Can The President Use An Executive Order To Push Through Cybersecurity Rules?

from the sorta-maybe-possibly dept

With the Cybersecurity Act failing in the Senate, there's been some buzz that President Obama might push through a bunch of provisions via executive order. From a political standpoint, there are tons of reasons to do so. If nothing gets done, and some sort of attack does happen, opponents can claim that he failed to strengthen our cybersecurity. But this way, he can claim he's doing what he can, and pin the blame on Congress for not doing their part.

But what would it mean if he goes down this route? The Daily Caller has a hysterical and totally misleading piece claiming that this would allow for an "internet takeover." As skeptical as I am for the need for such cybersecurity legislation (and I'm pretty skeptical), that article is just pure hyperbole. This has nothing to do with "taking over the internet," and that's just someone who's lying or clueless.

The original link above, from The Hill, points out that, when it comes to industries that are already regulated, the administration could easily order them to include certain cybersecurity standards among their existing regulations:

Many companies managing vital computer systems are already heavily regulated. Lewis said the president could order agencies to require the industries they regulate to meet cybersecurity standards.

"You don't need new legislative authority to do that," Lewis said.

He noted that some regulatory agencies, including the Federal Communications Commission and the Nuclear Regulatory Commission, are independent and not bound to follow executive orders. But Lewis predicted that even the independent agencies would likely enforce an executive order on cybersecurity.

That likely would lead to some pushback concerning the limits of regulatory control, but if it actually solves the few problems we hear about (such as critical systems being connected to the internet) then perhaps it's a more reasonable way to deal with things.

The other part of the bill, which was the part that concerned us the most, concerning information sharing, would be much more difficult to go after via an executive order. Stewart Baker has an interesting analysis of the possibility there, and he comes at it from someone who is... well, more hostile towards those of us who believe that privacy rights are important. He's been railing against privacy rights activists and their attacks on the cybersecurity proposals for a while, and doing so in misleading and incomplete ways, unfortunately. He does the same here, suggesting that privacy lobbyists are a part of the problem, while completely misrepresenting their concerns, even to the point of suggesting that privacy activists don't want to allow info sharing because sharing attack info reveals "personal info of the attacker." That's silly. No one has ever argued for that, and Baker is setting up a strawman.

However, he does note ways in which the administration can at least clarify intent via executive order to get around these claimed limitations (which I'm not convinced are actual limitations, as he describes them):

It is hard to fix bad laws with an executive order, but in this case I’m not sure it can’t be done. States with two-party laws are a minority already (about a dozen states, depending on how you count), and their laws are under pressure in the courts (thanks to police officers claiming that it’s a felony for members of the public to record them without their consent). What’s more, despite claims about their chilling effect on signature filtering, two-party-consent laws don’t seem to have stopped the emergence of robust spam filtering by private companies. A clear presidential statement that allowing such laws to bar signature filtering threatens national security would almost certainly resolve any lingering doubts, especially if it’s backed by an order that the Justice Department intervene as necessary in private state suits that challenge signature filtering.

All that’s left then is the federal ban on unsubpoenaed information sharing, and even it might yield to a little creativity. Not everyone is subject to the ban. So can the parties who are covered by the restriction (ISPs, webmail providers) simply share their data with parties who aren’t covered (security firms)? And can the security firms in turn sell their data to government? Maybe so. Again, a clear presidential statement that such a measure is essential for national security would make the courts think twice before declaring that Tinker-to-Evers-to-Chance is simply an evasion of the ban on Tinker sharing with Chance.

However, he also notes that Obama might not want to "tussle" with privacy groups and so this section may get ignored. While I agree that there are some privacy extremists who set forth proposals that go way too far, I think many of the people who were concerned about the cybersecurity bill over privacy issues wouldn't necessarily be against very narrowly defined rules on information sharing, though it still seems unclear how much any existing law is really holding back info sharing for the purpose of cybersecurity. Passing data through third parties, of course, is a lot more controversial, depending on the controls and oversight involved. But, again, it's still unclear how big of a problem this really is.

Either way, it wouldn't surprise me to see some sort of use of Executive Orders here, but the limits on those would hopefully limit most of the really bad stuff found in the bill proposals.

