“It’s a single point in the system through which all of the content can be collected if they can manage to activate it,” said Edward W. Felten, a computer science professor at Princeton and one of the authors of the report... “That’s a security vulnerability waiting to happen, as if we needed more,” he said.

The US government is waging electronic warfare on a vast scale — so large that it's causing a seismic shift in the unregulated grey markets where hackers and criminals buy and sell security exploits, Reuters reports.

Former White House cybersecurity advisors Howard Schmidt and Richard Clarke say this move to "offensive" cybersecurity has left US companies and average citizens vulnerable, because it relies on the government collecting and exploiting critical vulnerabilities that have not been revealed to software vendors or the public.

"If the US government knows of a vulnerability that can be exploited, under normal circumstances, its first obligation is to tell US users," Clarke told Reuters. "There is supposed to be some mechanism for deciding how they use the information, for offense or defense. But there isn't."

Top U.S. officials told Congress this year that poor Internet security has surpassed terrorism to become the single greatest threat to the country and that better information-sharing on risks is crucial. Yet neither of the two major U.S. initiatives under way - sweeping cybersecurity legislation being weighed by Congress and President Barack Obama's February executive order on the subject - asks defense and intelligence agencies to spread what they know about vulnerabilities to help the private sector defend itself.

When a U.S. agency knows about a vulnerability and does not warn the public, there can be unintended consequences. If malign forces purchase information about or independently discover the same hole, they can use it to cause damage or to launch spying or fraud campaigns before a company like Microsoft has time to develop a patch. Moreover, when the U.S. launches a program containing an exploit, it can be detected and quickly duplicated for use against U.S. interests before any public warning or patch.

Some of Endgame's activities came to light in purloined emails published by hackers acting under the banner Anonymous. In what appear to be marketing slides, the company touted zero-day subscriptions as well as lists of exactly which computers overseas belonged to specific criminal "botnets" - networks of compromised machines that can be mobilized for various purposes, including stealing financial passwords and knocking websites offline with traffic attacks.

The point was not to disinfect the botnet's computers or warn the owners. Instead, Endgame's customers in the intelligence agencies wanted to harvest data from those machines directly or maintain the ability to issue new commands to large segments of the networks, three people close to the company told Reuters.

Few object to what technology companies and the government say they want to do in practice: pool data about the activity patterns of hacker-controlled “botnets,” or the digital signatures of new viruses and other malware. This information poses few risks to the privacy of ordinary users. Yet CISPA didn’t authorize only this kind of narrowly limited information sharing. Instead, it gave companies blanket immunity for feeding the government vaguely-defined “threat indicators” — anything from users’ online habits to the contents of private e-mails — creating a broad loophole in all federal and state privacy laws and even in private contracts and user agreements.

...

There’s no need to share [personally identifiable] data for security purposes anyway: Kevin Mandia, head of the cybersecurity firm Mandiant, insisted at a February hearing on CISPA that in 20 years in the industry, he had “never seen a package of threat intelligence that’s actionable” that included personally identifiable information.

Sanchez suggests some straightforward basic requirements for a cybersecurity bill that might actually get consensus from privacy watchdogs and the broader public: the removal of personal information before data reaches the government, a limited lifespan on the data (CISPA's authors have stated that real-time information sharing to deal with immediate threats is the key point of the bill anyway), and the ability for companies to respect their contracts with customers. As written, CISPA would have exonerated service providers from keeping any promise they made to not share user data. Even a service provider that wanted to offer you the contractual certainty that they would protect your data would have been unable to do so.

The reason for that is a key piece of language that's been drifting around CISPA since the beginning: "notwithstanding any other provision of law." There are lots of bits and pieces to the bill, but that line is the exemption granted to companies that wish to share cyber threat information with the government, and it's incredibly broad, allowing companies to ignore even the contracts they have with their customers.

So why is it there? That's the question nobody seems to want to answer, and that's the real issue with the whole push for cybersecurity legislation. Supposedly, according to the message that has accompanied CISPA and similar bills from the beginning, companies and the government are currently prevented from doing some harmless, common-sense information sharing to improve network security, because existing laws block such sharing. But... what laws? That has never been clear. Why does CISPA need to provide immunity "notwithstanding any other provision of law" rather than simply creating specific exceptions to the specific laws that are causing a problem? Why has nobody in Congress even been able to point out these problematic laws?

Perhaps it's not just one or two laws; perhaps it's a whole cluttered legal framework that can't easily be cleaned up and needs some broad, sweeping exceptions. But... nobody has made that case either. They just keep saying, non-specifically, "existing laws prevent it". And yet we know that's not true, at least to some degree: the FBI has had a system for sharing threat information back and forth with companies for 15 years. Why is that model not sufficient? Again, if there are reasons, nobody in Congress is offering them.

