Slashdot Mirror
GOVNET In the Works
gtg010b writes: "According to USA Today, the U.S. government is considering a private network to be used for all government communications. This network would be "separate from the Internet to keep it safe from hackers or terrorists" according to Richard Clarke, the head of the president's "cyberspace security adviser." Whatever happened to government not being above the people?" Clarke is the guy who's been crying "cyber Pearl Harbor" for a few years; apparently if you cry wolf long enough you get promoted. His request (.doc format) is informative. I should point out that the U.S. military already has such a network (I'm not even going to ask why the Feds can't piggy-back on it), so GOVNET would be for critically-important government agencies like the Department of Agriculture to communicate.
Why not just encrypt across internet2 or something? i really don't understand why everyone is crying pearl harbor about everything anyway...
and get spammed with MAKE WHEAT FAST!
I think this would be a good test case for the government. They could use IPv6 and Internet2 standards, with full encryption of messages and full security.
Would be a good test case - if it works, then we can expect to see a clone system roll out in major cities within two years.
--- Will in Seattle - What are you doing to fight the War?
I guess I'm messed up, cause I thought the original inception of our current internet *wasn't* private either. So, what's the rukus? (aside from them already having one)
...and that's the end of our show. Donk!
People are using the terrorist threat to do things they wanted to do anyway, but would not normally be allowed.
Secrecy and weapons sales corrupt democracy: What should be the Response to Violence?
Bush's education improvements were
>Whatever happened to government not being above
>the people?"
I think it is about the government being separated from the people. So this sentense per se is irrelevant.
So, they want to set up an intranet for the government. Why is this a bad thing? Should all corporations be required to use the internet for any and all communications between employees/remote sites/customers?
In business news, Cisco Systems stock [CSCO] rose 60% today.
Thank god for USA Today: America's Pravda
Somewhere, something incredible is waiting to be known. -- Carl Sagan
A private, secure network is by definition fairly small. The larger the network became (as would be necessary given the size of the US gov't), the more opportunity crackers would have to get in.
The goverment is simply too large to expect that a separate network would make it that much harder for crackers to get in.
Most large government agencies already have extensive WANs. The Judiciary (third branch) has a WAN called the DCN (District Court Network) that connects all 92 Districts. To my understanding many agencies falling under the dept of Justice also have their own WAN's.
Looks like a lot of the "GOVNET" is already in place.
Government action:
#1 legally restrict secure communications
#2 build private network for security
If you need text styles to communicate then you don't have a message.
Startup.com the movie was about the same kind of government meets private industry to spread information scheme. They failed, hopefully this wont.
If my memory serves me right, the Internet is the bigger grandson of ARPAnet, which was originally developed for secure voice and teletype transmissions.
I say "Bring it on!" Not for a hacking standpoint, because really, what's the point? I think that GOVNET will eventually become another arm of the Internet eventually. It only makes sense that at least one department (Office of Homeland Security comes to mind) will want a direct link to the Internet to make work easier, and then another and then another, and finally, the GOVNET will just be another section of the internet, the same way WAIS and GOPHER are today. I wouldn't worry.
BTW, my thought that ARPAnet was the start of it all is sort of correct. You can check it all out right here.
The Dopester
"Yes, I'm a Karma Whore, but I'm doing it to pay my way through school."
These networks can't even be "integrated" into one another because of different classifications levels etc. There isn't even a way to move data from low to high (systems of low classification to systems of higher classification), because the fact that the high network wants certain data from the low netowrk is sensitive itself.
"A better way, Rasch suggested, might be to improve the ways sensitive information is encrypted and sent over public networks such as the Internet"
It is my understanding that this is exactly how the DOD's classified networks work. I suppose I could be wrong, but I doubt it.
sHi
This is our government's security expert? This is his big plan to keep government data safe?
The Internet is everywhere. It's so purvasive that there is zero chance you can have any isolated network. The second some low-level government flunkie at the Bureau of Railroad Employee Retirement signed onto AOL to check his e-mail, boom, there's a gateway.
My thinking is that they plan to use GOVNET as an excuse to be lazy. Everything will have minimal authentication because there's no way big bad hackers can get on the network, right? Except that any PC on the network can easily become a gateway. There are plenty of examples of "private" and "secure" networks that were breached through classic hacking techniques like social engineering and wardialing.
