New Group Seeking Privacy/Security Balance Loads Up On Former Government Officials And RSA Employees

from the don't-get-your-hopes-up dept

"I helped to organize it [Digital Equilibrium Project] with McKinsey's help with the idea that people on various sides were talking past one another, often without the facts," former Executive Chairman of RSA Art Coviello told eWEEK. "Our participants bring significant networks and resources to bear from themselves and the organizations they work with, and we're confident we have the resources to execute on the mission."

[...]

"We hope to create a groundswell of thinking—not through acrimonious and emotional debate, but through active listening and fact-based dialogue so we can we make progress before it is too late," he said.

So says Art Coviello of his new project -- one that he hopes will bring some coherence to the balancing act between security and privacy.

This is the same Art Coviello who said anonymity is the "enemy of privacy." Why? Because it allows bad people to do bad things and get away with it -- a sentiment echoed by any number of law enforcement officials and intelligence agency heads.

Coviello's timing couldn't be better. Against the backdrop of the FBI's efforts to force Apple to help it break into iPhones, Coviello hopes a balanced discussion of the issues may result in workable common ground between parties he feels often "talk past each other."

But the Digital Equilibrium Project isn't going to be the balanced discussion Coviello is framing it as. The list of participants seems to indicate the discussion will result in severe inner ear damage, rather than equilibrium.

Stewart Baker
Former 1st Assistant Secretary of DHS General Counsel of the NSA

Michael Chertoff
Executive Chairman of The Chertoff Group
U.S. Secretary of Homeland Security (’05-’09)

Edward Davis
Former Boston Police Commissioner

Michael McConnell
Former Director of the NSA and
Director of National Intelligence
[and head of Booz Allen, which goes unmentioned on DEG page...]

JR Williamson
Corporate Chief Information Officer, Northrop Grumman

Richard Clarke
Former White House Advisor
Chairman and CEO, Good Harbor Security Risk Management
[Former "cybersecurity czar" to be more precise, one who has suggested the government "search" internet traffic travelling in and out of the US (to prevent theft by China{?}). On the plus side, he did sign a letter to the Administration stating that mandated encryption backdoors are a terrible idea.]

That's only part of the stacked deck, but what a hand! NSA, DHS, Boston PD, military-industrial contractor, a cybersecurity "czar…"

From there, it gets marginally better.

Tim Belcher
Former CTO, RSA
[RSA worked closely with the NSA to recommend an undermined encryption standard]

Jim Bidzos
Chairman and CEO, Verisign
[Verisign has worked with ICE and others to make site seizures easier, participated in global internet censorship]

Art Coviello
Former Executive Chairman, RSA
[See above]

Kasha Gauthier
Program Committee Co-Chair, NICE
Special Advisor, Boston College Cybersecurity Masters Program
[Not mentioned: Gauthier's position as Director of Academic and Community Alliances at RSA. Also serves as Director of Marketing and Strategy.]

It gets much better from there. Most of the remaining names on this list have a long history of protecting privacy and working towards enhancing security for all internet users, not just government agencies.

Dr. Ann Cavoukian, Ph.D.
Executive Director of the Privacy and Big Data Institute at Ryerson University
[Former Ontario Privacy Commissioner, who has stated that "encryption is freedom" and taken legal action against local law enforcement for sharing sensitive medical information with US law enforcement agencies.]

Larry Clinton
President and CEO, Internet Security Alliance
[The ISA is a trade alliance which lobbies on behalf of businesses. In light of FBI v. Apple, this is possibly a good thing. Clinton's statements indicate he feels the government's belief that "information sharing" will solve cybersecurity woes is largely unfounded.]

Brian Fitzgerald
Chief Marketing Officer, Veracode
[Veracode was founded by white hat hackers and routinely provides updates on the current state of cybersecurity in the nation. Just as routinely, it finds government agencies to be the worst at security.]

J. Trevor Hughes
President and CEO, International Association of Privacy Professionals
[IAPP is a non-profit, "non-advocacy" group, which would make it about as unbiased as anyone can get in this discussion.]

Nuala O’Connor
President and CEO,
Center for Democracy and Technology
[O'Connor was the DHS's first Chief Privacy Officer and did that job well enough to earn the praise of the ACLU and others -- a tough thing to do with the inherent limitations of the position, which did not allow her to publicly criticize the DHS's failures. Since then, she has headed up the Center for Democracy and Technology, which advocates for privacy, freedom of speech and surveillance reform.]