Filed Under: cybersecurity, executive order, information sharing, privacy

The Stats Used To Support Cybercrime 'Threats' Just As Bogus As Hollywood's 'Loss' Claims

from the but-of-course... dept

While the latest attempt to pass a cybersecurity bill may be on ice for now, it'll be back... and with it there will be a lot more hyperbole about how urgent this is because of various massive "losses" already happening due to cybersecurity problems. Of course, nearly all of the numbers and claims you hear will be 100% bogus.

For years, we've highlighted stories about how the claims of "losses" from the entertainment industry due to infringement are completely fictitious. In the past, we've seen Julian Sanchez go on a hunt to find the origin of some of the numbers being thrown around, and come up with evidence that they're based on nothing. For example, claims of $200 billion in losses due to counterfeiting... came from a 1993 Forbes article that just makes that claim with no citation and no backing info. But it became gospel among those arguing there was as problem.

With Congress and the President continuing to insist that we need a cybersecurity bill, politicians have been tossing around all sorts of questionable numbers. Just a few weeks ago, we noted that General Keith Alexander, the head of the NSA, had tossed out some numbers and claimed that cybersecurity was the "greatest transfer of wealth in history." Considering that we're living through the aftermath of a financial meltdown that involved a massive transfer of wealth, I find the original claim difficult to believe. Plus, as we noted, he seemed to only cite studies from McAfee and Symantec, two companies who have a massive vested interest in keeping the cybersecurity FUD going, because it helps them sell stuff.

Thankfully, the folks over at Pro Publica decided to take a much closer look at the numbers politicians are relying on in support of the massive "harm" that is already being caused by online security issues... and discovered that the numbers are completely and totally bogus. In fact, the full story (which is fascinating) parallels (very closely) the story with "piracy" stats from the industry.

One popular number is "$1 trillion" in losses due to cybersecurity breaches. That number gets thrown around a lot by politicians (and many in the press who merely parrot such numbers unquestioningly, even as that gives those politicians more cover to claim that there's a reputable source supporting the number). Yet, the Pro Publica report highlights that, not only is this number bogus, but the (quite well respected) researchers who put together the original report for McAfee did not use that number and, more importantly, many of them spoke out publicly with surprise that McAfee put out a press release with such a number -- which they thought was questionable and not supported by their data.

In fact, there were a number of methodological problems, including that the data was based on a self-reported "average" amount of the "worth of sensitive information stored in offshore computer systems." Who knows if the respondents are being accurate, first of all, but even more to the point, the "worth" of such information is a highly subjective number. People can find something "worthwhile" without paying for it, but by focusing on the "worth," they obscure the fact that the market price may be quite different than what people think something is worth. And, what people think something is worth has zero impact on any actual losses. But, from a very small number, McAfee just sprinkled some magic pixie dust on the already questionable number, and proceeded to extrapolate, massively:

“The companies surveyed estimated they lost a combined $4.6 billion worth of intellectual property last year alone, and spent approximately $600 million repairing damage from data breaches,” the release said. “Based on these numbers, McAfee projects that companies worldwide lost more than $1 trillion last year.” The release contained a quote from McAfee’s then-president and chief executive David DeWalt, in which he repeated the $1 trillion estimate. The headline of the news release was “Businesses Lose More than $1 Trillion in Intellectual Property Due to Data Theft and Cybercrime.”

The trillion-dollar estimate was picked up by the media, including Bloomberg and CNET, which expressed no skepticism.

Now, remember, this $1 trillion number is just in the press release. It's not in the report at all. And the report's researchers were just as baffled (and even more concerned) about this:

Among [the study's researchers] was Ross Anderson, a security engineering professor at University of Cambridge, who told ProPublica that he did not know about the $1 trillion estimate before it was announced. “I would have objected at the time had I known about it,” he said. “The intellectual quality of this ($1 trillion number) is below abysmal.”

