8 ms·

Read the Trump administration's draft of the executive order on cybersecurity

99 points by pr0zac 10y ago

trishume 10y ago
Not much interesting in there it seems. TL;DR: Let's all review everything and decide on ways to improve things.
- meowface 10y ago
  >A review ... of the DoD, DHS, and NSA shall identify and initial set of capabilities needing improvement to adequately protect U.S. critical infrastructure. This could potentially mean allowing NSA expanded capabilities. Not necessarily, though, I guess.
  - 464192002d7fe1c 10y ago
    I don't think it goes either way. An argument could be made that the review ends up saying "Everything the NSA does is irrelevant, shut it down and give the money back to the shareholders". Obviously I don't think that is actually going to happen either, but, nor do I think this means the NSA would be expanded here.
ryanmarsh 10y ago
So far nothing controversial. Let's hope he gets one thing right. Even a broken clock is right twice a day.
- SAI_Peregrinus 10y ago
  A stopped clock is right twice a day. A clock that mistimes a second will be right far less often, and a mis-set clock is never right. Likewise a Widlarized clock is never right, and that's as broken as you can get. /pedantry
guest-speaker-4 10y ago
The part about Department of Education ensuring a competent workfore doesn't jive with haphazardly turning back permanent residents with PhDs and valid green card from reentering the country where they live. The US was made great when refugees from around the world were welcomed and then prospered for both themselves and the melting pot country. The rush to enact these sort of ignorant, brutal, arbitrary and uncivilized policy blunders further errode national security, the economy and international standing... also, the shitshow of a constitutional crisis is brewing where the various parts of government ignore the law and do whatever they want.
- yriri99 10y ago
  Kek. Fuck off libtard.
- guest-speaker-4 10y ago
  PS: it seems like it was thrown together without much roast beef on the bone.
- mc32 10y ago
  Except for Iran, most of the other countries didn't contribute to a large part of the US "intelligentsia" [people with advanced technical degrees] Any deficit could be compensated by increasing quotas for people from alternate countries, India, Russia, China all which produce great numbers of people in technical fields and who don't always get choice work in their home countries.
  - guest-speaker-4 10y ago
    You missed the point entirely. Leaving out Irish, Italians, Syrias or the Jews (Godwin's Law exception) because of nativist hate toward disparaged peoples was/is shooting oneself in the foot... other, wiser countries will gain by taking in more people (either to bolster their fertility rates, tax bases and/or future world standing) because it's hard to select the good ones in an haphazard, politically-driven immigration process whose children, grandchildren, etc. have the greatest probability of being the next billionaire job creator, small business owner or at least high income-earning taxpayers.
jastanton 10y ago
Is he demanding a review of government systems or of private systems as well? Like is the homeland security going to bring an army of security experts and start banging on Google's doors demanding access to their servers to see if they are above board?
- Waterluvian 10y ago
  I could only hope like he pins big tech against a wall and forces them to bring their full force to bear.
- concinds 10y ago
  If so, then Google should do the right thing. They know they have a lot of allies, and public opinion, media, NGOs, customers and most voters are on their side. The problem: could Trump do this legally, and legally force Google not to disclose it? What can Trump do with the NSA data? I haven't seen any stories addressing this, beyond vague "concerns".
  - cloakandswagger 10y ago
    I don't see much point to hypothesizing about jackbooted Trump soldiers showing up at Google and demanding their data until it happens. Furthermore, it misses the larger point that all of their data is readily and easily collected by the NSA already.
    - matt4077 10y ago
      > Furthermore, it misses the larger point that all of their data is readily and easily collected by the NSA already. Such assertions are counterproductive. They ignore actual statements by google regarding their efforts to improve security against US agency snooping, or Apple's somewhat valiant if ultimately fruitless attempts to defend the iPhone's security against national security interests. We need to specifically call out bad actors and actions, such as Yahoo's eagerness to CC the NSA on all our emails. We also need to reward positive action with praise. Both are methods to provide the incentives for companies to act in our interests: the companies can point to praise to argue that their principled stand makes financial sense, and the employees deserve the recognition by their peer group.
sandworm101 10y ago
The real joke is that all this information is already out there. Infrastructure has already been evaluated. The the enemy is well understood. But you do have to read the reports. You have to trust those writing the reports. You have to not yell them out of the room when they say something that offends your reality. This order is a call for new reports written by new people with the skills necessary to explain cybersecurity to large children. "China bad. Big internet computer need antivirus."
- Avshalom 10y ago
  Yup: "all the previous work is bullshit 'cause I said so, do it again"
  - guest-speaker-4 10y ago
    It's kissing cousins to Not Invented Here (NIH) syndrome.
  - jerkstate 10y ago
    Grizzly Steppe illustrated that the intelligence agencies are not working together (NSA had different confidence levels in the conclusions than CIA and FBI - why?) If you got a pen-test report back with those platitudinous security recommendations, you would probably not be very happy signing the check. The Department of Commerce is rightfully responsible for the creation of the private sector report, because NIST is part of the DoC and NIST is where all of the best security guidance is coming from these days (the DoD adopted NIST's security standards, for example).
