The Greatest Trick The Government Ever Pulled Was Convincing The Public The 'Hacker Threat' Exists

from the the-2nd-was-continuing-taxation-long-after-representation-ceased-to-exist dept

The US government is already fighting wars on several fronts, including the perpetual War on Terror. "War is the health of the state," as Randolph Bourne stated, and the state has never been healthier, using this variety of opponents as excuses to increase surveillance, curtail rights and expand power.

Bruce Schneier highlights a piece written by Molly Sauter for the Atlantic which poses the question, "If hackers didn't exist, would the government have to invent them?" The government certainly seems to need some sort of existential hacker threat in order to justify more broadly/badly written laws (on top of the outdated and overbroad CFAA). But the government's portrayal of hackers as "malicious, adolescent techno-wizards, willing and able to do great harm to innocent civilians and society at large," is largely false. If teen techno-wizards aren't taking down site after site, how is all this personal information ending up in hackers' hands? Plain old human carelessness.

According to the Privacy Rights Clearinghouse, the loss or improper disposal of paper records, portable devices like laptops or memory sticks, and desktop computers have accounted for more than 1,400 data-breach incidents since 2005 -- almost half of all the incidents reported. More than 180,000,000 individual records were compromised in these breaches...

By comparison, only 631 breaches were attributed to actual hacking, or at least hacking as it's portrayed by the government. Private entities aren't very worried about being hacked either, at least not from the outside. Their main concern, according to the Privacy Rights Clearinghouse, is "inside jobs" by disgruntled employees.

Nonetheless, the narrative advanced by the government (and passed along by the largely credulous mainstream media) of unstoppable hackers and their omnipresent threat to major companies, the government itself, average Americans and underlying infrastructure, continues nearly unimpeded. This narrative is essential to those in the government who wish to justify large-scale surveillance of anything and anyone connected to the internet. The scarier the image, the more it can get away with.

It is the hacker -- a sort of modern folk devil who personifies our anxieties about technology -- who gets all the attention. The result is a set of increasingly paranoid and restrictive laws and regulations affecting our abilities to communicate freely and privately online, to use and control our own technology, and which puts users at risk for overzealous prosecutions and invasive electronic search and seizure practices. The Computer Fraud and Abuse Act, the cornerstone of domestic computer-crime legislation, is overly broad and poorly defined. Since its passage in 1986, it has created a pile of confused caselaw and overzealous prosecutions.

We've seen the overzealous prosecution and expressed disbelief and amazement at some of the interpretations of this outdated law. (Amazingly, Sauter's post was written before the most recent cases of overzealous prosecution.) And instead of fixing the CFAA, legislators are actively working to make it worse, even as overly-broad cybersecurity legislation is being negotiated in secret.

The "modern folk devil" image has become part of the mass consciousness. Anonymous and its various offshoots roam the internet, at turns wreaking havoc and helping the oppressed, like an electronic manifestation of Loki, the Distributed. These activities are duly reported by the media in ominous tones, further driving home the image of the hacker at Millennial Public Enemy No. 1. The acts and the perception of the damage caused by this hacking are miles apart, as is perfectly illustrated by xkcd.

Many members of the American public are already convinced something should be done about hackers. Many of our representatives feel the same way. A lack of knowledge of the underlying technology, much less the methods or culture, hasn't deterred legislators from crafting an overbroad response with the CISPA bill. Examining the issues more closely or reconsidering the legislation doesn't seem to be an option. After all, a "cyber Pearl Harbor" is all but inevitable, a conclusion confirmed by shouting "HACKER!" in the halls of Congress and hearing it echoed back by like-minded representatives, sympathetich government agencies, the media and a subset of the American public.

In the effort to protect society and the state from the ravages of this imagined hacker, the US government has adopted overbroad, vaguely worded laws and regulations which severely undermine internet freedom and threaten the Internet's role as a place of political and creative expression.

The endgame is more control, and the "hacker" provides an ominous, omnipresent threat that, because of the hacker's naturally secretive nature, can neither be confirmed or denied with any veracity. Much like the War on Terror, this War on Hacking takes rights from the American public, carves out huge chunks and sends the gutted remains back to citizens in a package marked "Safety."