.... The company’s method did not meet the standards of the Purdue researchers whom it had engaged to analyze the survey responses and help write the report. In phone interviews and emails to ProPublica, associate professor Jackie Rees Ulmer said she was disconcerted when, a few days before the report’s unveiling, she received a draft of the news release that contained the $1 trillion figure. “I expressed my concern with the number as we did not generate it,” Rees Ulmer said in an email. She added that although she couldn’t recall the particulars of the phone conversation in which she made her concerns known, “It is almost certainly the case that I would have told them the number was unsupportable.”

...The news stories got the worried attention of some of the report’s contributors because McAfee was connecting their names to an estimate they had no previous knowledge of and were skeptical about. One of the contributors, Augusto Paes de Barros, a Brazilian security consultant, blogged a week after the news release that although he was glad to have been involved in the report, “I could not find any data in that report that could lead into that number.... I’d like to see how they found this number.”

I don't know about you, but when a super well respected security researcher tells you that the basis of a particular claim is based on a number whose "intellectual quality ... is below abysmal," that's the point at which you should probably stop using the number. But, instead, politicians and the press continue to parrot the line over and over again.

The slightly smaller number, from Symantec, is still equally questionable. They go with $250 billion... but the number has almost no support. It does come from a real Symantec report, but not from Symatec employees. Instead, they hired another firm to magically come up with the number, and it sounds like magic would have been equally as effective as what was eventually done. It raised concerns from actual experts in the field:

“Far from being broadly-based estimates of losses across the population, the cyber-crime estimates that we have appear to be largely the answers of a handful of people extrapolated to the whole population.”

Furthermore, even if we take these numbers at face value, the original reports on both of them say these numbers represent the value of the attacks in question, and not what was actually "lost" or how much it cost to deal with. However, when a politician quotes them, they almost always do so by at least suggesting that these made up "values" are very real "losses" to companies. In other words, the numbers (shocker, shocker) are being twisted by cybersecurity law supporters. For example, just recently, Senator Collins said that General Alexander "believes American companies have lost about $250 billion a year," but that's not true. Already, we know the number is suspect -- but even if we accepted the number, it only represents the "value" that various companies have put on things harmed by security issues, not any sense of actual losses. Claiming that these are losses isn't just misleading, it's wrong.

We've argued for years that actual data should inform the debate on these things -- but that data needs to be accurate and supportable. Unfortunately, with cybersecurity threats, the claims that are being thrown around have no basis in reality. If politicians really want to discuss the "threat" of cybersecurity, the least they can do is get some accurate research on the scope of the problem. Trusting a number from a McAfee press release is not credible and it's certainly no basis for passing a law that wipes out privacy rights of the public.

Filed Under: cybersecurity, fud, hype, losses, stats
Companies: mcafee, symantec

Cybersecurity Act Rejected By The Senate

from the there-goes-that-one dept

Over the last few days, it became clear that the big Cybersecurity Act in the Senate almost certainly didn't have the votes to pass. However, with all the negotiating and horse trading going on, there was still the possibility on some sort of "deal." Unfortunately, it seemed like the push for a deal also meant a push towards weakening the privacy protections. In the end, there was no deal, and no Cybersecurity Act this time around, as the vote in the Senate failed to reach the 60 vote threshold necessary for cloture (basically to continue moving the bill forward).

This certainly doesn't mean that any cybersecurity legislation is dead. There likely will be other attempts to get something through -- either something much less complex in this lame duck session, or (more likely) a bigger effort next year. The bill failed, in part, because some businesses were worried about it creating too many regulations for them. I still think it should have failed for failing to explain why it was actually needed. The good news, however, is that this latest version of the bill definitely took privacy concerns more seriously -- and the support for the Franken/Paul amendment would have made privacy safeguards even stronger. Hopefully this means that when the next attempt at cybersecurity comes through, that the baseline will include strong privacy safeguards. I'll have some more thoughts later on what Congress should do if it really wants to pass a cybersecurity bill, but for now, this version of the bill is dead.