This is stupid. What bout PPTP/VPN? Why can't they just make a virtual network that runs over the Internet like every other business is doing? The infrastructure costs are minimal because you aren't running redundant wiring. It's just as secure, in fact, it's more secure because you are going to be extra paranoid about things like password schemes and encryption levels if it has to survive some public data transfer points.
A few years ago, AOL tried to market this to companies. They called it EOL for Enterprise OnLine. Basically, for a fixed fee per user, all your employees got AOL accounts and access to a private keyword with your company's Intranet.
Except no one but Century21 ever signed up, as I suspect they got a good deal for being a test case. No one saw the point when security, done properly, is going to produce a much more versitile and cheaper result.
To make an analogy, this guys is suggesting that every government office get a tin can and a string so that they can communicate securely because there's alwaye the potential for someone to tap the phone lines.
Re-freakin-diculous.
- JoeShmoe
-- I wonder which will go down in history as the bigger failure: the War on Drugs or the War on Filesharing
Yeah, if the government isn't able to keep the flow of drugs coming into the country, society might fall apart.
It was called ARPAnet.
Ok, so what's the big deal? My company has an intranet to keep the unwanted away from our sacred data. What's wrong with government doing this? How does this make them "above the people"?
Yes, I'm still a junky. Are you still a bitch?
Well, I can't say it would be "secure," but certainly it would be "more secure." Come on, anybody who has read the RFCs for IP KNOWS that eavesdropping wasn't at the top of the list of concerns when the protocol was written.
Besides, the government has been using private networks for quite a while, this is just yet another private network. I don't think that I'd even want to run a business without SOME privacy.
Working for the military, I know that the US's classified network is shared w/ second parties (Britan, Australia, New Zealand, Canada) is physically separate from the internet. The only way we import stuff off the internet onto our network is copy it to a CD using an unclassified system, viral scan it and other measures, and place in a classified machine.
All 5 countries have access to it, but classified stuff still has to be encrypted for transmissions. And we dont use commercial stuff for that, each country uses their own stuff.
The interconnection of the 5 countries allows us to share data as we see necessary.
This separation from the internet keeps the classified network safe from things like Code Red or any other viruses and worms.
I'm all in favor of the civilian government (even the all important USDA) and the military having separate networks. In the ideal world, this would
./ readership knows, you average pubic worker/ 9-5er doesn't know enough and hasn't been trained enough to do his/her part in network security (i.e. not writing password on sticky note posted on monitor with phrase "Network Password Don't forget!!!")
be fine. The civilian governmental agencies could use the same network without problems and without interference.
Needless to say, this is not an ideal world. Do you think Billy Bob the Forest Ranger and Gordon the Beef Inspector (to use USDA examples) are going to do his part to keep the same network secure that James the Spy or Steve the Strategic Planner use? As the
Moreover, the separation of civilian powers and military powers is an important American ideal. If some civilian agency (the GSA maybe?) is investigating the military, you usually don't want them seeing or interfering with your communications. That can't happen when your network admin takes military orders, and will knowingly break the law under orders. A civilian government employee, on the other hand, can legally refuse to break the law without retribution by the employer.
So, all in all, its probably a good idea to keep the networks separate.
My email is real.
or something similar, which used the same protocols as TCP/IP, but over private lines which encrypted the data at the hardware level. Anyone have more info?
Whatever happened to government not being above the people?
Nice troll. I suppose suppose you think that the government should allow us all into their LANs - firewall separate the people from the government. And they shouldn't use private WAN links - they should transmit all their packets on public internet (and no VPNs!). Nor should they use encryption - that's just another barrier between the people and the information.
Come on, we're not talking about hiding stuff that's not already (theoretically) hidden. We're talking about basic security. I'd be shot if I seriously proposed to my employer any of those tongue-in-cheek items in my first paragraph - and we're a private firm. You don't let just anybody look at you're business. "But we're the people," you cry. "We have a right!" So you do. Consider the privacy implications of unsecured governmental communications. The feds have HUGE amounts of information about the citizenry, and I think that info should be secured from the likes of J. Random Cracker. Whether or not the government should have all that info is a question for another day, but surely they should secure what they have.
If you want to know what the government knows, use FOIA. Consider it a public interface; don't worry about the implementation details. Use your vote to eliminate bad implementors. encourage investigative journalism. Demand accountability in recordskeeping - make Ollie North a traitor. But for heaven's sake, don't be so pigheaded as to think that we should take phones out of government offices because ureaucrats use them to have point-to-point, uneavesdropped conversations.
