President Obama creates new cyber sanctions programme
bbc.co.uk
bbc.co.uk
If you detangle the weasel words, this is basically "emergency executive powers to do whatever we want to people we don't like, as long as we can tie it back to the internet". Combined with the existing surveillance dragnet, that's horrifying.
That's a lot of power, but it isn't unlimited power.
You must be new to this brave new world. In 2012 the US seized $26000 from a Danish businessman while being transfered to a German bank within an electronic banking system that the US is not a part of (SWIFT): http://en.wikipedia.org/wiki/SWIFT#US_control_over_transacti...
Under the CFAA, accessing a web page as an unauthorized person would probably be justification enough.
There is no check or balance as you imply. The Treasury and Executive are jury, judge, and executioner.
Intent speaks to motivation, which speaks to the internal workings of one's mind. That may be relevant in a criminal trial. But it's far too nebulous of a concept to be considered when they're deciding whether to freeze your bank account. So they won't, no matter what lip service they pay.
They will "freeze first and ask questions later." We all know it's the truth.
When you control the legal system your not going to have much difficulty prosecuting the unpopular.
TPP, this, what's next?
The cruel creep of tyranny. "Cyber-terrorism" is the new bogeyman, or the new "terrorism" but instead of using a real catastrophe like 9/11, the incident they're going to use to justify this is a "hack" on Sony pictures with probably the weakest links to North Korea that could be?
There was no proof issued that North Korea were behind that attack. All the evidence that came out of it made it look as though they almost certainly were not behind it. So instead we're just going to repeat it as fact until it's accepted as true?
This is horrifying but it's just another turd thrown onto the pile of horrifying things the powers in the US are doing now.
Without even touching the USA's utterly toxic foreign policy:
- NSA mass surveillance that has eroded everyone's privacy on any communication device they may own, stomping on their own people's 4th Amendment rights in doing so.
- NSA lying barefaced to congress and facing no punishment
- CIA overthrowing or attempting to overthrow governments in sovereign countries who aren't explicitly under the thumb of the USA, throwing these countries into disarray
- CIA torturing untried suspects in the most brutal ways that we've seen in modern times.
- CIA arming and training "rebels" abroad who've went on to cause absolute atrocities across the middle east.
- Creating a militarized police force in the USA despite violent crimes decreasing year on year. Hell, the NYPD wanted portable, mounted machine guns to deal with protestors!
- Supporting a police policy of no-knock raids which have lead to the deaths of an unfortunate number of totally innocent people, over nothing.
- Rallied against whistleblowers while at the same time claiming to be working toward transparency and support for whistleblowers.
The list just goes on and on.
The important emails leaked by the Guardians of Peace (their 'Christmas Gift') show that CEO Lynton, a boardmember of the RAND Corporation, had been discussing with the State Department and RAND Corporation specialist on nuclear deterrence, NK and regime change since June the same year how the film should end and what was most likely to cause instability in NK when CSOs introduced them to the NK population.
That is to say The Interview was a 'diplomacy product' of the US government and the NK hacking of SONY was a retaliation for that - and in fact the cyber team retaliating against SONY specifically punishes media outlets for running adversarial messages about the Kim regime.
So the story here isn't that NK probably wasn't behind the attack - they probably were. The reason people are so skeptical is that they don't understand why NK would attack SONY, a movie seeming to be too petty a reason. It's easier to see when you read the leaked emails and ascertain that the US government was involved in crafting the film for its purposes.
There's a lot of toxic stuff in US foreign policy - and not just US but every nation. We believe in myths about our countries because they perform these actions in covert ways, and propel a lofty image of themselves in public interactions and through the media. The US does some very ugly, dirty stuff. But I take exception with some of the things in your list - specifically the characterization that the CIA's torture is or was somehow the 'most' brutal we've seen in modern times. That's some hyperbole and I think you know it. It may seems like picking on details but there is absolutely more heinous forms of torture (dissolving people in acid, using power tools to remove limbs and digits, etc) practiced at large in other nations.
But really the thing I want to leave here is that there is a tragedy at the commons. Torture and rendition, surveillance and propaganda, coups and proxy wars, theft and sabotage - all of these things are alive and well. The US is one of many nations involved in these activities as the planet races to establish water and food security before our planet exhales.
Reminder that 90% of development tools are hacking tools. Subversion has subversion right in the name.
Huh? I haven't heard that one before?
The whole 'hacking tools' thing is just ignorance. As if wireshark and port scanners have no legitimate use. "We don't understand these things therefore they are scary"
http://www.washingtonpost.com/blogs/worldviews/wp/2013/07/30...
> That Manning was convicted of computer fraud seems to suggest that using wget on a U.S. government computer to download large numbers of files can be considered the digital equivalent of trespassing – even if it's on turf you're otherwise allowed to access.
I think is what he means.
Computer fraud means using a computer to do something you're not authorized to do. He was not authorized to use wget, he used it, thus he committed fraud.
He was authorized to access that "turf," but not with wget. Why? Specifically for the reason he did it: it's a risk.
