New US cybersecurity bill could threaten free software
fsf.org
fsf.org
Thanks for the useful shorthand, W!
One way I would improve the bill is to target a list of specific industries. They can amend that list later if gaps are identified. They can even have someone write up reports about which other industries ought to be on the list.
Or, more dangerously, in ways their corporate sponsors find profitable?
You're a security guy. You of all people should appreciate this stuff.
On the broader point, presidents are politicians, not gods. More to the point, they are our employees, and they should be treated with the dignity and respect appropriate to that position. You don't bow and scrape to your employees, but you don't call them rude names and spit at them either, even if you disagreed with the decision of the hiring committee to hire this particular candidate for the job.
Current I see "(1) IN GENERAL- The owners and operators of covered critical infrastructure shall have flexibility in their cybersecurity plans to implement any cybersecurity measure, or combination thereof, to satisfy the cybersecurity performance requirements described in subsection (c) and the first-party regulatory agency or sector-specific agency may not disapprove under this section any proposed cybersecurity measures, or combination thereof, based on the presence or absence of any particular cybersecurity measure if the proposed cybersecurity measures, or combination thereof, satisfy the cybersecurity performance requirements established by the Director under subsection (c)." ( http://thomas.loc.gov/cgi-bin/query/F?c111:1:./temp/~c111l3R...: )
Which seems to specifically state you can choose any approach you want as long as you secure the site.
Maybe there's something I missed.
I think you're confusing market-driven security levels with market-driven security products.
Big-website-taking-lots-of-citizen-data: I don't need security, the market hasn't demanded it.
The-State: I'm demanding it. Go buy good security, I don't care how.
Big-website-taking-lots-of-citizen-data: Ah, Ok, I think I've found it.
The-State: good, just give me outline so I know.
Big-website-taking-lots-of-citizen-data: here you go.
While the anarchist in me might just hate the state and the large corporations, here no one has yet shown how any of these are doing dastardly deeds. And that's a fine exception to the rule, really.
On the minus side, it's spawned a small industry of checkbox consultants who do companies a disservice by allowing them to believe they've been audited and assured when really nothing of the sort has happened. It's not hard to trace public incidents back to the PCI auditors who OK'd those companies.
Cynicism is a free pass for bad legislators to continue operating badly. Reasoned, constructive, informed opposition is needed to get the desired outcomes.
"The end."
* Gather reports on what, specifically, is needed in those industries (before going off to mandate it).
* Those reports, of course, should indicate performance metrics (as well as how to measure them) and dictate what levels of service the companies must provide and must NOT mandate specific means of achieving those mandates.
That's just for starters.
I'm sure I could think up more. The point is to avoid a "we have to do something!" mentality and think things through and figure out what good can and should be done before deciding that we need to hire a bunch of people who will soon work on justifying their existence and expanding their organizational mission.
The problem becomes, what if we're taken by surprise by some piece of infrastructure that nobody expected was critical, but that clearly is? How likely is that to happen? It's virtually guaranteed.
Well, such an event will either be an emergency or it will not be an emergency.
If it's an emergency, it's going to be far too late to bolt on some kind of half-ass emergency security and there's really nothing we can do anyhow. The notion that we could have some kind of oversight is, after all, not at all dependent on whether or not there's a list of industries in the bill. The same thing can (and will) happen if the agency makes up its own list with no public discussion at all. On that note, I'd like to quote something aristus wrote just over a week ago that's apropos: "Policies implemented under the gun have two unfortunate properties: they are wasteful and hard to change after the fact."
And there's nothing stopping them from consulting with that industry on proper security measures. If they're under attack by terrorists and they need help, well, who is going to refuse expert help? (This assumes the government hires real experts and not some congressman's golfing buddy... being able to refuse that "help" is a design feature.)
That leaves us considering the non-emergency case. If that happens, they can go back and amend the law after giving the problem consideration. The advantage this has over the new agency updating its internal list is that it has to go through public discussion. They can't just pass the buck off to an unelected agency with no accountability.
