3 ms·

Taking responsibility for collecting and using vulnerabilty scan data in this case also means assuming authority to do so. A good test would be whether citizens

Taking responsibility for collecting and using vulnerabilty scan data in this case also means assuming authority to do so. A good test would be whether citizens are also free to inspect the vulnerabilities of government systems, or have a right to do so. If they don't, that's worth scrutinizing. Canada has a different approach, where institutions can sign up to using a federal DNS service provided through the domain registrar, which I interpret is not unlike 1.1.1.1 or 9.9.9.9, but with malware detection. I believe it's called Canadian Shield, and it's not active scanning, but rather passive collection from institutions that manage infrastructure. Active scans by government seems a bit like domestic intelligence collection. Given the techincal capabilities of most of these agencies when they work with ISPs, hairpinning traffic from one of these scanned servers for inspection is trivial. Fine if the threat model involved exceptional cases with clear oversight, and individual decision accountability in response to ticking bomb situations, but the examples of how similar powers have been used in the past are so abundant that I'm having trouble remembering a situation where they were used to protect a mere citizen.

deleted 4y ago
[deleted]
- deleted 4y ago
  [deleted]
zemnmez 4y ago
I can personally attest to the fact that yes, british citizens can assess vulnerabilities in UK government systems. This was something I worked with the UKNCSC on: https://www.ncsc.gov.uk/information/vulnerability-reporting https://www.ncsc.gov.uk/information/vulnerability-reporting
- motohagiography 4y ago
  That's pretty cool. There are these pockets of really great public service internet services. Am I interpreting correctly that you can join HackerOne to do work on UK public service projects? I tried to get something like that done for a municipality and a province, where it was going to be a way to engage college students on doing vulnerability hunting on public infrastructure, but also use it as a recruiting pipeline to get people interested in public service.
- michaelt 4y ago
  I can personally attest to the fact that if your uninvited assessment of vulnerabilities reaches the level of gaining unauthorised access to computer systems - i.e. if you find something and check it works - you are technically in violation of the Computer Misuse Act 1990. It's very easy to forget such laws exist because 99.99% of cybercrime goes unpunished - but that's for small victims, with hard-to-find attackers who are likely beyond the police's jurisdiction. If the 'victim' is an important government department, and you are within the police's jurisdiction, you could be one of the few people to actually face punishment - unjust though that may seem.
secstu 4y ago
The NCSC also has a similar service to the Canadian approach you mention, Protected DNS - https://www.ncsc.gov.uk/information/pdns https://www.ncsc.gov.uk/information/pdns I believe CISA in the US has something similar too.
pvg 4y ago
Active scans by government seems a bit like domestic intelligence collection. This is like saying foot patrols are a bit like SWAT raids. They are, a bit, but they are a lot more than a bit entirely unlike them.
autoexec 4y ago
> Canada has a different approach, where institutions can sign up to using a federal DNS service It seems far more invasive to route all your DNS traffic through a untrusted source than having that same source use the exact types of scans attackers are using every day already and report problems they find to you. I can learn a hell of a lot more about you by your DNS history than I can from knowing what ports you have open and what vulnerable services you're running.
j_not_j 4y ago
"where institutions can sign up to using a federal DNS service provided through the domain registrar..." The domain registrar is CIRA, and has only one of twelve board members having a federal government affiliation. See cira.ca for the facts. Their Canadian Shield services uses data from Akamai, Mozilla, and CCCS. It is not "federal". Sigh. Another comment from someone's memory that takes only 2 minutes to fact-check and discover to be incorrect.
- motohagiography 4y ago
  Would you like to elaborate on who collects the data and does the security analysis on it and offers to provide threat intelligence back to the institutions? I can save you a click: https://cyber.gc.ca/en/news-events/canadian-shield-sharing-cyber-centres-threat-intelligence-protect-canadians-during-covid-19 https://cyber.gc.ca/en/news-events/canadian-shield-sharing-c... It's a useful service that I was commenting on as analogous to the one being provided in the UK, and it taking a different and passive approach. Instead of apologizing, my favourite charity can be found at victimsofcommunism\.org

deleted 4y ago

[deleted]

deleted 4y ago
[deleted]

zemnmez 4y ago

I can personally attest to the fact that yes, british citizens can assess vulnerabilities in UK government systems. This was something I worked with the UKNCSC on: https://www.ncsc.gov.uk/information/vulnerability-reporting https://www.ncsc.gov.uk/information/vulnerability-reporting

motohagiography 4y ago
That's pretty cool. There are these pockets of really great public service internet services. Am I interpreting correctly that you can join HackerOne to do work on UK public service projects? I tried to get something like that done for a municipality and a province, where it was going to be a way to engage college students on doing vulnerability hunting on public infrastructure, but also use it as a recruiting pipeline to get people interested in public service.
michaelt 4y ago
I can personally attest to the fact that if your uninvited assessment of vulnerabilities reaches the level of gaining unauthorised access to computer systems - i.e. if you find something and check it works - you are technically in violation of the Computer Misuse Act 1990. It's very easy to forget such laws exist because 99.99% of cybercrime goes unpunished - but that's for small victims, with hard-to-find attackers who are likely beyond the police's jurisdiction. If the 'victim' is an important government department, and you are within the police's jurisdiction, you could be one of the few people to actually face punishment - unjust though that may seem.

secstu 4y ago

The NCSC also has a similar service to the Canadian approach you mention, Protected DNS - https://www.ncsc.gov.uk/information/pdns https://www.ncsc.gov.uk/information/pdns I believe CISA in the US has something similar too.

pvg 4y ago

Active scans by government seems a bit like domestic intelligence collection. This is like saying foot patrols are a bit like SWAT raids. They are, a bit, but they are a lot more than a bit entirely unlike them.

autoexec 4y ago

> Canada has a different approach, where institutions can sign up to using a federal DNS service It seems far more invasive to route all your DNS traffic through a untrusted source than having that same source use the exact types of scans attackers are using every day already and report problems they find to you. I can learn a hell of a lot more about you by your DNS history than I can from knowing what ports you have open and what vulnerable services you're running.

j_not_j 4y ago

"where institutions can sign up to using a federal DNS service provided through the domain registrar..." The domain registrar is CIRA, and has only one of twelve board members having a federal government affiliation. See cira.ca for the facts. Their Canadian Shield services uses data from Akamai, Mozilla, and CCCS. It is not "federal". Sigh. Another comment from someone's memory that takes only 2 minutes to fact-check and discover to be incorrect.

motohagiography 4y ago
Would you like to elaborate on who collects the data and does the security analysis on it and offers to provide threat intelligence back to the institutions? I can save you a click: https://cyber.gc.ca/en/news-events/canadian-shield-sharing-cyber-centres-threat-intelligence-protect-canadians-during-covid-19 https://cyber.gc.ca/en/news-events/canadian-shield-sharing-c... It's a useful service that I was commenting on as analogous to the one being provided in the UK, and it taking a different and passive approach. Instead of apologizing, my favourite charity can be found at victimsofcommunism\.org