I'd like to say Sanchez's guidelines make an excellent starting point for cybersecurity legislation, but a starting point for legislation has to be a definition of the problem it's trying to solve, and we still don't have that. Nevertheless, they do serve as an excellent set of rules to hold Congress to if it is really so intent on barreling forward blindly. Cybersecurity grandstanders are likely to say that such restrictions would gut the legislation. Whether that's ignorance, cognitive dissonance or a tacit admission of dishonesty I'm not sure, but the restrictions suggested by Sanchez, the EFF, the ACLU and others would do nothing to hinder CISPA's stated and largely innocuous purpose — they would only interfere with the other much scarier potential uses that Congress insists aren't going to happen.

The longer Congress offers only the vaguest of vague definitions of the problem it's trying to solve, while at the same time seeming to betray even that vague definition with its response to suggested safeguards and restrictions, the harder it gets to afford them even one iota of trust on the subject of cybersecurity.

[A] new coalition of special interests, which include America's two largest cellular service providers AT&T, Inc. and Verizon Wireless -- jointly owned by Verizon Communications Inc. and Vodafone Group Plc. -- as well as two of the nation's largest software firms Microsoft Corp. and Intel Corp., came together to create a similar data grab bill (Microsoft has since renounced its support). Security firms like Symantec Corp. also backed the bill.

Pushing the bill through was $84M USD in funding from special interest backers.

New co-sponsors have received 38 times as much money ($7,626,081) from interests supporting CISPA than from interests opposing ($200,362).

Members of the House in total have received 16 times as much money ($67,665,694) from interests supporting CISPA than from interests opposing ($4,164,596).

In the latest round of changes to CISPA, the House passed a new amendment that supposedly (according to CISPA supporters) addresses the privacy and civil liberty concerns about the bill. The amendment (pdf and embedded below) ostensibly establishes civilian agency control (through Homeland Security) over information shared under CISPA, since many people are reasonably worried about all this data ending up in the hands of the NSA. Unfortunately, as the EFF determined in their initial analysis, it doesn't really change anything—it just lets the DHS go along for the ride:

The amendment in question does not strike or amend the part of CISPA that actually deals with data flowing from companies to other entitities, including the federal government. The bill still says that: “Notwithstanding any other provision of law, a self-protected entity may, for cybersecurity purposes...share such cyber threat information with any other entity, including the Federal Government." The liability immunity provisions also remain.

While this amendment does change a few things about how that information is treated within the government, it does not amend the primary sharing section of the bill and thus would not prevent companies from sharing data directly with military intelligence agencies like the National Security Agency if they so choose.

Indeed, the text of the amendment appears to create a significant role for the DHS in information sharing procedures, but gives it little power in terms of actually protecting privacy or filtering information—the amendment mandates that information still be shared with other agencies in realtime, and it still appears to allow companies and organizations to bypass the DHS entirely.

A portion of the amendment outlines certain privacy guidelines, but they are the same as those we discussed before: filled with enough release valves and escape routes to render them virtually meaningless, closer to a list of "best practices" than actual rules. The fact is that, despite what the bill's supporters and some of the media reporting on it would have you believe, the core problems with CISPA have not been addressed, nor have any of the "efforts" in that direction amounted to much more than a smokescreen. With a final CISPA vote looming at any time, it's never been more important to voice your opposition to the bill.

1. The FISA Amendments Act, which was passed in association with the Patriot Act, supposedly to give the NSA more powers to scoop up communications of folks involved in terrorist activity. Now, the NSA is -- by mandate -- not allowed to spy on Americans. And yet, multiple whistleblowers and hints from folks who know in Congress have made it quite clear that the NSA has interpreted the FISA Amendments Act to allow exactly that -- even as many in Congress clearly don't understand how the bill is being used.
   
   While it's still not official, enough information has been revealed to show that the NSA interprets the requirement that its surveillance target foreign persons to mean that as long as it's looking for foreign terrorist activity, it can spy on everyone. Get that? It's a sneaky trick that many have not realized. The NSA argues -- likely with agreement from a secret court ruling -- that so long as it can claim that it is investigating a foreign threat somewhere, somehow, the prohibition on spying on Americans does not apply. There is increasing evidence that this now means that the NSA is scooping up pretty much all data it can get its hands on. While it may not be going through it in real time, it appears to believe that as long as it can make the argument that it's searching for a foreign threat, that it can delve into that treasure chest of, well, everything.
   