The problem becomes what can we do to ensure every piece of infrastructure can be put back on-line in reasonable time. There is a lot of people dedicated to that task, even if, when asked whether their little feud is a piece of critical infrastructure, they may scratch their heads and say "what?".
In general, yes. Not that specifically, but it was pretty clear from the start that it would be invasive and ineffective (because it's always been about theater rather than results).
> There will come a day when all computing purchases will be "routinely" reported to DHS.
That's completely unrelated to the bill at hand here, and the DHS will not be involved. (It will be the IRS, and it won't be at all specific to computing.)
> And every member of IT staff will need a Fed license.
IT is too ill-defined and general for that to happen, but I could see some positions on some specific kinds of projects requiring licensing just like Plumbers, Electricians, real Engineers, Lawyers, etc have.
The reality is, while the bill sucks and the language is fuzzy, the intent is clear: critical private national infrastructure means air traffic control and the power grid. Maybe, under the broadest interpretation, they might call the NASDAQ ECNs part of the "nation's information infrastructure".†
The bill makes no mention of proprietary software or hardware. The FSF is apparently reacting to the notion of DHS having any authority over the operation of networks; the notional concern is, "if they can dictate operational terms, they can dictate Cisco and Microsoft". They could just as well dictate Linux or Apache.
It is a fair critique of this bill that DHS has virtually no expertise in this area (despite repeated appeals to US-CERT, which, respectishly, doesn't have the requisite expertise either).
Personally, while virtually everyone else on HN is going to disagree with me, I think it's less fair to criticize the notion of FedGov nationalizing the security of private networks in an emergency. I have several reasons for arguing this:
* * * It is simply the truth that vast amounts of our critical infrastructure are privately owned and operated, and while reasonable and mostly hands-off regulation may enable utility operators to serve the public good using their own best judgement, that same regulation does nothing to deal with malicious adversaries.
* * * The government already has the "shadow" authority to accomplish these goals. Does anyone seriously believe the President lacks the ability to nationalize power grid security in the event that an attack makes the midwest go dark? Of course he can. It's better to be explicit about that authority now, when we're not panicking over an actual technological attack, than it will be for us to create de facto new rules in a crisis.
* * * There is a real risk that companies managing critical infrastructure might not realize that their networks are critical infrastructure, or, worse, might not care. We have decades worth of track record for companies not disclosing horrible incidents for fear of economic consequences. It's one thing when a retail chain delays disclosure of credit card leaks; it's another when a grid operator gets owned up.
† Systems can be designated if "the destruction or the disruption of the reliable operation of the system or asset would cause a national or regional catastrophe"; specific factors that must be considered include whether an attack would cause "a mass casualty event with an extraordinary number of fatalities", "severe economic consequences", "mass evacuations with a prolonged absence", or "severe degradation of national security capabilities, including intelligence and defense functions".
Except one of those scenarios I can believe happening, and the other won't.
Is it so hard to believe that a bill could be interpreted in such a way that unexpected and undesired consequences happen? Rather than waving off criticism by claiming "intent is clear", I think it's best to make the language clear.
Between the debate over cyber security and the debate over healthcare, the Commerce Clause may well prove to be the most significant part of the Constitution for the next decade.
[1] http://www.nytimes.com/2010/12/10/health/policy/10lawyer.htm...
What? I never claimed that it did.
It simply (arguably) authorized Congress to pass legislation regulating health care.
Yes, key word arguably.
What we're arguing about is whether Congress should exercise its power under the Commerce Clause to give the executive branch more power over the Internet. The language of the statute determines how much, and what kinds, of power the executive branch would get.
