<?xml version="1.0" encoding="utf-8"?>
<rss version="2.0"
xmlns:dc="http://purl.org/dc/elements/1.1/"
xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
xmlns:wfw="http://wellformedweb.org/CommentAPI/">
<channel>
<title>Techdirt. Stories filed under &quot;cyberattacks&quot;</title>
<description>Easily digestible tech news...</description>
<link>http://www.techdirt.com/</link>
<language>en-us</language>
<image><title>Techdirt. Stories filed under &quot;cyberattacks&quot;</title><url>http://www.techdirt.com/images/td-88x31.gif</url><link>http://www.techdirt.com/</link></image>
<item>
<pubDate>Mon, 15 Apr 2013 11:59:22 PDT</pubDate>
<title>IBM Sends 200 Execs To Capitol Hill To Demand The Right To Send Your Private Info To The NSA</title>
<dc:creator>Mike Masnick</dc:creator>
<link>http://www.techdirt.com/articles/20130415/11401222711/ibm-sends-200-execs-to-swarm-capital-hill-demand-right-to-send-your-private-info-to-nsa.shtml</link>
<guid>http://www.techdirt.com/articles/20130415/11401222711/ibm-sends-200-execs-to-swarm-capital-hill-demand-right-to-send-your-private-info-to-nsa.shtml</guid>
<description><![CDATA[ We've talked about various tech companies <a href="https://www.techdirt.com/articles/20130411/15571022683/shameful-tech-companies-fighting-against-necessary-cfaa-reform-cispa-fixes.shtml">supporting CISPA</a>, which is really shameful and short-sighted.  Yes, it protects them from liability if they trample all over your privacy and provide your private info to the government -- which is why they support it.  But if they were truly customer focused companies, they would know that violating your privacy is no way to build a loyal customer base.  And, apparently, the right to violate your privacy and hand that info to the government is so important to IBM that it has <a href="http://thehill.com/blogs/hillicon-valley/technology/293715-ibm-launching-cispa-advocacy-tour" target="_blank">sent 200 executives to Capital Hill today to lobby in favor of passing CISPA</a>.  CISPA is expected to go to a floor vote in the House either this Wednesday or Thursday.
<blockquote><i>
Nearly 200 senior IBM executives are flying into Washington to press for the passage of a controversial cybersecurity bill that will come up for a vote in the House this week.
<br /><br />
The IBM executives will pound the pavement on Capitol Hill Monday and Tuesday, holding nearly 300 meetings with lawmakers and staff. Over the course of those two days, their mission is to convince lawmakers to back a bill that&#8217;s intended to make it easier for industry and government to share information about cyber threats with each other in real time.
</i></blockquote>
What they still can't explain is what laws <i>currently</i> get in the way of this information sharing?  We've been asking for years and <b>no one</b> has answered.  Everyone agrees that information sharing around an attack can be useful in stopping it, but no one has explained why that information sharing (a) requires a new law or (b) can't be done without wiping out <b>all</b> basic privacy protections for personal info currently provided under existing law.
<br /><br />
Even more ridiculous is that IBM <b>flat out admits</b> that they want to be able to send your info to the NSA.  We've pointed out for a while that one of the major concerns with CISPA is that the NSA -- a military agency -- would get access to your info, despite the general prohibition on spying on Americans.  Of course, the NSA has <a href="http://www.techdirt.com/articles/20120821/16141120116/how-random-lawsuit-about-telco-policy-probably-resulted-broad-secret-law-enabling-nsa-to-spy-you.shtml">twisted</a> that mandate ridiculously, such that it believes it can now spy on <a href="http://www.techdirt.com/articles/20120827/12503920170/nsa-whistleblower-explains-how-nsa-is-collecting-data-all-you-hes-sorry-about-it.shtml"><i>anything</i></a> so long as they claim it may <a href="http://www.techdirt.com/articles/20120913/23182420380/house-approves-bill-to-spy-americans-misrepresenting-lying-about-whats-bill.shtml">help</a> them in finding a foreign threat.  Technically, the law is about the "target" of the information, and the NSA (and potentially the secret ruling from the FISA Court) has interpreted this to mean that as long as the target of the <i>investigation</i> is as foreign threat, then the NSA can snoop through anything in pursuit of that target.
