by Mike Masnick
Tue, May 14th 2013 12:53pm
by Tim Cushing
Tue, May 14th 2013 8:44am
from the adding-up-wrongs-to-make-a-right dept
The US government is waging electronic warfare on a vast scale — so large that it's causing a seismic shift in the unregulated grey markets where hackers and criminals buy and sell security exploits, Reuters reports.I'm not sure how increasing user vulnerability helps win a cyberwar, but no doubt any home team casualties will be written off as sacrifices for the greater good. Even more troubling than the government's willingness to sacrifice security for security (??) is the fact that it's unwilling to share this information. What good are those provisions in CISPA and President Obama's recent cybersecurity executive order about the government sharing cybersecurity info with companies, if the government hoards the information for their own hacking purposes? More details from the Reuters report.
Former White House cybersecurity advisors Howard Schmidt and Richard Clarke say this move to "offensive" cybersecurity has left US companies and average citizens vulnerable, because it relies on the government collecting and exploiting critical vulnerabilities that have not been revealed to software vendors or the public.
"If the US government knows of a vulnerability that can be exploited, under normal circumstances, its first obligation is to tell US users," Clarke told Reuters. "There is supposed to be some mechanism for deciding how they use the information, for offense or defense. But there isn't."
Top U.S. officials told Congress this year that poor Internet security has surpassed terrorism to become the single greatest threat to the country and that better information-sharing on risks is crucial. Yet neither of the two major U.S. initiatives under way - sweeping cybersecurity legislation being weighed by Congress and President Barack Obama's February executive order on the subject - asks defense and intelligence agencies to spread what they know about vulnerabilities to help the private sector defend itself.Is it any surprise the public distrusts the government? It claims to be fighting a cyberwar in order to make us more secure and yet, when it goes on the attack, it values its own secretive efforts over the security of the public.
When a U.S. agency knows about a vulnerability and does not warn the public, there can be unintended consequences. If malign forces purchase information about or independently discover the same hole, they can use it to cause damage or to launch spying or fraud campaigns before a company like Microsoft has time to develop a patch. Moreover, when the U.S. launches a program containing an exploit, it can be detected and quickly duplicated for use against U.S. interests before any public warning or patch.
As the government purchases more of these exploits to help fight its cyberwar, the lines on the battlefield are continuously redrawn and obscured. Buying exploits from independent hackers leaves them free to sell to other high bidding countries when not using the exploits themselves. This arms race also creates a perverse set of incentives. As the demand for new exploits increases, security companies and contractors that used to release information to those affected are now keeping their discoveries to themselves to preserve "market value."
The Reuters report also notes that this new breed of security contractor is offering up, among other things, keys to criminal botnets. Endgame, a heavily funded tech startup with close ties to the intelligence community, is more than willing to hand over control of thousands of zombie computers for the right price.
Some of Endgame's activities came to light in purloined emails published by hackers acting under the banner Anonymous. In what appear to be marketing slides, the company touted zero-day subscriptions as well as lists of exactly which computers overseas belonged to specific criminal "botnets" - networks of compromised machines that can be mobilized for various purposes, including stealing financial passwords and knocking websites offline with traffic attacks.So, we're engaged in a cyberwar that's going to help us by hurting us, is that it? I understand that no one wants to be outgunned when facing the enemy, but what's being detailed here looks like a whole lot of collateral damage in the pursuit of unattainable goals. The same exploits will be used on both sides of the battle, and with end users and the companies they rely on being cut out of the loop, it will be the civilians who fare the poorest. We'll just be asked to pretend the government's saving us from something even worse.
The point was not to disinfect the botnet's computers or warn the owners. Instead, Endgame's customers in the intelligence agencies wanted to harvest data from those machines directly or maintain the ability to issue new commands to large segments of the networks, three people close to the company told Reuters.
from the putting-the-cybercart-before-the-horse dept
Few object to what technology companies and the government say they want to do in practice: pool data about the activity patterns of hacker-controlled “botnets,” or the digital signatures of new viruses and other malware. This information poses few risks to the privacy of ordinary users. Yet CISPA didn’t authorize only this kind of narrowly limited information sharing. Instead, it gave companies blanket immunity for feeding the government vaguely-defined “threat indicators” — anything from users’ online habits to the contents of private e-mails — creating a broad loophole in all federal and state privacy laws and even in private contracts and user agreements.
There’s no need to share [personally identifiable] data for security purposes anyway: Kevin Mandia, head of the cybersecurity firm Mandiant, insisted at a February hearing on CISPA that in 20 years in the industry, he had “never seen a package of threat intelligence that’s actionable” that included personally identifiable information.
