link

Bill would give president emergency control of Internet
by Declan McCullagh

Internet companies and civil liberties groups were alarmed this spring when a U.S. Senate bill proposed handing the White House the power to disconnect private-sector computers from the Internet.

They're not much happier about a revised version that aides to Sen. Jay Rockefeller, a West Virginia Democrat, have spent months drafting behind closed doors. CNET News has obtained a copy of the 55-page draft (excerpt), which still appears to permit the president to seize temporary control of private-sector networks during a so-called cybersecurity emergency.

The new version would allow the president to "declare a cybersecurity emergency" relating to "non-governmental" computer networks and do what's necessary to respond to the threat. Other sections of the proposal include a federal certification program for "cybersecurity professionals," and a requirement that certain computer systems and networks in the private sector be managed by people who have been awarded that license.

"I think the redraft, while improved, remains troubling due to its vagueness," said Larry Clinton, president of the Internet Security Alliance, which counts representatives of Verizon, Verisign, Nortel, and Carnegie Mellon University on its board. "It is unclear what authority Sen. Rockefeller thinks is necessary over the private sector. Unless this is clarified, we cannot properly analyze, let alone support the bill."

Representatives of other large Internet and telecommunications companies expressed concerns about the bill in a teleconference with Rockefeller's aides this week, but were not immediately available for interviews on Thursday.

A spokesman for Rockefeller also declined to comment on the record Thursday, saying that many people were unavailable because of the summer recess. A Senate source familiar with the bill compared the president's power to take control of portions of the Internet to what President Bush did when grounding all aircraft on Sept. 11, 2001. The source said that one primary concern was the electrical grid, and what would happen if it were attacked from a broadband connection.

When Rockefeller, the chairman of the Senate Commerce committee, and Olympia Snowe (R-Maine) introduced the original bill in April, they claimed it was vital to protect national cybersecurity. "We must protect our critical infrastructure at all costs––from our water to our electricity, to banking, traffic lights and electronic health records," Rockefeller said.

The Rockefeller proposal plays out against a broader concern in Washington, D.C., about the government's role in cybersecurity. In May, President Obama acknowledged that the government is "not as prepared" as it should be to respond to disruptions and announced that a new cybersecurity coordinator position would be created inside the White House staff. Three months later, that post remains empty, one top cybersecurity aide has quit, and some wags have begun to wonder why a government that receives failing marks on cybersecurity should be trusted to instruct the private sector what to do.

Rockefeller's revised legislation seeks to reshuffle the way the federal government addresses the topic. It requires a "cybersecurity workforce plan" from every federal agency, a "dashboard" pilot project, measurements of hiring effectiveness, and the implementation of a "comprehensive national cybersecurity strategy" in six months––even though its mandatory legal review will take a year to complete.

The privacy implications of sweeping changes implemented before the legal review is finished worry Lee Tien, a senior staff attorney with the Electronic Frontier Foundation in San Francisco. "As soon as you're saying that the federal government is going to be exercising this kind of power over private networks, it's going to be a really big issue," he says.

Probably the most controversial language begins in Section 201, which permits the president to "direct the national response to the cyber threat" if necessary for "the national defense and security." The White House is supposed to engage in "periodic mapping" of private networks deemed to be critical, and those companies "shall share" requested information with the federal government. ("Cyber" is defined as anything having to do with the Internet, telecommunications, computers, or computer networks.)

"The language has changed but it doesn't contain any real additional limits," EFF's Tien says. "It simply switches the more direct and obvious language they had originally to the more ambiguous (version)...The designation of what is a critical infrastructure system or network as far as I can tell has no specific process. There's no provision for any administrative process or review. That's where the problems seem to start. And then you have the amorphous powers that go along with it."

Translation: If your company is deemed "critical," a new set of regulations kick in involving who you can hire, what information you must disclose, and when the government would exercise control over your computers or network.

The Internet Security Alliance's Clinton adds that his group is "supportive of increased federal involvement to enhance cyber security, but we believe that the wrong approach, as embodied in this bill as introduced, will be counterproductive both from an national economic and national secuity perspective."

What the other side would be saying if Bush were still President....

The question is, what would you say if Bush was trying to impliment this and what are you saying now?

Originally Posted by the_13th_redneck

The question is, what would you say if Bush was trying to impliment this and what are you saying now?

Compared to Liberal reaction on the Patriotism Act? This should be a bipartisan issue everyone can get behind. But then it is the "Liberty Lovin Liberals" who desperatly want to shut down talk radio & internet blogs that keep exposing thier schemes, ones often ignored by coconspirators in the Main Stream Media.

First of all the title smells of scare tactics, its not quite that bad we you read it closely.