P.S. I'll bet some proactive GS IT types are using current events to finally get some long-needed network security into place.
As is often the case this sounds like people who only know a bit about the technology and options making very expensive suggestions.
A few alternatives to consider:
The government expanding the network already in place for the "Internet 2" initiative (high bandwith application testing) which currently exists between a network of universities, is already in place, and already has the fiber allocated and lit.
The government buying (or leasing in some form) some of the thousands of miles of dark fiber strung recently in the massive network infrastructure buildout.
Then, a second more practical and imporant suggestion. The government's goals are to ensure secure communication, ensure access to critical government data (not so much websites but FBI photo files, salelite imagary, even census data), and ensure critical command infrastructures.
Look at how non-goverment agencies accomplish very similar tasks - Banks use a web of network providers (usually at least two, often three) providing basic network connectivity to data centers; they often layer this with dedicated encryption (so that any traffic across public switched networks is encrypted); sometimes there are networks with-in networks (VPN tunnels etc); and there is extensive (and expensive) redundancy of all systems (and usually key people).
This redundancy would be rather expensive and difficult for most government agencies - but it is likely required. This includes physical as well as technical redundancy (i.e. serious data centers have power from multiple power grids entering the building at multiple locations; similarly they have data leaving the data center in multiple ways.
Now the good news - the government could probably pick up seriously redundant data centers, servers, networking equipment, fiber (dark or lit but already in the ground) for a very reduced price with the recent consolidation and collapse of hosting providers and network equipment vendors.
Rather than using this to build an entirely seperate network - if the government took the appropriate steps to secure and protect the system if could overlay the existing Internet without much difficulty.
(I would recommend of course that the government look at using the appropriate equipment for this job - i.e. secure and reliable OS's runing on physically secured machines)
Hope someone reads this and expands on my suggestions.
- some disclusures - I do not currently work for the government - my company is a software and consulting firm that may in the future do business with the government.
-- Join us in Chicago May 1-4th for MeshForum -- writer, historian, tech geek, entrepreneur, internet junky since '91 --
Allows:
This is basically the way the military handles things, and it works fairly well. The largest issue is that the military had much of this infrastructure in place prior to the huge growth of computer networks, so much of the infrastructure isn't as integrated as it should be. I'd love to be able to design a system like that from the ground up. Can you say Voice-over-IP in all US government agencies?
Good things, indeed.
JJ
disclaimer: I run networks for the military...
I read your post and think it offers some interesteing points but its clear that you havent worked in corporate IS which might change a few perceptions.
1. The second some low-level government flunkie at the Bureau of Railroad Employee Retirement signed onto AOL to check his e-mail, boom, there's a gateway. - Nope - i can lock it down so he cannot even get to the site and without local admin cannot install anything - we already do this with hotmail and yahoo etc due to people getting round our virus scanning and mail attachment restrictions by using hotmail - thus infecting us in this way - its simple proxy control and group policy application
2. VPN and PPTP are great concepts but shitty in practical terms - we use it here for remote clients and it is the bane of my existence with failed clients and forgotten passwords - its find with a limited number of remote sites but is cannot be used to replace infrastructure in larger (5+ people sites ) the only solution there is Frame/ATM
3. EOL sucked as it ws simply AOL attempting to give corporates a cheaper intranet option back before internet access was a standard thing
Drawing the TIN can analogy is a joke - the guy who wrote the article is an idiot in many ways but dont oversimplify the argument like that. The fact is with IDSL and Frame and ISDN running a routed network for communication and a good firewall and admin policy (and staff) you can have a secure environment (even on MS products) and totally private - the environment this guy is describing covers this and i suspect in most cases is already in place, as for offsite i think stronger mail encryption for them and PPTP would be sufficient for limited exchange.
This is one guy trying to make a name for himself and hes doing it by stating the obvious.
I refuse to argue with Anonymous Cowards - if you want a discussion get an account....
I don't know if "critically-important government agencies like the Department of Agriculture" was meant to sound sarcastic, but I don't seem to be the only one who read it that way, judging from a couple of comments here. I'd just like to point out that the Ag Dept does an awful lot of good. Aside from various projects that help keep rural America afloat, the Agriculture Department also runs the Forest Service, protects open space, keeps ag-related disease out of this country, provides low-cost foods for school lunches, and does all sorts of other nifty behind-the-scenes market-oriented stuff to help ensure that when you go to the store, the stuff you need is always there. And affordable. If the Ag Dept vanished, you'd notice.