If the RSA insiders are "swing votes," this discussion could actually end up "balanced." But it seems unlikely to result in the common ground Coviello says he's seeking. He wants to break up "polarized, entrenched views" but a majority of those participating will likely advocate for positions that closely align with the government and its contractors.

Fortunately, this wasn't assembled by Congress or the administration, where it might do some actual damage. Some decent discussion may result from this blend of privacy advocates and former government officials, but the composition is still too one-sided to state this with any confidence.

Filed Under: ann cavoukian, art coviello, brian fitzgerald, consortium, edward davis, jim bidzos, jr williamson, kasha gauthier, larry clinton, michael chertoff, michael mcconnell, nuala o'connor, privacy, richard clarke, security, stewart baker, trevor hughes

Former NSA Directors Coming Out Strongly *Against* Backdooring Encryption

from the didn't-see-that-coming dept

Earlier this summer, we were taken a bit by surprise when both former NSA/CIA boss Michael Hayden, along with former DHS boss Michael Chertoff, came out fairly strongly against backdooring encryption at a time when their counterparts still in the government seemed to be leaning in the other direction and have been pushing proposals to mandate backdoors. And it appears they're not backing down. Hayden has now doubled down with further statements against backdooring encryption, according to Lorenzo Franceschi-Bicchierai at Vice's Motherboard.

Michael Hayden, the former head of the US top spy agencies, the CIA, and the NSA, thinks the US government should stop railing against encryption and should support strong crypto rather than asking for backdoors.

The US is “better served by stronger encryption, rather than baking in weaker encryption,” he said during a panel on Tuesday.

Later, he told Lorenzo that part of his thinking is that the intelligence community doesn't need such backdoors since it has other ways of getting that info:

“In retrospect, we mastered the problem we created by the lack of the Clipper Chip,” he said. “We were able to do a whole bunch of other things. Some of the other things were metadata, and bulk collection and so on.”

Hayden is being a bit snarky there. He knows that privacy advocates will take his words about backdooring encryption and celebrate them, so he's using it at the same time to argue in favor of the other problematic programs -- programs that Hayden is most closely associated with involving mass surveillance. He's also being disingenuous. The metadata and mass surveillance efforts generally give you access to a different kind of information. What Hayden leaves out, of course, is the real reason why backdoors usually aren't that important: because there are almost always ways to hack into encrypted data, though that also raises serious questions.

Meanwhile, another former NSA director, Mike McConnell, has joined with the other two Michaels in arguing against backdoors. This according to Kaveh Waddell at the National Journal:

“Don’t get in the way of pro­gress,” Mc­Con­nell said Thursday at a pan­el dur­ing an en­cryp­tion sum­mit hos­ted by The Wash­ing­ton Post. “Don’t get in the way of in­nov­a­tion and cre­ativ­ity, be­cause this is go­ing to hap­pen. Some­body’s go­ing to provide this en­cryp­tion.”

Mc­Con­nell’s po­s­i­tion is a com­plete de­par­ture from the per­spect­ive he rep­res­en­ted in gov­ern­ment, a shift he has pub­licly ac­know­ledged. When he ran the Na­tion­al Se­cur­ity Agency in the 1990s, Mc­Con­nell was a vo­cal sup­port­er of the Clip­per Chip, a device de­veloped by the NSA that al­lowed the gov­ern­ment to de­crypt elec­tron­ic com­mu­nic­a­tions.

Of course, what's mostly left out of this discussion is that both McConnell and Hayden are now in the private sector -- Hayden at the Chertoff Group with Michael Chertoff, and McConnell at defense contracting giant (and former Ed Snowden employer) Booz Allen Hamilton -- where both have economic reasons for supporting actual stronger security, rather than undermining such security. Either way, in this debate, it seems that those pushing for backdooring encryption are increasingly being marginalized entirely. Even their normally faithful supporters have moved on into the world of reality, where backdooring encryption only leads to trouble.

