Bill would give president emergency control of Internet

[eunhye]

Bill would give president emergency control of Internet | Politics and Law - CNET News

Internet companies and civil liberties groups were alarmed this spring when a U.S. Senate bill proposed handing the White House the power to disconnect private-sector computers from the Internet.

They're not much happier about a revised version that aides to Sen. Jay Rockefeller, a West Virginia Democrat, have spent months drafting behind closed doors. CNET News has obtained a copy of the 55-page draft (excerpt), which still appears to permit the president to seize temporary control of private-sector networks during a so-called cybersecurity emergency.

The new version would allow the president to "declare a cybersecurity emergency" relating to "non-governmental" computer networks and do what's necessary to respond to the threat. Other sections of the proposal include a federal certification program for "cybersecurity professionals," and a requirement that certain computer systems and networks in the private sector be managed by people who have been awarded that license.

"I think the redraft, while improved, remains troubling due to its vagueness," said Larry Clinton, president of the Internet Security Alliance, which counts representatives of Verizon, Verisign, Nortel, and Carnegie Mellon University on its board. "It is unclear what authority Sen. Rockefeller thinks is necessary over the private sector. Unless this is clarified, we cannot properly analyze, let alone support the bill."

Representatives of other large Internet and telecommunications companies expressed concerns about the bill in a teleconference with Rockefeller's aides this week, but were not immediately available for interviews on Thursday.

A spokesman for Rockefeller also declined to comment on the record Thursday, saying that many people were unavailable because of the summer recess. A Senate source familiar with the bill compared the president's power to take control of portions of the Internet to what President Bush did when grounding all aircraft on Sept. 11, 2001. The source said that one primary concern was the electrical grid, and what would happen if it were attacked from a broadband connection.

When Rockefeller, the chairman of the Senate Commerce committee, and Olympia Snowe (R-Maine) introduced the original bill in April, they claimed it was vital to protect national cybersecurity. "We must protect our critical infrastructure at all costs--from our water to our electricity, to banking, traffic lights and electronic health records," Rockefeller said.

The Rockefeller proposal plays out against a broader concern in Washington, D.C., about the government's role in cybersecurity. In May, President Obama acknowledged that the government is "not as prepared" as it should be to respond to disruptions and announced that a new cybersecurity coordinator position would be created inside the White House staff. Three months later, that post remains empty, one top cybersecurity aide has quit, and some wags have begun to wonder why a government that receives failing marks on cybersecurity should be trusted to instruct the private sector what to do.

Rockefeller's revised legislation seeks to reshuffle the way the federal government addresses the topic. It requires a "cybersecurity workforce plan" from every federal agency, a "dashboard" pilot project, measurements of hiring effectiveness, and the implementation of a "comprehensive national cybersecurity strategy" in six months--even though its mandatory legal review will take a year to complete.

The privacy implications of sweeping changes implemented before the legal review is finished worry Lee Tien, a senior staff attorney with the Electronic Frontier Foundation in San Francisco. "As soon as you're saying that the federal government is going to be exercising this kind of power over private networks, it's going to be a really big issue," he says.

Probably the most controversial language begins in Section 201, which permits the president to "direct the national response to the cyber threat" if necessary for "the national defense and security." The White House is supposed to engage in "periodic mapping" of private networks deemed to be critical, and those companies "shall share" requested information with the federal government. ("Cyber" is defined as anything having to do with the Internet, telecommunications, computers, or computer networks.)

"The language has changed but it doesn't contain any real additional limits," EFF's Tien says. "It simply switches the more direct and obvious language they had originally to the more ambiguous (version)...The designation of what is a critical infrastructure system or network as far as I can tell has no specific process. There's no provision for any administrative process or review. That's where the problems seem to start. And then you have the amorphous powers that go along with it."

Translation: If your company is deemed "critical," a new set of regulations kick in involving who you can hire, what information you must disclose, and when the government would exercise control over your computers or network.

The Internet Security Alliance's Clinton adds that his group is "supportive of increased federal involvement to enhance cyber security, but we believe that the wrong approach, as embodied in this bill as introduced, will be counterproductive both from an national economic and national secuity perspective."

kinda interesting to say the least.

[xopher]

Nevermind.

[Tagus]

OMG THE WHITEHOUSE.GOV GOT HACKED BY TERRORISTS!!! SHUT IT ALL DOWN

[Dimmauk]

I think its a great idea. We cant hope that John Mcclain will save us if we have a fire sale.

[Sirrus_Asura]

I think its a great idea. We cant hope that John Mcclain will save us if we have a fire sale.

John Mcclain always comes through. Otherwise its not John Mcclain.

[Cephius]

If some group were trying to gain control of a nuclear power plant by hacking into it, would people really be opposed to the President saying "hey, disconnect Indian Point from the Internet, thanks"? Didn't think so.

The "translation" part of that article is particularly fear-mongerish. No one is going to shut down the intertubes.