Filed Under: cispa, cybersecurity, fud, government, hacking

Shockingly Unshocking: 'Cybersecurity' FUD Has Been Big Big Business For Contractors

from the well,-look-at-that dept

Back when this hype about "cybersecurity" and "cyberwar" first started to hit the mainstream (early on, "cyberwar" was more common, but lately people focus on "cybersecurity"), we had an article which suggested that much of this really seemed to be about scaring up a panic for the sake of throwing money at defense contractors who wanted to charge crazy huge sums for "helping" with cybersecurity. And, as we noted, that push was leading to hundreds of millions of dollars in government contracts. It appears that, with cybersecurity FUD only getting bigger and bigger, the folks who are making out like bandits are all those defense contractors who are jumping in to fan the flames of FUD... and then taking our taxpayer money to "fix" the problem.

In that link above, they talk about Lockheed and Raytheon signing agreements with Homeland Security in which they get to "help" the government out by scanning email and other info collected by the NSA.

Under the program, critical infrastructure companies will pay the providers, which will use the classified information to block attacks before they reach the customers. The classified information involves suspect Web addresses, strings of characters, email sender names and the like.

None of this necessarily means that online attacks aren't a real threat... but I'd feel a lot more comfortable about where things were heading if there weren't a whole bunch of defense contractors gleefully rubbing their hands together as they scoop up more and more contracts while the FUD keeps spreading.

Filed Under: business, cybersecurity, defense contractors, fud

Time To Speak Up About CISPA: We Shouldn't Be Scared Into Giving Up Our Privacy

from the speak-out-now dept

A bunch of groups are teaming up this week to call for a week of action against CISPA just as Congress is gearing up, yet again, to push through this cybersecurity bill based on a lot of FUD, with little to back it up. To be clear, there are a lot of challenges around online (can we dump the stupid "cyber" prefix?) security out there, and it's clear that there is plenty of malicious and government-sponsored hacking and attacks. But we need to put this all in perspective. First off, there is already tremendous incentive to combat these attacks, and there are existing methods to do so. Second, no one has given a reasonable response to explain how something like CISPA will do anything at all to help prevent such attacks in the future. Third, while these attacks may be economically damaging, there is little evidence of them creating real physical harm to date. That's not to say it's not possible in the future, but stories of airplanes falling from the sky are quite exaggerated. Fourth, and most importantly, no one has explained why we all need to sacrifice our own privacy for these vague and undefined benefits.

A bunch of groups are fighting this, and now is the time to take part. EFF and Fight for the Future have put together a simple page to help you take action. As they point out there are three key objectionable parts to CISPA:

• Eviscerating existing privacy laws by giving overly broad legal immunity to companies who share users' private information, including the content of communications, with the government.
• Authorizing companies to disclose users' data directly to the NSA, a military agency that operates secretly and without public accountability.
• Broad definitions that allow users' sensitive personal information to be used for a range of purposes, including for "national security," not just computer and network security.

None of these are even remotely necessary to allow for effectively combating online attacks, but all certainly would be quite handy in helping the government snoop on the activities of citizens (and non-citizens) without much oversight. Considering how often we've seen other laws passed in a flurry of FUD around other "threats" later turn out to be abused by government officials for the sake of snooping, rather than any legitimate reason, we should be very concerned about these efforts here.

Filed Under: cispa, cybersecurity, fud, privacy, security, speak out, week of action

Press Parrots Cybersecurity FUD From Former NSA Boss Without Mentioning Massive Conflict Of Interest

from the do-some-freaking-research dept

Not this again. Nearly three years ago, we wrote about the growing hype around "cyberwar" in the US government -- much of it being pushed by one Michael McConnell. News reports love to cover McConnell's fear-mongering about how the internet is at risk. He used to always talk about "cyberwar" but that term went out of fashion, so lately it's all "cyberattacks" and "cyberterrorism." The reason the press loves McConnell is that he's a former head of the NSA (under Clinton) and director of national intelligence (under George W. Bush). What those reports don't like to mention is that since leaving the government, McConnell has a very cushy job as Vice Chairman of Booz, Allen, Hamilton. Booz Allen is a company that regularly seems to do $100 million+ deals with government agencies, many of them related to cybersecurity. You think that having a former NSA director running around scaring agencies about how they're at risk of "cyberwar" or "cybersecurity" isn't useful for business?