Filed Under: cybersecurity, cybersecurity act, privacy, regulations, senate

Would You Like To Keep The Government From Spying On You? Speak Up Now

from the do-you-have-a-secret? dept

We've been talking about the Senate debate over cybersecurity all week, and it appears that it's moving into the endgame process. Last night, Senate Majority Leader Harry Reid called for cloture -- basically the process to end the debate and move to a vote. In doing so, he also set it up such that he's basically blocking most amendments from being discussed. However, the important Franken/Paul amendment that increases privacy protections will be voted on. In fact, it will be the first amendment to be considered. Whether or not the overall bill passes (and there's some skepticism about whether the votes exist), it is important that the Franken/Paul amendment pass, and Congress get the message that protecting the public from government snooping is an issue the public cares about. Senate staffers have been saying that they've been getting calls on this issue, but more would certainly help.

The folks at Fight for the Future have set up the excellent Do you have a secret? site to highlight why government snooping is a serious problem. Similarly, the EFF has set up a useful site with an embedded Tweet tool (and, yes, tweeting about this also helps -- staffers are paying attention to this, though calling is always best).

The Franken/Paul amendment does have some support, including from Senator Chuck Schumer who made an impassioned speech last night for protecting our privacy rights within this bill, and how important such privacy protections were to the future of the internet. Either way, today and tomorrow are important days for letting your Senators know that stopping the government from snooping on your private info online is important to you, so speak up.

Filed Under: al franken, chuck schumer, cybersecurity, privacy, rand paul, senate

There Are Many Reasons Not To Give The NSA The Power To Spy On Your Info

from the here-are-just-a-few dept

We were just noting that the Senate is undergoing a fight concerning whether or not the Cybersecurity Act is going to go anywhere, with much of the fight being a tug of war over your privacy. Senators Franken, Paul and Schumer are supporting an amendment to add in more privacy protections. Senators McCain and Hutchison are looking to take away privacy protections and give the NSA much more power to violate your privacy and access your private info, with less oversight and without it having anything to do with cybersecurity.

The folks over at EFF have put together a nice list of reasons why the NSA cannot be trusted with your data. There are a bunch of reasons, but here are a few:

• NSA has a dark history of violating Americans’ constitutional rights

  In the 1960’s, a Congressional investigation, led by four-term Senator Frank Church, found that the NSA had engaged in widespread and warrantless spying on Americans citizens. Church was so stunned at what he found, he remarked that the National Security Agency’s "capability at any time could be turned around on the American people, and no American would have any privacy left, such is the capability to monitor everything." (emphasis added) The investigation led to the passage of the Foreign Intelligence Surveillance Act, which provided stronger privacy protections for Americans’ communications—that is, until it was weakened by the USA-PATRIOT Act and other reactions to 9/11.

• NSA has continued its warrantless wiretapping scandal

  In 2005, the New York Times revealed that the NSA set up a massive warrantless wiretapping program shortly after 9/11, in violation of the Fourth Amendment and several federal laws. This was later confirmed by virtually every major media organization in the country. It led to Congressional investigations and several ongoing lawsuits, including EFF’s. Congress passed the FISA Amendments Act to grant telecom companies retroactive immunity for participating in illegal spying and severely weaken privacy safeguards for Americans communicating overseas.Since the FISA Amendments Act (FAA) passed, the NSA has continued collecting emails of Americans. A 2009 New York Times investigation described how a “significant and systemic” practice of "overcollection" of communications resulted in the NSA’s intercepting millions of purely domestic emails and phone calls between Americans. In addition, documents obtained via a Freedom of Information Act request by the ACLU, although heavily redacted, revealed "that violations [of the FAA and the Constitution] continued to occur on a regular basis through at least March 2010"— the last month anyone has public data for.

• NSA recently admitted to violating the Constitution.

  Just last week, the Office of the Director of National Intelligence—which oversees the NSA—begrudgingly acknowledged that "on at least one occasion" the secret FISA court "held that some collection… used by the government was unreasonable under the Fourth Amendment." Wired called it a "federal sidestep of a major section of the Foreign Intelligence Surveillance Act," and it confirmed the many reports over the last few years: the NSA has violated the Constitution.

There are more where that came from. All of these, however, raise serious concerns about why Senators McCain and Huchison seem so eager to allow the NSA to abuse your privacy even more with their amendments. What are they thinking? The EFF has put together an action page asking you to contact your Senators (which you can do via a handy site set up by the American Library Association). The EFF site is also asking people to tweet to their Senators, using the hashtag #defendprivacy and has set up a nice tool to make that easier as well (at the "action page" link above).