Filed Under: backdoors, encryption, michael chertoff, michael hayden, michael mcconnell, nsa, surveillance

Washington Post Publishes... And Then Unpublishes... Opinion Piece By Ex-Intelligence Industry Brass, In Favor Of Strong Encryption

from the what-happened? dept

Update: And... the article has been republished at the Washington Post's site with a note claiming that it was accidentally published without fully going through its editing process. Extra points if anyone can spot anything that's changed...

Earlier this week, we noted with some surprise that both former DHS boss Michael Chertoff and former NSA/CIA boss Michael Hayden had come out against backdooring encryption, with both noting (rightly) that it would lead to more harm than good, no matter what FBI boss Jim Comey had to say. Chertoff's spoken argument was particularly good, detailing all of the reasons why backdooring encryption is just a really bad idea. Last night, Chertoff, along with former NSA boss Mike McConnell and former deputy Defense Secretary William Lynn, published an opinion piece at the Washington Post, doubling down on why more encryption is a good thing and backdooring encryption is a bad thing.

Yes, the very same Washington Post that has flat out ignored all of the technical expertise on the subject and called for a "golden key" that would let the intelligence community into our communications. Not only that, but after being mocked all around for its original editorial on this piece, it came back and did it again.

Of course, you may note that I have not linked to this piece by Chertoff, McConnell and Lynn at the Washington Post... and that's because it's gone. If you go there now you get oddly forwarded to a 2013 story (as per the rerouted URL), with a 2010 dateline, claiming that "this file was inadvertently published." Of course, this is the internet, and the internet never forgets. A cached version of the story can be found online. The title really says it all: Why the fear over ubiquitous data encryption is overblown. Of course, technical experts have been saying that for decades, but it's nice to see the intelligence community finally coming around to this. And here's a snippet of what was said in the article before it disappeared.

We recognize the importance our officials attach to being able to decrypt a coded communication under a warrant or similar legal authority. But the issue that has not been addressed is the competing priorities that support the companies’ resistance to building in a back door or duplicated key for decryption. We believe that the greater public good is a secure communications infrastructure protected by ubiquitous encryption at the device, server and enterprise level without building in means for government monitoring.

First, such an encryption system would protect individual privacy and business information from exploitation at a much higher level than exists today. As a recent MIT paper explains, requiring duplicate keys introduces vulnerabilities in encryption that raise the risk of compromise and theft by bad actors. If third-party key holders have less than perfect security, they may be hacked and the duplicate key exposed. This is no theoretical possibility, as evidenced by major cyberintrusions into supposedly secure government databases and the successful compromise of security tokens held by the security firm RSA. Furthermore, requiring a duplicate key rules out security techniques, such as one-time-only private keys.

The op-ed also points out that "smart bad guys" will still figure out plenty of ways to use encryption anyway and all we're really doing is weakening security for everyone else. And, of course, it raises the fact that if the US demands such access, so will China and other companies.

Strategically, the interests of U.S. businesses are essential to protecting U.S. national security interests. After all, political power and military power are derived from economic strength. If the United States is to maintain its global role and influence, protecting business interests from massive economic espionage is essential. And that imperative may outweigh the tactical benefit of making encrypted communications more easily accessible to Western authorities.

These are the same basic arguments that experts have been making for quite some time now. What's also interesting is that the three former government officials also point out that the "threat" of "going dark" is totally overblown anyway. It raises the original crypto wars and the fight over the Clipper Chip, and notes that when that effort failed, "the sky did not fall, and we did not go dark and deaf."

But the sky did not fall, and we did not go dark and deaf. Law enforcement and intelligence officials simply had to face a new future. As witnesses to that new future, we can attest that our security agencies were able to protect national security interests to an even greater extent in the ’90s and into the new century.

This is an important bit of input into this debate, and one hopes that the Washington Post only "unpublished" it because it forgot to correct some grammar or something along those lines. Hopefully it is republished soon -- but even if it was published briefly, this kind of statement could be a necessary turning point, so that hopefully we can avoid having to waste any further effort on the wasteful idiocy of a second crypto war.

