Pentagon Also Looking To Set Up A Branch Office In The Silicon Valley

from the the-NEW-East-Coast/West-Coast-rivalry dept

It's officially a trend. US government agencies are making cross-country treks to Silicon Valley in hopes of talking tech companies into joining forces as they work towards thwarting the upcoming Cybergeddon.

President Obama’s newly installed defense secretary, Ashton B. Carter, toured Silicon Valley last week to announce a new military strategy for computer conflict, starting the latest Pentagon effort to invest in promising start-ups and to meet with engineers whose talent he declared the Pentagon desperately needed in fending off the nation’s adversaries.

I'm sure the government could use the help but sending pitchmen tied to domestic surveillance/crotch-grabbing airport "security" (as in the case of DHS Secretary Jeh Johnson) or extrajudicial killings/endless wars (as in the case of Carter and the DoD) isn't going to win many new converts. It's going to have even less success winning over those who've already decided there's no way they're partnering up with the US government, not after two years of leaked documents showing the NSA has backdoored hardware, software, mobile devices... basically anything these companies touch.

Carter wants to rebuild trust. He could start by declassifying a pile of documents on Dept. of Defense activities before some leaker does it for him, but he's really not here to offer increased transparency. All he's offering is the same talking point agencies have routinely deferred to when commenting on exposed surveillance programs.

“I think that people and companies need to be convinced that everything we do in the cyber domain is lawful and appropriate and necessary,” Mr. Carter told students and faculty at Stanford.

That sentence is full of truth, but fundamentally dishonest. Yes, people and companies need to be "convinced" that these government agencies are acting lawfully and only doing what's '"appropriate or necessary." But a really good place to start would be actually ensuring that government agencies act lawfully and only do what is appropriate and necessary. Simply claiming you are when the facts show otherwise doesn't do anything for anybody.

There's a CyberWar coming and the government is heavily scouting the West Coast for foot soldiers. If the government finds itself continually rebuffed by tech companies, will it decide to institute a cyberdraft? Legislators are pushing through bills to make "information sharing" -- something that would normally describe voluntary efforts -- mandatory. What Carter says sounds like he's prepared to initiate a cyber-Vietnam Conflict in hopes of heading off the next cyber-Pearl Harbor.

He urged the next generation of software pioneers and entrepreneurs to take a break from developing killer apps and consider a tour of service fending off Chinese, Russian and North Korean hackers…

Or, as Dealbreaker's Thornton McEnery refers to this pitch: "Lean in… or Die."

It's not just touching base with tech companies. The Pentagon wants an actual base in the Silicon Valley.

The Pentagon plans to open its first office in Silicon Valley and provide venture capital in an effort to tap commercial technology that can be used to develop more advanced weapons and intelligence systems.

The desire for bright, young minds is understandable. What isn't is the government's apparent belief that a few chats and moving into the neighborhood will somehow make years of uncovered abuses simply vanish. The outreach would be admirable if it wasn't mired in the usual talking points. The government should expect nothing from the tech world -- for years.

The DoD and DHS opening branch offices in the Silicon Valley just as cybersecurity bills edge closer to becoming law is no coincidence. Much like many military-industrial contractors build offices and plants in the Beltway area to ensure maximum access to legislators, the government must also have a West Coast presence if it wants to efficiently "lobby" for information sharing and surveillance-ready products and services. And let's not forget the government's desire to "share" information is still mostly about obtaining usable exploits and beefing up existing surveillance programs, rather than ensuring the security of its constituents. Any statements to the contrary aren't to be trusted.

Filed Under: ashton carter, defense department, dod, encryption, silicon valley

Expected Next Defense Department Boss Claims Snowden Leak A 'Huge Detriment' To US, Willing To Give Cybersecurity To FBI

from the of-course dept

It's widely expected that Ashton Carter is going to be nominated as the next Defense Secretary to replace Chuck Hagel, who recently was pushed out by President Obama. So it seemed like an opportune time to see that the latest podcast from venture capital firm Andreessen Horowitz was actually a panel discussion involving Carter and Yahoo's security boss Alex Stamos. The whole podcast is actually quite interesting: However, what struck me is that Carter actually makes a comment about Ed Snowden. In the past, Carter (who was deputy Defense Secretary -- and, remember, NSA is a part of the Defense Department), has shied away from commenting on Snowden's actions, instead focusing on the internal issues that allowed Snowden to do what he did. Here, he does more of the same, but drops in an aside about Snowden's actions causing damage:

If anyone thinks we did a good job protecting Defense networks, take a look at Edward Snowden. Whatever you think of that, it was a classic insider threat -- realized to the huge detriment of the country.