In the meantime, we're still waiting for someone (anyone?) to tell us exactly why this bill is needed without resorting to hyperbole about planes falling out of the sky. If there's an existing problem with infosharing, what is it? What law, today, is blocking this kind of infosharing? Until the government can explain that, it seems weird that they're pushing for much greater spying power by the NSA and fewer privacy rights. How can they defend this when they can't even point to what the roadblocks are?

Filed Under: al franken, charles schumer, cybersecurity, john mccain, kay bailey hutchison, privacy, rand paul

Cybersecurity Bill: Protecting Us From Attacks... Or Keeping Our Own Attacks Secret?

from the seems-quite-likely dept

We've been discussing the fight in the Senate over the latest version of the Cybersecurity Act. One of the things we mentioned is that, at 211-pages, it's quite likely there are a ton of little "easter egg" gems in there that the public doesn't want or need, but which we'll be stuck with -- and only discover way down the road. Paul Rosenzweig, over at the Lawfare Blog, may have turned up one of them, in trying to understand Section 706(d), which reads:

(d) DELAY OF NOTIFICATION AUTHORIZED FOR LAW ENFORCEMENT, NATIONAL SECURITY, OR HOMELAND  SECURITY PURPOSES.—No civil or criminal cause of action shall lie or be maintained in any Federal or Statecourt against any entity, and any such action shall be dismissed promptly, for a failure to disclose a cybersecurity threat indicator if—

(1) the Attorney General or the Secretary determines that disclosure of a cybersecurity threat indicator would impede a civil or criminal investigation and submits a written request to delay notification for up to 30 days, except that the Attorney General or the Secretary may, by a subsequent written request, revoke such delay or extend the period of time set forth in the original request made under this paragraph if further delay is necessary;

(2) the Secretary, the Attorney General, or the Director of National Intelligence determines that disclosure of a cybersecurity threat indicator would threaten national or homeland security and submits a written request to delay notification, except that  the Secretary, the Attorney General, or the Director,may, by a subsequent written request, revoke such delay or extend the period of time set forth in the original request made under this paragraph if further delay is necessary.

What's odd about this? Well, it suggests that it says that companies might not get in legal trouble if they don't disclose info. But, as we're constantly reminded, the whole point of the info sharing from companies in this bill is that it's voluntary. So there wouldn't be any cause of action generally when they choose not to share. But, as Rosenzweig thinks through it, there is another scenario where this could come into play: if a company wanted to share info but was stopped -- perhaps because that info implicated the US government itself:

I suppose there is another possibility as well – that they might want to stop temporarily the sharing of CTI when the threat being disclosed is one that has been created by .... Well, NSA. In fact, if you believe that, then the reason the government so much wants to be at the center of CTI sharing is not just to protect the public but also to protect its own methods.

This actually makes a fair amount of sense. Remember, the only two serious cases of digital attacks that we know of -- Stuxnet and Flame -- both appear to have originated from US government officials, and both eventually got out when security firms discovered their existence, and tried to make sense of the malware. So, perhaps part of the "urgency" in trying to pass this bill is to help silence researchers who discover what other malware the US government has put out itself!

Filed Under: attacks, cybersecurity, information sharing, nsa, privacy, secrecy

Let Your Senator Know Right Now That You Are Watching If They'll Vote To Protect Privacy

from the speak-up dept

On Friday, we mentioned that this week is the week in which the Senate will wrangle over the new Cybersecurity bill. The current bill has some privacy safeguards, but not nearly enough. Senators Al Franken and Rand Paul have put together an amendment to strengthen the privacy safeguards even more -- and over the weekend, Senator Chuck Schumer agreed to co-sponsor the Franken/Paul amendment after talking to various folks in the tech industry and the civil liberties community. That adds more weight to the amendment. Unfortunately, Senators John McCain and Kay Bailey Huchison and a few others, who have been carrying water for the NSA throughout this fight, are looking to move the bill very far in the other direction, wiping out tons of privacy protections. It's really shameful.

Either way, this is the week to let your Senator know how you feel about all of this (and if you're a constituent of McCain or Huchison, please ask why they're so against protecting the privacy of the American public). The American Library Association has kindly set up a simple one-click tool to call your Senator and let them know how you feel.

