10 ms·

President Obama creates new cyber sanctions programme

132 points by tekacs 12y ago

basicallydan 12y ago
I'm a little surprised that this BBC article doesn't mention the ongoing DDoS attack on GitHub by China. Does it seem like this programme could give US authorities the power to sanction the Chinese government over something like a DDoS attack? EDIT: Ah, looks like GitHub is back to normal. Maybe the attacks are over now?
- PaulMougel 12y ago
  GitHub has indeed been operating normally since the 31st; see https://status.github.com/messages https://status.github.com/messages .
  - golergka 12y ago
    This doesn't mean that they don't get attacked.
- drzaiusapelord 12y ago
  This is exactly what this is. China and Russia have legitimized cybercrime. Its done openly with approval of the goverment. See Brian Kreb's expose on various cyberwarrior Russian companies that operate with impunity. The US can identify these companies and sanction them, which is something they should have done long ago. If you don't want sanctions, don't attack our infrastructure or citizens. Autocratic one party states need to be reminded that we won't stand for this shit any longer. What China did to Github is inexcusable and deserves a response.
  - notsony 12y ago
    > What China did to Github is inexcusable. How do you know it was China? An IP address does not mean the person sitting behind the computer is Chinese. The person could just as easily be controlling a botnet from a VPN while sipping a latte in a coffee shop in Palo Alto.
    - igammarays 12y ago
      Read the details of the attack. It's not a botnet. The attack works by injecting malicious JavaScript into common websites within Chinese borders, and doing this only for visitors of these files from outside China. Only the Great Firewall (or the website owners, ie. government-controlled Baidu) can possibly do that. http://www.netresec.com/?month=2015-03&page=blog&post=china%27s-man-on-the-side-attack-on-github http://www.netresec.com/?month=2015-03&page=blog&post=china%...
  - wongarsu 12y ago
    >What China did to Github is inexcusable and deserves a response. Github arguably operates in China by offering their website there. At the same time Github is refusing to meet demands by the Chinese government. Their refusal to meet those demands directly undermines policy enacted by the Chinese government. Now the Chinese government tried using their power to enforce their policy decisions. I'm not saying it's right, but it doesn't seem that different from what's the norm these days. The only difference between China and powerful western countries is the kind of policy they enforce (censorship, not copyright protection or nuclear arms treaties etc).
cooked 12y ago
> sanction "individuals or entities" that pose a cyber threat to the "national security, foreign policy, or economic health or financial stability of the United States," If you detangle the weasel words, this is basically "emergency executive powers to do whatever we want to people we don't like, as long as we can tie it back to the internet". Combined with the existing surveillance dragnet, that's horrifying.
- nickysielicki 12y ago
  2015 seems to be the year for multi-national globalization to really kick into gear. TPP, this, what's next?
- tekacs 12y ago
  Speaking of those words, it's worth noting that those points (national security, foreign policy, economic health/financial stability) are the same that GCHQ [is charged][1] to protect (I'd cite NSA, but I'm not familiar with where to find a list of their responsibilities). [1]: https://en.wikipedia.org/wiki/GCHQ#Legal_basis https://en.wikipedia.org/wiki/GCHQ#Legal_basis
- bstar77 12y ago
  It's sad that this is the exact same conclusion I came to. I have zero confidence that executive powers like this won't somehow be abused to target Americans that pose no threat to national security.
  - balabaster 12y ago
    I think "zero confidence" underplays it. The U.S. Government has a history of abusing their executive powers. Given their past behavior and not only a complete absence of remorse, but proactive justification of their abuses, it seems as though abuse of those powers is almost a foregone conclusion.
    - tljr 12y ago
      The cliche's were right all along. It does corrupt absolutely.
nickysielicki 12y ago
First of all, this article doesn't have a single criticism of this? It is really scary to me that our lawmakers are enacting legislation for topics they have absolutely no personal experience with. Their decisions are based on what can only amount to 100 hours, optimistically, of information sessions given by people representing multinationals with agendas. All I want to know is what the hell constitutes a "malicious cyber activity". Is that as innocuous as U.S. v Auernheimer?
- GabrielF00 12y ago
  No lawmakers voted on anything. It's an executive order.
  - nickysielicki 12y ago
    I know. I'm just saying in general.
    - GabrielF00 12y ago
      I understand your comment, and I agree that there have been plenty of examples of lawmakers misunderstanding technology, but this isn't really an issue that's unique to technology. Lawmakers vote on bills on dozens of extremely complex subjects, ranging from agriculture to foreign policy. No single person could have a deep understanding of all the issues that come up in Congress. I don't think that cybersecurity is any more complicated than health care economics or agricultural subsidies. It's just the nature of trying to govern an incredibly complicated country.
  - tptacek 12y ago
    Lawmakers voted on 50 U.S.C. 1702, which is what gives the President the ability to issue this executive order. The President can't just make up powers. He's been delegated a whole mess of them by congress, contingent on the declaration of a national emergency.
  - dragonwriter 12y ago
