark policing duty itself.

But what do you expect from the Commerce Department? It's really turned into nothing more than an internal lobbying arm for big business, these days. It's too bad the FTC didn't take on this particular task, as it seems like it's really more something they should cover, and at least it's a federal agency that seems to really try to understand the issues, when it comes to intellectual property.

Filed Under: bullying, commerce department, trademark, trademark bullying

US Gov't Interest In Domain Name Veto Represents Yet Another PR Nightmare

from the does-no-one-think-about-this-stuff dept

Last week, someone had sent over a document purporting to be from the Commerce Department advocating that ICANN's new open top level domain plan include a "government veto," that would let various government agencies seek to block a particular TLD. We didn't write about it at the time, because I couldn't confirm that it was real, and the whole thing seemed so ridiculous and short-sighted I didn't think that it could have really come out of the Commerce Department. Lesson learned: never underestimate the Commerce Department's ability to make really bad decisions.

It appears that it's now been confirmed that the Commerce Department really does want veto power for any government over a particular TLD. The reports suggest that there's concern about TLD's like ".gay" which some countries may not like, and some of the fear is driven by the .xxx debacle, when ICANN initially approved a .xxx domain, thinking it would be a "redlight district" for porn, but then after public outcry, the US government pressured ICANN to change its mind. This was especially funny because no one seemed sure whether or not .xxx was good or bad for kids. There were some people who thought .xxx would be "good" for kids by creating an area that was easy to rope off and keep kids out of. Others argued that .xxx was bad because it admitted that porn existed (or something like that).

The whole thing was a complete mess, and now the US government seems to want to repeat that process around the world.

Here's why this is about as pointless as can be: already anyone can register any URL within the existing TLDs. No government has any veto power over the part that comes before the TLD. So what difference does it make to include a veto over what comes after the TLD. In what world does it make sense to say that "gaysex.com" is okay but "sex.gay" is not? Why does the government care?

Even worse, this whole thing creates a massive unnecessary PR nightmare for the administration. Already there are concerns around the world that ICANN -- a quasi-public/private entity -- is too much in the pocket of the US government. The Commerce Department has always tried to deny this, insisting that ICANN had autonomy. And yet... in pushing for this veto power, it's admitting that it actually does want to take greater control over ICANN... and to give other governments some veto power as well.

Filed Under: commerce department, domain names, tlds, veto
Companies: icann

Commerce Department Wants To Hear From You About Copyright

from the speak-up dept

While I've been quite disappointed in the current administration's positions on various copyright issues, I will admit that it's been a lot better about at least talking to some of us critics and asking us for our thoughts. Actually listening to what we have to say still seems to be a bit lacking, but it's a step in the right direction.

Along those lines, Mike Kruger, the Director of New Media for the US Commerce Department, has reached out to let us know that the Commerce Department has now officially opened its comment period for the Internet Policy Task Force's exploration into copyright and innovation online -- and they'd like to hear from folks here. While I've been quite disappointed in the positions on this issue taken by Commerce Secretary Gary Locke to date, hopefully getting more voices involved will open him up to recognize that some of his assumptions may be faulty.

As I've done in the past on similar requests for input, I'll post my own submission here when I'm done with it.

Filed Under: commerce department, copyright

Commerce Dept Cites Bogus Stats, Chamber Of Commerce Uses Them To Ask Bush To Accept Copyright Czar

from the bogus-stats-are-fun dept

We've seen it time and time again, where totally bogus stats about the "costs" of "piracy" are floated (usually by lobbyists) and then suddenly accepted as fact. It's even worse when it's government officials citing the stats as fact. Yet, we've got that happening again. In urging President Bush to sign into law the ProIP bill, which would give him a copyright czar (something the Justice Department had said it it doesn't want), the US Chamber of Commerce is claiming that 750,000 American jobs have been lost to piracy. Yet, it doesn't cite where that number comes from.

Wired's David Kravets tries to track down the source but finds no one can quite figure it out. Instead, they each point to different gov't organizations which have all quoted the number -- often citing each other, but no one pointing out where it actually came from. Chances are, of course, that the stat comes from a variety of reports, like the easily debunked piracy impact report from the BSA, put together by IDG. That lists out a number for job losses in the software industry that's simply untrue, and is based on only the negative impact of "piracy" impacting jobs, leaving out any positive impact (i.e., if a company used only pirated software, it could hire more people). That's not to defend piracy, but to note that the job loss claim is completely made up -- and now repeated by a variety of different government officials based on... nothing.

Filed Under: bogus stats, commerce department, copyright czar, stats