    - willstrafach 10y ago
      > why? HUMINT vs SIGINT. NSA confidence was moderate as they weight SIGINT-based evidence more heavily. The biggest bits of evidence came from human intelligence sources in Russian government (I believe some were arrested for treason due to this).
- shaftway 10y ago
hoodoof 10y ago
.
- crymer11 10y ago
  wat? Please show me where it says or even alludes to such things.
  - pdkl95 10y ago
    https://www.washingtonpost.com/politics/trump-invites-russia-to-meddle-in-the-us-presidential-race-with-clintons-emails/2016/07/27/a85d799e-5414-11e6-b7de-dfe509430c39_story.html https://www.washingtonpost.com/politics/trump-invites-russia... edit: possibly referring to this?
- huntermeyer 10y ago
  I don't see that part. "Russia" isn't in the text at all. Would you point out where you're reading that?
taddeimania 10y ago
That's one heck of a wordy security audit request.
danso 10y ago
FWIW, here are 3 executive orders related to cybersecurity that President Obama signed: https://obamawhitehouse.archives.gov/the-press-office/2013/02/12/executive-order-improving-critical-infrastructure-cybersecurity https://obamawhitehouse.archives.gov/the-press-office/2013/0... https://obamawhitehouse.archives.gov/the-press-office/2015/02/13/executive-order-promoting-private-sector-cybersecurity-information-shari https://obamawhitehouse.archives.gov/the-press-office/2015/0... https://obamawhitehouse.archives.gov/the-press-office/2016/02/09/executive-order-commission-enhancing-national-cybersecurity https://obamawhitehouse.archives.gov/the-press-office/2016/0...
deleted 10y ago
[deleted]
notliketherest 10y ago
I think it'd be good for everyone to read these executive orders, rather than jumping to conclusions and acting hysterically.
matt4077 10y ago
Some thoughts, sorry for the long quotes. Start with the second-to-last quote for what I personally find to be the most worrying. As a result of these changes, cyberSpace has emerged as a new domain of engagement, comparable in signi?cance to land, sea, air, and space, and its signi?cance will increase in the years ahead. This raises the possibility of hacking being treated as an act of war, and the resulting actions. I'm not sure if that's the current status quo – I know there was discussion about it a few months ago. The term ?critical infrastructure? means systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters. This does notably seem to exclude anything related to elections. The term ?national security system? means any telecommunications or information system Operated by the Federal Government or any contractor on its behalf, the function, operation, or use of which: [...] is critical to the direct fulfillment of military or intelligence missions (but does not include a system used for routine administrative and business applications, including payroll, finance, logistics, and personnel management applications). This seems to go out of its way to exclude "personnel management applications", which is curious considering exactly such a system was at center of the second-largest hacking scandal involving the government last year. Review Participants. The Secretary of Defense shall co?chair the Vulnerabilities Review with the Secretary of Homeland Security, the Director of National Intelligence, the Assistant to the President for National Security Affairs, and the Assistant to the President for Homeland Security and Counterterrorism. The last three are Dan Coats, Michael Flynn, and Tom Bossert, respectively. It's a bit heavy on the military brass and leans towards the political side to the exclusion of anybody with technical credentials (I'd think someone from the NSA or even the private sector could possibly be useful). But I've always been critical when, for example, judges have been accused to be inadequate to adjudicate technical issue – smart people can and will get the information they need to make right decisions. So let's give them the benefit of the doubt. Possibly relevant: it's two cabinet members vs three people reporting directly to the president. I don't know if these committees ever vote on anything, but that could be intentional to allow the President to keep full control over the direction of the investigation (Cabinet Secretaries being traditionally more independent than anyone in the West Wing) [..]the Secretary of Defense and Secretary of Homeland Security shall also gather and review information from the Department of Education regarding computer science, mathematics, and cyber security education from primary through higher education to understand the ?ll] scope of US. efforts to educate and train the workforce of the future. Th Secretary of Defense shall make recommendations as he sees ?t in order to best position the US. educational system to maintain its competitive advantage into the future. I feel a bit uneasy about Secretary of Defense being authorized to change the primary school curriculum, especially considering the basically limitless scope of "maintain[ing] its competitive advantage into the future". It sounds like they want more math in school. But what if he concludes that the US has plenty of hackers, but they're just not patriotic enough and rather work for Apple (which is actually somewhat true)? [A review shall find ways to incentivice private enterprises to] invest in cyber enterprise risk management tools and services; and adopt best practices with respect to processes and technologies necessary for the increased sharing of and response to real-time cyber threat information. This is once again pretty broad, but I thought it warrants inclusion because any sharing of data collected by private entities with government agencies has the potential to violate individuals' privacy. Overall this isn't really specific enough to scare me, yet. The bit about education is what most effectively raises my blood pressure, while the focus on military systems at the exclusion of anything election-related is somewhat curious.