   
2. Next: the "national security letters" (NSL) issue. While a court recently ruled these unconstitutional, this process has been widely abused by the FBI for years to get private information on people without a warrant and with a gag order on recipients. Every time it's been investigated, it's been shown that the FBI has widely abused its NSL powers. However, since there's almost no oversight, the FBI still feels free to make widespread use of the tool, which was only supposed to be used in extreme circumstances.
   
   Along those lines, the FBI has gotten so comfortable with asking companies for data without a warrant or any formal oversight process, that it was revealed a few years ago that, rather than going through the drudge of actually processing paperwork to get private info from AT&T, some agents simply used Post-It Notes to make their requests, which AT&T readily coughed up without question.

Polis: Why wouldn't it work to leave it up, getting back to the contract part, and I think again there may be a series of amendments to do this, if a company feels, if it's voluntary for companies, why not allow them the discretion to enter into agreements with their customers that would allow them to share the information? ...

Rogers: I think those companies should make those choices on their own. They develop their own contracts. I think they should develop their own contracts. They should enforce their own contracts in the way they do now in civil law. I don't know why we want to get in that business.

According to the Privacy Rights Clearinghouse, the loss or improper disposal of paper records, portable devices like laptops or memory sticks, and desktop computers have accounted for more than 1,400 data-breach incidents since 2005 -- almost half of all the incidents reported. More than 180,000,000 individual records were compromised in these breaches...

It is the hacker -- a sort of modern folk devil who personifies our anxieties about technology -- who gets all the attention. The result is a set of increasingly paranoid and restrictive laws and regulations affecting our abilities to communicate freely and privately online, to use and control our own technology, and which puts users at risk for overzealous prosecutions and invasive electronic search and seizure practices. The Computer Fraud and Abuse Act, the cornerstone of domestic computer-crime legislation, is overly broad and poorly defined. Since its passage in 1986, it has created a pile of confused caselaw and overzealous prosecutions.

Many members of the American public are already convinced something should be done about hackers. Many of our representatives feel the same way. A lack of knowledge of the underlying technology, much less the methods or culture, hasn't deterred legislators from crafting an overbroad response with the CISPA bill. Examining the issues more closely or reconsidering the legislation doesn't seem to be an option. After all, a "cyber Pearl Harbor" is all but inevitable, a conclusion confirmed by shouting "HACKER!" in the halls of Congress and hearing it echoed back by like-minded representatives, sympathetich government agencies, the media and a subset of the American public.

In the effort to protect society and the state from the ravages of this imagined hacker, the US government has adopted overbroad, vaguely worded laws and regulations which severely undermine internet freedom and threaten the Internet's role as a place of political and creative expression.

Both government and private companies need cyber threat information to allow them to identify, prevent, and respond to malicious activity that can disrupt networks and could potentially damage critical infrastructure. The Administration believes that carefully updating laws to facilitate cybersecurity information sharing is one of several legislative changes essential to protect individuals' privacy and improve the Nation's cybersecurity. While there is bipartisan consensus on the need for such legislation, it should adhere to the following priorities: (1) carefully safeguard privacy and civil liberties; (2) preserve the long-standing, respective roles and missions of civilian and intelligence agencies; and (3) provide for appropriate sharing with targeted liability protections.

The Administration recognizes and appreciates that the House Permanent Select Committee on Intelligence (HPSCI) adopted several amendments to H.R. 624 in an effort to incorporate the Administration's important substantive concerns. However, the Administration still seeks additional improvements and if the bill, as currently crafted, were presented to the President, his senior advisors would recommend that he veto the bill. The Administration seeks to build upon the continuing dialogue with the HPSCI and stands ready to work with members of Congress to incorporate our core priorities to produce cybersecurity information sharing legislation that addresses these critical issues.

Nearly 200 senior IBM executives are flying into Washington to press for the passage of a controversial cybersecurity bill that will come up for a vote in the House this week.

The IBM executives will pound the pavement on Capitol Hill Monday and Tuesday, holding nearly 300 meetings with lawmakers and staff. Over the course of those two days, their mission is to convince lawmakers to back a bill that’s intended to make it easier for industry and government to share information about cyber threats with each other in real time.

[IBM VP of government affairs Chris] Padilla, however, says companies need to be able to share threat data directly with the NSA “because that’s where the expertise is.”

“It really is a simple matter. The expertise in the U.S. government on cybersecurity largely rests in one place, and that's the National Security Agency,” he said. “They tend to know the most, the soonest about cyber threats and I think, frankly, there is a certain amount of feeling in the business community that you should be able to work directly and share information directly with the agency that has the most expertise.”

