3 ms·

Wouldn't it just be a law requiring ISP's to kill peering upon the government's request? Am I missing something here? If it isn't feasible, I would think that

Wouldn't it just be a law requiring ISP's to kill peering upon the government's request? Am I missing something here? If it isn't feasible, I would think that's because it isn't legal, not because of a technical hurdle.

roc 16y ago
If the "Kill Switch" bill passes, the legal question will be answered. As no-one's optimistic the bill will fail [1] commentary has moved on to: can it actually be implemented? Personally, I don't see that being a very interesting question either. Once it's law, "Kill Switch"-Compliance will get built into the big switches and routers. It would only be a technical challenge to implement in the near term. And I don't think you can be paranoid-enough to think the government plans on hitting this switch in the near term, yet be rational enough to believe the government would wait for legal authority to do so. So whether it's feasible in the next 5 years is pretty academic. [1] If people aren't going to take issue with standing constitution-free-zones covering 80% of the population, the growing surveillance state, increasingly-intrusive security theatre at the airport and greenlit assassinations of suspected terrorist US citizens, an argument about internet access during hypothetical 'states of emergency' has a snowball's chance in hell.
- wmf 16y ago
  I think you're right on. People complained that CALEA was technically infeasible, but those people just didn't understand it; ISPs are obligated to make CALEA work and they complied even if it meant redesigning their networks. If ISPs have to update their OSS systems to support the "kill switch", they will do it.
  - bitskits 16y ago
    That's actually the example [CALEA] I had in mind as well. I don't see a huge technical hurdle here, other than maybe a script to disable all peering interfaces for every ISP in the US. This could be done by hand just as easily should Uncle Sam come knocking. The real issue, to me, is the why behind this. The only real motivator is to prevent people from organizing to overtake a government they perceive as corrupt. Is it really worth exploring crippling our economy and stifling free speech at the same time? Forget the technical hurdle, what about the constitutional one? Interesting that we also claim to have a way to "force" internet on a country who kills it, but at the same time are looking for a legal basis to kill it ourselves.
    - roc 16y ago
      > "Forget the technical hurdle, what about the constitutional one?" We haven't had much luck with that one lately. I don't think the "Why" is quite so transparently dystopian. They don't want to turn off the entire internet. It's just another attempted end-run around the judicial process, to make it easier to further political and economic goals. e.g. filtering WikiLeaks or BitTorrent. The idea that they would need this to disconnect critical infrastructure to protect it from cyberattack is laughable. Any critical infrastructure that could still operate independent from the internet should not have a connection to the internet, and if it did should certainly have it's own disconnect capability. The only reason to put disconnect capability on the ISP or backbone carrier is to do it against the will of the target facility. If they wanted to protect things like the Hoover Dam [1] they'd just issue/enforce some government regs. [2] [1] The Dam Authority has already taken issue with being a talking point in this debate. Pointing out that, no, they are not foolish enough to have dam controls connected to the internet. [2] I'm pretty sure these already exist, as regards air-gaps for critical infrastructure and security requirements for networks that do have a connection to the public internet. There may not be a unified national service to flip connection-kill-switches, but that would be resolved with a government network project, not a new law. The government already has legal authority over infrastructure.
    - security_ish 16y ago
      While I don't think it is technically impossible, I don't think it is as quick and easy to deploy and support as CALEA. For example... - ISPs would have to be able to characterize all their connections and subnets as being part of the critical infrastructure and of which parts of the critical infrastructure those users or networks were members. - This entails insane tracking and management - literally thousands of smaller CIP organizations might be served by one ISP - they have to know in real time what IPs/ranges/etc, and on what ports, those organizations are operating - Central management or the ability to engage the 'kill switch' implies that there is some means of remotely (read: outside the ISP control) engage the kill switch and remove those organizations from the network All of those points (and many more I can include later) make this vastly different from CALEA, where a warrant compels ISP personnel to engage collection on an IP or target of interest and to turn over that capture to the authorities. That puts the control in the hands of the ISP - the kill switch would put the controls of ISP assets in the hands of the government.
- joe_the_user 16y ago
  The thing about the article is that it points that it would be very hard to determine how to "limit traffic to critical infrastructure". But "conveniently", when a state has a mandate that "must be done" while being hard to do surgically, that state has mandate to muck-about as it sees fit (that's why search warrants are supposed to specific, etc). So "conveniently", it may turn out that to implement the bill, ISPes would be required to install flexible remote controlled switches of various sorts. Meaning that the real impact of the bill would be the configuration of a remote-controlled censoring system. IE, a Great-Firewall-of-America "by accident" (yeah).