And yet, it seems that time and time again when we see McConnell's name, reporters completely fail to mention this particular conflict of interest. Instead, they report his claims as if they're fact, despite the much simpler and more obvious fact: no one has died from an internet attack. Ever. None. Zero. Zilch.

Take, for example, this News.com article by Steven Musil. And then let me know where either of these points is made. You can't, because they're not in there. McConnell's connection to Booz isn't mentioned. Nor is the fact that "cyberthreats" are still as dangerous as a ghost story.

Instead, he throws in a couple scary scary quotes from McConnell about how we're getting close to a cyber-9/11 or a cyber-Pearl Harbor without pointing out that plenty of people think such claims are completely overblown. Also, we've been hearing about this for years now, and while it's been quite profitable for McConnell, there's been no evidence that such a threat is really any closer. But, boy does it make money for government contractors. This isn't to pick on Musil in particular -- plenty of reporters seem totally taken in by McConnell's old job and seem to throw any skepticism (or the ability to do a basic Google search about his current job) out the window. But if we keep seeing it, we're going to keep calling it out until people realize that maybe there are motives there beyond what McConnell says.

Filed Under: conflict, cybersecurity, fud, michael mcconnell
Companies: booz allen

What Do Sandy & Pearl Harbor Have In Common? Politicians Exploit Both To Push Cybersecurity Agendas

from the but-of-course dept

Defense Department boss Leon Panetta has been recycling his cyber Pearl Harbor ghost stories for a few years now to push for expansive cybersecurity legislation (i.e. budget and power to spy on people), but Pearl Harbor is a bit outdated these days. So why not shoot for a more contemporary reference? Why not something in the "now"? Well, Homeland Security boss Janet Napolitano (who's in a bit of a turf war with Panetta over who gets control -- again, budget and power to spy on people -- of "cybersecurity") has decided to go with the most contemporary possible reference: Hurricane Sandy. Apparently, to Napolitano, the answer to the question of "how soon is it appropriate to cynically abuse the story of Hurricane Sandy for political gain?" is "right away."

Napolitano, who, you may remember, doesn't know how the internet works, went to a cybersecurity event on Wednesday to warn that without cybersecurity legislation, an attack might be just as bad as Hurricane Sandy. Quoting a report from Hillicon Valley:

After Hurricane Sandy wreaked havoc on the East Coast, Napolitano said people should look than no further than the damage caused by the massive storm to understand the need to boost the nation's cybersecurity protections.

"One of the possible areas of attack, of course, is attacks on our nation's control systems — the control systems the operate our utilities, our water plants, our pipelines, our financial institutions," Napolitano said. "If you think that a critical systems attack that takes down a utility even for a few hours is not serious, just look at what is happening now that Mother Nature has taken out those utilities."

"The urgency and the immediacy of the cyber problem; the cyberattacks that we are undergoing and continuing to undergo can not be overestimated," she said.

I'd say that it's not so much the utility downtime that's been the problem with Hurricane Sandy compared to, say, the wind and the copious amounts of water falling from the sky and piling up on the ground. Last I checked, that can't be controlled via a computer (leaving wacky conspiracy theories aside).

As per usual, when it comes to cybersecurity threats, Napolitano (like pretty much every single other politician pushing for legislation) refused to get into specifics about how real any threat is -- other than to make scary "be afraid, be very afraid!" noises. The one time she was asked about a specific threat, she immediately went vague, but in full-on FUD mode:

When asked by Post editor Mary Jordan about whether hackers are stealing information or money from banks, Napolitano answered "yes" and then quickly added, "I really don't want to go into that per se."

"All I want to say is that there are active matters going on with financial institutions," she said.

Is it really so crazy to think that if the government is going to pass a bill that has broad implications for our privacy, they should at least come up with a legitimate and clear explanation for why it's needed? Instead they toss out scare stories about hackers stealing money, planes falling from skies and utilities shutting down -- without any proof that any of it is actually likely or possible.

