7 ms·

New US cybersecurity bill could threaten free software

104 points by tjr 16y ago

joe_the_user 16y ago
The bill might have changed since this was written. Current I see "(1) IN GENERAL- The owners and operators of covered critical infrastructure shall have flexibility in their cybersecurity plans to implement any cybersecurity measure, or combination thereof, to satisfy the cybersecurity performance requirements described in subsection (c) and the first-party regulatory agency or sector-specific agency may not disapprove under this section any proposed cybersecurity measures, or combination thereof, based on the presence or absence of any particular cybersecurity measure if the proposed cybersecurity measures, or combination thereof, satisfy the cybersecurity performance requirements established by the Director under subsection (c)." ( http://thomas.loc.gov/cgi-bin/query/F?c111:1:./temp/~c111l3ROpa:e13057 http://thomas.loc.gov/cgi-bin/query/F?c111:1:./temp/~c111l3R...: ) Which seems to specifically state you can choose any approach you want as long as you secure the site. Maybe there's something I missed.
- smokeyj 16y ago
  They can simply require a security measures that is protected by existing IP, thus leaving network security up to the biggest patent-trolls with a lobbying budget. I would much rather entrust security to market-driven solutions, not some herp derp government agency.
  - tptacek 16y ago
    Market-driven security is failing us. It's luck, not sound engineering, that is preventing catastrophe. I can respect that regulation would be even worse than catastrophe, but have a hard time dignifying the argument that there's no tradeoff.
    - deleted 16y ago
      [deleted]
    - joe_the_user 16y ago
      Thom, I think you're confusing market-driven security levels with market-driven security products. Big-website-taking-lots-of-citizen-data: I don't need security, the market hasn't demanded it. The-State: I'm demanding it. Go buy good security, I don't care how. Big-website-taking-lots-of-citizen-data: Ah, Ok, I think I've found it. The-State: good, just give me outline so I know. Big-website-taking-lots-of-citizen-data: here you go. While the anarchist in me might just hate the state and the large corporations, here no one has yet shown how any of these are doing dastardly deeds. And that's a fine exception to the rule, really.
      - tptacek 16y ago
        This bill isn't about "big-website-taking-lots-of-citizen-data". To save us a really pointless and boring argument, let's stipulate that it's about Exelon and not about eBay, and to the extent it isn't, that's a flaw that needs to be corrected.
        joe_the_user 16y ago
        ... orthogonal to my earlier argument...
    - Andys 16y ago
      How about PCI-DSS (as a counterpoint)?
      - tptacek 16y ago
        There's plusses and minuses to PCI. On the plus side, it has absolutely increased awareness of web security at commerce companies, and further it has pushed people from trying to do their own credit card handling to outsourcing that function to companies that can keep on top of it. On the minus side, it's spawned a small industry of checkbox consultants who do companies a disservice by allowing them to believe they've been audited and assured when really nothing of the sort has happened. It's not hard to trace public incidents back to the PCI auditors who OK'd those companies.
jrockway 16y ago
I skimmed the bill but couldn't find any reference to "specific proprietary software". What are we talking here, Cisco routers or something?
- wooster 16y ago
  I presume it's a reference to the Common Criteria certification requirements. So: http://www.commoncriteriaportal.org/products/ http://www.commoncriteriaportal.org/products/
tomjen3 16y ago
That's true, but the headline is am understatement. This line of legislation will kill Silicon valley. Who can afford $100k/day when you are just two guys in a garage? Or even writing cyber defence plans and submit them to DHS?
tptacek 16y ago
Both the FSF and CNet's sources are making the same complaint about the proposed bill: that it allows DHS to designate private networks as "critical national infrastructure", and that the terminology in the bill is so broad that it would allow (say) eBay to be declared critical infrastructure. The reality is, while the bill sucks and the language is fuzzy, the intent is clear: critical private national infrastructure means air traffic control and the power grid. Maybe, under the broadest interpretation, they might call the NASDAQ ECNs part of the "nation's information infrastructure".