99 points by pr0zac 10y ago

trishume 10y ago

Not much interesting in there it seems. TL;DR: Let's all review everything and decide on ways to improve things.

meowface 10y ago
>A review ... of the DoD, DHS, and NSA shall identify and initial set of capabilities needing improvement to adequately protect U.S. critical infrastructure. This could potentially mean allowing NSA expanded capabilities. Not necessarily, though, I guess.
- 464192002d7fe1c 10y ago
  I don't think it goes either way. An argument could be made that the review ends up saying "Everything the NSA does is irrelevant, shut it down and give the money back to the shareholders". Obviously I don't think that is actually going to happen either, but, nor do I think this means the NSA would be expanded here.

ryanmarsh 10y ago

So far nothing controversial. Let's hope he gets one thing right. Even a broken clock is right twice a day.

SAI_Peregrinus 10y ago
A stopped clock is right twice a day. A clock that mistimes a second will be right far less often, and a mis-set clock is never right. Likewise a Widlarized clock is never right, and that's as broken as you can get. /pedantry

guest-speaker-4 10y ago

The part about Department of Education ensuring a competent workfore doesn't jive with haphazardly turning back permanent residents with PhDs and valid green card from reentering the country where they live. The US was made great when refugees from around the world were welcomed and then prospered for both themselves and the melting pot country. The rush to enact these sort of ignorant, brutal, arbitrary and uncivilized policy blunders further errode national security, the economy and international standing... also, the shitshow of a constitutional crisis is brewing where the various parts of government ignore the law and do whatever they want.