Filed Under: cybersecurity, fud, grandstanding, homeland security, hurricane sandy, janet napolitano

Defense Secretary Leon Panetta Recycles His 'Cyber-Pearl Harbor' FUD... Third Time's The Charm?

from the if-at-first-you-don't-succeed,-beat-that-dead-horse dept

A recent (failed) push to enact cybersecurity legislation has resulted in some interesting maneuvering in Washington, DC. Rep. Mike Rogers, who introduced CISPA, is trying to revive his lousy legislation by telling scary stories that are short on detail, but long on FUD. Other interested parties are hoping to bypass the legislative process altogether and get an executive order pushed through. The "process" has become so chaotic that politicians are finding themselves hurriedly agreeing to stuff that contradicts the other stuff.

Of all the people that believe Something Must Be Done, cybersecurity-wise, one of the pithiest has been Secretary of Defense Leon Panetta, who issued a memorable pull-quote on October 11th in a speech at the Intrepid Sea, Air and Space Museum, warning that the United States was facing the possibility of a "cyber-Pearl Harbor."

A dire situation indeed, if true. Panetta is worried about critical infrastructure being sabotaged by cyberterrorists and is totally not just pushing his own agenda.* According to defense officials, "Mr. Panetta's words were not hyperbole."

(*Panetta is totally pushing his own agenda... those same defense officials "acknowledged that Mr. Panetta was also pushing for legislation on Capitol Hill.")

Yes. Panetta is non-hyperbolically pushing his own agenda. The problem is that, while the CISPA/executive order debacle is fairly recent, Panetta's "cyber-Pearl Harbor" has the ring of a worn-out catchphrase, severely limiting the impact of those somewhat stirring words.

Let's go back to June 2011, when Panetta was holding forth during his confirmation hearing for the post of Secretary of Defense.

The next great battle America faces is likely to involve cyberwarfare, Leon Panetta, the Central Intelligence Agency director, warned senators Thursday, predicting that "the next Pearl Harbor that we confront could very well be a cyberattack that cripples" America’s electrical grid and its security and financial systems.

Tough words from an old warrior (and now former CIA Director). Perhaps the warrior might be a bit too old, as he also offered this quote-worthy bit of scaremongering back in February 2011:

"The potential for the next Pearl Harbor could very well be a cyber-attack," he testified on Capitol Hill Thursday before the House Permanent Select Committee on Intelligence.

The more things change, the more they are the same old shit. Unchanged: using "Pearl Harbor" as shorthand for "unforeseeable bad thing," while simultaneously plucking at patriotic heartstrings by conjuring up the last war the US didn't play to a tie. Savvy. But repetitive.

The most current edition of "cyber-Pearl Harbor" finds Panetta concentrating mostly on infrastructure, thus equating a military surprise attack with some Russian Chinese Iranian hacker flipping the "OFF" switch on the power grid.

“An aggressor nation or extremist group could use these kinds of cyber tools to gain control of critical switches,” Mr. Panetta said. “They could derail passenger trains, or even more dangerous, derail passenger trains loaded with lethal chemicals. They could contaminate the water supply in major cities, or shut down the power grid across large parts of the country.”

Past editions of "Clue: Panetta Edition" haven't been so concentrated on the still-mythic "Cyberterrorists in the Water Main with the Malicious Code." In February 2011, it was "Chinese 'Entities' in the Internet with the Hacking," and a bit of "Anonymous in the EVERYTHING with the LOIC." There was some talk of putting together a joint task force composed of NSA and DHS members. Additional hyperbole was added by Director of National Intelligence James Clapper:

"This threat is increasing in scope and scale, and its impact is difficult to overstate."

Sure is. Especially when you lead in with "cyber-Pearl Harbor." Setting the "overstatement" bar this high does kind of throw off the curve.

June 2011 didn't change much for Panetta's ongoing game of cyber-Clue. Most of the "grilling" during his confirmation hearing revolved around ongoing actual wars, like Afghanistan, Iraq and Libya. Concern was also expressed about "indiscriminate Pentagon budget cuts."

Back to last week, and it's all about the infrastructure. It's as if no one had bothered debunking a recent DHS report about Russian hackers burning out a water pump at an Illinois water facility. Not that it matters, as the DHS was proud to have been involved in a successful FUD operation. Any publicity is good publicity, right? Boring old truth and measured phrases rarely inspire the sort of support needed to shove through questionable legislation and keep the money flowing to the cottage industries that have sprung up like kudzu around the leaky water main that is Washington, DC.