† The bill makes no mention of proprietary software or hardware. The FSF is apparently reacting to the notion of DHS having any authority over the operation of networks; the notional concern is, "if they can dictate operational terms, they can dictate Cisco and Microsoft". They could just as well dictate Linux or Apache. It is a fair critique of this bill that DHS has virtually no expertise in this area (despite repeated appeals to US-CERT, which, respectishly, doesn't have the requisite expertise either). Personally, while virtually everyone else on HN is going to disagree with me, I think it's less fair to criticize the notion of FedGov nationalizing the security of private networks in an emergency. I have several reasons for arguing this: * * * It is simply the truth that vast amounts of our critical infrastructure are privately owned and operated, and while reasonable and mostly hands-off regulation may enable utility operators to serve the public good using their own best judgement, that same regulation does nothing to deal with malicious adversaries. * * * The government already has the "shadow" authority to accomplish these goals. Does anyone seriously believe the President lacks the ability to nationalize power grid security in the event that an attack makes the midwest go dark? Of course he can. It's better to be explicit about that authority now, when we're not panicking over an actual technological attack, than it will be for us to create de facto new rules in a crisis. * * * There is a real risk that companies managing critical infrastructure might not realize that their networks are critical infrastructure, or, worse, might not care. We have decades worth of track record for companies not disclosing horrible incidents for fear of economic consequences. It's one thing when a retail chain delays disclosure of credit card leaks; it's another when a grid operator gets owned up. † Systems can be designated if "the destruction or the disruption of the reliable operation of the system or asset would cause a national or regional catastrophe"; specific factors that must be considered include whether an attack would cause "a mass casualty event with an extraordinary number of fatalities", "severe economic consequences", "mass evacuations with a prolonged absence", or "severe degradation of national security capabilities, including intelligence and defense functions".
Bud 16y ago
Ever since W started tacking "Homeland" onto everything he could find, the presence of that word on ANYTHING has been a guarantee that that thing a) sucks, b) is unnecessary, and c) is a grave threat to civil liberties. Thanks for the useful shorthand, W!
- tptacek 16y ago
  The civil liberty to which you refer in this comment is "the right to run a region electric grid provider free from government intervention". Hardly the stuff of Thomas Paine.
  - Natsu 16y ago
    Is it really so unreasonable to suppose that politicians and bureaucrats will, when convenient, interpret this vague bill in such a way as to allow them carte blanche to regulate whatever they want? One way I would improve the bill is to target a list of specific industries. They can amend that list later if gaps are identified. They can even have someone write up reports about which other industries ought to be on the list.
    - rbanffy 16y ago
      > when convenient, interpret this vague bill in such a way as to allow them carte blanche to regulate whatever they want? Or, more dangerously, in ways their corporate sponsors find profitable?
      - tptacek 16y ago
        Yawn. It's like you think nobody has ever made this point before. It's the most boring conceivable objection. Don't be boring.
        deleted 16y ago
        [deleted]
        16y ago
mikecane 16y ago
Just remember this, kids: Did any of you imagine TSA would lead to crotches being grabbed in the name of "national security"? There will come a day when all computing purchases will be "routinely" reported to DHS. And every member of IT staff will need a Fed license.
- tptacek 16y ago
  Instead of resting on "government is bad, m'kay", how about taking a crack at suggesting something to improve the bill? That's something people can actually debate productively.
  - noarchy 16y ago
    Bills are not written by people on discussion boards. They are written by lobbyists, and then adopted by legislators who rarely even read the bills on which they vote.
    - tptacek 16y ago
      What's your point? Presumably, you're commenting for a reason.
      - smokeyj 16y ago
        It appears OP doesn't trust lobbyists to ensure security.
    - eftpotrm 16y ago
      Then perhaps you might like to campaign and vote against legislators you believe are representing your opinion so poorly? With primary elections it's far from impossible to get rid of bad candidates. Cynicism is a free pass for bad legislators to continue operating badly. Reasoned, constructive, informed opposition is needed to get the desired outcomes.
  - binarybits 16y ago
    Why improve the bill when it's not obvious there's a problem here that requires Congressional action to solve?