It's part of the internet as envisioned by Clinton, a complete private government network for Pr0n. Eventually all pr0n will be outlawed, available only in special government archives for use by government investigators and officials in thier research projects.
Eventually all the best pr0n will be there, leaving all of the junk out on the net as a collection of blind links going in an endless circle.
This is as good a reason as any for this network, to safeguard the government pr0n collection
"It is a greater offense to steal men's labor, than their clothes"
2. Spend billions upon billions of dollars to replicate the Internet, whose supposed network-wide security could be compromised by tapping into a LAN at a Dept. of Agriculture office or whatever.
Of course, many Internet protocols are wildly insecure, due to the academic roots of the 'Net when security wasn't an issue. However, we have https, ssh, all that good stuff now.
I demand you show me more than a handful of properly administered (Yes, MS software could possibly be a part of that) government computer networks that have been compromised like this guy fears. Unix-based servers with good IT people backing them up are pretty goddamned solid. DDOS attacks are probably the only threat which could be helped by building DARPANET-2. What a dumbass!
--hongpong.com
posted without the +1 bonus, so it's easy to ignore:
Request for Information for a Government Network Designed to Serve Critical Government Functions (GOVNET)
1.0 SUBJECT
Request for Information (RFI) for a Government Network designed to provide protected services for critical Government functions. The network is designated GOVNET. Responses are due to this RFI by 4:00 PM on November 21, 2001. See section 8.0 for further information.
2.0 DESCRIPTION
The General Services Administration, at the request of the Executive Office of the President of the United States, and the newly designated Advisor for Cyberspace Security, and in support of National Security goals established by the President, is seeking information from industry that will assist in the development and deployment of a special telecommunications network, GOVNET.
Specifically, this RFI seeks the following information:
Conceptual technical architecture alternatives
Technical feasibility alternatives assessments
Approximate cost information (i.e., order of magnitude, ballpark estimates, etc.) for alternatives
Information about spare or unused telecommunications capacities that could support GOVNET minimizing the need for special construction and associated costs and time delays
Schedule estimates
Ideas and suggestions that provide alternative approaches to designing, developing, acquiring, operating, and managing GOVNET
3.0 REQUIREMENTS
This section enumerates the high-level functional requirements for GOVNET. For purposes of responding to the RFI, requirements in the form of hypothetical locations to be served and associated traffic requirements for initial operational capability (IOC) will be made available to interested respondents at an information exchange meeting (see Section 6.0, below).
GOVNET will be a private Internet Protocol (IP) network shared by government agencies and other authorized users only. GOVNET will provide connectivity among users to a defined set (to be determined) of service delivery points.
There will be no interconnections or gateways to the Internet or other public or private networks. This applies to any network management, control, and maintenance functions for GOVNET as well. Initially, GOVNET will provide private intranet data connectivity within the contiguous 48 United States (CONUS).
GOVNET will provide commercial-grade voice communications capabilities within the network among specified users using the data network components and protocols. Voice services to be supported will include, but not be limited to, conferencing and multicast/broadcast. No connections or gateways to the PSTN or SS7 are envisioned for voice communications.
The potential for adding video communications also exists as a secondary requirement at this time. Video services to be supported will include, but not be limited to, conferencing and multicast/broadcast. As with voice requirements, there will be no communications or gateways outside of GOVNET.
GOVNET will support critical government functions and will be immune from malicious service and/or functional disruptions to which the shared public networks are vulnerable (i.e., so-called cyber attacks). In particular, it shall be impossible for malicious or intentionally disruptive activities (e.g., denial of service attacks) to be perpetrated within GOVNET from any network external to GOVNET. Similarly, it shall be impossible for malicious code (e.g., computer viruses) to penetrate GOVNET from any network external to GOVNET.
GOVNET will provide the highest levels of reliability and availability including trunk and access diversity, and rapid response times for customer outages. This RFI does not specify a particular requirement for availability or reliability. Responses to this RFI will assist in establishing this requirement. In formulating responses, each respondent should describe the reliability and availability characteristics of each alternative included in their response.
GOVNET traffic will be secure (i.e., encrypted by the network using NSA approved encryption techniques), and will be suitable for carrying classified information. For purposes of this RFI respondents should assume encryption of payload data only. No encryption of routing or addressing information is contemplated at this time.
