Posted by
Vikki Roemer on Saturday, August 29, 2009 12:27:43 AM
Ok, this new proposed regulation of cybersecurity is ridiculous. The administration and members of congress want control of 'key sections' of the internet for fear of power outages and other cybersecurity threats to our infrastructure? The main question that screams in my mind is, and I've had this question since we first started seeing worms take out power and water plants, why are these things tied into the internet to begin with? What is the point? Intranets for ease of administration of the computer systems controlling the machinery, yes, but remote access over the internet of mission-critical systems is just insanity. Sorry non-CS/CE majors out there, just sum that up as "networking together the computers inside the plants = good, hooking the network to the internet = bad".
I see this as just another power-grab. A lot of our economy (and most of my generation's news and information) is based in the internet. Control the internet, you control a lot of our culture and economy. Now, granted, a lot of things that I read into the Patriot Act never came to pass (I haven't disappeared yet for talking quite freely about my distrust of the government, for example), so hopefully if this internet control bill passes, it will be the same way. But I doubt it. This president seems the type to take a vague legislation and run with it. And that's a lot of what bothered me about the Patriot Act, and a lot of what bothers me about this bill-- the vagueness of wording. There are no clear definitions of who/what this applies to (just basically whatever the executive branch deems 'critical'), and no limits placed upon the powers granted in the bill. So this could run the gamut, in practice, from a bunch of feel-good nothingness, to a step towards China-esque control of the internet within our borders.
Assuming this gets extended to a power-grab on par with China's control of their internet, that is a scary thought considering how much of the internet infrastructure is governed, standardized, and administered within US borders. ICANN (Internet Corporation for Assigned Names and Numbers, the company that handles registrations of domain names) and IANA (Internet Assigned Numbers Authority, they handle assigning IP addresses to people and assigning ports to programs) are both in the US, the IETF (Internet Engineering Task Force), IAB (Internet Architecture Board), and ISOC (Internet Society) are mainly based here. ISOC is the umbrella group of the IETF and IAB, who in turn are responsible for the various workings and standards governing how the internet works under the hood. This legislation already proposes regulating IANA, so that the federal government has to approve any renewals or changes of IP addressing blocks that companies hold.
So think about this. Say, townhall.com handles their own IP address(s) (I have no idea how they handle their internet, just an example), and like anyone who owns a block of IP addresses they have to renew their contract periodically. If townhall.com is considered a 'threat to cybersecurity' (or national security, or whatever) they can have their IP block revoked and get pulled offline. Scary, huh?
The other thing that strikes me about this bill is how much stuff that's already done by the private sector is taken over by the government. For one thing, tracking bugs and vulnerabilities is taken over by the Dept. of Commerce, rather than being handled by various groups like Bugtraq, linuxsecurity.com, etc. The National Institute of Standards and Technology (NIST) will be required to dictate standards for testing and maintaining network security-- right now there are several private organizations that handle certifications and training in security.
But wait, not only does this bill regulate (and potentially stifle) the internet, it also governs intranets. What's the difference? The internet is what you're using right now to visit other people's computers. An intranet is a collection of private computers not connected to the world in general. For those of you with multiple computers who have a home network, your network is an intranet; if you unplug your modem from the internet, your computers stay connected to your network and can still access each other. Or if you can access other work computers within your office from inside your office, that's a company intranet. This legislation is applying the same rules for those as for the big ol' Internet. Including proposing setting up friendly local offices to help your small/medium businesses comply.
So going back to the power plants, even those not stupidly connected to the internet are still going to be under government control. Again, why?
Considering how badly the government and military handle their own cybersecurity, using outdated and lobbyist-influenced technologies, standards, and protocols, what makes anyone think they'll handle ours any better? The government receives failing marks on its security, yet what's good for them is good for us. They also want the specs and proposals for the overhaul of our nation's cybersecurity done in 6 months. Private industry just doesn't move that fast, and government by its own rules and laws can't. The government has to take at least a year to draw up all the proposals and do their reviews and measurements of 'hiring effectiveness', etc. Private industry would probably take at least that long to adopt this, assuming they don't completely try to balk at the idea of the government pushing them around telling them who they can hire and what sort of network infrastructure they need to implement. Because that's yet another facet of this-- you not only have to have the industry certifications already required to be hired as a reputable cybersecurity professional (not to mention the degrees)-- you have to be government certified as well.
Hopefully this mess of misguided legislation will never fly. Regulating, stifling, controlling, and micromanaging a pillar of our economy and a large part of our culture and news sources is an incredibly bad idea. Government certification of IT employees and imposing their poor quality of computing on us will set back american businesses even further than they already are. Not to mention the 'standardizing' of our internet and intranets, which is already being handled by autonomous international standards bodies, and handled quite well it seems. All this is a recipe for disaster, and one more thing that will hopefully wake up Americans to the nightmare of this administration.