4 ms·

Key passage from the article: "Probably the most controversial language begins in Section 201, which permits the president to "direct the national response to

by miked 17y ago

Key passage from the article: "Probably the most controversial language begins in Section 201, which permits the president to "direct the national response to the cyber threat" if necessary for "the national defense and security." The White House is supposed to engage in "periodic mapping" of private networks deemed to be critical, and those companies "shall share" requested information with the federal government. ("Cyber" is defined as anything having to do with the Internet, telecommunications, computers, or computer networks.)" "The language has changed but it doesn't contain any real additional limits," EFF's Tien says. "It simply switches the more direct and obvious language they had originally to the more ambiguous (version)...The designation of what is a critical infrastructure system or network as far as I can tell has no specific process. There's no provision for any administrative process or review. That's where the problems seem to start. And then you have the amorphous powers that go along with it."

tptacek 17y ago
That's Sec. 18 (5). It says: (5) shall direct the periodic mapping of Federal Government and United States critical infrastructure information systems or networks, and shall develop metrics to measure the effectiveness of the mapping process; Which is to say, the government will have an inventory of its networked assets. Which, if the WaPo ran an expose about how the government didn't have an inventory of their assets (they don't), we'd be writing comments making fun of them about. The thing that's freaking people out is Sec 23 (3), which says: (3) FEDERAL GOVERNMENT AND UNITED STATES CRITICAL INFRASTRUCTURE INFORMATION SYSTEMS AND NETWORKS- The term ‘Federal Government and United States critical infrastructure information systems and networks’ includes-- (A) Federal Government information systems and networks; and 3 (B) State, local, and nongovernmental information systems and networks in the United States designated by the President as critical infrastructure information systems and networks. 23 (3) (B) allows the president to designate a "nongovernmental information system" as critical. That's scary until you realize that: * There clearly are nongovernmental information systems, such as SCADA and nuclear controls facilities, or E911, or GSM towers. * Those nongovernmental systems are often scarier than the systems this bill is really going to impact, viz. secretary desktops at Interior. * The other requirements of this bill w/r/t those designated critical systems are so onerous that it's unlikely too many systems will be so designated. * Those nongovernmental systems are often already under intrusive regulation, for instance NERC/FERC, and this bill is just aiming to harmonize that. I'm not saying I like the language here. I don't. But it's just a badly written bill. It's not a conspiracy.
- jaekwon 17y ago
  I agree, the wording could be misinterpreted, but it's clearly not the intention.
  - anamax 17y ago
    > I agree, the wording could be misinterpreted, but it's clearly not the intention. How do you know the intent of the bill's authors and the folks who are likely to vote in favor? (I'm not doubting you, I'm asking about your sources.)

by miked 17y ago

tptacek 17y ago

That's Sec. 18 (5). It says: (5) shall direct the periodic mapping of Federal Government and United States critical infrastructure information systems or networks, and shall develop metrics to measure the effectiveness of the mapping process; Which is to say, the government will have an inventory of its networked assets. Which, if the WaPo ran an expose about how the government didn't have an inventory of their assets (they don't), we'd be writing comments making fun of them about. The thing that's freaking people out is Sec 23 (3), which says: (3) FEDERAL GOVERNMENT AND UNITED STATES CRITICAL INFRASTRUCTURE INFORMATION SYSTEMS AND NETWORKS- The term ‘Federal Government and United States critical infrastructure information systems and networks’ includes-- (A) Federal Government information systems and networks; and 3 (B) State, local, and nongovernmental information systems and networks in the United States designated by the President as critical infrastructure information systems and networks. 23 (3) (B) allows the president to designate a "nongovernmental information system" as critical. That's scary until you realize that: * There clearly are nongovernmental information systems, such as SCADA and nuclear controls facilities, or E911, or GSM towers. * Those nongovernmental systems are often scarier than the systems this bill is really going to impact, viz. secretary desktops at Interior. * The other requirements of this bill w/r/t those designated critical systems are so onerous that it's unlikely too many systems will be so designated. * Those nongovernmental systems are often already under intrusive regulation, for instance NERC/FERC, and this bill is just aiming to harmonize that. I'm not saying I like the language here. I don't. But it's just a badly written bill. It's not a conspiracy.

jaekwon 17y ago
I agree, the wording could be misinterpreted, but it's clearly not the intention.
- anamax 17y ago
  > I agree, the wording could be misinterpreted, but it's clearly not the intention. How do you know the intent of the bill's authors and the folks who are likely to vote in favor? (I'm not doubting you, I'm asking about your sources.)