We continue to believe that information sharing improvements are essential to effective legislation, but they must include privacy and civil liberties protections, reinforce the roles of civilian and intelligence agencies, and include targeted liability protections. The Administration seeks to build upon the productive dialogue with Chairman Rogers and Ranking Member Ruppersberger over the last several months, and the Administration looks forward to continuing to work with them to ensure that any cybersecurity legislation reflects these principles. Further, we believe the adopted committee amendments reflect a good faith-effort to incorporate some of the Administration's important substantive concerns, but we do not believe these changes have addressed some outstanding fundamental priorities.

Though it doesn't raise the possibility of a veto, and even avoids explicitly taking a position of support or opposition, it serves as a fairly clear indication that the administration will not be supporting CISPA. Nevertheless, it's a little disappointing in its meekness.

Whenever someone spends that many words acknowledging the "good faith" of their opponent and boasting about "productive dialogue", it's a good sign that neither of those things are true. As we noted earlier, the amendments that were adopted during markup do not just fail to address the issues, they raise serious questions about just how much "good faith" has really been involved in this debate on the side of those who are pushing for the legislation. The dialogue, much like the one with CISPA last year, tends to go a lot like this:

Opponents: We are concerned that the bill will be abused in the following ways...
Supporters: No, we're not going to do those things.
Opponents: Good, but the language still makes it a possibility. You should re-write it to be more clear.
Supporters: Okay, we've rewritten it with a more detailed list of restrictions and exceptions.
Opponents: But these exceptions are all for exactly the things we were worried about in the first place.
Supporters: Sure, but we're not going to do those things.

The truth is, there's little evidence of any real effort to address the concerns of privacy and civil liberties advocates, the administration, or the general public. The markup session in which the final changes were adopted was closed to the public, and the responses from the bill's supporters when pressed on these issues have been somewhat less than comforting. Moreover, we shouldn't even be in the final stages of drafting legislation to solve a problem that nobody has clearly described in the first place. It's good that the White House is not giving CISPA any support, but here's hoping they go a step further and make their opposition to this whole broken approach to cybersecurity legislation explicit.

CISPA is expected to go to the full house for a vote next week. As we get a closer look at the bill in its latest state, we'll do a more detailed analysis — but as it stands there's little reason to believe that any of the core problems have been fixed (and we're still waiting for someone to explain in clear, specific terms why this bill is needed at all).

The 27 largest U.S. companies reporting cyber attacks say they sustained no major financial losses, exposing a disconnect with federal officials who say billions of dollars in corporate secrets are being stolen.

MetLife Inc., Coca-Cola Co. (KO), and Honeywell International Inc. were among the 100 largest U.S. companies by revenue to disclose online attacks in recent filings with the Securities and Exchange Commission, according to data compiled by Bloomberg. Citigroup Inc. (C) reported “limited losses” while the others said there was no material impact.

Under the program, critical infrastructure companies will pay the providers, which will use the classified information to block attacks before they reach the customers. The classified information involves suspect Web addresses, strings of characters, email sender names and the like.

One question we sometimes get is: Under CISPA, which government agencies can receive this data? For example, could the FBI, NSA, or Immigration and Customs Enforcement receive data if CISPA were to pass?

The answer is yes. Any government agency could receive data from companies if this were to pass, meaning identifiable data could be flowing to the Bureau of Alcohol, Tobacco, Firearms and Explosives, the National Security Agency, or even the Food and Drug Administration.

Whoever conspires to commit or attempts to commit an offense under subsection (a) of this section shall be punished as provided for the completed offense in subsection (c) of this section.

• Eviscerating existing privacy laws by giving overly broad legal immunity to companies who share users' private information, including the content of communications, with the government.
• Authorizing companies to disclose users' data directly to the NSA, a military agency that operates secretly and without public accountability.
• Broad definitions that allow users' sensitive personal information to be used for a range of purposes, including for "national security," not just computer and network security.

The idea is known as "active defense" to some, "strike-back" capability to others and "counter measures" to still more experts in the burgeoning cybersecurity field. Whatever the name, the idea is this: Don't just erect walls to prevent cyberattacks, make it more difficult for hackers to climb into your systems — and pursue aggressively those who do.

Some of those fears have reached Rep. Mike Rogers (R-Mich.), chairman of the chamber's Intelligence Committee and one of CISPA's lead authors. In fact, panel aides told POLITICO they're open to revising the relevant definitions in the bill. And Rogers himself this year has railed on the idea of an aggressive active defense, describing it as a "disaster for us" at a time when the country's digital defenses remain subpar.