You missed the point of my post and I apologize for expressing myself poorly. The act of passing legislation is irrelevant to whether the executive branch will exercise the powers in question. Even if we pass legislation with an explicit enumeration of powers, the executive branch will still step outside those enumerations and use the Commerce Clause as the legal basis. My point is that the only thing which will actually limit the powers the executive branch takes is legal precedence, which we don't have right now. We wont see true limits on what the executive branch can do until we see some Supreme Court rulings in this area.
How would you improve the language of the bill? I agree with the suggestion downthread: "economic damage" is too broad. I think they should just strike that.
Perhaps an analogy is in order. The intent of intellectual property legislation (specifically, patent law) was to promote innovation. However, the outcome of the legislation has been almost exactly the opposite when such legislation has been applied to computer and information technologies. How can you say that the same thing will not happen with this legislation? As the aphorism goes, "The road to hell is paved with good intentions."
The trouble is, in the absence of prior action, some people or organisations cause harm that can be undone, but some cause harm that cannot be undone and for which mere financial compensation is insufficient. The question is which is more damaging, a harm that cannot be undone or the consequences of preemptive regulation to prevent that harm from occurring.
Individual possession of weapons is a crude but effective example. In some jurisdictions, individual citizens are free to carry personal firearms. In some jurisdictions, they are not. There is a political difference of opinion on whether the damage caused by irresponsible individuals abusing that freedom is outweighed by the benefits. However, I know of no jurisdiction where an individual citizen may lawfully carry around a nuclear weapon that would allow them to unilaterally destroy an entire city. The consequences of abuse are just too severe.
In all such matters, there will be grey areas, but it seems very clear from the state of the world today that commercial incentives do not automatically coincide with guaranteeing the continued provision of essential services in the face of attacks that are relatively unlikely but would cause vast disruption if carried out successfully.
The bill makes no mention of proprietary software or hardware.
the intent is clear: critical private national infrastructure
means air traffic control and the power grid
The bill doesn't require Common Criteria certified software, but it allows for that requirement to be made.
However, it's not a binary decision between the Wild West and nationalization. The scale goes from:
* Standards ("Here's the minimum." - building codes) * Checks ("Ask us if it's okay." - gun background checks) * Certification ("Tell us, and we'll make you more legit." - LEED [non gov't I know]) * Licensure ("You must tell us." - Liquor License) * Incentives ("Do this and we'll help you." - Tax Credits) * Nationalization ("Only we can do it." - Post Office)
You gain coordination of public interests and lose long-term innovation as you go down the list. Looking at how many disasters are handled with WalMart, Home Depot, FedEx having better response times - due to their economic incentives.
I'd propose solving this market inefficiency via standards, certification, and perhaps incentives - primarily because this will align incentives without the government needing to know the business and without the moral hazards politicians controlling companies brings. Think of building codes: builder's incentives now are "build cheap, but safe" - not just "build cheap" like 100 years ago.
2.) Most people can see that constitution has been largely deprecated and is more of a talking point than real power restriction. It doesn't mean we don't keep fighting for the new laws to be defined as open as possible (as you mention).
3.) Very true, but this doesn't automatically mean they should nationalize. There are lesser powers that will accomplish the same goal and more efficiently.
But, as the crisis passes, operators then have the freedom to adjust their cooperation, without a permanent obligation that could be abused. That's flexible and includes natural checks on abuse in the diversity of citizens' opinions and decentralization of decisionmaking.
No explicit language can achieve the same broad flexibility; when it tries through vagueness, it opens the door to both abuse and paranoia. And it encourages clumsy ass-covering overbroad orders from overreaching politicians, given in a dictatorial spirit, rather than considered requests offered in a spirit of community coordination.
In practice it may also be better for the government to exceed its proper bounds temporarily in emergencies, then be snapped back by calmer minds shortly thereafter, than to enshrine in law the maximal authority that might ever be needed. Lincoln, Wilson, FDR, and Bush-43 all overstepped their legal or constitutional authority in wartime, and then pulled back (or were pushed back) by the courts and public opinion later. Preauthorizing what they actually did would have made it harder in each situation to return to normalcy afterward.