<br /><br />
Of course, most folks have been trying to <i>play down</i> the fact that the NSA would get the info.  But not IBM.  Nope, they're thrilled to send your private info right to the NSA:
<blockquote><i>
[IBM VP of government affairs Chris] Padilla, however, says companies need to be able to share threat data directly with the NSA &#8220;because that&#8217;s where the expertise is.&#8221;
<br /><br />
&#8220;It really is a simple matter. The expertise in the U.S. government on cybersecurity largely rests in one place, and that's the National Security Agency,&#8221; he said. &#8220;They tend to know the most, the soonest about cyber threats and I think, frankly, there is a certain amount of feeling in the business community that you should be able to work directly and share information directly with the agency that has the most expertise.&#8221;
</i></blockquote>
While the NSA does have <i>some</i> knowledge on cybersecurity, it's an exaggeration to suggest that they have "the expertise" on the subject.  It also does nothing to explain why your private info should be included.<br /><br /><a href="http://www.techdirt.com/articles/20130415/11401222711/ibm-sends-200-execs-to-swarm-capital-hill-demand-right-to-send-your-private-info-to-nsa.shtml">Permalink</a> | <a href="http://www.techdirt.com/articles/20130415/11401222711/ibm-sends-200-execs-to-swarm-capital-hill-demand-right-to-send-your-private-info-to-nsa.shtml#comments">Comments</a> | <a href="http://www.techdirt.com/articles/20130415/11401222711/ibm-sends-200-execs-to-swarm-capital-hill-demand-right-to-send-your-private-info-to-nsa.shtml?op=sharethis">Email This Story</a><br />
 ]]></description>
<slash:department>nice-one,-guys</slash:department>
<wfw:commentRss>http://www.techdirt.com/comment_rss.php?sid=20130415/11401222711</wfw:commentRss>
</item>
<item>
<pubDate>Thu, 14 Feb 2013 10:58:30 PST</pubDate>
<title>CISPA Wouldn't Actually Solve The Reasons Congress Is Giving For Why We Need CISPA</title>
<dc:creator>Mike Masnick</dc:creator>
<link>http://www.techdirt.com/articles/20130214/02084321967/why-wont-anyone-explain-why-we-need-cispa.shtml</link>
<guid>http://www.techdirt.com/articles/20130214/02084321967/why-wont-anyone-explain-why-we-need-cispa.shtml</guid>
<description><![CDATA[ As <a href="http://www.techdirt.com/articles/20130212/02540821948/despite-protests-congress-to-bring-back-cispa-exactly-as-it-was-last-year-while-obama-signs-exec-order.shtml">expected</a>, Representatives Mike Rogers and Dutch Ruppersberger have <a href="https://www.eff.org/deeplinks/2013/02/cispa-privacy-invading-cybersecurity-spying-bill-back-congress" target="_blank">reintroduced CISPA</a>, exactly as it was when it passed the House last year.  Incredibly, we've been hearing that they've brushed off the massive privacy concerns by claiming that those were all "fixed" in the final version of the bill that got approved.  This is highly disingenuous.  While it is true that they made some modifications to the bill at the very end before it got approved, most privacy watchers were (and are) still very concerned.  They did convince one organization to flip-flop, and they seem to think that's all they need.
<br /><br />
But, here's the thing that no one has done yet: explain why this bill is needed.  With President Obama's <a href="http://www.techdirt.com/articles/20130213/10460421964/cybersecurity-executive-order-actually-respects-some-privacy-so-do-we-actually-need-cispa-any-more.shtml">executive order</a> in place, the government can more easily share threat info with companies, so really the only thing that CISPA piles on is more incentives for companies to cough up private information to the government with little in the way of oversight or restrictions on how that information can be used.  And given how frequently the government likes to cry "cyberattack" when it's simply not true, it's only a matter of time before they start using claims of "cyberthreat!" to troll through private information.
<br /><br />
And they still refuse to explain why this is needed.  We hear lots of scare stories, but no explanation for <i>how this bill helps</i>.  For example, Ruppersberger has written up an oped for the Baltimore Sun in which he <a href="http://www.baltimoresun.com/news/opinion/oped/bs-ed-cybersecurity-20130212,0,5471804.story" target="_blank">lays out the reasons we need CISPA</a>, but it's all scare stories, without a single explanation for how CISPA would help.  And that's because it wouldn't.
<blockquote><i>
March: Hackers allegedly steal the credit card numbers from 1.5 million Visa and MasterCard customers by breaking into the computer systems of the company's payment processor in New York. The thieves stockpiled the stolen credit card numbers for months before beginning to use them.
</i></blockquote>
Payment processors already have some of the best security people in the world and have a large and widespread community of folks who do nothing but think about <a href="http://www.pcicomplianceguide.org/pcifaqs.php" target="_blank">security issues</a> for this industry.  At what point would that lead the payment processor or Visa or Mastercard to need to hand information over to the government?
<blockquote><i>
August: Cyber attackers disrupt production from Saudi Aramco, the world's largest exporter of crude oil, taking out 30,000 computers in the process, according to press reports.
</i></blockquote>
Saudi Aramco is a Saudi Arabian company.  Not sure why they would be sharing info with the US government or how CISPA would relate to them at all.
