Bulgarian Security/Cybercrime Researcher Missing For Months

from the uh-oh dept

This one's a bit scary. Security and cybercrime researcher Dancho Danchev, who has blogged about organized crime and online terrorist activities, has apparently been missing since September. ZDNet, where he sometimes blogged, has published a notice asking for help tracking him down, and publishing an email he sent shortly before he disappeared. That email included photos of a device he found planted in his bathroom, that he believed was from Bulgarian intelligence services. ZDnet has been trying to reach him for months -- and recently received information from a source in Bulgaria that Danchev is alive "but he's in a lot of trouble."

Filed Under: bulgaria, crime, cybersecurity, dancho danchev, security

How The Defense Department And NSA Is Hyping Cyberwar To Better Spy On You

from the not-cool dept

We've discussed multiple times the massive unsubstantiated hype around the concept of "cyberwar", which mostly has been led by former government officials who are seriously cashing in on the hype. Yet, every time we mention this, we get people insisting that we just don't know the "real story" and the "threat" is really big. But we keep waiting for some evidence to support that theory.

Seymour Hersh, over at the New Yorker, who tends to be the most connected reporter around when it comes to getting the inside scoop on what's happening in the US military, has a (typically) long and worth reading analysis of the whole "cyberwar" concept that effectively agrees with exactly what we've been saying all along: it's totally hyped up beyond reality, in an effort to build the reputations of a few people and to cash in on a trend. People on all sides of the issue all seemed to point out to Hersh that "cyberwar" is blowing things out of proportion. There's plenty of espionage going on, but that's quite different (and a lot less sexy when it comes to trying to make money).

But what's even scarier than the people seeking to get money is the way the Defense Department has been using this to try to basically take control of the whole "cyber defense" aspect. Back in August, we discussed how there was this ongoing fight between the Defense Department (military) and Homeland Security (civilian) to manage the "cyber" threats, with the Defense Department basically using its experience in being incompetent to argue that it knows better.

And, as you look at the details, the Defense Department isn't just looking at "cyber defense," it keeps on making the argument that part of "cyber defense" is also "securing" private networks and usage. Jerry Brito, over at the Tech Liberation Front, just had a post questioning whether or not the military should have a role in civilian cybersecurity, and Hersh's long article gives plenty of reasons why it absolutely should not.

Multiple people note that one of the best ways to make various networks and systems more secure from espionage attacks is to increase (or even mandate) widespread encryption. That would certainly make things more difficult for espionage. But the NSA (part of the Defense Department) doesn't want that because that makes it much harder to spy on people. In fact, the very same NSA has been pushing the feds to put in place a mandatory backdoor to any encryption so that it can keep on spying.

But, of course, any such backdoor can (and absolutely will) be used by those trying to spy from elsewhere as well. So when you put the NSA in charge of "cyber security," it seems to focus on using that mandate to actually improve its ability to spy on everyone (including on domestic soil), rather than actually doing stuff related to actual "cyber security." We've had various pieces of similar stories over the past few months, but Hersh does a great job pulling it all together in a way that makes it pretty clear that this whole thing is a huge boondoggle for most of the players. The ex-gov't officials screaming "cyberwar" are making tons of cash, while the Defense Department and the NSA are using all that hype to gain more control over the internet and the ability to spy on people -- but not necessarily to make anyone more secure.

Filed Under: cybersecurity, cyberwar, defense department, nsa, privacy, security

Dear Journalists: There Is No Cyberwar

from the period dept

At the beginning of April, we noted that director of national intelligence, Michael McConnell, who's now consulting for some firms that would profit greatly from a re-architecting of the internet, is going around pushing a ridiculous moral panic about "cyberwar" and how we basically need to break the internet and get rid of all privacy and anonymity. Forget your civil liberties, there's money to be made in scaring people. While even the US "cybersecurity" czar tried to throw some cold water on these claims, the press sure does love bogus "cyberwar" stories, despite the lack of proof that there is any such thing or that it could do any real damage.

It's being helped along, of course, by another former government official, Richard Clarke, who is selling a new book all about "Cyberwar" (in fact, that's the title), leading to all sorts of news stories about how the US is at risk in this "cyberwar."

The problem, of course, is the same as we described back in March: the people playing up the whole "cyberwar" threat are simply lumping together basic vandalism -- the kind done by script kiddies, as if it's part of a war. If that's the definition of a "war," you can find it going on around the country, anywhere there are kids and spray paint. Thankfully, Tom Lee has written a scathing critique of dumb journalistic coverage of this whole "cyberwar" crap:

The piece starts out by discussing Russian vandals' successful efforts to screw with the Georgian government’s website -- something that can be plausibly done by a disaffected teenager -- then jumps rapidly to "monkey[ing] with GPS" which involves, you know, satellites, or at least skill at building, concealing and fortifying radio transmitters; and, if anything other than a braindead denial of service, would also require the discovery of a novel attack on the system's design. These things are much harder than checking to see if the recently-launched website of a small ex-Soviet country is running slightly outdated software that someone else has written an exploit for....