Sanchez suggests some straightforward basic requirements for a cybersecurity bill that might actually get consensus from privacy watchdogs and the broader public: the removal of personal information before data reaches the government, a limited lifespan on the data (CISPA's authors have stated that real-time information sharing to deal with immediate threats is the key point of the bill anyway), and the ability for companies to respect their contracts with customers. As written, CISPA would have exonerated service providers from keeping any promise they made to not share user data. Even a service provider that wanted to offer you the contractual certainty that they would protect your data would have been unable to do so.
The reason for that is a key piece of language that's been drifting around CISPA since the beginning: "notwithstanding any other provision of law." There are lots of bits and pieces to the bill, but that line is the exemption granted to companies that wish to share cyber threat information with the government, and it's incredibly broad, allowing companies to ignore even the contracts they have with their customers.
So why is it there? That's the question nobody seems to want to answer, and that's the real issue with the whole push for cybersecurity legislation. Supposedly, according to the message that has accompanied CISPA and similar bills from the beginning, companies and the government are currently prevented from doing some harmless, common-sense information sharing to improve network security, because existing laws block such sharing. But... what laws? That has never been clear. Why does CISPA need to provide immunity "notwithstanding any other provision of law" rather than simply creating specific exceptions to the specific laws that are causing a problem? Why has nobody in Congress even been able to point out these problematic laws?
Perhaps it's not just one or two laws; perhaps it's a whole cluttered legal framework that can't easily be cleaned up and needs some broad, sweeping exceptions. But... nobody has made that case either. They just keep saying, non-specifically, "existing laws prevent it". And yet we know that's not true, at least to some degree: the FBI has had a system for sharing threat information back and forth with companies for 15 years. Why is that model not sufficient? Again, if there are reasons, nobody in Congress is offering them.
I'd like to say Sanchez's guidelines make an excellent starting point for cybersecurity legislation, but a starting point for legislation has to be a definition of the problem it's trying to solve, and we still don't have that. Nevertheless, they do serve as an excellent set of rules to hold Congress to if it is really so intent on barreling forward blindly. Cybersecurity grandstanders are likely to say that such restrictions would gut the legislation. Whether that's ignorance, cognitive dissonance or a tacit admission of dishonesty I'm not sure, but the restrictions suggested by Sanchez, the EFF, the ACLU and others would do nothing to hinder CISPA's stated and largely innocuous purpose — they would only interfere with the other much scarier potential uses that Congress insists aren't going to happen.
The longer Congress offers only the vaguest of vague definitions of the problem it's trying to solve, while at the same time seeming to betray even that vague definition with its response to suggested safeguards and restrictions, the harder it gets to afford them even one iota of trust on the subject of cybersecurity.
from the cybersecurity,-the-sequel dept
by Tim Cushing
Mon, Apr 22nd 2013 7:31am
from the $84M-isn't-money;-it's-a-motive-with-a-universal-adapter dept
[A] new coalition of special interests, which include America's two largest cellular service providers AT&T, Inc. and Verizon Wireless -- jointly owned by Verizon Communications Inc. and Vodafone Group Plc. -- as well as two of the nation's largest software firms Microsoft Corp. and Intel Corp., came together to create a similar data grab bill (Microsoft has since renounced its support). Security firms like Symantec Corp. also backed the bill.$84 million is change-of-heart money, although one imagines those contributing checked and double-checked their "sponsored" representatives to make sure they were all on the same page. As DailyTech points out, nearly $86 million went into the SOPA push and most of that turned out to be wasted money.
Pushing the bill through was $84M USD in funding from special interest backers.
Last Monday, two hundred IBM executives visited the White House to make a last minute push for CISPA. Whatever they said or did must have been very persuasive. By the end of the day, 36 new sponsors had signed on to the bill, up from a very lonely two previous to IBM's visit. Unsurprisingly, financial motivation was involved, according to numbers gathered by Maplight.
New co-sponsors have received 38 times as much money ($7,626,081) from interests supporting CISPA than from interests opposing ($200,362).Now, it's up to Senate to come up with some sort of cyber-security bill that has a chance to get passed and dodge a Presidential veto. Fortunately, there's no clear favorite at the moment (although Lieberman's bill seems to have the President's blessing) and with the limited number of voters, the Senate is much more prone to be gridlocked by partisan politics. Of course, a daylong visit by a few lobbyists could win over just enough hearts and minds to be dangerous. In the meantime, it would probably do these senators a world of good to hear from their constituents, if only to remind them that there are plenty of actual people out there who have to live with the consequences of bad legislation.