GOVNET will be a turnkey solution offered and priced as a service to participating users. For purposes of this RFI, assume a single invoice with supporting detail presented monthly to GSA will be acceptable.
GOVNET will offer bandwidth-on-demand services at user locations and will be scalable to meet growth in overall network demand and/or peak requirements.
All GOVNET components and links must be located in the U.S. or Canada.
GOVNET shall evolve to maintain technology and service currency with state of the art commercial services to the maximum extent practical.
GOVNET will be operated on a 24/7 basis by the contractor.
GOVNET will provide initial operational capabilities (IOC) within six months from contract award. For purposes of responding to the RFI, IOC is defined as full GOVNET IP connectivity to all locations that will be made available at the public information exchange meeting. Within 12 months after award, voice and video capabilities will be available on GOVNET.
Other requirements not directly related to physical network and services isolation will be addressed at a later date. Examples of such requirements include security policies and security management requirements, required active defense measures, security of network management and control technologies, network capacities, service level agreements, and other important considerations.
The purpose of this RFI is to gather information about those requirements enumerated above. To the extent simplifying assumptions are needed, respondents are encouraged to make and document such assumptions in their responses.
4.0 POSSIBLE NETWORK SOLUTION
GOVNET must meet the functional requirements specified above. The Government is open to alternative concepts for solutions that meet these requirements. The Government encourages creativity and outside the box thinking in responses to this RFI.
One possible solution would be to build a completely dedicated network based on dedicated physical fiber pairs and full path diversity. All hardware would be dedicated, including all transmission equipment, routers, switches, multiplexing equipment, network management and control equipment, etc. In addition, all management and operational personnel would be fully dedicated to the network.
This RFI seeks information about a fully dedicated non-shared network as well as other approaches that could meet the functional requirements with additional levels of sharing of personnel, equipment, and connectivity paths. In doing so, the Government seeks to understand the tradeoffs among risks, costs (initial and ongoing) and alternative technical architectures that incorporate increasing degrees of sharing.
Accordingly, respondents are encouraged to provide information about any alternatives that can be demonstrated to be immune from the kinds of disruptions described in section 3.0, above.
5.0 SAMPLE RESPONSE OUTLINE
Following is a suggested outline and suggested page counts for a response to this RFI. This outline is intended to minimize the effort of the respondent and structure the responses for ease of analysis by the government. Nevertheless, respondents are free to develop their response as they see fit.
Section 1 - Conceptual Alternatives
Briefly describe two or more alternative architecture concepts for GOVNET, including the reliability and availability characteristics of the alternatives. Discuss the capability for the architecture to expand to meet video requirements, and to meet needs outside CONUS. (3-5 pages per alternative with one diagram per alternative identifying the brand/type of equipment that would typically be deployed)
Section 2 - Feasibility Assessment
Briefly describe the feasibility of each alternative and the design tradeoffs involved as matched against the functional requirements and risks of penetration. (1 page per alternative)
Section 3 - Cost and Schedule Estimates
Provide cost estimates for each alternative for 5 and 10-year contract terms for non-recurring and annual recurring costs using the locations provided at the public information exchange meeting(one page table). Also, discuss cost drivers, cost tradeoffs, and schedule considerations (2-3 pages)
Section 4 - Corporate Expertise
Briefly describe your company, your products and services, history, ownership, financial information, and other information you deem relevant. (no suggested page count)
In particular, please describe any projects you have been involved in that are similar in concept to what is described in this RFI, including management and operations approach, security requirements, security assurance processes, and any relevant lessons learned (1-2 pages per project).
Include any comments on the structure of the requirements for a formal RFP response.
Note - please also describe any network capacity assets that you might be willing to dedicate for deploying GOVNET. Examples of such assets might include unsold or unsubscribed capacities, so-called dark fiber routes, assets designated for liquidation or that are financially under-performing, etc.
Section 5 - Additional Materials
Please provide any other materials, suggestions, and discussion you deem appropriate.
6.0 INFORMATION EXCHANGE MEETINGS
GSA and the Special Advisor for Cyberspace Security will hold an information exchange meeting to discuss this RFI with interested potential respondents. Details about this meeting will be made available at a later date. If you wish to attend this meeting, please respond to the contact provided in section 8.0, below.
