Heartbleed Suspicion And NSA Denial Show Why NSA's Dual Offense/Defensive Role Must End

from the it's-a-problem dept

We've talked for a while how dangerous and ridiculous it is that the NSA has a dual role as both handling "offensive" attacks and (supposedly) stopping incoming attacks in a "defensive" role. While technically, the NSA is supposed to be handling the "defensive" side while the US Cyber Command handles the offensive, there is no real separation between the two. The US Cyber Command is headquartered within the NSA and is run by the same person. Despite multiple recommendations to split the roles, the White House refuses to do so. Meanwhile, the NSA itself has been doing more and more offensive work anyway.

However, the claim late last week that the NSA knew about and exploited Heartbleed, followed by the quick denial by the NSA, really puts an exclamation point on how untenable this dual role is for the NSA. It's difficult to take the NSA seriously given the competing interests within it. Add to this, President Obama basically giving his broad approval for the NSA to exploit security flaws it finds, and you have a very dangerous setup for your average internet user. The NSA, despite its job, will have little interest in actually protecting internet users.

Julian Sanchez summarizes the issue nicely by pointing out that the two roles are simply incompatible:

But the denial itself serves as a reminder that NSA's two fundamental missions – one defensive, one offensive – are fundamentally incompatible, and that they can't both be handled credibly by the same government agency.

The NSA's history of being less than forthright in the past, as well as many of the Snowden revelations, combined with its dual role, simply means that most people won't believe the NSA's denial about Heartbleed, even if it was much more strongly worded than earlier denials. If the NSA's role, however, were made much clearer, such that it was only focused on protecting systems, without the offensive elements, then it would be both a lot more believable, and a lot more trustworthy. However, the very fact that the administration (and the NSA) appear to have little interest in moving in this direction says a lot about how much they really prioritize protecting our computer systems.

Filed Under: cybersecurity, defensive, nsa, offensive, surveillance, us cyber command

Effort Underway For Defensive Patent Pool For Open Source Developers

from the figthing-evil-with-evil dept

Slashdot alerts us to a new effort to create a "Defensive Patent License" (DPL) as a defensive mechanism for open source developers. The idea is a bit more advanced than your every day patent pools (even the defensive ones). The basic framework is as follows:

• Members of the DPL would make a business decision that they are obtaining patents strictly for defensive purposes and not because they want to sell licenses or go on the offensive with lawsuits.
• Members of the DPL contribute all of their patents in their patent portfolio – they don’t pick and choose (and this is what differentiates it from other defensive patent pools).
• Members of the DPL allow all other members to use its patents without royalty and without fear of patent infringement lawsuits from other members as long as a member does not file offensive lawsuits or remove their patents from the DPL.
• Members may choose to leave the DPL but cannot revoke the royalty-free license from members who used it during the time the company was a member.
• Members that join after a company leaves would not have royalty-free access to a former member’s patent portfolio.
• The royalty-free cross licensing applies only to members of the DPL. Members are free to pursue royalties or lawsuits with companies outside the DPL.

It still seems like a pain that those who don't even believe in software patents have to go through this sort of trouble, but it's the nature of the system. Also, it does worry me that this creates more incentives for patents to be filed, when those patents could, potentially, end up in others' hands down the road. Apparently the folks putting this together are looking into whether or not the "membership could legally be applied to a patent that changed ownership from a bankruptcy." Of course, even so, the new owner could opt-out of the DPL, and while it couldn't revoke the license for other members, those patents could still be used pretty offensively. Either way, given the nature of the market today, adding a bit more protection for open source developers seems like it could be a good thing -- even though we haven't seen too many successful patent lawsuits against open source providers.

Filed Under: defensive, dpl, open source, patents

Apple Goes Offensive On Patents: Sues HTC

from the no-smartphones-at-all dept

Well, well, well. We've discussed recently how it seemed effectively impossible for any smartphone maker to survive the patent gantlet, as there are so many patents held by so many different parties, and they all seem to have recently started suing each other. The latest, sent in by a whole bunch of you (though Phillip was first) is that Apple is suing HTC, again both in the courts and using the ITC loophole. What's interesting here is that, despite Apple playing up the fact that it had over 200 patents on the iPhone, for the most part, it hadn't gone on the offensive with them. The recent patent lawsuits that Apple has been involved in have all been on the defensive side -- which we thought was a smart move for Apple. The fact that it's now going on the offensive on patents is unfortunate. It's usually a sign that a company is worried that it can't keep up with the competition.

Filed Under: defensive, itc, offensive, patents, smartphones
Companies: apple, htc