    > No lawmakers voted on anything. It's an executive order. How do you think that all the laws that the President cites at the top of the order that provide the authority under which the order is issued were passed? [0] [0] "By the authority vested in me as President by the Constitution and the laws of the United States of America, including the International Emergency Economic Powers Act (50 U.S.C. 1701 et seq.) (IEEPA), the National Emergencies Act (50 U.S.C. 1601 et seq.) (NEA), section 212(f) of the Immigration and Nationality Act of 1952 (8 U.S.C. 1182(f)), and section 301 of title 3, United States Code, [...]" -- https://www.whitehouse.gov/the-press-office/2015/04/01/executive-order-blocking-property-certain-persons-engaging-significant-m https://www.whitehouse.gov/the-press-office/2015/04/01/execu...
yAnonymous 12y ago
So, are the U.S. going to sanction themselves?
- arh68 12y ago
  Good question. Should the US be sanctioned for DDoSing North Korea? Should the US be surprised when China enacts similar legislation?
  - borgia 12y ago
    > Should the US be surprised when China enacts similar legislation? I wouldn't be surprised to see Obama label such an act by China as an "act of war".
    - LLWM 12y ago
      I would. Doing that without any follow-up erodes your credibility. And the US is not going to go to war with China.
  - stefantalpalaru 12y ago
    You seem confused. Watch a few seasons of Homeland and it will all become clear: no matter what atrocities the good guys are doing, they always have good justifications. Which may need to remain secret, just like the proof that NK was involved in the Sony breach, but it's all for the common good.
- deleted 12y ago
  [deleted]
belorn 12y ago
I guess its a start, even if the irony seems a bit thick with NSA on the forefront with offensive cyber operations. Has there been anything similar to Stuxnet from China?
chucksmart 12y ago
Sidestep Congress with a 'national emergency.' Really necessary?
- dragonwriter 12y ago
  A national emergency declaration doesn't sidestep Congressional oversight; in many cases, its a required condition of exercising powers granted by Congress. An executive action that includes or is supported by a national emergency declaration is no less subject to oversight by Congress than any other executive action.
- tptacek 12y ago
  The mechanisms of "national emergency" and the IEEPA are both products of congressional oversight. If they didn't want him to be able to do that, they could repeal the IEEPA. Of course, this is pretty silly: if they put this executive order to a vote in the House, the only flak Obama would get is that he is not also bombing China.
codazoda 12y ago
I haven't done any research into what this executive order actually does but language like "not one we expect to use everyday" makes me nervous. This sounds like down-playing. Laws written with good intentions are often used later in ways and at frequencies with which they weren't designed.
- johngalt 12y ago
  If they say "we don't expect to use it everyday", that means they expect to use it every hour.
  - balabaster 12y ago
    no, just on days where they need to shut someone up ;)
fweespeech 12y ago
I submitted the Politico article yesterday: http://www.politico.com/story/2015/04/new-us-sanctions-foreign-hacker-cyber-spy-116579.html http://www.politico.com/story/2015/04/new-us-sanctions-forei... > President Barack Obama said Wednesday that the U.S. will now treat foreign hackers and cyber spies like terrorists and nuclear arms dealers. There is also the medium post he made about it [claiming legitimate security researchers won't be targeted, not that I really believe that]: https://medium.com/@PresidentObama/a-new-tool-against-cyber-threats-1a30c188bc4 https://medium.com/@PresidentObama/a-new-tool-against-cyber-... To be honest, it sounds like Obama is positioning all "hackers" as "terrorists" and "foreigners" in the public view. I fully expect him or the next President to declare a "War on Cybercrime". It also means, as of today, the Treasury can literally freeze all of the assets of any non-US citizen on circumstantial evidence. Lets face it, the case against North Korea for the Sony Hack is primarily based on circumstantial evidence. Its indicative but none of it truly is proof. It also pretty much creates a situation where the Executive can freeze the accounts of anyone it doesn't like on circumstantial evidence. Eventually, if they continue the "hackers == terrorists" mantra...they'll start throwing them in prions without trials. And let us be honest, we all know this is where it is going to go eventually. To the average person, the computer is a magical box. This makes it the perfect weapon for a terrorist group with the right type of fanatic to engage in cybercrime to fund their operations while simultaneously the perfect tool to suppress people on the basis of circumstantial evidence that the public, frankly, doesn't understand. I doubt it would ever be used against a US Citizen but already we have security researchers being treated like criminals when they try to enter the US. And, frankly, we have some obligation to say "Hey, this isn't right".
sarciszewski 12y ago
I think this is a pretty clear sign that hackers should seriously consider a mass exodus from the United States. This decision might not be right for everyone, of course, but neither is having your life destroyed because of the foolish executive orders.
ck2 12y ago
Can we get spammers labeled as terrorists?
- balabaster 12y ago
  Can we also get the guys who keep leaving unsolicited advertising on my car at the station and also on my front doorstep despite a sign on my front door saying "No junk mail" classified the same?
balabaster 12y ago
Given the U.S. Government's laughable ability to properly classify "hackers" apart from script kiddies, security experts, programmers, I.T. admins and any other computer "expert" where does that leave anyone in the I.T. industry that a politically influential corporation [i.e. Sony et al.] takes a dislike to? A software engineer posts a politically embarrassing YouTube video and is arrested as a hacker and thus a cyber terrorist under the guise of "national security"?
- task_queue 12y ago