yriri99 10y ago
Kek. Fuck off libtard.
guest-speaker-4 10y ago
PS: it seems like it was thrown together without much roast beef on the bone.
mc32 10y ago
Except for Iran, most of the other countries didn't contribute to a large part of the US "intelligentsia" [people with advanced technical degrees] Any deficit could be compensated by increasing quotas for people from alternate countries, India, Russia, China all which produce great numbers of people in technical fields and who don't always get choice work in their home countries.
- guest-speaker-4 10y ago
  You missed the point entirely. Leaving out Irish, Italians, Syrias or the Jews (Godwin's Law exception) because of nativist hate toward disparaged peoples was/is shooting oneself in the foot... other, wiser countries will gain by taking in more people (either to bolster their fertility rates, tax bases and/or future world standing) because it's hard to select the good ones in an haphazard, politically-driven immigration process whose children, grandchildren, etc. have the greatest probability of being the next billionaire job creator, small business owner or at least high income-earning taxpayers.

jastanton 10y ago

Is he demanding a review of government systems or of private systems as well? Like is the homeland security going to bring an army of security experts and start banging on Google's doors demanding access to their servers to see if they are above board?

Waterluvian 10y ago
I could only hope like he pins big tech against a wall and forces them to bring their full force to bear.
concinds 10y ago
If so, then Google should do the right thing. They know they have a lot of allies, and public opinion, media, NGOs, customers and most voters are on their side. The problem: could Trump do this legally, and legally force Google not to disclose it? What can Trump do with the NSA data? I haven't seen any stories addressing this, beyond vague "concerns".
- cloakandswagger 10y ago
  I don't see much point to hypothesizing about jackbooted Trump soldiers showing up at Google and demanding their data until it happens. Furthermore, it misses the larger point that all of their data is readily and easily collected by the NSA already.
  - matt4077 10y ago
    > Furthermore, it misses the larger point that all of their data is readily and easily collected by the NSA already. Such assertions are counterproductive. They ignore actual statements by google regarding their efforts to improve security against US agency snooping, or Apple's somewhat valiant if ultimately fruitless attempts to defend the iPhone's security against national security interests. We need to specifically call out bad actors and actions, such as Yahoo's eagerness to CC the NSA on all our emails. We also need to reward positive action with praise. Both are methods to provide the incentives for companies to act in our interests: the companies can point to praise to argue that their principled stand makes financial sense, and the employees deserve the recognition by their peer group.

sandworm101 10y ago

The real joke is that all this information is already out there. Infrastructure has already been evaluated. The the enemy is well understood. But you do have to read the reports. You have to trust those writing the reports. You have to not yell them out of the room when they say something that offends your reality. This order is a call for new reports written by new people with the skills necessary to explain cybersecurity to large children. "China bad. Big internet computer need antivirus."

Avshalom 10y ago
Yup: "all the previous work is bullshit 'cause I said so, do it again"
- guest-speaker-4 10y ago
  It's kissing cousins to Not Invented Here (NIH) syndrome.
- jerkstate 10y ago
  Grizzly Steppe illustrated that the intelligence agencies are not working together (NSA had different confidence levels in the conclusions than CIA and FBI - why?) If you got a pen-test report back with those platitudinous security recommendations, you would probably not be very happy signing the check. The Department of Commerce is rightfully responsible for the creation of the private sector report, because NIST is part of the DoC and NIST is where all of the best security guidance is coming from these days (the DoD adopted NIST's security standards, for example).
  - willstrafach 10y ago
    > why? HUMINT vs SIGINT. NSA confidence was moderate as they weight SIGINT-based evidence more heavily. The biggest bits of evidence came from human intelligence sources in Russian government (I believe some were arrested for treason due to this).
shaftway 10y ago

hoodoof 10y ago

crymer11 10y ago
wat? Please show me where it says or even alludes to such things.
- pdkl95 10y ago
  https://www.washingtonpost.com/politics/trump-invites-russia-to-meddle-in-the-us-presidential-race-with-clintons-emails/2016/07/27/a85d799e-5414-11e6-b7de-dfe509430c39_story.html https://www.washingtonpost.com/politics/trump-invites-russia... edit: possibly referring to this?
huntermeyer 10y ago
I don't see that part. "Russia" isn't in the text at all. Would you point out where you're reading that?

taddeimania 10y ago

That's one heck of a wordy security audit request.