Members of the House in total have received 16 times as much money ($67,665,694) from interests supporting CISPA than from interests opposing ($4,164,596).
by Mike Masnick
Thu, Apr 18th 2013 10:21am
from the all-the-others-are-just-14-year-olds-in-their-basement dept
by Mike Masnick
Thu, Apr 18th 2013 5:38am
from the no-conflict,-no-interest dept
It has seemed quite strange to see how strongly Rogers has been fighting for CISPA, refusing to even acknowledge the seriousness of the privacy concerns. At other times, he can't even keep his own story straight about whether or not CISPA is about giving information to the NSA (hint: it is). And then there was the recent ridiculousness with him insisting that the only opposition to CISPA came from 14-year-old kids in their basement. Wrong and insulting.
Of course, as we've noted all along, all attempts at cybersecurity legislation have always been about money. Mainly, money to big defense contractors aiming to provide the government with lots of very expensive "solutions" to the cybersecurity "problem" -- a problem that still has not been adequately defined beyond fake scare stories. Just last month, Rogers accidentally tweeted (and then deleted) a story about how CISPA supporters, like himself, had received 15 times more money from pro-CISPA group that the opposition had received from anti-CISPA groups.
So it seems rather interesting to note that Rogers' wife, Kristi Clemens Rogers, was, until recently, the president and CEO of Aegis LLC a "security" defense contractor company, whom she helped to secure a $10 billion (with a b) contract with the State Department. The company describes itself as "a leading private security company, provides government and corporate clients with a full spectrum of intelligence-led, culturally-sensitive security solutions to operational and development challenges around the world."
Hmm. Sounds like a company like that would benefit greatly to seeing a big ramp up in cybersecurity FUD around the globe, and, with it, big budgets by various government agencies to spend on such things. Indeed, just a few months ago, Rogers penned an article for Washington Life Magazine all about evil hackers trying to "steal information." In it, there's a line that might sound a wee-bit familiar, referring to the impression of hackers as being "the teenager in his or her parent's basement with bunny slippers and a Mountain Dew." Apparently, both of the Rogers really have a thing about teens in basements. The article is typical FUD, making statements with no proof, including repeating the NSA's ridiculous allegation that hackers have led to the "greatest transfer of wealth in American history." It's such a good line, except that it's completely untrue. The top US companies have recently admitted to absolutely no damage from such attacks. The article also lumps in "hacktivists" like Anonymous, as if they're a part of this grand conspiracy that needs new laws.
Tellingly, in the print version of Washington Life that this article appeared in, which you can see embedded below, you'll note that there's a side bar right next to her article about the importance of passing cybersecurity legislation in Congress. Guess what's not mentioned anywhere at all? The fact that Kristi Rogers, author of the fear-mongering article, happens to be married to Rep. Mike Rogers, the guy in charge of pushing through cybersecurity legislation. That sure seems like a rather key point, and a major conflict of interest that neither seemed interested in disclosing. Oh, and Kristi Rogers recently changed jobs as well, such that she's now the "managing director of federal government affairs and public policies" at Manatt a big lobbying firm, where (surprise, surprise) she's apparently focused on "executive-level problem solving in the defense and homeland security sectors." I'm sure having CISPA in place will suddenly create plenty of demand for such problem solving.
A few months ago, on one of his FUD-filled talks about why we need cybersecurity, Rogers claimed that it was all so scary that he literally couldn't sleep at night until CISPA was passed due to an "unusual source" threatening us. The whole statement seemed odd, until you realize that his statement came out at basically the same time as his wife's fear-mongering article about cybersecurity. I guess when your pillow talk is made up boogeyman stories about threats that don't actually exist, it might make it difficult to fall asleep.
Either way, even if we assume that everything here was done aboveboard -- and we're not suggesting it wasn't -- this is exactly the kind of situation that Larry Lessig has referred to as soft corruption. It's not bags of money shifting hands, but it appears highly questionable to the public, leading the public to trust Congress a lot less. At the very least, in discussing all of this stuff, when Mrs. Rogers is writing articles that help the push for CISPA, it seems only fair to disclose that she's married to the guy pushing for the bill. And when Mr. Rogers is pushing for the bill, it seems only right to disclose that his wife almost certainly would benefit from the bill passing. And yet, that doesn't seem to have happened... anywhere.
by Leigh Beadon
Thu, Apr 18th 2013 3:31am
from the same-old-thing-with-a-new-coat-of-paint dept
Update: It has become a little unclear what the status of this amendment is now. Yesterday we heard that it had passed, but now it seems to have been changed, and it's back up for debate on the floor. We'll get you more updates on whether or not it goes through, and the latest changes, as soon as we can.