  Reminder that not using a browser to access a website has been construed as hacking. Reminder that 90% of development tools are hacking tools. Subversion has subversion right in the name.
  - johngalt 12y ago
    > not using a browser to access a website has been construed as hacking. Huh? I haven't heard that one before? The whole 'hacking tools' thing is just ignorance. As if wireshark and port scanners have no legitimate use. "We don't understand these things therefore they are scary"
    - deleted 12y ago
      [deleted]
      - balabaster 12y ago
        I got voted down yesterday for linking this kind behaviour to the Salem Witch Trials... but I stand by my point: Fear of what they're ignorant about and starting witch hunts to eradicate it is part of American history... you may cast it to the annals of history, but with the undertones of Islamophobia, xenophobia and racism that constantly play out in the media demonstrate that it's still alive and kicking in the halls of politics. This is just another form of the same thing - fear of their own ignorance.
    - fweespeech 12y ago
omgitstom 12y ago
It is like the only tool the US government has to handle this problem is a hand grenade. No precision. All it is going to take is one lazily worded law / executive order, and anyone in the security space could have the possibility to go to jail if enforced broadly.
- balabaster 12y ago
  You'll be fine, just don't piss off anyone that has influential lobbyists... like the communications, media, banking or oil & gas companies, the NRA, any corporations or financial transactions that politicians have stakes in, anyone in authority or anyone that could make your life... uncomfortable. You'll probably be fine. Maybe :P
  - deleted 12y ago
    [deleted]
  - omgitstom 12y ago
    I'm pretty sure if the government wanted me in jail, they could do so. As the machine gears turns and laws are created as time moves forward, I don't see any other outcome then total lock down. All liberties and freedoms are gone.
kordless 12y ago
I submitted the RT story yesterday: https://news.ycombinator.com/item?id=9305942 https://news.ycombinator.com/item?id=9305942. The RT article has a copy of the executive order, which is a legally binding law enabling "promulgation of rules and regulations" until it (hopefully) is reviewed and struck down by the judicial system as being unconstitutional. Given what we've seen historically from this White House and Congress, I'm not holding my breath. This legally binding order gives the US Government the right to lay claim to assets held by individuals and corporations who may "constitute an unusual and extraordinary threat to the national security, foreign policy, and economy of the United States", all without prior notice. Laws and legal contracts provide us a trusted system by which we may operate within a society. By 'sweeping off' certain rights, that trust is effectively eroded to the point implicit trust is all that remains of the 'contract' held with the governing body, in this case the US Government. This opens up the path to abuse of power by certain individuals by enabling them to hack the remaining (implicit) trust to suit their own needs. While cyber criminals should be held accountable for their actions and the acts they commit can create additional suffering for individuals, corporations and communities, I don't feel eroding trust of the governing body of a country is the most logical approach to combatting crime committed by the criminals. Implicit trust in things of importance, especially infrastructure, never ends well for the parties trying to trust each other. FWIW, this is an opinion based on trust observations seen while working on infrastructure, which is not necessarily a fact of all our reality. At the very least, this is a complicated issue. There are certainly other avenues available to us for addressing criminal behavior on the Internet. Those avenues are most likely technical in nature, and are clearly well beyond the responsibilities (or abilities) of The Office of the President of the United States. It feels like the US is currently in a massive bought of cognitive dissonance: wanting to stop attacks while (at least for some) holding our freedoms as individuals to high levels. As with most duality situations, this will resolve itself at a future date in one way or another. For all of us, I hope this is done in a transparent, trustworthy and LEGAL way. I would add that implementing technical measures to combat these attacks in and of themselves could be considered violations of this Executive Order as they may judged by the government at will: "any person determined by the Secretary of the Treasury, in consultation with the Attorney General and the Secretary of State, to be responsible for or complicit in, or to have engaged in, directly or indirectly, cyber-enabled activities originating from, or directed by persons located, in whole or in substantial part, outside the United States that are reasonably likely to result in, or have materially contributed to, a significant threat to the national security, foreign policy, or economic health or financial stability of the United States". Cyber-enabled activities likely to result in a threat. Think about it.
sandworm 12y ago
DPRK attacks film studio = sanctions, counterattack, TO WAR! China attacks Github = nothing, silence, heads kept in sand. The attack itself is irrelevant. The scale of response is only related, inversely related, to the political size of the attackers. Small countries and individuals are to be punished. Large countries holding billions of US debt are to be forgiven. The extent of damage done doesn't enter into the equation.
- themeek 12y ago
  The United States hacks and counterattacks China all of the time. The reason for calling the DPRK's attack on the propaganda creation of the State Department 'cyberterrorism' and 'cyberwar' is that it aligns with US foreign policy (SK's official policy now is to pursue reunification). NK is going down - China is more complicated. We do hack and counterattack China though, all the time.