The Bill allows the president to disconnect critical US private-sector networks off the internet (hint: Wall Street). This might be necessary if for example Chinese Hackers decided to damage or bring down the US Financial System network or shutdown the electrical Power-grid via a DDOS attack, or perhaps to stop a system wide infiltration of a critical system by a virus. Don't you think it might be necessary for the President to have the power to pull the plug in such a emergency to protect key infrustructure? I do, even Bush.

The Bill does not say he would take control of the entire internet, because that's physically impossible. How could Obama disconnect systems not located in US territory short of a nuke strike? There is a term in a IT we call routing, it refers to the way traffic is vectored to its destination. If a route is cut off (say due to a equipment failure), internet traffic is detoured via other routes which are hard-coded into the routers themselves.

In this very unlikely case IP addresses in the US would fail, but not worldwide.

The worst a president could do would be to take control of icann (the independent entity that distributes IP addresses), that would cause IP organization havoc but it wouldn't physical shut down the internet. It would cause a major international incident and cause other governments simply to setup the organization elsewhere and business would continue as usual. A government can only shut off its own internet access like Iran and China have done, but it cannot stop what goes on outside its borders.

What were the Iranians doing with internet access when it became annoying?

Originally Posted by George

What were the Iranians doing with internet access when it became annoying?

Exactly what I said above: they shut it off in their country. But they could not shut it off completely.

Originally Posted by mmarsh

First of all the title smells of scare tactics, its not quite that bad we you read it closely.

The Bill allows the president to disconnect critical US private-sector networks off the internet (hint: Wall Street). This might be necessary if for example Chinese Hackers decided to damage or bring down the US Financial System network or shutdown the electrical Power-grid via a DDOS attack, or perhaps to stop a system wide infiltration of a critical system by a virus. Don't you think it might be necessary for the President to have the power to pull the plug in such a emergency to protect key infrustructure? I do, even Bush.

The Bill does not say he would take control of the entire internet, because that's physically impossible. How could Obama disconnect systems not located in US territory short of a nuke strike? There is a term in a IT we call routing, it refers to the way traffic is vectored to its destination. If a route is cut off (say due to a equipment failure), internet traffic is detoured via other routes which are hard-coded into the routers themselves.

In this very unlikely case IP addresses in the US would fail, but not worldwide.

The worst a president could do would be to take control of icann (the independent entity that distributes IP addresses), that would cause IP organization havoc but it wouldn't physical shut down the internet. It would cause a major international incident and cause other governments simply to setup the organization elsewhere and business would continue as usual. A government can only shut off its own internet access like Iran and China have done, but it cannot stop what goes on outside its boarders.

Oh come on you know Obama is going to use hit squads to take out the servers around the world so that he can spread world socialism from really big loudspeakers he is erecting on the Whitehouse roof aren't you up with the latest right wing whack job websites?

Surely you realise you have elected the Anti-Christ and in 2012 he will personally bring about the galactic alignment to destroy the world and worst of all I have even heard rumours that he may be black.

Ok will stop now.

PS. I probably needed to slot the term "International Jewery" and "Islamofascists" in there somewhere to improve the credibility of my post but I don't have time right now I am eating lunch.

Originally Posted by George

Compared to Liberal reaction on the Patriotism Act? This should be a bipartisan issue everyone can get behind. But then it is the "Liberty Lovin Liberals" who desperatly want to shut down talk radio & internet blogs that keep exposing thier schemes, ones often ignored by coconspirators in the Main Stream Media.

Yeah, because nothing says patriot like wiretapping.

To use the popular right wing terminology about such acts, if you're not doing anything illegal you have nothing to worry about!

Obama is afraid of the truth because it destroys his poll numbers. Limiting or baning negative opinions is paramount now for the administration to complete its goals. Similar to the alien and sedition bill back in the 18th century.

I actually could see the merits in the Patriot Act and why in an age where the enemy is increasingly elusive and invisible, information gathering is absolutely paramount. Especially as a response to the gutting of US intelligence assets in the 90's I think it has its merits. Has its flaws too but most of the "scary" stuff has an expiration date (as far as I know). This sort of stuff actually will not affect folks who are not crazy about blowing up the USA. The more annoying and scary intelligence gathering is already being done by companies world wide who are trying to find customers. They will get your phone number from some sort of source, call you without your permission, usually when you're having dinner.
Scared of the US government's database on you? The private sector's got it as well and I bet they run it better than the government does.

The ability to disconnect an individual or an organization from the internet is kinda small compared to the Patriot Act... so much so that it reads an awful like it would belong to one of the numerous sections covered by the Patriot Act.