6 ms·
President Obama Authorizes Secret Directive to Fight Cyberattacks
- redthrowaway 14y agoHow're they defining "cyberattacks directed at major U.S. networks"? Are we talking a sophisticated attempt to take down trading on the NYSE? Industrial espionage from China? Anonymous running LOIC? This is the problem with sealed executive orders: the only people who know what's up are those issuing or receiving said orders. There's absolutely no oversight or checks and balances against government overreach.
- tptacek 14y agoThat's because the EO (apparently) concerns itself with the operations of systems within the federal government. Government intervention into privately operated systems requires congressional action. The federal government is collectively the largest IT operator in the world, so there's a huge amount of work to be done and policy to be created just in setting governance standards for their own systems, which is what the administration is doing here.
- anigbrowl 14y agoThere's absolutely no oversight or checks and balances against government overreach. Of course there is, that's what Congressional oversight committees are for. When they deal with classified stuff, they do so in closed session. There's a closed intel committee hearing tomorrow about that attack in Libya, for example. Sure, it's not open to the voters, but there are practical limits to transparency.
- tptacek 14y agoGroan. Reporters have already had access to drafts of this executive order. It's a watered-down version of the Lieberman cybersecurity bill, to which CISPA was a watered-down market-friendly alternative. From the thread on the original disclosure of the EO: The Obama bill (note: Obama-supportin' Democrat here) is worse than CISPA: an everything-and-the-kitchen-sink bill that randomly creates incentive programs, new research organizations, a "cybersecurity tip line", and federally funds research into DNSSEC (DNSSEC: Rated S for Statutory). Also worth noting: nothing in the Lieberman bill that this EO is patterned on creates enforcement mechanisms for IP and copyright enforcement, or for collecting customer information from ISPs. Of course, neither did the GOP's CISPA bill. That's because neither regulatory effort is about user information. The problems both of these ill-conceived bills are addressing are simple. Problem 1: There is no coherent strategy in the (vast, sprawling, chaotic) federal government, which is the largest IT operator in probably the world. Every agency does something slightly different. This means (a) nobody is doing exactly the right thing (usually, they aren't doing anything close to the right thing) and (b) it is prohibitively difficult to introduce new technology to help fix things, because everyone you'd get to buy it has a different set of hoops to jump through. Problem 2: If you were a foreign adversary who wanted to cripple the US with electronic attacks, you probably wouldn't bother hitting government IT systems. Instead, you'd go for something like the power grid, or a trading exchange. Those systems are privately operated, and so nothing the government does to try to track, monitor, or deflect online attacks can benefit them.
- brown9-2 14y agoSo when you say "worse", you mean less effective?
- tptacek 14y agoYes. I broadly and specifically oppose measures designed to reduce our privacy, or to grant the government warrantless access to our emails or communications. But at the same time, the insecurity of critical systems in the US is a real problem, and it is reasonable to assert that it demands some kind of intervention, and thus to measure proposals like this by how much of a dent they put in the problem. As it happens, the privacy impact of this EO and of CISPA are minimal. The privacy impact of the Lieberman-Collins act is marginally greater, but the market impact of it is much worse, and I anticipate that it would do a much poorer job of addressing the problem.
- slurgfest 14y agoThis post may be a little confusing. Do you mean to suggest that Obama has reached beyond executive authority, circumventing the legislature to establish a new SOPA? or is that unintentional? Because when you say this EO is a watered-down version of a bill, and CISPA was a watered-down version of that, and say that what Obama likes is 'worse' than CISPA - what many people are going to hear is that this EO is the super-mega-SOPA that will take away all their freedoms, and this time sneakily enacted by Obama alone - not that you just think these measures are ill-conceived because they do little to improve security.
- tptacek 14y agoI don't know what any of this has to do with SOPA. Or rather: I'm pretty sure none of this has anything to do with SOPA. Even in the early CISPA drafts that mentioned "intellectual property", the animating concern was the theft of source trees and market data, not Creed CDs (intellectual property was stricken from the final version of CISPA passed by the house). Technology is a big topic. You should just assume that most bills (and EO's) pertaining to technology are not extensions of SOPA, which was a copyright enforcement measure.
- karlgrz 14y agoSecret's out, I guess.
- ajsharp 14y agoReal secret, ain't it :)