132 points by tekacs 12y ago

I'm a little surprised that this BBC article doesn't mention the ongoing DDoS attack on GitHub by China. Does it seem like this programme could give US authorities the power to sanction the Chinese government over something like a DDoS attack? EDIT: Ah, looks like GitHub is back to normal. Maybe the attacks are over now?

PaulMougel 12y ago
GitHub has indeed been operating normally since the 31st; see https://status.github.com/messages https://status.github.com/messages .
- golergka 12y ago
  This doesn't mean that they don't get attacked.
drzaiusapelord 12y ago
This is exactly what this is. China and Russia have legitimized cybercrime. Its done openly with approval of the goverment. See Brian Kreb's expose on various cyberwarrior Russian companies that operate with impunity. The US can identify these companies and sanction them, which is something they should have done long ago. If you don't want sanctions, don't attack our infrastructure or citizens. Autocratic one party states need to be reminded that we won't stand for this shit any longer. What China did to Github is inexcusable and deserves a response.
- notsony 12y ago
  > What China did to Github is inexcusable. How do you know it was China? An IP address does not mean the person sitting behind the computer is Chinese. The person could just as easily be controlling a botnet from a VPN while sipping a latte in a coffee shop in Palo Alto.
  - igammarays 12y ago
    Read the details of the attack. It's not a botnet. The attack works by injecting malicious JavaScript into common websites within Chinese borders, and doing this only for visitors of these files from outside China. Only the Great Firewall (or the website owners, ie. government-controlled Baidu) can possibly do that. http://www.netresec.com/?month=2015-03&page=blog&post=china%27s-man-on-the-side-attack-on-github http://www.netresec.com/?month=2015-03&page=blog&post=china%...
- wongarsu 12y ago
  >What China did to Github is inexcusable and deserves a response. Github arguably operates in China by offering their website there. At the same time Github is refusing to meet demands by the Chinese government. Their refusal to meet those demands directly undermines policy enacted by the Chinese government. Now the Chinese government tried using their power to enforce their policy decisions. I'm not saying it's right, but it doesn't seem that different from what's the norm these days. The only difference between China and powerful western countries is the kind of policy they enforce (censorship, not copyright protection or nuclear arms treaties etc).