<blockquote><i>
January: PNC Bank announces to its 5 million customers that its website is getting hit with high traffic consistent of a cyber attack meant to delay business with its online banking customers.
</i></blockquote>
Again, why would PNC need to give information to the government?  And, if they could alert their customers to the threat, they can also alert the government.  None of that requires the ability to share customer info.
<blockquote><i>
These are just three reported examples of cyber attacks in the past 12 months. Each could have had a devastating impact on the U.S. and global economies. That's more than a bad dream &#8212; that's a full-blown nightmare.
</i></blockquote>
These are just three scare stories of cyber attacks in the past 12 months, none of which would have been impacted by CISPA.  So why do we need it again?
<blockquote><i>
Highly trained Chinese, Russian and Iranian hackers are probing, pilfering and plotting every second of every day. They're often after personal data: In November, reports suggested a hacker was able to access nearly 4 million tax returns in South Carolina with a single malicious email. And they're often after the trade secrets of our companies: The media has reported that Coca-Cola may have fallen victim to hackers from a Chinese beverage company.
</i></blockquote>
Again, what does any of that have to do with CISPA?
<blockquote><i>
Many believe that what is happening to American business may be the largest transfer of wealth in the history of the world. It's costing our companies billions of dollars, and it's costing our country thousands of jobs.
</i></blockquote>
Many believe that's pure hogwash.  It's not the largest transfer of wealth in the history of the world.  It's not costing companies billions of dollars and it's certainly not costing our country thousands of jobs.
<blockquote><i>
Preventing the U.S. government from sharing information about malicious computer code it detects is akin to preventing forecasters from warning citizens about a hurricane.
</i></blockquote>
Except the government <i>already</i> could share a lot of information, and with the executive order can now share more.  So why do we need CISPA?
<blockquote><i>
Our legislation doesn't just protect companies. It will also protect every American citizen who, for example, uses electricity or banks online, or whose doctor compiles medical records electronically.
</i></blockquote>
How?  It's a serious question.  You can talk about all of these hacks, and you can say "yay, cybersecurity bill!" but if you don't explain specifically how that bill does anything to actually stop those attacks or to protect Americans, you're full of it.
<blockquote><i>
It's important to note that under my legislation, your private information will also be kept private from the government. Information-sharing between companies and the government will be entirely voluntary. Businesses do not have to share information with the government in order to receive information from the government. The bill does not authorize the government to monitor your computer or read your email, Tweets or Facebook posts. Nor does it authorize the government to shut down websites or require companies to turn over personal information.
</i></blockquote>
The first sentence is simply not true.  Your private information <i>can</i> be shared with the government, so to say that it absolutely will be kept private is simply wrong.  The second and third sentences are misleading.  Yes, the information sharing is "voluntary" but since there are broad immunity exemptions, if the government is coming to most companies and saying "share this info for cybersecurity reasons, and you can't get sued for doing so," how many companies are going to stand up to the government and say no?  There may be a very small number, but for the most part, companies will hand over the info.  The fourth and fifth sentences are simply meaningless, because they are unrelated to the legitimate privacy concerns raised.
<br /><br />
Once again, we're left in the same boat as before.  Lots of scare stories <b>but no explanation</b> of why CISPA is needed or how it actually helps.  The whole thing is just way too broad, with vague justifications that simply don't make much sense when you look at the actual threats compared to what the bill would allow.<br /><br /><a href="http://www.techdirt.com/articles/20130214/02084321967/why-wont-anyone-explain-why-we-need-cispa.shtml">Permalink</a> | <a href="http://www.techdirt.com/articles/20130214/02084321967/why-wont-anyone-explain-why-we-need-cispa.shtml#comments">Comments</a> | <a href="http://www.techdirt.com/articles/20130214/02084321967/why-wont-anyone-explain-why-we-need-cispa.shtml?op=sharethis">Email This Story</a><br />
 ]]></description>
<slash:department>it's-the-little-things...</slash:department>
<wfw:commentRss>http://www.techdirt.com/comment_rss.php?sid=20130214/02084321967</wfw:commentRss>
</item>
<item>
<pubDate>Mon, 4 Feb 2013 10:53:46 PST</pubDate>
<title>White House Declares It Has 'Broad Powers' When It Comes To Cyberattacks</title>
<dc:creator>Mike Masnick</dc:creator>
<link>http://www.techdirt.com/articles/20130203/21581921871/white-house-declares-it-has-broad-powers-when-it-comes-to-cyberattacks.shtml</link>
<guid>http://www.techdirt.com/articles/20130203/21581921871/white-house-declares-it-has-broad-powers-when-it-comes-to-cyberattacks.shtml</guid>
<description><![CDATA[ In a bit of news that will shock just about no one, the Obama administration did a legal review over what it's allowed to do in making use of "cyberweapons," and concluded <a href="http://mobile.nytimes.com/2013/02/04/us/broad-powers-seen-for-obama-in-cyberstrikes.xml" target="_blank">that it has "broad powers" to do all sorts of stuff</a>.  The specifics, of course, will remain classified:
<blockquote><i>
That decision is among several reached in recent months as the administration moves, in the next few weeks, to approve the nation's first rules for how the military can defend, or retaliate, against a major cyberattack. New policies will also govern how the intelligence agencies can carry out searches of faraway computer networks for signs of potential attacks on the United States and, if the president approves, attack adversaries by injecting them with destructive code - even if there is no declared war.