Disrupting the operation of a website is very different from disrupting the operation of the internet, which is very different from interfering with military communication systems, which is very different from interfering with military battlefield communication systems, which is very different from being susceptible to the interception of digital communications. But all of these things are just jammed together, mindlessly.

What kinds of electronic attack are possible? To what extent are our defense systems susceptible to them -- in particular, are those systems at all tangled up with the internet? If not, what economic consequences could plausibly be inflicted on our country by disruption of the internet, and how do they compare to the historical example of, say, a blockade? If an online attack originates from overseas, what countermeasures are available? And do we have a protocol in place with the major backbone operators to implement them?

None of these questions are asked or answered. Blah blah blah cyber. That's it, over and over.

Welcome to the next moral panic that's more about taking away your rights in an attempt to make some ex-politicians rich.

Filed Under: cybersecurity, cyberwar, michael mcconnell, moral panic

Bad Things Happen When Politicians Think They Understand Technology

from the not-so-good dept

With health care reform out of the way, lots of politicians are pushing out new legislative ideas, hoping that Congress can now focus on other issues -- so we're seeing lots of bad legislation proposed. Let's do a two for one post, highlighting two questionable bills that many of you have been submitting. The first, proposed by Senators Schumer and Graham, is technically about immigration reform, which is needed, but what's scary is that the plan includes yet another plan for a national ID card. Didn't we just go through this with Real ID, which was rejected by the states? Jim Harper, who follows this particular issue more than just about anyone, has an excellent breakdown of the proposal, questioning what good a national ID does, while also pointing to the potential harm of such a plan.

Then we have the big cybercrime bill put forth by Senators Hatch and Gillibrand Senators Rockefeller and Snowe (updated, since there are two separate cybersecurity bills, and its the Rockefeller/Snowe one that has people scared), that tries to deal with the "serious threat of cybercrime." But, of course, it already has tech companies worried about the unintended consequences, especially when it requires complying with gov't-issued security practices that likely won't keep up with what's actually needed:

"Despite all [the] best efforts, we do have concerns regarding whether government can rapidly recognize best practices without defaulting to a one-size-fits all approach," they wrote.

"The NIST-based requirements framework in the bill, coupled with government procurement requirements, if not clarified, could have the unintended effect of hindering the development and use of cutting-edge technologies, products, and services, even for those that would protect our critical information infrastructure."

They added the bill might impose a bureaucratic employee-certification program on companies or give the president the authority to mandate security practices.

This is one of those bills that sounds good for the headlines (cybercrime is bad, we need to stop it), but has the opposite effect in reality: setting up needless "standards" that actually prevent good security practices. It's bills like both of these that remind us that technologically illiterate politicians making technology policy will do funky things, assuming that technology works with some sort of magic.

Filed Under: cybersecurity, immigration, national id, politicians, technology

Wouldn't The Last Thing We Want During A 'Cybersecurity Emergency' Be For The Gov't To Take Over Private Networks?

from the given-their-technical-knowledge... dept

A bunch of folks are sending in this News.com story about a draft of the latest cybersecurity bill, that still includes bizarre and totally unnecessary language that would allow the President to declare a cybersecurity emergency and then be able to take control over private computer networks. First, the idea of the whole "cybersecurity emergency" that would require such a thing still remains a science fiction idea. Yes, there can be cybersecurity attacks and they can cause all sorts of problems, but these are problems that generally are not life-threatening or that can't be handled reasonably.

But the bigger issue is why the government should be taking control over private networks. This is the same gov't that doesn't let people in the State Department use Firefox and which thinks that RealPlayer is the state of the art in online video streaming. Even if there were a "cybersecurity emergency," I would think the last people I'd want to take charge would be the federal government.

Filed Under: cybersecurity, emergency

Does The US Government Really Need 'Wider Latitude' To Monitor Private Networks?

from the e-Maginote-Line dept

Harvard Law Professor, and former Bush White House lawyer, Jack Goldsmith has an opinion piece today in the NYT about cyber-security. In it, he makes a number of obvious (though admittedly often overlooked) points about the need for better education and information sharing, but then asserts that those, untried, methods will not be enough. Instead, he argues, "The government must be given wider latitude than in the past to monitor private networks and respond to the most serious computer threats." For a lawyer who saw first-hand (and even wrote a book about) the excesses of the Bush administration, this is a reckless claim. The repeatedly documented violations of civil liberties by the NSA and other government agencies (not to mention their private sector compatriots) through widespread network surveillance did not serve to protect and defend US critical infrastructure. In fact, by adding legitimacy to network monitoring, scholars like Goldsmith and respected countries like the USA make it easier for less savorable regimes to justify their digital surveillance and crackdowns. While China's "Green Dam" censorship software was justified on child-safety grounds, the next iteration of liberty limiting code could very well be to stop "cyber-terrorism" or some other amorphous, ill-defined concept.