cooked 12y ago

> sanction "individuals or entities" that pose a cyber threat to the "national security, foreign policy, or economic health or financial stability of the United States," If you detangle the weasel words, this is basically "emergency executive powers to do whatever we want to people we don't like, as long as we can tie it back to the internet". Combined with the existing surveillance dragnet, that's horrifying.

nickysielicki 12y ago
2015 seems to be the year for multi-national globalization to really kick into gear. TPP, this, what's next?
tekacs 12y ago
Speaking of those words, it's worth noting that those points (national security, foreign policy, economic health/financial stability) are the same that GCHQ [is charged][1] to protect (I'd cite NSA, but I'm not familiar with where to find a list of their responsibilities). [1]: https://en.wikipedia.org/wiki/GCHQ#Legal_basis https://en.wikipedia.org/wiki/GCHQ#Legal_basis
bstar77 12y ago
It's sad that this is the exact same conclusion I came to. I have zero confidence that executive powers like this won't somehow be abused to target Americans that pose no threat to national security.
- balabaster 12y ago
  I think "zero confidence" underplays it. The U.S. Government has a history of abusing their executive powers. Given their past behavior and not only a complete absence of remorse, but proactive justification of their abuses, it seems as though abuse of those powers is almost a foregone conclusion.
  - tljr 12y ago
    The cliche's were right all along. It does corrupt absolutely.

nickysielicki 12y ago

First of all, this article doesn't have a single criticism of this? It is really scary to me that our lawmakers are enacting legislation for topics they have absolutely no personal experience with. Their decisions are based on what can only amount to 100 hours, optimistically, of information sessions given by people representing multinationals with agendas. All I want to know is what the hell constitutes a "malicious cyber activity". Is that as innocuous as U.S. v Auernheimer?

GabrielF00 12y ago
No lawmakers voted on anything. It's an executive order.
- nickysielicki 12y ago
  I know. I'm just saying in general.
  - GabrielF00 12y ago
    I understand your comment, and I agree that there have been plenty of examples of lawmakers misunderstanding technology, but this isn't really an issue that's unique to technology. Lawmakers vote on bills on dozens of extremely complex subjects, ranging from agriculture to foreign policy. No single person could have a deep understanding of all the issues that come up in Congress. I don't think that cybersecurity is any more complicated than health care economics or agricultural subsidies. It's just the nature of trying to govern an incredibly complicated country.
- tptacek 12y ago
  Lawmakers voted on 50 U.S.C. 1702, which is what gives the President the ability to issue this executive order. The President can't just make up powers. He's been delegated a whole mess of them by congress, contingent on the declaration of a national emergency.
- dragonwriter 12y ago
  > No lawmakers voted on anything. It's an executive order. How do you think that all the laws that the President cites at the top of the order that provide the authority under which the order is issued were passed? [0] [0] "By the authority vested in me as President by the Constitution and the laws of the United States of America, including the International Emergency Economic Powers Act (50 U.S.C. 1701 et seq.) (IEEPA), the National Emergencies Act (50 U.S.C. 1601 et seq.) (NEA), section 212(f) of the Immigration and Nationality Act of 1952 (8 U.S.C. 1182(f)), and section 301 of title 3, United States Code, [...]" -- https://www.whitehouse.gov/the-press-office/2015/04/01/executive-order-blocking-property-certain-persons-engaging-significant-m https://www.whitehouse.gov/the-press-office/2015/04/01/execu...

yAnonymous 12y ago

So, are the U.S. going to sanction themselves?

arh68 12y ago
Good question. Should the US be sanctioned for DDoSing North Korea? Should the US be surprised when China enacts similar legislation?
- borgia 12y ago
  > Should the US be surprised when China enacts similar legislation? I wouldn't be surprised to see Obama label such an act by China as an "act of war".
  - LLWM 12y ago
    I would. Doing that without any follow-up erodes your credibility. And the US is not going to go to war with China.
- stefantalpalaru 12y ago
  You seem confused. Watch a few seasons of Homeland and it will all become clear: no matter what atrocities the good guys are doing, they always have good justifications. Which may need to remain secret, just like the proof that NK was involved in the Sony breach, but it's all for the common good.
deleted 12y ago
[deleted]

belorn 12y ago

I guess its a start, even if the irony seems a bit thick with NSA on the forefront with offensive cyber operations. Has there been anything similar to Stuxnet from China?