In the latest round of changes to CISPA, the House passed a new amendment that supposedly (according to CISPA supporters) addresses the privacy and civil liberty concerns about the bill. The amendment (pdf and embedded below) ostensibly establishes civilian agency control (through Homeland Security) over information shared under CISPA, since many people are reasonably worried about all this data ending up in the hands of the NSA. Unfortunately, as the EFF determined in their initial analysis, it doesn't really change anything—it just lets the DHS go along for the ride:
The amendment in question does not strike or amend the part of CISPA that actually deals with data flowing from companies to other entitities, including the federal government. The bill still says that: “Notwithstanding any other provision of law, a self-protected entity may, for cybersecurity purposes...share such cyber threat information with any other entity, including the Federal Government." The liability immunity provisions also remain.
While this amendment does change a few things about how that information is treated within the government, it does not amend the primary sharing section of the bill and thus would not prevent companies from sharing data directly with military intelligence agencies like the National Security Agency if they so choose.
Indeed, the text of the amendment appears to create a significant role for the DHS in information sharing procedures, but gives it little power in terms of actually protecting privacy or filtering information—the amendment mandates that information still be shared with other agencies in realtime, and it still appears to allow companies and organizations to bypass the DHS entirely.
A portion of the amendment outlines certain privacy guidelines, but they are the same as those we discussed before: filled with enough release valves and escape routes to render them virtually meaningless, closer to a list of "best practices" than actual rules. The fact is that, despite what the bill's supporters and some of the media reporting on it would have you believe, the core problems with CISPA have not been addressed, nor have any of the "efforts" in that direction amounted to much more than a smokescreen. With a final CISPA vote looming at any time, it's never been more important to voice your opposition to the bill.
by Mike Masnick
Wed, Apr 17th 2013 1:02pm
from the let's-get-real dept
One of the key points that Rogers keeps saying over and over again is that this bill is not a "surveillance" bill. Why? Because it doesn't allow the NSA or others to go in and automatically get info. But Rogers is choosing his words very carefully, such that he absolutely misrepresents how the bill can and almost certainly will be used. And while he and other CISPA supporters will (and have) argued that the possible abuses of CISPA are crazy conspiracy theories that wouldn't happen in practice, we have too many examples of how the US government's intelligence infrastructure very quickly expands to make use of every single loophole provided to them within the law -- sometimes going so far as to interpret laws in ways clearly contrary to Congressional intent, just because they can. Let's just highlight two examples:
- The FISA Amendments Act, which was passed in association with the Patriot Act, supposedly to give the NSA more powers to scoop up communications of folks involved in terrorist activity. Now, the NSA is -- by mandate -- not allowed to spy on Americans. And yet, multiple whistleblowers and hints from folks who know in Congress have made it quite clear that the NSA has interpreted the FISA Amendments Act to allow exactly that -- even as many in Congress clearly don't understand how the bill is being used.
While it's still not official, enough information has been revealed to show that the NSA interprets the requirement that its surveillance target foreign persons to mean that as long as it's looking for foreign terrorist activity, it can spy on everyone. Get that? It's a sneaky trick that many have not realized. The NSA argues -- likely with agreement from a secret court ruling -- that so long as it can claim that it is investigating a foreign threat somewhere, somehow, the prohibition on spying on Americans does not apply. There is increasing evidence that this now means that the NSA is scooping up pretty much all data it can get its hands on. While it may not be going through it in real time, it appears to believe that as long as it can make the argument that it's searching for a foreign threat, that it can delve into that treasure chest of, well, everything.
- Next: the "national security letters" (NSL) issue. While a court recently ruled these unconstitutional, this process has been widely abused by the FBI for years to get private information on people without a warrant and with a gag order on recipients. Every time it's been investigated, it's been shown that the FBI has widely abused its NSL powers. However, since there's almost no oversight, the FBI still feels free to make widespread use of the tool, which was only supposed to be used in extreme circumstances.
Along those lines, the FBI has gotten so comfortable with asking companies for data without a warrant or any formal oversight process, that it was revealed a few years ago that, rather than going through the drudge of actually processing paperwork to get private info from AT&T, some agents simply used Post-It Notes to make their requests, which AT&T readily coughed up without question.