It would seem that his "whatever you think of that" is immediately negated by his "huge detriment to the country." But I'm curious as to what that huge detriment really is. So far, all we've seen is that it revealed to the public abusive practices of the NSA and its partners, widespread mass surveillance on Americans that has raised significant questions of legality and constitutionality by all three branches of government. And yet, what hasn't been shown is any harm caused by this.

Not that I'd expect a bigshot in the Defense Department to celebrate Snowden's whistleblowing, but at the very least, you'd hope that some would avoid throwing around bogus smears that don't seem to be supported by reality.

Later in the discussion there is a pretty interesting look at the state of cybersecurity issues. The big "information sharing" question is brought up, but more interesting is that Carter seems to admit that he'd be okay with the Justice Department handling cybersecurity issues, rather than the Defense Department. This is actually quite surprising. For years, we've highlighted that much of the fight within the government concerning cybersecurity legislation was really nothing more than a turf war between the Defense Department (NSA) and Homeland Security over who would get the purse strings for the massive cybersecurity budget. While Homeland Security has its problems, we'd greatly prefer a civilian agency have control over the situation, rather than a military one using its signals intelligence agency for cybersecurity (since the two goals there are clearly at odds). Carter surprisingly admits that it's something of a turf battle, but seems to indicate his comfort with a third player handling it instead: the Justice Department. In fact, he even basically notes that, contrary to what the NSA (and others in the Defense Department) have claimed in the past, the NSA really isn't that good at cybersecurity, since that's not what its job is about:

A lot of the threat information that the government collects in the counterintelligence area, counterterrorism, protect your own networks area -- some of its germane, but a lot of it is not really germane to these commercial attacks. Said differently, the government isn't collecting a lot of information about these attacks. That's thing one.

Thing two, which is less acceptable, is in this... the US federal government has still not made a decision in the manner of cyberdefense of the kind it had to make in the area of counterterrorism. Which is: is this an attack, a crime or a disaster? Now, why does that matter if it's all three? Well, if it's an attack, then you expect you defense establishment to take care of it. If it's a crime, then you expect your law enforcement establishment to take care of it. And if it's a disaster, then you expect your Homeland Security apparatus to take care of it.

So there's been this sort of three-fold struggle over this. And you add this huge layer of lawyering -- government lawyering, which is even worse -- on top of this, and you have stasis and paralysis.... Even that which is collected and could be shared is inadequately shared, because of those trivial bureaucratic [logjam]....

... I think you see Jim Comey trying to [break that logjam]. My attitude, when I was representing the Defense Department, to Jim and his predecessor Bob Mueller, my attitude was 'I'm not going to try to claim this. Go for it. And I'm 100% behind you.' I could never get Homeland Security, quite honestly. Because they had the attitude that they wanted this bureaucratically. I mean all bureaucracies want things. And they wanted this. But they didn't have the capability. Comey had the authorities and some reasonable technical capabilities. We had a lot of technical capability, but I didn't feel like we were the right people to do it.

So my attitude was, "this is a national problem, let me just get in behind Jim and tell all my bureaucrats to stuff it and stop fighting with him and trying to seize it yourself" but I never got Homeland Security to that point of view.

That's pretty interesting -- because for years the view from the outside has always been that the Defense Department was the one that was actively demanding this control. The NSA, under Keith Alexander in particular, was pretty blatant about wanting the cybersecurity mandate. If Carter is really willing to give that up, that's interesting. Though, of course, the NSA and FBI have a fairly close relationship -- and I don't see how handing this mandate over to the FBI is such a good idea either. You pretty quickly run into the same issues the NSA had (though sometimes with even less oversight).

Either way, given how much attention Carter is likely to get for his expected new role, it seems worth noting his views on these things that we discuss around these parts pretty frequently.

Filed Under: ashton carter, chuck hagel, edward snowden, nsa