This repeated catchphrase of Panetta's has stuck with him, even as he's shifted loyalties. Back in February 2011, there was talk of DHS/NSA cooperation. Fast-forward to the latest iteration of "cyber-Pearl Harbor" and Panetta's batting for his new home team: the Defense Department, pulling the control (and money) back into the hands of the NSA, the greater of two evils.

Repeat after Panetta:

If you're against cybersecurity legislation, you're for bombing Americans on early December mornings. Can you live with that?

Filed Under: cyber pearl harbor, cybersecurity, fud, leon panetta

DHS: Our Reports To Congress Are Successful Bullshit

from the yeah,-we-already-kinda-figured dept

Okay, it's official. I no longer believe that our Department of Homeland Security is an actual government agency with important work to do. No, I now believe that it is a series of highly subtle performance art pieces designed to make us laugh at the sheer audacity of dumb government. We already know about the agency's boss, who is in charge of cybersecurity, not bothering to use the internet. And then there is the DHS's highly touted fusion centers being both a waste of money and a detriment to the very freedoms they're supposedly protecting.

But Tim K writes in about a rather stunning admission by DHS officials of a bogus DHS report on a water pumping facility. It essentially amounts to: "sure the report is a complete lie, but it was a successful lie." Don't believe me?

Officials behind the false claims told Senate investigators that such reports weren’t meant to be “finished intelligence” and that despite their report’s inaccuracies and sloppy wording they considered it to be a “success.”

“[It did] exactly what it’s supposed to do – generate interest,” DHS officials told Senate investigators.

Now, let's do some quick background on this report, less because it informs you and more because it's hysterical. About a year ago, a water pump failed in an Illinois water facility. In response, almost immediately, an Illinois fusion center (part DHS, part Illinois State Police) circulated a report blaming a hacking attack from Russia. Not soon after that report was circulated, the greater DHS office rebuffed the fusion center's hacking allegation as absolute nonsense. It pointed out, as does the linked article, that the allegation was pure conjecture based on the fusion center's inability to do even the most basic investigation.

Someone did access the water district’s SCADA system from Russia, but it was a water district contractor who was asked to access the system by water district employees, as Wired first reported. They had called him to seek his opinion on something while he was on vacation in Russia, and he had logged into the system remotely to check on some data for them.

When the pump broke five months later and someone examined the network logs to determine the cause, they found an IP address from Russia listed in the logs next to the username and password of the contractor. No one ever bothered to call the contractor to see if he had logged in from Russia; they just assumed someone in Russia had stolen his credentials.

It's worth noting that the water pump busted 5 months after this Russian IP logged in. In other words, none of this makes a lick of sense, except if it's the case of someone looking for a convenient scapegoat. "Hackers! Russians!" is apparently what these people went with, for reasons unknown to this author.

But the DHS report circulated to Congress, which DHS says is a success even though it's bullshit, was written up after they called out their own fusion center for making stuff up. I think most reasonable people would suspect that such successful excriment is part of the fear mongering around so-called cyberwars and the trumped up need for Congress to pass some kind of cybersecurity bill. But even the least cynical person would at least expect the DHS to correct their report and alert Congress to the pure made-up-iness of it. DHS has thus far declined to do so, because, paraphrasing DHS itself, the lie is more effective than the truth. Yay, government!

Filed Under: congress, cybersecurity, dhs, fear mongering, fud, homeland security

CISPA Author Ramps Up The FUD: Claims He Can't Sleep At Night Due To 'Unusual Source' Threatening Us

from the oh-come-on dept

Rep. Mike Rogers, who introduced CISPA, the infamous cybersecurity bill that was absolutely horrible when it came to privacy, is apparently trying to ramp up the FUD to get CISPA back on the legislative calendar, despite the Senate's decision to go in another direction (which eventually stalled out). In a new interview, he talked mysteriously about new threats from "unexpected sources" and even claimed he couldn't sleep at night because of them. But -- shh! -- he can't really talk about specifics:

"We think there might be one last shot here -- maybe I'm just an eternal optimist -- to get this thing sparked back to life."

Driving the interest, he said, has been a series of briefings for key legislators "on what appears to be a new level of threat that would target networks from -- I've got to be careful here -- an unusual source."

Rogers has been giving fellow legislators a "glimpse" of this new danger. "I figured if I can't sleep at night, why should any other member of Congress?" He declined to describe the threat, citing the highly classified nature of the information. "I look really bad in orange -- those orange jumpsuits with the numbers on the back," he said to laughter.