[Headspace]

http://denisewymore.files.wordpress....ky-falling.jpg

[BRP]

the la li lu le lo

[Tagus]

If some group were trying to gain control of a nuclear power plant by hacking into it, would people really be opposed to the President saying "hey, disconnect Indian Point from the Internet, thanks"? Didn't think so.

The "translation" part of that article is particularly fear-mongerish. No one is going to shut down the intertubes.

wut... do you honestly think that a nuclear power plant could be hacked into through the internet, let alone that the government would be aware of it before it happened and be capable of saving us by shutting down any portion of the internet itself?

[Olo401]

I read the excerpted section of the bill they provided, and nowhere does it mention the internet at all. All the references are to critical infrastructure networks, which would mean the electrical grid, air traffic control systems, other sensitive networks like Centcom and the Pentagon, etc.. It would most likely also include the .mil and .gov domains of the internet, but that makes sense because they are government-run websites. But there's nothing here that indicates or grants emergency control of the internet as a whole, or the internet backbone, to anyone.

[kuronosan]

What's this? Our government wants to protect critical systems from hackers and cyber-terrorism?

FUCKING SOCIALISTS! THEY WANT EVERYTHING!

[Sirrus_Asura]

OH NOZ 4CHAN WILL BE GONE.

[Dimmauk]

wut... do you honestly think that a nuclear power plant could be hacked into through the internet, let alone that the government would be aware of it before it happened and be capable of saving us by shutting down any portion of the internet itself?

Its like you have never seen this
http://www.impawards.com/2007/poster...r_die_hard.jpg

Based on a possibly true story.

[Cephius]

wut... do you honestly think that a nuclear power plant could be hacked into through the internet, let alone that the government would be aware of it before it happened and be capable of saving us by shutting down any portion of the internet itself?

It's not the best example, but an example nontheless. Are you saying it couldn't happen? I would assume all the systems that control the reactors aren't accessible through the internet. But you never know what kind of exploits are possible.

[Senoska]

It's not the best example, but an example nontheless. Are you saying it couldn't happen? I would assume all the systems that control the reactors aren't accessible through the internet. But you never know what kind of exploits are possible.

I'm going to hack a tree to produce money through the internet, you never know what kind of exploits are possible.

But seriously, all in the name of security? Pass. Fear mongering sure is effective nowadays.

[Khamsin]

I hear the president of Madagascar has this power.

[Olo401]

It's not the best example, but an example nontheless. Are you saying it couldn't happen? I would assume all the systems that control the reactors aren't accessible through the internet. But you never know what kind of exploits are possible.

Given the sheer age of the nuclear reactors in this country, I highly doubt they're connected to the internet lol..

[Kryssan]

It's not the best example, but an example nontheless. Are you saying it couldn't happen? I would assume all the systems that control the reactors aren't accessible through the internet. But you never know what kind of exploits are possible.

Yeah mate. Can't happen. Not even close. Nice use of the nuclear scare tactic though, I'll give you props for that. At least you were trying to be inventive.


They typically have triple redundant systems as a bare minimum and the LAN computers are in no way connected to any reactor plant systems. Most sites have at least two networks - not including reactor control and instrumentation, which will always be local only. Rx I&C can be monitored remotely, but not off-site, and once again, is separate from any WAN links. The only exceptions to this would be electrical grid intercommunications, which really has nothing to do with the reactor side of things. Is it possible that a hacker could turn off a turbine generator making power? Or change power regulation states? I doubt it. But it's the only thing they could do, if it were possible. And that would assume that the electrical grid control and interface components were accessible from the internet - which I sincerely doubt but I can't say for absolute certainty. I don't have experience with that side of the box. I'm fairly certain most of that communication is controlled by secure land line between facilities or by the use of a security encryptor. I can't get specific about the latter, but I assure you, if they hack those, they're targeting the wrong facilities.


I can say the reactor side equipment with absolute certainty though. It can only be manipulated by direct operator input. This is why there is always personnel around... you don't just pull a plug and turn it off. There is always an operator at a panel 24/7, regardless of the reactor state. The requirements to secure that operator are insane - and not applicable to any operating facility.

[Dimmauk]

I hear the president of Madagascar has this power.

http://img526.imageshack.us/img526/4...opyardsal1.gif

[Octavious]

IIRC, this is pretty old. I remember reading something similar about this bill like 2 months ago? Still, the fear mongering bullshit aspect of it hasn't changed. Eunhye has been on an Obama-trolling spin as of late, gets him/her off I would assume. Not that disagreeing with the president is bad, just trolling with fear mongering is lol'able. Almost as funny as the RNC Emails trying to tell people that if the Gov finds out you're a republican they're denying you health care, lol.

Oh, also lol@google ads, before I logged in:

Spoiler: show

http://i31.tinypic.com/jkbsxl.jpg

lastly, I almost spit out my water reading BRPs comment.

edit:
it's great to see the nuclear experts coming out to defend something that is slightly irrelivant to the topic. Now all we need is BG Legal to show up and that's /thread