Filed Under: backdoors, encryption, going dark, james comey, jim comey, michael chertoff, michael mcconnell, mobile encryption, william lynn
Companies: washington post

Press Parrots Cybersecurity FUD From Former NSA Boss Without Mentioning Massive Conflict Of Interest

from the do-some-freaking-research dept

Not this again. Nearly three years ago, we wrote about the growing hype around "cyberwar" in the US government -- much of it being pushed by one Michael McConnell. News reports love to cover McConnell's fear-mongering about how the internet is at risk. He used to always talk about "cyberwar" but that term went out of fashion, so lately it's all "cyberattacks" and "cyberterrorism." The reason the press loves McConnell is that he's a former head of the NSA (under Clinton) and director of national intelligence (under George W. Bush). What those reports don't like to mention is that since leaving the government, McConnell has a very cushy job as Vice Chairman of Booz, Allen, Hamilton. Booz Allen is a company that regularly seems to do $100 million+ deals with government agencies, many of them related to cybersecurity. You think that having a former NSA director running around scaring agencies about how they're at risk of "cyberwar" or "cybersecurity" isn't useful for business?

And yet, it seems that time and time again when we see McConnell's name, reporters completely fail to mention this particular conflict of interest. Instead, they report his claims as if they're fact, despite the much simpler and more obvious fact: no one has died from an internet attack. Ever. None. Zero. Zilch.

Take, for example, this News.com article by Steven Musil. And then let me know where either of these points is made. You can't, because they're not in there. McConnell's connection to Booz isn't mentioned. Nor is the fact that "cyberthreats" are still as dangerous as a ghost story.

Instead, he throws in a couple scary scary quotes from McConnell about how we're getting close to a cyber-9/11 or a cyber-Pearl Harbor without pointing out that plenty of people think such claims are completely overblown. Also, we've been hearing about this for years now, and while it's been quite profitable for McConnell, there's been no evidence that such a threat is really any closer. But, boy does it make money for government contractors. This isn't to pick on Musil in particular -- plenty of reporters seem totally taken in by McConnell's old job and seem to throw any skepticism (or the ability to do a basic Google search about his current job) out the window. But if we keep seeing it, we're going to keep calling it out until people realize that maybe there are motives there beyond what McConnell says.

Filed Under: conflict, cybersecurity, fud, michael mcconnell
Companies: booz allen

More Cyberwar Hype: Gov't Fear Mongering To Get More Control Over The Network

from the where's-the-evidence? dept

We've been discussing the nature of the hype around the concept of a "cyberwar." There still has been no credible evidence presented that any such thing exists. There certainly has been computer based espionage. And there have been various vandalism attempts. But that's hardly a "war" and doesn't amount to all that much. But politicians and defense contractors have been playing up a few stories of vandalism to make it sound like foreign hackers are going to shut down critical services. And journalists are eating it up. Take, for example, a recent MSNBC blog post, that describes the following "scenario":

Imagine this scenario: Estonia, a NATO member, is cut off from the Internet by cyber attackers who besiege the country's bandwidth with a devastating denial of service attack. Then, the nation's power grid is attacked, threatening economic disruption and even causing loss of life as emergency services are overwhelmed. As international outcry swells, outside researchers determine the attack is being sponsored by a foreign government and being directed from a military base. Desperate and outgunned in tech resources, Estonia invokes Article 5 of the NATO Treaty -- an attack against one member nation is an attack against all. It requests an immediate response from its military allies: Bomb the attacker's command-and-control headquarters to stop the punishing cyber attack.

Now, the U.S. government is faced with a chilling question: Should it get dragged into a shooting war by a cyber attack on an ally? Or should it decline and threaten the fiber of the NATO alliance?

About half this fictional scenario occurred in 2007, when Estonian government and financial Web sites were crippled by a cyber attack during a dispute with Russia. That incident never escalated to this hypothetic level, however: The source of the attack was unclear, physical harm did not occur and Estonia never invoked Article 5.

I'd say that's a lot less than "half" of the scenario. Basically, there was a denial of service attack. It's not good, but it happens, and it's hardly a "war." No power grid was attacked. No one was harmed. People and businesses were certainly inconvenienced, but that's not the same thing. It's not war. But, adding in the hypotheticals, suddenly the "reality" that never happened seems so much closer.

And then there's NPR. It recently ran a whole long article about cyberwar that repeatedly suggests that the way to deal with this is to solve the "attribution problem" so that everyone online can be identified. Privacy? Anonymity? Not important, because of this threat -- even though no one can provide any proof actually exists. The NPR piece uses Mike McConnell as a key source, highlighting (as everyone does) his former public service positions: former director of the National Security Agency and later the director of national intelligence. What NPR leaves out? Oh, that McConnell is now a Vice President at defense contracting giant Booz Allen Hamilton -- a firm that recently scored contracts worth hundreds of millions of dollars around this whole bogus cyber war threat.