Whatever your opinion on whistleblower protections, this is not a risky judgment.
It's almost as if there's a difference between DOD classified file storage and google.com.
Could I make a website that immediately drops you onto a landing page that says "The rest of this website may only be accessed using Safari. Use of Firefox, Chrome, or any other software constitutes unauthorized access."?
Manning was active-duty military, accessing classified military systems. There are all sorts of duties, laws, and regulations that apply to that situation that don't apply to a civilian accessing some random website on the web.
I'd be interested in seeing the exhaustive list of programs they are authorized to use.
Is it really that unbelievable that the Department of Defense would have a strict set of software that's allowed to utilize their network, for a variety of reasons, including Manning's usecase or just simple security concerns?
Is your employer comfortable with you sharing encryption keys via post-it notes stuck on your monitor?
Should the DOD be comfortable with people accessing classified filesystems with any software they please?
This is simply a non-argument. I think it's a tacked-on charge meant to take down a maybe-legitimate whistleblower, but it's not like you can say it's actually unreasonable/unrealistic.
These are the real limitations of the real world and they're there by design.
Manning skirted them, and he got hit for it.
Whitelisting acceptable software really isn't a bad idea, especially for organizations that care about safety and security of data. The next step is to lock down the platforms to only execute whitelisted software (similar to how Apple tries to lock down iPhones, iPods, and iPads).
Blurred lines. [Apologies if that song is now stuck in your head as it is mine]
So what does it matter what the government calls them? The government reaction to a security threat should not depend on the classification.
It is really scary to me that our lawmakers are enacting legislation for topics they have absolutely no personal experience with. Their decisions are based on what can only amount to 100 hours, optimistically, of information sessions given by people representing multinationals with agendas.
All I want to know is what the hell constitutes a "malicious cyber activity". Is that as innocuous as U.S. v Auernheimer?
It's just the nature of trying to govern an incredibly complicated country.
How do you think that all the laws that the President cites at the top of the order that provide the authority under which the order is issued were passed? [0]
[0] "By the authority vested in me as President by the Constitution and the laws of the United States of America, including the International Emergency Economic Powers Act (50 U.S.C. 1701 et seq.) (IEEPA), the National Emergencies Act (50 U.S.C. 1601 et seq.) (NEA), section 212(f) of the Immigration and Nationality Act of 1952 (8 U.S.C. 1182(f)), and section 301 of title 3, United States Code, [...]" -- https://www.whitehouse.gov/the-press-office/2015/04/01/execu...
That's not to say that there couldn't have been criticism if another source provided them with some, but the BBC tend not to provide their own 'opinion' as a criticism (think Wikipedia).
In a Danish context I would imagine the archetypical NPR listener voting for the Social Liberals, who are basically in the exact center (socially liberal, economically free-market, but not radically so in either category).
People in the US have absolutely no idea what "heavily left" means in Europe.
Of course this varies from country to country with some countries being quite far from neutral in their reporting but the 'beeb' is pretty good at this.
If you want to get away from such bias the best trick that I've found is to go to the news sites of three different countries not directly implicated in the news item and figure out the common elements. Everything else is likely bias or interpretation.
In some places, there is still a distinction between:
(1) Reporting on the news,
(2) Reporting on reactions to the news, and
(3) Providing an outlet's own commentary/opinion on the news.
Its true that a number of popular news outlets try to pass off (2) and even (3) as (1), and that if you are used to that an article that sets out to do (1) and ends up only doing (1) may be confusing.
Image 1: [CC on keyboard] - Followed by text about "foreign hackers", "The US Treasury" and "economic ... security challenges."
Image 2: [Anonymous] - Proceeded by text about "individuals or entities that pose a cyber threat", both of which the image presumably represents.
Image 3: [Switch Rack] - Proceeded by assurances regarding the use of this power, followed by FUD and vague threats justifying it.
The final image is critical. It simultaneously represents the Internet, what is an obvious mess and, to those in the know, extremely poor cable management. Each of these associations imply something damning about the order.
I would absolutely expect a BBC reporter to have so carefully crafted such implications.
One could use the same logic to make the argument that this article strongly supports the sanctions:
1: [CC on keyboard] "Hackers are trying to steal your money. We need these sanctions to protect you" 2: [Anonymous] "Look at the scary hacker. Don't you know kids these days can do anything with your computer?" 3: [Switch Rack] "See how complicated the internet is? Don't think about it too much, just let us protect you"
Personally I consider it more likely that those were the first results on the stock image site when the reporter searched for "internet, security, hackers" :-)
http://www.politico.com/story/2015/04/new-us-sanctions-forei...
> President Barack Obama said Wednesday that the U.S. will now treat foreign hackers and cyber spies like terrorists and nuclear arms dealers.
There is also the medium post he made about it [claiming legitimate security researchers won't be targeted, not that I really believe that]:
https://medium.com/@PresidentObama/a-new-tool-against-cyber-...
To be honest, it sounds like Obama is positioning all "hackers" as "terrorists" and "foreigners" in the public view. I fully expect him or the next President to declare a "War on Cybercrime".