104 points by tjr 16y ago

The bill might have changed since this was written. Current I see "(1) IN GENERAL- The owners and operators of covered critical infrastructure shall have flexibility in their cybersecurity plans to implement any cybersecurity measure, or combination thereof, to satisfy the cybersecurity performance requirements described in subsection (c) and the first-party regulatory agency or sector-specific agency may not disapprove under this section any proposed cybersecurity measures, or combination thereof, based on the presence or absence of any particular cybersecurity measure if the proposed cybersecurity measures, or combination thereof, satisfy the cybersecurity performance requirements established by the Director under subsection (c)." ( http://thomas.loc.gov/cgi-bin/query/F?c111:1:./temp/~c111l3ROpa:e13057 http://thomas.loc.gov/cgi-bin/query/F?c111:1:./temp/~c111l3R...: ) Which seems to specifically state you can choose any approach you want as long as you secure the site. Maybe there's something I missed.

smokeyj 16y ago
They can simply require a security measures that is protected by existing IP, thus leaving network security up to the biggest patent-trolls with a lobbying budget. I would much rather entrust security to market-driven solutions, not some herp derp government agency.
- tptacek 16y ago
  Market-driven security is failing us. It's luck, not sound engineering, that is preventing catastrophe. I can respect that regulation would be even worse than catastrophe, but have a hard time dignifying the argument that there's no tradeoff.
  - deleted 16y ago
    [deleted]
  - joe_the_user 16y ago
    Thom, I think you're confusing market-driven security levels with market-driven security products. Big-website-taking-lots-of-citizen-data: I don't need security, the market hasn't demanded it. The-State: I'm demanding it. Go buy good security, I don't care how. Big-website-taking-lots-of-citizen-data: Ah, Ok, I think I've found it. The-State: good, just give me outline so I know. Big-website-taking-lots-of-citizen-data: here you go. While the anarchist in me might just hate the state and the large corporations, here no one has yet shown how any of these are doing dastardly deeds. And that's a fine exception to the rule, really.
    - tptacek 16y ago
      This bill isn't about "big-website-taking-lots-of-citizen-data". To save us a really pointless and boring argument, let's stipulate that it's about Exelon and not about eBay, and to the extent it isn't, that's a flaw that needs to be corrected.
      - joe_the_user 16y ago
        ... orthogonal to my earlier argument...
  - Andys 16y ago
    How about PCI-DSS (as a counterpoint)?
    - tptacek 16y ago
      There's plusses and minuses to PCI. On the plus side, it has absolutely increased awareness of web security at commerce companies, and further it has pushed people from trying to do their own credit card handling to outsourcing that function to companies that can keep on top of it. On the minus side, it's spawned a small industry of checkbox consultants who do companies a disservice by allowing them to believe they've been audited and assured when really nothing of the sort has happened. It's not hard to trace public incidents back to the PCI auditors who OK'd those companies.

jrockway 16y ago

I skimmed the bill but couldn't find any reference to "specific proprietary software". What are we talking here, Cisco routers or something?

wooster 16y ago
I presume it's a reference to the Common Criteria certification requirements. So: http://www.commoncriteriaportal.org/products/ http://www.commoncriteriaportal.org/products/

tomjen3 16y ago

That's true, but the headline is am understatement. This line of legislation will kill Silicon valley. Who can afford $100k/day when you are just two guys in a garage? Or even writing cyber defence plans and submit them to DHS?