Wouldn't you think that a news organization like NPR would at least mention that whopping conflict of interest? It doesn't.

Instead, it lets McConnell go on and on about his favorite idea: re-architecting the internet to get rid of anonymity:

Security experts focus on the "attribution problem" -- the challenge of identifying and tracking down the source of a cyberattack. Under current conditions, cybercrime, cyber-espionage, and cyberattacks can be directed remotely, with the perpetrator's identity and location a secret.

This totally overhypes how much of a problem "attribution" really is. If people want to figure out a way to be anonymous, they'll do so. Worst case, they hijack someone else's line and attack that way. Attribution is not the issue. Having reasonable security is. And that doesn't require taking away anonymity or changing the nature of the internet.

"One side couldn't attack the other side without the side being attacked knowing who it is and from where it came," says retired Vice Adm. Mike McConnell, a former director of the National Security Agency and later the director of national intelligence.

McConnell argues that deterrence is needed to prevent countries today from waging cyberwar on each other. An attack on U.S. computer networks could knock out power grids, telecommunications, transportation and banking systems in a matter of seconds.

Note, yet again, the lack of a mention of his current job. Note also no explanation of why any critical infrastructure would be connected to the internet? Also, there's no mention of how serious this threat really is. After all, we currently do have this so-called "attribution" problem, and based on other fear mongering reports, there are tens of thousands of "cyberwarriors" conducting attacks around the globe. And we haven't heard of a single case of such an attack knocking any of those things offline. Yes, there have been temporary denial of service attacks that blocked some internet sites. But that's not the same thing.

Such an attack could be deterred if the attacking country knew it would bring immediate retaliation. But first it would be necessary to attribute the attack to someone.

"Some level of confidence that you know from where a transaction originated is a requirement," McConnell says.

Except that's not true. In pretty much every case of such hacking/DDoS attempts, people have been pretty quick to figure out where they're really originating from. No one actually seems confused by that -- and, again, if the lack of such attribution means more attacks, why aren't there more attacks now?

McConnell highlighted the "attribution problem" in a recent interview with NPR. He advocates "re-engineering the Internet" to make more transactions there traceable.

"There is a need for investment in technology that would allow you to achieve a level of attribution," McConnell says, "[so you could know] who's engaged in this transaction."

Why? He doesn't say. He just tells NPR so, and NPR says ok. At least NPR quotes a few people are are skeptical of the fix, but no one who questions either the actual size of the problem or why NPR is letting McConnell spin the story for his employer's benefit, without even the most basic level of disclosure.

And, of course, with all this fear mongering going on in the press -- a very high percentage of which you can trace back to McConnell -- Congress is eager to act. It's put together a new "cybersecurity" bill that will give the White House the power to declare a "cyber emergency" and step in and take control over certain "assets." It will also involve creating an "Office of Cyberspace Policy." Yes, we'll soon have a Cyber Czar. I thought we already had an Office of Science and Technology Policy in the White House. We need a separate Cyberspace office too?

Filed Under: cyberterrorism, cyberwar, michael mcconnell, moral panic, politicians
Companies: booz allen

Pushing Cyberwar Moral Panic Apparently Quite Profitable For Booz Allen

from the spreading-fear-for-money dept

A few months ago, people began questioning the difference between reality and rhetoric when it came to the "threat" of "cyberwar." Many of the claims were clearly exaggerated with people purposely confusing script kiddies doing basic vandalism with some sort of organized "war" or threat. One of the folks, who has been given the most attention for playing up this threat, is former director of national intelligence, Michael McConnell, who just happens to have scored a job as a top exec at Booz Allen. So it seems worth noting that Booz Allen has racked up over $400 million in gov't contracts in just the past few weeks. Of course, most of the press that McConnell has been able to get about this issue plays up his former gov't role, but plays down the fact that his new job seems to be scaring the gov't into shoveling truckloads of cash to Booz Allen, no matter how serious the "threat" really is.