chucksmart 12y ago

Sidestep Congress with a 'national emergency.' Really necessary?

dragonwriter 12y ago
A national emergency declaration doesn't sidestep Congressional oversight; in many cases, its a required condition of exercising powers granted by Congress. An executive action that includes or is supported by a national emergency declaration is no less subject to oversight by Congress than any other executive action.
tptacek 12y ago
The mechanisms of "national emergency" and the IEEPA are both products of congressional oversight. If they didn't want him to be able to do that, they could repeal the IEEPA. Of course, this is pretty silly: if they put this executive order to a vote in the House, the only flak Obama would get is that he is not also bombing China.

codazoda 12y ago

I haven't done any research into what this executive order actually does but language like "not one we expect to use everyday" makes me nervous. This sounds like down-playing. Laws written with good intentions are often used later in ways and at frequencies with which they weren't designed.

johngalt 12y ago
If they say "we don't expect to use it everyday", that means they expect to use it every hour.
- balabaster 12y ago
  no, just on days where they need to shut someone up ;)

fweespeech 12y ago

I submitted the Politico article yesterday: http://www.politico.com/story/2015/04/new-us-sanctions-foreign-hacker-cyber-spy-116579.html http://www.politico.com/story/2015/04/new-us-sanctions-forei... > President Barack Obama said Wednesday that the U.S. will now treat foreign hackers and cyber spies like terrorists and nuclear arms dealers. There is also the medium post he made about it [claiming legitimate security researchers won't be targeted, not that I really believe that]: https://medium.com/@PresidentObama/a-new-tool-against-cyber-threats-1a30c188bc4 https://medium.com/@PresidentObama/a-new-tool-against-cyber-... To be honest, it sounds like Obama is positioning all "hackers" as "terrorists" and "foreigners" in the public view. I fully expect him or the next President to declare a "War on Cybercrime". It also means, as of today, the Treasury can literally freeze all of the assets of any non-US citizen on circumstantial evidence. Lets face it, the case against North Korea for the Sony Hack is primarily based on circumstantial evidence. Its indicative but none of it truly is proof. It also pretty much creates a situation where the Executive can freeze the accounts of anyone it doesn't like on circumstantial evidence. Eventually, if they continue the "hackers == terrorists" mantra...they'll start throwing them in prions without trials. And let us be honest, we all know this is where it is going to go eventually. To the average person, the computer is a magical box. This makes it the perfect weapon for a terrorist group with the right type of fanatic to engage in cybercrime to fund their operations while simultaneously the perfect tool to suppress people on the basis of circumstantial evidence that the public, frankly, doesn't understand. I doubt it would ever be used against a US Citizen but already we have security researchers being treated like criminals when they try to enter the US. And, frankly, we have some obligation to say "Hey, this isn't right".

sarciszewski 12y ago

I think this is a pretty clear sign that hackers should seriously consider a mass exodus from the United States. This decision might not be right for everyone, of course, but neither is having your life destroyed because of the foolish executive orders.

ck2 12y ago

Can we get spammers labeled as terrorists?

balabaster 12y ago
Can we also get the guys who keep leaving unsolicited advertising on my car at the station and also on my front doorstep despite a sign on my front door saying "No junk mail" classified the same?

balabaster 12y ago

Given the U.S. Government's laughable ability to properly classify "hackers" apart from script kiddies, security experts, programmers, I.T. admins and any other computer "expert" where does that leave anyone in the I.T. industry that a politically influential corporation [i.e. Sony et al.] takes a dislike to? A software engineer posts a politically embarrassing YouTube video and is arrested as a hacker and thus a cyber terrorist under the guise of "national security"?