tptacek 16y ago

Both the FSF and CNet's sources are making the same complaint about the proposed bill: that it allows DHS to designate private networks as "critical national infrastructure", and that the terminology in the bill is so broad that it would allow (say) eBay to be declared critical infrastructure. The reality is, while the bill sucks and the language is fuzzy, the intent is clear: critical private national infrastructure means air traffic control and the power grid. Maybe, under the broadest interpretation, they might call the NASDAQ ECNs part of the "nation's information infrastructure".† The bill makes no mention of proprietary software or hardware. The FSF is apparently reacting to the notion of DHS having any authority over the operation of networks; the notional concern is, "if they can dictate operational terms, they can dictate Cisco and Microsoft". They could just as well dictate Linux or Apache. It is a fair critique of this bill that DHS has virtually no expertise in this area (despite repeated appeals to US-CERT, which, respectishly, doesn't have the requisite expertise either). Personally, while virtually everyone else on HN is going to disagree with me, I think it's less fair to criticize the notion of FedGov nationalizing the security of private networks in an emergency. I have several reasons for arguing this: * * * It is simply the truth that vast amounts of our critical infrastructure are privately owned and operated, and while reasonable and mostly hands-off regulation may enable utility operators to serve the public good using their own best judgement, that same regulation does nothing to deal with malicious adversaries. * * * The government already has the "shadow" authority to accomplish these goals. Does anyone seriously believe the President lacks the ability to nationalize power grid security in the event that an attack makes the midwest go dark? Of course he can. It's better to be explicit about that authority now, when we're not panicking over an actual technological attack, than it will be for us to create de facto new rules in a crisis. * * * There is a real risk that companies managing critical infrastructure might not realize that their networks are critical infrastructure, or, worse, might not care. We have decades worth of track record for companies not disclosing horrible incidents for fear of economic consequences. It's one thing when a retail chain delays disclosure of credit card leaks; it's another when a grid operator gets owned up. † Systems can be designated if "the destruction or the disruption of the reliable operation of the system or asset would cause a national or regional catastrophe"; specific factors that must be considered include whether an attack would cause "a mass casualty event with an extraordinary number of fatalities", "severe economic consequences", "mass evacuations with a prolonged absence", or "severe degradation of national security capabilities, including intelligence and defense functions".

Bud 16y ago

Ever since W started tacking "Homeland" onto everything he could find, the presence of that word on ANYTHING has been a guarantee that that thing a) sucks, b) is unnecessary, and c) is a grave threat to civil liberties. Thanks for the useful shorthand, W!

tptacek 16y ago
The civil liberty to which you refer in this comment is "the right to run a region electric grid provider free from government intervention". Hardly the stuff of Thomas Paine.
- Natsu 16y ago
  Is it really so unreasonable to suppose that politicians and bureaucrats will, when convenient, interpret this vague bill in such a way as to allow them carte blanche to regulate whatever they want? One way I would improve the bill is to target a list of specific industries. They can amend that list later if gaps are identified. They can even have someone write up reports about which other industries ought to be on the list.
  - rbanffy 16y ago
    > when convenient, interpret this vague bill in such a way as to allow them carte blanche to regulate whatever they want? Or, more dangerously, in ways their corporate sponsors find profitable?
    - tptacek 16y ago
      Yawn. It's like you think nobody has ever made this point before. It's the most boring conceivable objection. Don't be boring.
      - deleted 16y ago
        [deleted]
      - 16y ago

mikecane 16y ago

Just remember this, kids: Did any of you imagine TSA would lead to crotches being grabbed in the name of "national security"? There will come a day when all computing purchases will be "routinely" reported to DHS. And every member of IT staff will need a Fed license.

tptacek 16y ago
Instead of resting on "government is bad, m'kay", how about taking a crack at suggesting something to improve the bill? That's something people can actually debate productively.
- noarchy 16y ago
  Bills are not written by people on discussion boards. They are written by lobbyists, and then adopted by legislators who rarely even read the bills on which they vote.
  - tptacek 16y ago
    What's your point? Presumably, you're commenting for a reason.
    - smokeyj 16y ago
      It appears OP doesn't trust lobbyists to ensure security.
  - eftpotrm 16y ago
    Then perhaps you might like to campaign and vote against legislators you believe are representing your opinion so poorly? With primary elections it's far from impossible to get rid of bad candidates. Cynicism is a free pass for bad legislators to continue operating badly. Reasoned, constructive, informed opposition is needed to get the desired outcomes.
- binarybits 16y ago
  Why improve the bill when it's not obvious there's a problem here that requires Congressional action to solve?