Filed Under: cyberterrorism, cyberwar, michael mcconnell, moral panic, politicians
Companies: booz allen

Dear Journalists: There Is No Cyberwar

from the period dept

At the beginning of April, we noted that director of national intelligence, Michael McConnell, who's now consulting for some firms that would profit greatly from a re-architecting of the internet, is going around pushing a ridiculous moral panic about "cyberwar" and how we basically need to break the internet and get rid of all privacy and anonymity. Forget your civil liberties, there's money to be made in scaring people. While even the US "cybersecurity" czar tried to throw some cold water on these claims, the press sure does love bogus "cyberwar" stories, despite the lack of proof that there is any such thing or that it could do any real damage.

It's being helped along, of course, by another former government official, Richard Clarke, who is selling a new book all about "Cyberwar" (in fact, that's the title), leading to all sorts of news stories about how the US is at risk in this "cyberwar."

The problem, of course, is the same as we described back in March: the people playing up the whole "cyberwar" threat are simply lumping together basic vandalism -- the kind done by script kiddies, as if it's part of a war. If that's the definition of a "war," you can find it going on around the country, anywhere there are kids and spray paint. Thankfully, Tom Lee has written a scathing critique of dumb journalistic coverage of this whole "cyberwar" crap:

The piece starts out by discussing Russian vandals' successful efforts to screw with the Georgian government’s website -- something that can be plausibly done by a disaffected teenager -- then jumps rapidly to "monkey[ing] with GPS" which involves, you know, satellites, or at least skill at building, concealing and fortifying radio transmitters; and, if anything other than a braindead denial of service, would also require the discovery of a novel attack on the system's design. These things are much harder than checking to see if the recently-launched website of a small ex-Soviet country is running slightly outdated software that someone else has written an exploit for....

Disrupting the operation of a website is very different from disrupting the operation of the internet, which is very different from interfering with military communication systems, which is very different from interfering with military battlefield communication systems, which is very different from being susceptible to the interception of digital communications. But all of these things are just jammed together, mindlessly.

What kinds of electronic attack are possible? To what extent are our defense systems susceptible to them -- in particular, are those systems at all tangled up with the internet? If not, what economic consequences could plausibly be inflicted on our country by disruption of the internet, and how do they compare to the historical example of, say, a blockade? If an online attack originates from overseas, what countermeasures are available? And do we have a protocol in place with the major backbone operators to implement them?

None of these questions are asked or answered. Blah blah blah cyber. That's it, over and over.

Welcome to the next moral panic that's more about taking away your rights in an attempt to make some ex-politicians rich.

Filed Under: cybersecurity, cyberwar, michael mcconnell, moral panic

Cyberwar Or Moral Panic? Beware Of Ex-Politicians Screaming About Cyberthreats

from the let-it-go dept

For years and years we've been hearing about the supposed threats of "cyberwar" and "cyberterrosism." For nearly a decade we've questioned whether this was all hype, and the story hasn't changed. Sure, there are hackers and those who look to break into systems, but the real risks and overall threats still seem fairly minimal. But that's not enough for some people. Wired's Ryan Singel has a long, but excellent look at how former director of national intelligence (now consultant) Michael McConnell appears to be trying to build up a giant moral panic about this ill-defined threat, with the goal of basically ripping out the guts of today's internet to recreate it with almost no privacy at all. He recently claimed:

We need to re-engineer the Internet to make attribution, geo-location, intelligence analysis and impact assessment -- who did it, from where, why and what was the result -- more manageable

In other words, we need to be able to spy on everyone. To build up this moral panic, McConnell isn't even just getting the press to write articles for him -- he's doing it himself. The Washington Post recently gave him op-ed space to ridiculously claim that the recent hack on Google showed we're "losing the cyberwar." Yet, as Singel points out, that was entirely different. It wasn't warfare, it was espionage. McConnell also played up some bogus threats, such as some old viruses and botnets that are hardly part of some dangerous "cyberwar."

Singel then goes on to connect McConnell's efforts with various other political proposals lately -- suggesting that the government is moving towards more control of the internet and more monitoring. At times, unfortunately, the piece feels like it slips a bit into conspiracy theory territory -- but McConnell's efforts certainly appear questionable. He's pushing a bogus "threat" and he works for a company that could profit tremendously from any "response" to such a threat. That seems like a massive conflict of interest that a lot of people are ignoring.

Filed Under: cyberterrorism, cyberwar, michael mcconnell, moral panic, politicians