</i></blockquote>
Comforting, huh?  And, by comforting, I mean "terrifying."  While we've already talked a few times about the US <a href="http://www.techdirt.com/articles/20130123/08103221763/cyber-war-one-sided-battle-against-trumped-up-enemy.shtml">using</a> "cyber weapons" against Iran (hello Stuxnet, Flame, etc.) this NY Times report suggests that the White House is being freed up to do much more, though one "concession" is that the use of such tools must be approved by the President, rather than allowing various agencies (Defense Department, mainly) to run off and starting attacking others electronically without first getting it approved by the President.
<br /><br />
In the meantime, this looks like yet another case of the White House not minding leaks that <a href="http://www.techdirt.com/articles/20120601/16020419176/if-youre-going-to-leak-classified-info-about-white-house-it-better-make-them-look-good.shtml">make it look good</a>.  As we've noted, whenever there are leaks that <i>embarrass</i> the White House, they come down like a ton of bricks on whoever did the leaking as being guilty of <i>espionage</i>.  But when the White House itself leaks information about how awesome and powerful they themselves are, no one ever seems to get arrested.<br /><br /><a href="http://www.techdirt.com/articles/20130203/21581921871/white-house-declares-it-has-broad-powers-when-it-comes-to-cyberattacks.shtml">Permalink</a> | <a href="http://www.techdirt.com/articles/20130203/21581921871/white-house-declares-it-has-broad-powers-when-it-comes-to-cyberattacks.shtml#comments">Comments</a> | <a href="http://www.techdirt.com/articles/20130203/21581921871/white-house-declares-it-has-broad-powers-when-it-comes-to-cyberattacks.shtml?op=sharethis">Email This Story</a><br />
 ]]></description>
<slash:department>well,-of-course</slash:department>
<wfw:commentRss>http://www.techdirt.com/comment_rss.php?sid=20130203/21581921871</wfw:commentRss>
</item>
<item>
<pubDate>Fri, 18 Jan 2008 19:33:00 PST</pubDate>
<title>CIA Claims Cyberattacks At Fault In Blackouts</title>
<dc:creator>Mike Masnick</dc:creator>
<link>http://www.techdirt.com/articles/20080118/181113.shtml</link>
<guid>http://www.techdirt.com/articles/20080118/181113.shtml</guid>
<description><![CDATA[ A few years back, after a major blackout hit the northeast, many people immediately assumed that it had something to do with a terrorist attack on the electricity system or perhaps a computer worm/cyber attack.  It turned out to be neither, but it wasn't that surprising that people jumped to that conclusion.  However, afterwards, people began discussing how likely it was that a cyberattack really could take out the power grid for a city, and some people felt that it was fairly unlikely to occur.  The CIA, apparently, would disagree.  Late Friday, a CIA official claimed that <a href="http://www.informationweek.com/management/showArticle.jhtml?articleID=205901631&#038;cid=RSSfeed_TechWeb">cyberattacks have been to blame</a> for certain blackouts over the past few years, and that the agency had debated whether or not to release that information publicly.  Of course, without much in the way of detail, it's difficult to have any sense of what's actually happening here and how accurate the information really is.  However, we will repeat what we said after that huge blackout: even if it was a cyberattack, <a href="http://www.techdirt.com/articles/20030815/0014248.shtml">it wasn't particularly damaging</a>.  Yes, it was an inconvenience.  And, yes, it was annoying, and some businesses were temporarily hurt due to the blackout.  But, compared to other types of attacks, shutting off the power certainly seems relatively minor.<br /><br /><a href="http://www.techdirt.com/articles/20080118/181113.shtml">Permalink</a> | <a href="http://www.techdirt.com/articles/20080118/181113.shtml#comments">Comments</a> | <a href="http://www.techdirt.com/articles/20080118/181113.shtml?op=sharethis">Email This Story</a><br />
 ]]></description>
<slash:department>now-they-tell-us</slash:department>
<wfw:commentRss>http://www.techdirt.com/comment_rss.php?sid=20080118/181113</wfw:commentRss>
</item>
</channel>
</rss>