It really was just a few days ago that we wondered if the government was going to start using stories of "new threats" to try to ram through legislation. That's basically been the plan all along. Tell scary ghost stories, none of which have any actual facts behind them, until people feel compelled to pass the bills. What's never mentioned is whether or not any of this is effective or a reasonable response. Also missing: any discussion of what is the actual problem being solved today. Rogers' CISPA bill, for example, focuses on information sharing, but fails to explain why the necessary information sharing is being blocked today, or why the bill can't just target the few issues that block such info sharing.

Of course, at the very same time that he's telling scary ghost stories about monsters in our wires keeping him up at night, he's absolutely livid that no one in the White House came to talk to him about their own plan for a cybersecurity executive order. So, apparently, we're all going to die in the night if we don't let companies and the government spy on us more easily... but the White House's plan to do something about that is "irresponsible." Right.

Filed Under: cispa, cybersecurity, fud, mike rogers, threats

The Stats Used To Support Cybercrime 'Threats' Just As Bogus As Hollywood's 'Loss' Claims

from the but-of-course... dept

While the latest attempt to pass a cybersecurity bill may be on ice for now, it'll be back... and with it there will be a lot more hyperbole about how urgent this is because of various massive "losses" already happening due to cybersecurity problems. Of course, nearly all of the numbers and claims you hear will be 100% bogus.

For years, we've highlighted stories about how the claims of "losses" from the entertainment industry due to infringement are completely fictitious. In the past, we've seen Julian Sanchez go on a hunt to find the origin of some of the numbers being thrown around, and come up with evidence that they're based on nothing. For example, claims of $200 billion in losses due to counterfeiting... came from a 1993 Forbes article that just makes that claim with no citation and no backing info. But it became gospel among those arguing there was as problem.

With Congress and the President continuing to insist that we need a cybersecurity bill, politicians have been tossing around all sorts of questionable numbers. Just a few weeks ago, we noted that General Keith Alexander, the head of the NSA, had tossed out some numbers and claimed that cybersecurity was the "greatest transfer of wealth in history." Considering that we're living through the aftermath of a financial meltdown that involved a massive transfer of wealth, I find the original claim difficult to believe. Plus, as we noted, he seemed to only cite studies from McAfee and Symantec, two companies who have a massive vested interest in keeping the cybersecurity FUD going, because it helps them sell stuff.

Thankfully, the folks over at Pro Publica decided to take a much closer look at the numbers politicians are relying on in support of the massive "harm" that is already being caused by online security issues... and discovered that the numbers are completely and totally bogus. In fact, the full story (which is fascinating) parallels (very closely) the story with "piracy" stats from the industry.

One popular number is "$1 trillion" in losses due to cybersecurity breaches. That number gets thrown around a lot by politicians (and many in the press who merely parrot such numbers unquestioningly, even as that gives those politicians more cover to claim that there's a reputable source supporting the number). Yet, the Pro Publica report highlights that, not only is this number bogus, but the (quite well respected) researchers who put together the original report for McAfee did not use that number and, more importantly, many of them spoke out publicly with surprise that McAfee put out a press release with such a number -- which they thought was questionable and not supported by their data.

In fact, there were a number of methodological problems, including that the data was based on a self-reported "average" amount of the "worth of sensitive information stored in offshore computer systems." Who knows if the respondents are being accurate, first of all, but even more to the point, the "worth" of such information is a highly subjective number. People can find something "worthwhile" without paying for it, but by focusing on the "worth," they obscure the fact that the market price may be quite different than what people think something is worth. And, what people think something is worth has zero impact on any actual losses. But, from a very small number, McAfee just sprinkled some magic pixie dust on the already questionable number, and proceeded to extrapolate, massively:

“The companies surveyed estimated they lost a combined $4.6 billion worth of intellectual property last year alone, and spent approximately $600 million repairing damage from data breaches,” the release said. “Based on these numbers, McAfee projects that companies worldwide lost more than $1 trillion last year.” The release contained a quote from McAfee’s then-president and chief executive David DeWalt, in which he repeated the $1 trillion estimate. The headline of the news release was “Businesses Lose More than $1 Trillion in Intellectual Property Due to Data Theft and Cybercrime.”