danso 10y ago

FWIW, here are 3 executive orders related to cybersecurity that President Obama signed: https://obamawhitehouse.archives.gov/the-press-office/2013/02/12/executive-order-improving-critical-infrastructure-cybersecurity https://obamawhitehouse.archives.gov/the-press-office/2013/0... https://obamawhitehouse.archives.gov/the-press-office/2015/02/13/executive-order-promoting-private-sector-cybersecurity-information-shari https://obamawhitehouse.archives.gov/the-press-office/2015/0... https://obamawhitehouse.archives.gov/the-press-office/2016/02/09/executive-order-commission-enhancing-national-cybersecurity https://obamawhitehouse.archives.gov/the-press-office/2016/0...

deleted 10y ago

[deleted]

notliketherest 10y ago

I think it'd be good for everyone to read these executive orders, rather than jumping to conclusions and acting hysterically.

matt4077 10y ago

Some thoughts, sorry for the long quotes. Start with the second-to-last quote for what I personally find to be the most worrying. As a result of these changes, cyberSpace has emerged as a new domain of engagement, comparable in signi?cance to land, sea, air, and space, and its signi?cance will increase in the years ahead. This raises the possibility of hacking being treated as an act of war, and the resulting actions. I'm not sure if that's the current status quo – I know there was discussion about it a few months ago. The term ?critical infrastructure? means systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters. This does notably seem to exclude anything related to elections. The term ?national security system? means any telecommunications or information system Operated by the Federal Government or any contractor on its behalf, the function, operation, or use of which: [...] is critical to the direct fulfillment of military or intelligence missions (but does not include a system used for routine administrative and business applications, including payroll, finance, logistics, and personnel management applications). This seems to go out of its way to exclude "personnel management applications", which is curious considering exactly such a system was at center of the second-largest hacking scandal involving the government last year. Review Participants. The Secretary of Defense shall co?chair the Vulnerabilities Review with the Secretary of Homeland Security, the Director of National Intelligence, the Assistant to the President for National Security Affairs, and the Assistant to the President for Homeland Security and Counterterrorism. The last three are Dan Coats, Michael Flynn, and Tom Bossert, respectively. It's a bit heavy on the military brass and leans towards the political side to the exclusion of anybody with technical credentials (I'd think someone from the NSA or even the private sector could possibly be useful). But I've always been critical when, for example, judges have been accused to be inadequate to adjudicate technical issue – smart people can and will get the information they need to make right decisions. So let's give them the benefit of the doubt. Possibly relevant: it's two cabinet members vs three people reporting directly to the president. I don't know if these committees ever vote on anything, but that could be intentional to allow the President to keep full control over the direction of the investigation (Cabinet Secretaries being traditionally more independent than anyone in the West Wing) [..]the Secretary of Defense and Secretary of Homeland Security shall also gather and review information from the Department of Education regarding computer science, mathematics, and cyber security education from primary through higher education to understand the ?ll] scope of US. efforts to educate and train the workforce of the future. Th Secretary of Defense shall make recommendations as he sees ?t in order to best position the US. educational system to maintain its competitive advantage into the future. I feel a bit uneasy about Secretary of Defense being authorized to change the primary school curriculum, especially considering the basically limitless scope of "maintain[ing] its competitive advantage into the future". It sounds like they want more math in school. But what if he concludes that the US has plenty of hackers, but they're just not patriotic enough and rather work for Apple (which is actually somewhat true)? [A review shall find ways to incentivice private enterprises to] invest in cyber enterprise risk management tools and services; and adopt best practices with respect to processes and technologies necessary for the increased sharing of and response to real-time cyber threat information. This is once again pretty broad, but I thought it warrants inclusion because any sharing of data collected by private entities with government agencies has the potential to violate individuals' privacy. Overall this isn't really specific enough to scare me, yet. The bit about education is what most effectively raises my blood pressure, while the focus on military systems at the exclusion of anything election-related is somewhat curious.