Obama Talks Toxic Clouds And Runaway Trains, But The Real Cybersecurity Solution Is Still Simple And Obvious

from the and-what's-blocking-that-now? dept

Even as we’re encouraged by the direction of the latest cybersecurity bill (with significant caveats), lots of folks have been asking from the beginning for two things: an end to “Hollywood-style” FUD claims of planes falling from the skies, and a clear statement on what existing laws make the kind of information sharing the government desires impossible today. President Barack Obama took to the Wall Street Journal Op-Ed pages today to explain why we need cybersecurity legislation… and unfortunately he failed on both accounts. The opening part is positively cinematic:

Last month I convened an emergency meeting of my cabinet and top homeland security, intelligence and defense officials. Across the country trains had derailed, including one carrying industrial chemicals that exploded into a toxic cloud. Water treatment plants in several states had shut down, contaminating drinking water and causing Americans to fall ill.

Our nation, it appeared, was under cyber attack. Unknown hackers, perhaps a world away, had inserted malicious software into the computer networks of private-sector companies that operate most of our transportation, water and other critical infrastructure systems.

He goes on to point out that some of the things mentioned have “already happened,” except that’s not quite true. It is true that some hackers accessed systems they shouldn’t have had access to, but it’s not clear if they were ever able to actually do any damage. Here’s Obama’s summary of the details:

Last year, a water plant in Texas disconnected its control system from the Internet after a hacker posted pictures of the facility’s internal controls. More recently, hackers penetrated the networks of companies that operate our natural-gas pipelines

What’s amusing is that the story in Texas came about because a hacker was trying to show that the feds were ignoring and downplaying threats to critical infrastructure. From the details, it looks like the system was vulnerable because of poor password choices, and the stupid decision to connect the system to the internet. So the fact is that “disconnect its control system from the Internet” is the solution. Not more laws. Meanwhile, the story about targeting natural-gas pipelines involved some basic social engineering (spear phishing) rather than any technical hackery. In both cases, the issue appears to be the same: critical infrastructure like that which controls the functioning of water treatment plants and gas pipelines shouldn’t be connected to the internet.

But do we need a 211-page law to share information just to recognize that?

The bigger problem is that while the President’s Op-Ed highlights how we want to avoid the cinematic story he tells at the beginning, where it fails is that it never explains why the kind of information sharing he’s talking about is blocked today. Which rules and regulations are blocking that from happening? No one seems to want to say. Instead, we get legislation that just assumes there must be regulations blocking information sharing and wipes them all away.

We appreciate that Obama says that he’ll veto any bill that doesn’t include strong privacy and civil liberties protections, but we should never be passing legislation based on made up scary stories.

Filed Under: , , , , , ,

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “Obama Talks Toxic Clouds And Runaway Trains, But The Real Cybersecurity Solution Is Still Simple And Obvious”

Subscribe: RSS Leave a comment
31 Comments
Eric Jaffa (profile) says:

The bill will be used against whistleblowers.

==============
The Cybersecurity Act of 2012

SEC. 702. VOLUNTARY DISCLOSURE OF CYBERSECURITY
THREAT INDICATORS AMONG PRIVATE ENTI3
TIES.
(a) AUTHORITY TO DISCLOSE.? Notwithstanding any
other provision of law, any private entity may disclose law
fully obtained cybersecurity threat indicators to any other
private entity in accordance with this section.
==============

A newspaper publishes a story about illegal activity by a corporation. Then the corporation can contact the email-provider of the journalist who wrote the story, and say the information in the article was based on unauthorized computer access, and therefore they need to read the journalist’s emails to find out who contacted him. Then the corporation can fire the whistleblower and may even press charges against the whistleblower.

The law removes all privacy protection with the phrase “Notwithstanding any
other provision of law.” Emails, passwords, and medical records can all be distributed under it without the users permission, and without the user ever being told.

Anonymous Coward says:

And yet, the legislation Obama endorses STILL does not require businesses of any kind to do anything to improve their cyber security to protect themselves from cyber attacks. All it does is lay out some voluntary guide lines.

Can anyone who thinks we NEED CISPA or something like it explain how CISPA can protect our electric companies and other critical infrastructure from cyber attacks if private businesses running said critical infrastructure are allowed to continue to leave access to the nations power grid and other stuff accessible on the Internet with zero password protection or other basic security measures?

Without requirements that businesses must follow to protect themselves from cyber attacks the whole thing is just for show to make politicians look like they’re doing SOMETHING and taking a security issue seriously.

Anonymous Coward says:

I read all of the comments for the presidents OpEd piece.
Nearly all were condemnation of Obama’s hidden agenda, critical thinking ability and past record.

And then I realized, the target audience is typically (Not always, I know.) well read, educated and better than average awareness of national issues. These were the majority of those lambasting him for a shallow diatribe on how the US needs to enforce cyber security.

I am not really clear on what the president is trying to accomplish. To be honest, I do not trust him and that affects my view of him and his motives.

Anonymous Coward says:

“Last month I convened an emergency meeting of myLast month I convened an emergency meeting of my cabinet and top homeland security, intelligence and defense officials. Across the country trains had derailed, including one carrying industrial chemicals that exploded into a toxic cloud. Water treatment plants in several states had shut down, contaminating drinking water and causing Americans to fall ill. . Across the country trains had derailed, including one carrying industrial chemicals that exploded into a toxic cloud. Water treatment plants in several states had shut down, contaminating drinking water and causing Americans to fall ill.”

Should have been followed by:

“I then fired my cabinet and top homeland security, intelligence and defense officials for being stupid enough to allow anyone to connect this shit to the fucking Internet.”

Anonymous Coward says:

Re: Re:

This should not have surprised anyone after I fired my fast and scurious AG, told the DoJ/ICE to stop whoring themselves for their music and movie pals, that civil liability is not criminal, but that laundering money for terrorists is, and sent them all to go put cuffs on some banksters.

Great things Obama will never say #2

alternatives() says:

3 big cyberattacks

the story about targeting natural-gas pipelines involved some basic social engineering (spear phishing) rather than any technical hackery.

Perhaps the US Government understands what is possible because it is alleged to be behind 3 of the biggest attacks?

Gas Pipeline – http://www.zdnet.com/us-software-blew-up-russian-gas-pipeline-3039147917/
Software supplied to run a Russian pipeline was deliberately planned to go haywire, causing the biggest non-nuclear explosion the world had ever seen, says a book published today

Then you have Stuxnet and Flame – both have had parties claim the US has had a hand in them.

FatBigot says:

To all the armchair industrial control experts out there

To all the armchair industrial control experts out there
Given the two options:

1. Connect your instrumentation to the corporate network & internet. Be able to check status and diagnose from your office desktop. Find it trivially easy to fix issues before they lead to production stops.

Or

2. Make a 400 mile round trip everytime you or a production manager suspects that there is an issue with your kit. Face hostile questions about your expenses and the need to travel at all.

What would you rather do ? Note that in all cases management are far more concerned with immediate costs than future risks.

It is very easy to say “keep your industrial control gear off the internet”, rather harder in practice.

Add Your Comment

Your email address will not be published. Required fields are marked *

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...
Loading...