roc 16y ago

If the "Kill Switch" bill passes, the legal question will be answered. As no-one's optimistic the bill will fail [1] commentary has moved on to: can it actually be implemented? Personally, I don't see that being a very interesting question either. Once it's law, "Kill Switch"-Compliance will get built into the big switches and routers. It would only be a technical challenge to implement in the near term. And I don't think you can be paranoid-enough to think the government plans on hitting this switch in the near term, yet be rational enough to believe the government would wait for legal authority to do so. So whether it's feasible in the next 5 years is pretty academic. [1] If people aren't going to take issue with standing constitution-free-zones covering 80% of the population, the growing surveillance state, increasingly-intrusive security theatre at the airport and greenlit assassinations of suspected terrorist US citizens, an argument about internet access during hypothetical 'states of emergency' has a snowball's chance in hell.

wmf 16y ago
I think you're right on. People complained that CALEA was technically infeasible, but those people just didn't understand it; ISPs are obligated to make CALEA work and they complied even if it meant redesigning their networks. If ISPs have to update their OSS systems to support the "kill switch", they will do it.
- bitskits 16y ago
  That's actually the example [CALEA] I had in mind as well. I don't see a huge technical hurdle here, other than maybe a script to disable all peering interfaces for every ISP in the US. This could be done by hand just as easily should Uncle Sam come knocking. The real issue, to me, is the why behind this. The only real motivator is to prevent people from organizing to overtake a government they perceive as corrupt. Is it really worth exploring crippling our economy and stifling free speech at the same time? Forget the technical hurdle, what about the constitutional one? Interesting that we also claim to have a way to "force" internet on a country who kills it, but at the same time are looking for a legal basis to kill it ourselves.
  - roc 16y ago
    > "Forget the technical hurdle, what about the constitutional one?" We haven't had much luck with that one lately. I don't think the "Why" is quite so transparently dystopian. They don't want to turn off the entire internet. It's just another attempted end-run around the judicial process, to make it easier to further political and economic goals. e.g. filtering WikiLeaks or BitTorrent. The idea that they would need this to disconnect critical infrastructure to protect it from cyberattack is laughable. Any critical infrastructure that could still operate independent from the internet should not have a connection to the internet, and if it did should certainly have it's own disconnect capability. The only reason to put disconnect capability on the ISP or backbone carrier is to do it against the will of the target facility. If they wanted to protect things like the Hoover Dam [1] they'd just issue/enforce some government regs. [2] [1] The Dam Authority has already taken issue with being a talking point in this debate. Pointing out that, no, they are not foolish enough to have dam controls connected to the internet. [2] I'm pretty sure these already exist, as regards air-gaps for critical infrastructure and security requirements for networks that do have a connection to the public internet. There may not be a unified national service to flip connection-kill-switches, but that would be resolved with a government network project, not a new law. The government already has legal authority over infrastructure.
  - security_ish 16y ago
    While I don't think it is technically impossible, I don't think it is as quick and easy to deploy and support as CALEA. For example... - ISPs would have to be able to characterize all their connections and subnets as being part of the critical infrastructure and of which parts of the critical infrastructure those users or networks were members. - This entails insane tracking and management - literally thousands of smaller CIP organizations might be served by one ISP - they have to know in real time what IPs/ranges/etc, and on what ports, those organizations are operating - Central management or the ability to engage the 'kill switch' implies that there is some means of remotely (read: outside the ISP control) engage the kill switch and remove those organizations from the network All of those points (and many more I can include later) make this vastly different from CALEA, where a warrant compels ISP personnel to engage collection on an IP or target of interest and to turn over that capture to the authorities. That puts the control in the hands of the ISP - the kill switch would put the controls of ISP assets in the hands of the government.
joe_the_user 16y ago
The thing about the article is that it points that it would be very hard to determine how to "limit traffic to critical infrastructure". But "conveniently", when a state has a mandate that "must be done" while being hard to do surgically, that state has mandate to muck-about as it sees fit (that's why search warrants are supposed to specific, etc). So "conveniently", it may turn out that to implement the bill, ISPes would be required to install flexible remote controlled switches of various sorts. Meaning that the real impact of the bill would be the configuration of a remote-controlled censoring system. IE, a Great-Firewall-of-America "by accident" (yeah).