It also means, as of today, the Treasury can literally freeze all of the assets of any non-US citizen on circumstantial evidence. Lets face it, the case against North Korea for the Sony Hack is primarily based on circumstantial evidence. Its indicative but none of it truly is proof.
It also pretty much creates a situation where the Executive can freeze the accounts of anyone it doesn't like on circumstantial evidence. Eventually, if they continue the "hackers == terrorists" mantra...they'll start throwing them in prions without trials. And let us be honest, we all know this is where it is going to go eventually.
To the average person, the computer is a magical box. This makes it the perfect weapon for a terrorist group with the right type of fanatic to engage in cybercrime to fund their operations while simultaneously the perfect tool to suppress people on the basis of circumstantial evidence that the public, frankly, doesn't understand.
I doubt it would ever be used against a US Citizen but already we have security researchers being treated like criminals when they try to enter the US. And, frankly, we have some obligation to say "Hey, this isn't right".
Does it seem like this programme could give US authorities the power to sanction the Chinese government over something like a DDoS attack?
EDIT: Ah, looks like GitHub is back to normal. Maybe the attacks are over now?
The US can identify these companies and sanction them, which is something they should have done long ago. If you don't want sanctions, don't attack our infrastructure or citizens. Autocratic one party states need to be reminded that we won't stand for this shit any longer. What China did to Github is inexcusable and deserves a response.
How do you know it was China? An IP address does not mean the person sitting behind the computer is Chinese. The person could just as easily be controlling a botnet from a VPN while sipping a latte in a coffee shop in Palo Alto.
Only the Great Firewall (or the website owners, ie. government-controlled Baidu) can possibly do that.
http://www.netresec.com/?month=2015-03&page=blog&post=china%...
Github arguably operates in China by offering their website there. At the same time Github is refusing to meet demands by the Chinese government. Their refusal to meet those demands directly undermines policy enacted by the Chinese government. Now the Chinese government tried using their power to enforce their policy decisions.
I'm not saying it's right, but it doesn't seem that different from what's the norm these days. The only difference between China and powerful western countries is the kind of policy they enforce (censorship, not copyright protection or nuclear arms treaties etc).
China attacks Github = nothing, silence, heads kept in sand.
The attack itself is irrelevant. The scale of response is only related, inversely related, to the political size of the attackers. Small countries and individuals are to be punished. Large countries holding billions of US debt are to be forgiven. The extent of damage done doesn't enter into the equation.
The reason for calling the DPRK's attack on the propaganda creation of the State Department 'cyberterrorism' and 'cyberwar' is that it aligns with US foreign policy (SK's official policy now is to pursue reunification).
NK is going down - China is more complicated. We do hack and counterattack China though, all the time.
I wouldn't be surprised to see Obama label such an act by China as an "act of war".
All it is going to take is one lazily worded law / executive order, and anyone in the security space could have the possibility to go to jail if enforced broadly.
As the machine gears turns and laws are created as time moves forward, I don't see any other outcome then total lock down. All liberties and freedoms are gone.
This legally binding order gives the US Government the right to lay claim to assets held by individuals and corporations who may "constitute an unusual and extraordinary threat to the national security, foreign policy, and economy of the United States", all without prior notice.
Laws and legal contracts provide us a trusted system by which we may operate within a society. By 'sweeping off' certain rights, that trust is effectively eroded to the point implicit trust is all that remains of the 'contract' held with the governing body, in this case the US Government. This opens up the path to abuse of power by certain individuals by enabling them to hack the remaining (implicit) trust to suit their own needs.
While cyber criminals should be held accountable for their actions and the acts they commit can create additional suffering for individuals, corporations and communities, I don't feel eroding trust of the governing body of a country is the most logical approach to combatting crime committed by the criminals. Implicit trust in things of importance, especially infrastructure, never ends well for the parties trying to trust each other. FWIW, this is an opinion based on trust observations seen while working on infrastructure, which is not necessarily a fact of all our reality. At the very least, this is a complicated issue.
There are certainly other avenues available to us for addressing criminal behavior on the Internet. Those avenues are most likely technical in nature, and are clearly well beyond the responsibilities (or abilities) of The Office of the President of the United States.
It feels like the US is currently in a massive bought of cognitive dissonance: wanting to stop attacks while (at least for some) holding our freedoms as individuals to high levels. As with most duality situations, this will resolve itself at a future date in one way or another. For all of us, I hope this is done in a transparent, trustworthy and LEGAL way.
I would add that implementing technical measures to combat these attacks in and of themselves could be considered violations of this Executive Order as they may judged by the government at will: "any person determined by the Secretary of the Treasury, in consultation with the Attorney General and the Secretary of State, to be responsible for or complicit in, or to have engaged in, directly or indirectly, cyber-enabled activities originating from, or directed by persons located, in whole or in substantial part, outside the United States that are reasonably likely to result in, or have materially contributed to, a significant threat to the national security, foreign policy, or economic health or financial stability of the United States".
Cyber-enabled activities likely to result in a threat. Think about it.
Has there been anything similar to Stuxnet from China?