A far more level-headed approach to cyber-security is taken by Evgeny Morozov in his recent essay in the Boston Review, which points out that "[m]uch of the data are gathered by ultra-secretive government agencies—which need to justify their own existence—and cyber-security companies—which derive commercial benefits from popular anxiety. Journalists do not help. Gloomy scenarios and speculations about cyber-Armaggedon draw attention, even if they are relatively short on facts." While Goldsmith is certainly not promoting increased government intervention out of self-interest, it is not good enough to pay lip-service to privacy and network openness. Decision-makers need to recognize that certain policies and rhetoric will inevitably have dangerous, unproductive unintended consequences.

Filed Under: cybersecurity, jack goldsmith, monitoring

Congress Ponders Cybersecurity Power Grab

from the no-cybersecurity-licenses-please dept

There was a lot of attention paid last week to a new "cybersecurity" bill that would drastically expand the government's power over the Internet. The two provisions that have probably attracted the most attention are the parts that would allow the president to "declare a cybersecurity emergency" and then seize control of "any compromised Federal government or United States critical infrastructure information system or network." Perhaps even more troubling, the EFF notes a section that states that the government "shall have access to all relevant data concerning (critical infrastructure) networks without regard to any provision of law, regulation, rule, or policy restricting such access." Read literally, this language would seem to give the government the power to override the privacy protections in such laws as the Electronic Communications Privacy Act and the Foreign Intelligence Surveillance Act. Thankfully, Congress can't override the Fourth Amendment by statute, but this language poses a real threat to Fourth Amendment rights.

One clause that I haven't seen get the attention it deserves is the provision that would require a federal license, based on criteria determined by the Secretary of Commerce, to provide cybersecurity services to any federal agency or any "information system or network" the president chooses to designate as "critical infrastructure." It's hard to overstate how bad an idea this is. Cybersecurity is a complex and fast-moving field. There's no reason to think the Department of Commerce has any special expertise in certifying security professionals. Indeed, security experts tend to be a contrarian bunch, and it seems likely that some of the best cybersecurity professionals will refuse to participate. Therefore, it's a monumentally bad idea to ban the government from soliciting security advice from people who haven't jumped through the requisite government hoops. Even worse, the proposal leaves the definition of "critical infrastructure" to the president's discretion, potentially allowing him to designate virtually any privately-owned network or server as "critical infrastructure," thereby limiting the freedom of private firms to choose cybersecurity providers.

When thinking about cyber-security, it's important to keep in mind that an open network like the Internet is never going to be perfectly secure. Providers of genuinely critical infrastructure like power grids and financial networks should avoid connecting it to the Internet at all. Moreover, the most significant security threats on the Internet, including botnets and viruses, are already illegal under federal law. If Congress is going to pass cybersecurity legislation this session (and it probably shouldn't) it should focus on providing federal law enforcement officials with the resources to enforce the cyber-security laws we already have (and getting the government's own house in order), not give the government sweeping and totally unnecessary new powers that are likely to be abused.

Filed Under: certification, congress, critical infrastructure, cybersecurity, fourth amendment

Is FEMA The Best Group To Model A Cybersecurity Agency After?

from the proactivity dept

There's been a lot of talk about the cybersecurity policy actions the Obama administration will undertake, with few clear ideas on exactly what such a policy should entail, or what powers the much-discussed cybersecurity "czar" should have. One of the supposed leading candidates for the czarship says that what the country really needs is "a FEMA for the internet" that can coordinate responses to electronic attacks and problems. The wisdom of invoking the idea of another FEMA doesn't seem too wise, given the agency's rather tarnished reputation following its ham-fisted response to Hurricane Katrina and other disasters, but leaving that aside, there may be deeper issues. FEMA's role is largely preparedness for and reaction to natural disasters; shouldn't a cybersecurity agency be focused more on prevention than reaction? The idea of something like FEMA makes sense in the context of natural disasters and emergencies, since they are largely unpreventable and inevitable. But isn't cybersecurity an area in which prevention of disasters and attacks is arguably more important?

Filed Under: cybersecurity, fema, government, politics

If There's A National Cybersecurity Policy, What Should It Cover?

from the if-anything... dept

A bunch of folks have been sending in the various news stories about a new report recommending to the incoming presidential administration a set up a national cybersecurity policy, which is the sort of broad pronouncement that many people would instinctively agree with. However, it's not really clear what this covers. The report covers both government and private companies' computer networks, as if the issues and challenges facing each should be covered under a single plan. There's also talk of some new kind of warrant called "data warrants" rather than search warrants. Obviously, protecting internet infrastructure from foreign attacks is a good thing, but there's a lot here that seems like a grab for power -- and the ability to more closely gather and monitor data.

The fact that government networks and security of government computers is a mess is one issue, but it shouldn't be mixed in with private companies protecting their own data. The two issues should be tackled separately. If the government needs to fix its own computer network and security policies, that seems like a reasonable job for the national CIO that Obama has indicated is a part of his plan, rather than a separate cybersecurity policy.

Filed Under: cybersecurity, national policy