task_queue 12y ago
Reminder that not using a browser to access a website has been construed as hacking. Reminder that 90% of development tools are hacking tools. Subversion has subversion right in the name.
- johngalt 12y ago
  > not using a browser to access a website has been construed as hacking. Huh? I haven't heard that one before? The whole 'hacking tools' thing is just ignorance. As if wireshark and port scanners have no legitimate use. "We don't understand these things therefore they are scary"
  - deleted 12y ago
    [deleted]
    - balabaster 12y ago
      I got voted down yesterday for linking this kind behaviour to the Salem Witch Trials... but I stand by my point: Fear of what they're ignorant about and starting witch hunts to eradicate it is part of American history... you may cast it to the annals of history, but with the undertones of Islamophobia, xenophobia and racism that constantly play out in the media demonstrate that it's still alive and kicking in the halls of politics. This is just another form of the same thing - fear of their own ignorance.
  - fweespeech 12y ago

omgitstom 12y ago

It is like the only tool the US government has to handle this problem is a hand grenade. No precision. All it is going to take is one lazily worded law / executive order, and anyone in the security space could have the possibility to go to jail if enforced broadly.

balabaster 12y ago
You'll be fine, just don't piss off anyone that has influential lobbyists... like the communications, media, banking or oil & gas companies, the NRA, any corporations or financial transactions that politicians have stakes in, anyone in authority or anyone that could make your life... uncomfortable. You'll probably be fine. Maybe :P
- deleted 12y ago
  [deleted]
- omgitstom 12y ago
  I'm pretty sure if the government wanted me in jail, they could do so. As the machine gears turns and laws are created as time moves forward, I don't see any other outcome then total lock down. All liberties and freedoms are gone.

kordless 12y ago

I submitted the RT story yesterday: https://news.ycombinator.com/item?id=9305942 https://news.ycombinator.com/item?id=9305942. The RT article has a copy of the executive order, which is a legally binding law enabling "promulgation of rules and regulations" until it (hopefully) is reviewed and struck down by the judicial system as being unconstitutional. Given what we've seen historically from this White House and Congress, I'm not holding my breath. This legally binding order gives the US Government the right to lay claim to assets held by individuals and corporations who may "constitute an unusual and extraordinary threat to the national security, foreign policy, and economy of the United States", all without prior notice. Laws and legal contracts provide us a trusted system by which we may operate within a society. By 'sweeping off' certain rights, that trust is effectively eroded to the point implicit trust is all that remains of the 'contract' held with the governing body, in this case the US Government. This opens up the path to abuse of power by certain individuals by enabling them to hack the remaining (implicit) trust to suit their own needs. While cyber criminals should be held accountable for their actions and the acts they commit can create additional suffering for individuals, corporations and communities, I don't feel eroding trust of the governing body of a country is the most logical approach to combatting crime committed by the criminals. Implicit trust in things of importance, especially infrastructure, never ends well for the parties trying to trust each other. FWIW, this is an opinion based on trust observations seen while working on infrastructure, which is not necessarily a fact of all our reality. At the very least, this is a complicated issue. There are certainly other avenues available to us for addressing criminal behavior on the Internet. Those avenues are most likely technical in nature, and are clearly well beyond the responsibilities (or abilities) of The Office of the President of the United States. It feels like the US is currently in a massive bought of cognitive dissonance: wanting to stop attacks while (at least for some) holding our freedoms as individuals to high levels. As with most duality situations, this will resolve itself at a future date in one way or another. For all of us, I hope this is done in a transparent, trustworthy and LEGAL way. I would add that implementing technical measures to combat these attacks in and of themselves could be considered violations of this Executive Order as they may judged by the government at will: "any person determined by the Secretary of the Treasury, in consultation with the Attorney General and the Secretary of State, to be responsible for or complicit in, or to have engaged in, directly or indirectly, cyber-enabled activities originating from, or directed by persons located, in whole or in substantial part, outside the United States that are reasonably likely to result in, or have materially contributed to, a significant threat to the national security, foreign policy, or economic health or financial stability of the United States". Cyber-enabled activities likely to result in a threat. Think about it.

sandworm 12y ago

DPRK attacks film studio = sanctions, counterattack, TO WAR! China attacks Github = nothing, silence, heads kept in sand. The attack itself is irrelevant. The scale of response is only related, inversely related, to the political size of the attackers. Small countries and individuals are to be punished. Large countries holding billions of US debt are to be forgiven. The extent of damage done doesn't enter into the equation.

themeek 12y ago
The United States hacks and counterattacks China all of the time. The reason for calling the DPRK's attack on the propaganda creation of the State Department 'cyberterrorism' and 'cyberwar' is that it aligns with US foreign policy (SK's official policy now is to pursue reunification). NK is going down - China is more complicated. We do hack and counterattack China though, all the time.