The EFF has a page with some more info as well, noting that it's basically too late to email your Senators, so please call. If you want some more info, check out Fred Wilson's analysis of the situation, which matches almost exactly with mine. We still have not been given a compelling reason why any such legislation is needed. We keep hearing scare stories about mushroom clouds and planes falling from the sky if information can't be shared. But... what no one has done yet is explain which existing regulations block the necessary sharing of information. If they did that, we could look at fixing those laws. Instead, we're just told scare stories and given a massive 211-page bill that wipes out all sorts of previous laws, and adds all sorts of other things to the law. Given the length of the bill, it's quite likely there are some awful "easter eggs" in there that we'll only discover years down the road.

That said, if the bill is going to pass, it would be much better if it had very strong privacy protections in it, and the Franken/Paul amendment go a long way towards putting such protections in. The McCain/Huchison proposal do the opposite, and basically seek to take away privacy protections, while giving the NSA much more ability to access your data. Don't let the Senate trample your privacy rights. Go ahead and use the ALA's tool to contact your Senator today.

Filed Under: al franken, chuck schumer, cybersecurity, john mccain, kay bailey huchison, privacy, rand paul, senate

Next Week: The Senate Fights Over Whether It Can Take Away Your Online Privacy

from the pay-attention dept

If you haven't been keeping up on all the politics of the cybersecurity bill fight over the past few weeks, a new bill was recently introduced that at least had some improvements concerning privacy (though it still had lots of problems). Yesterday, the Senate basically made it clear that they're done with debating the issue, and will bring the new bill to a vote next week. But now the real fight begins: the fight over the amendments on the bill. A whole bunch of amendments have already been proposed, with a second batch expected to be filed on Monday.

Senator McCain is leading the charge with a whole slew of amendments which are designed to delete basically every last bit of privacy protection that is in the bill. Among many, many other things, McCain's amendments would take away the limitation that any information sharing not go directly to the NSA. As we've noted in the past, a lot of this is a turf battle over whether NSA or Homeland Security gets control of the info, and McCain has been "Team NSA's" biggest cheerleader all along. Furthermore, he wants to remove the limitation that the information can only be used for cybersecurity reasons, making the use of the information much, much broader. There are also all sorts of efforts to take away government liability if information is abused. Basically, everything that's useful or good in protecting privacy? McCain and a few other Senators seem to want to take that away.

On the flip side, there are a few good amendments to increase privacy. Senators Al Franken and Rand Paul are pushing an amendment to strengthen the privacy protections. Senator Wyden is pushing an amendment that basically includes his GPS Act, which basically says law enforcement can't track GPS data without a warrant.

Either way, next week is going to be quite a big fight in the Senate, and the "marginally better" Cybersecurity Act may quickly turn into somethinghorribly destructive to your online privacy. If you care about your privacy, now (and all next week) would be a good time to call your Senator and tell them that any attempt to weaken privacy protections is unacceptable, and that they should get behind the proposals to strengthen privacy protections.

Filed Under: al franken, cybersecurity, cybersecurity act, john mccain, privacy, rand paul, ron wyden, senate

Wyden Traps Feds In Their Own Words: ACTA Explanation Opens Up Big Hole In Cybersecurity Bill

from the which-is-it? dept

Back in March, when the US State Department responded to Ron Wyden's questions about the feds' authority to negotiate and sign onto ACTA without Congressional approval (damn you, Constitution), it made an odd (and rather new) claim: that Congress had actually already approved the executive branch's ability to negotiate and approve international agreements on intellectual property issues. The claim was that the ProIP Act (of 2008) said the newly appointed IP Czar should create a joint strategic plan which, among other things, helps identify how the administration can deal with IP enforcement issues by "working with other countries to establish international standards and policies for the effective protection and enforcement of intellectual property rights."

Yes, because Congress said that the IP Czar should create a strategic plan in which the administration can work with other countries on IP enforcement, the administration now claims that Congress effectively abdicated its powers over international commerce on that issue, despite it never clearly stating that.