CISPA supporters also like to claim that since CISPA is "voluntary," companies will have no reason to give up your private info. That's nice in theory. And, sure, perhaps some principled companies will resist, but we've already seen the AT&T example above. And, even more importantly, we've seen how pressure from the US government, or even threats of the government shaming them publicly for not "helping" have been incredibly effective in making "voluntary" action suddenly seem obligated.
The saying goes "fool me once, shame on you. Fool me twice, shame on me." We've been fooled many times by the US government insisting that certain laws won't be used to violate our privacy, when it later comes out that they were used in exactly that way. So forgive us for calling bullshit on Mike Rogers' claims that CISPA doesn't "allow" the government to spy on Americans. It absolutely does. It opens up a clear path for law enforcement and intelligence agencies (and others!) to hide behind the liability protections within the law to pressure companies to reveal whatever they want with absolutely no repercussions.
That seems like a pretty serious issue, and one that Congress and supporters of CISPA don't seem to want to admit.
by Berin Szoka
Wed, Apr 17th 2013 9:55am
from the all-talk dept
At that Committee meeting (1:01:45), the bill's chief sponsor Chairman Rogers emphatically repeated his earlier assertions that CISPA wouldn't breach private contracts in response to questions from Jared Polis:
Polis: Why wouldn't it work to leave it up, getting back to the contract part, and I think again there may be a series of amendments to do this, if a company feels, if it's voluntary for companies, why not allow them the discretion to enter into agreements with their customers that would allow them to share the information? ...And yet... CISPA will go to the House floor as written, providing an absolute immunity from "any provision of law," including private contracts and terms of service.
Rogers: I think those companies should make those choices on their own. They develop their own contracts. I think they should develop their own contracts. They should enforce their own contracts in the way they do now in civil law. I don't know why we want to get in that business.
Only in Congress can you swear up and down that your bill doesn't do X, then refuse to amend it so that it really doesn't do X—and then lecture those who note the disconnect, like Polis, with patronizing comments like "once you understand the mechanics of the bill..." (1:02:50).
It brings to mind what Galileo said after he was forced to sign a confession recanting belief in Copernicus's heretical idea that the Earth revolves around the sun: "And yet, it moves."
And yet... for all Rogers' bluster, CISPA moots private contracts—and House Republican leadership won't fix the problem, even when five of their GOP colleagues offer a simple, elegant fix.
This is the same stubborn refusal to accept criticism and absorb new information that brought us SOPA, PIPA and a host of other ill-conceived attempts to regulate the Internet. It's the very opposite of what should be the cardinal virtue of Internet policy: humility. Tinkering with the always-changing Internet is hard work. But it's even harder when you stuff your fingers in your ears and chant "Lalalala, I can't hear you."
The good news is that, as with SOPA, this fight transcended partisan lines, uniting a Democrat like Jared Polis (an openly gay progressive from Boulder) with a strict constitutionalist like Justin Amash (the "Ron Paul Republican" from Grand Rapids Michigan)—and four more traditional Republicans. This is precisely the realignment predicted 15 years ago by Virginia Postrel in The Future and Its Enemies. On one side are those profoundly uncomfortable with change, desperate to control and plan the future, and so insecure about their own understanding of technology that they inevitably perceive criticism as a personal attack. On the other are those far more humble and more willing to let the future play out in all its messy unpredictability. The first camp is always pushing for the one, right piece of legislation that will avert a crisis. The second camp admits they don't know the one, best way to deal with a problem like encouraging sharing of cyberthreat information while protecting user privacy, so they reject static rules that can only be changed by Congress. They want simple rules for a complex world. At a minimum, they want what law Professor Richard Epstein argues in his book Simple Rules for a Complex World--the perfect slogan for this camp--"the most ubiquitous legal safety hatch adds three words to the formal statement of any rule: unless otherwise agreed."
It's not a battle between Left and Right, or conservatives and progressives. It's a battle between attitudes towards the future: the stasis mentality of Congressmen like Mike Rogers and Lamar Smith (of SOPA infamy) and the dynamism of Justin Amash and Jared Polis, and SOPA foes like Republicans Darrell Issa and Jason Chaffetz and Democrats Ron Wyden and Zoe Lofgren.
The dynamists may have lost this battle. But, like Galileo, we'll eventually win the war. The only questions are: How many more poorly crafted, one-size-fits-all laws will the stasists put on the books in the meantime? How long it will take to clear the real "legislative thicket"--all the complex laws that attempt to provide a single answer for a complex and unknowable future? And when will it finally become unacceptable for Congressmen like Mike Rogers to ram through legislation that doesn't even do what they claim?
Berin Szoka (@BerinSzoka) is President of TechFreedom (@TechFreedom), a dynamist tech policy think tank.