The trillion-dollar estimate was picked up by the media, including Bloomberg and CNET, which expressed no skepticism.

Now, remember, this $1 trillion number is just in the press release. It's not in the report at all. And the report's researchers were just as baffled (and even more concerned) about this:

Among [the study's researchers] was Ross Anderson, a security engineering professor at University of Cambridge, who told ProPublica that he did not know about the $1 trillion estimate before it was announced. “I would have objected at the time had I known about it,” he said. “The intellectual quality of this ($1 trillion number) is below abysmal.”

.... The company’s method did not meet the standards of the Purdue researchers whom it had engaged to analyze the survey responses and help write the report. In phone interviews and emails to ProPublica, associate professor Jackie Rees Ulmer said she was disconcerted when, a few days before the report’s unveiling, she received a draft of the news release that contained the $1 trillion figure. “I expressed my concern with the number as we did not generate it,” Rees Ulmer said in an email. She added that although she couldn’t recall the particulars of the phone conversation in which she made her concerns known, “It is almost certainly the case that I would have told them the number was unsupportable.”

...The news stories got the worried attention of some of the report’s contributors because McAfee was connecting their names to an estimate they had no previous knowledge of and were skeptical about. One of the contributors, Augusto Paes de Barros, a Brazilian security consultant, blogged a week after the news release that although he was glad to have been involved in the report, “I could not find any data in that report that could lead into that number.... I’d like to see how they found this number.”

I don't know about you, but when a super well respected security researcher tells you that the basis of a particular claim is based on a number whose "intellectual quality ... is below abysmal," that's the point at which you should probably stop using the number. But, instead, politicians and the press continue to parrot the line over and over again.

The slightly smaller number, from Symantec, is still equally questionable. They go with $250 billion... but the number has almost no support. It does come from a real Symantec report, but not from Symatec employees. Instead, they hired another firm to magically come up with the number, and it sounds like magic would have been equally as effective as what was eventually done. It raised concerns from actual experts in the field:

“Far from being broadly-based estimates of losses across the population, the cyber-crime estimates that we have appear to be largely the answers of a handful of people extrapolated to the whole population.”

Furthermore, even if we take these numbers at face value, the original reports on both of them say these numbers represent the value of the attacks in question, and not what was actually "lost" or how much it cost to deal with. However, when a politician quotes them, they almost always do so by at least suggesting that these made up "values" are very real "losses" to companies. In other words, the numbers (shocker, shocker) are being twisted by cybersecurity law supporters. For example, just recently, Senator Collins said that General Alexander "believes American companies have lost about $250 billion a year," but that's not true. Already, we know the number is suspect -- but even if we accepted the number, it only represents the "value" that various companies have put on things harmed by security issues, not any sense of actual losses. Claiming that these are losses isn't just misleading, it's wrong.

We've argued for years that actual data should inform the debate on these things -- but that data needs to be accurate and supportable. Unfortunately, with cybersecurity threats, the claims that are being thrown around have no basis in reality. If politicians really want to discuss the "threat" of cybersecurity, the least they can do is get some accurate research on the scope of the problem. Trusting a number from a McAfee press release is not credible and it's certainly no basis for passing a law that wipes out privacy rights of the public.

Filed Under: cybersecurity, fud, hype, losses, stats
Companies: mcafee, symantec

Microsoft Continues To Get Companies To Pay It For Non-Microsoft Software

from the this-is-not-a-good-thing dept

We've discussed in the past just how ridiculous it is that Microsoft has a "licensing program" for Android -- someone else's technology. And, of course, for many years, Microsoft has been running around insisting that Linux infringes on hundreds of its patents, though it gets pretty shy when asked to identify them. Every so often, Microsoft convinces some company to cough up some protection money for being Linux users -- though usually it's for companies selling Linux-based hardware.

Now Microsoft has convinced Amdocs to fork over some cash for running a Linux-based service. While (of course!) details are sparse, Microsoft made sure in the press release that it was clear that the license was for "Amdocs' use of Linux-based servers in its data centers."

This really does seem somewhat offensive. Microsoft is getting other companies to pay it for software that it had absolutely nothing to do with (and which many people use, in part, because it keeps them away from having to pay Microsoft).

Filed Under: fud, linux, patents
Companies: amdocs, microsoft