Given that strained interpretation, Wyden has noticed that the new cybersecurity bill that the Senate is considering could be broadly interpreted in the same manner to create all sorts of powers for the administration to ignore Congress in crafting international agreements concerning online security. He's now sent the State Department a letter asking for clarification. Here's the key part:

Do these provisions, or any others, in S. 3414 authorize the Executive Branch to enter into binding agreements with foreign governments for the purposes of establishing disciplines on cybersecurity? If so, under what circumstances would Congress need to consider such agreements and under what circumstances would you argue that Congress need not consider such agreements? If S. 3414 does not authorize the Executive Branch to enter into binding international agreements over cybersecurity without Congress' consideration of such an agreement, how do you square this view with your interpretation of the Pro IP Act of 2008?

In other words: Wyden is calling the State Department on its bullshit retroactive interpretation of Pro IP by noting that if they truly believe it, then the new cybersecurity bill would effectively mean Congress gives up its powers to have oversight on any international agreements about cybersecurity -- something the administration almost certainly does not want, since that would spark a debate that would likely hold up approval of the bill. The State Department, of course, wants it both ways. It wants to claim that the Pro IP gave the administration the power to ignore the Constitution with IP issues, but the same is not true of the cybersecurity bill. But that would involve ignoring that the same language is present in both bills.

I fully expect that the State Department will now seek to tapdance its way around this -- or (more likely) not answer until after the cybersecurity debate is over.

Filed Under: authority, cybersecurity, negotiations, pipa, ron wyden, sopa, treaties

Obama Talks Toxic Clouds And Runaway Trains, But The Real Cybersecurity Solution Is Still Simple And Obvious

from the and-what's-blocking-that-now? dept

Even as we're encouraged by the direction of the latest cybersecurity bill (with significant caveats), lots of folks have been asking from the beginning for two things: an end to "Hollywood-style" FUD claims of planes falling from the skies, and a clear statement on what existing laws make the kind of information sharing the government desires impossible today. President Barack Obama took to the Wall Street Journal Op-Ed pages today to explain why we need cybersecurity legislation... and unfortunately he failed on both accounts. The opening part is positively cinematic:

Last month I convened an emergency meeting of my cabinet and top homeland security, intelligence and defense officials. Across the country trains had derailed, including one carrying industrial chemicals that exploded into a toxic cloud. Water treatment plants in several states had shut down, contaminating drinking water and causing Americans to fall ill.

Our nation, it appeared, was under cyber attack. Unknown hackers, perhaps a world away, had inserted malicious software into the computer networks of private-sector companies that operate most of our transportation, water and other critical infrastructure systems.

He goes on to point out that some of the things mentioned have "already happened," except that's not quite true. It is true that some hackers accessed systems they shouldn't have had access to, but it's not clear if they were ever able to actually do any damage. Here's Obama's summary of the details:

Last year, a water plant in Texas disconnected its control system from the Internet after a hacker posted pictures of the facility's internal controls. More recently, hackers penetrated the networks of companies that operate our natural-gas pipelines

What's amusing is that the story in Texas came about because a hacker was trying to show that the feds were ignoring and downplaying threats to critical infrastructure. From the details, it looks like the system was vulnerable because of poor password choices, and the stupid decision to connect the system to the internet. So the fact is that "disconnect its control system from the Internet" is the solution. Not more laws. Meanwhile, the story about targeting natural-gas pipelines involved some basic social engineering (spear phishing) rather than any technical hackery. In both cases, the issue appears to be the same: critical infrastructure like that which controls the functioning of water treatment plants and gas pipelines shouldn't be connected to the internet.

But do we need a 211-page law to share information just to recognize that?

The bigger problem is that while the President's Op-Ed highlights how we want to avoid the cinematic story he tells at the beginning, where it fails is that it never explains why the kind of information sharing he's talking about is blocked today. Which rules and regulations are blocking that from happening? No one seems to want to say. Instead, we get legislation that just assumes there must be regulations blocking information sharing and wipes them all away.

We appreciate that Obama says that he'll veto any bill that doesn't include strong privacy and civil liberties protections, but we should never be passing legislation based on made up scary stories.

Filed Under: cybersecurity, internet, obama, privacy, regulations, risks, threats