In addition, GSA will consider meeting individually with interested potential respondents. If you are interested in requesting such a meeting, please respond to the contact provided in section 8.0, below.
7.0 DISCLAIMER
This RFI is issued solely for information and planning purposes only and does not constitute a solicitation. All information received in response to this RFI that is marked Proprietary will be handled accordingly. Responses to the RFI will not be returned. In accordance with FAR 15.202(e), responses to this notice are not an offers and cannot be accepted by the Government to form a binding contract. Responders are solely responsible for all expenses associated with responding to this RFI.
8.0 CONTACT INFORMATION
Following is the Point of Contact (POC) for this RFI, including the public information exchange meeting:
Mr. John (Jack) Braun
(703) 306-6423
jack.braun@gsa.gov
Please submit responses via e-mail in Microsoft Office format by 4:00 PM on November 21, 2001, to the POC at: govnet.ts.fts@gsa.gov. You may also submit supplemental hardcopy materials such as brochures, etc. (5 copies each) to the POC.
Mooniacs for iOS and Android
Its composed of people like you and I, not evil robots that try to strip us of everything we own in some gigantic conspiracy to "ruuuule the wooooorld"
A few questions:
How many times, in the last century alone, has a nation killed tens of thousands of it's own people in a consolidation of government power? Hundreds of thousands? Millions? The fact that you probably need to research an accurate answer to the first two, and that the answer to #3 is not "zero", should worry you just a little.
Given the above answers, do statements like: "Some civil servants might not care about my privacy as much as they should" really seem that outlandish?
If the government were as truly evil as you think they are, they would have already killed you, or would have prevented you from being born in the first place, let alone let you (gasp) speak openly in public!
Oh, of course! They're not committing genocide yet, so obviously everything is hunky-dory in the binary "perfect good" vs. "infinite evil" world you live in. Sorry if we're confusing you by suggesting the existance of gray...
The government wants the network up and running six months after a contractor is picked
Is this the same government I'm familiar with? 6 years, maybe. Cripes, I wait in line at the DMV longer than 6 months, let alone roll out a new security infrastructure.
There is no reasonable defense against an idiot with an agenda
:wq
I hope they doesn't think about making parts of this GOVNET wireless, the day they do that they're hacked for sure. And anyway, I dont think it will work with such a large network without any loopholes in it (with or without the wireless feature).
;-). And finally I think the reason that the Feds can't piggy-back on the U.S. Military network is just because they will screw it up.
Think about it for a while, how many works for the government in the US today? And if just one of those are lazy/stupid/corrupt or anything else, they will have a LARGE enough loophole to be hacked to hell. And how should they check if no one lazy/stupid/corrupt worker by mistake/laziness/stupidity/intention just happens to connect his pc to the other world? And how should they do with more practical things, like there may be some chance that some of the workers would like to get emails for instance from people not on GOVNET, or maybe they must use the ordinary net in work. Should they use two physically separated pc's in their work?
Alright, I say OK to the fact that it works in the network used by the U.S. military. But thats a big difference, they have more discipline, are fewer and are more easily controlled (compared to the Department of Agriculture for instance
2 reptiles beneath your current threshold.
If SIPRNET was what the original poster was referring to, it would not be a good choice government wide.
SIPRNET carries classified data and is physically and logically separate from the Internet. Not even the best hacker can get through an airgap.
The way I understand the proposal, it would be to establish a similar network for unclassified but sensitive data that would also be logically and physically separate from the Internet.
I think most likely this would be accomplished by disconnecting the current unclassified IP router network from the Internet and extending it government wide. Email could pass through a special purpose mail guard/robust firewall of some sorts that would provide a high level of protection.
ICANN, VeriSign, that whole lot? Pretty please?
Edith Keeler Must Die
'piggy backing' (as michael put it) wont work for many reasons. I'll explain one major reason:
A person's security clearance. There are multiple levels: Secret and Top Secret are the two most common for military and intelligence uses (there are other levels of classification, but I'm singling out these two for simplicity's sake). Hence, the mil and IC share TWO separated networks, a Secret and a Top Secret (both separate from each other and separate from teh Internet). People with a S clearance cannot access the TS network. But people who are TS cleared can access the S network if their job deems it necessary.
Now for to the rest of the government. Many agencies dont require a security clearance at all (ok, they do require criminal bkgd checks, but that's about it). Question to ask is do you really want uncleared people accessing a network made for classified data?
What I think is being proposed here is a third network that's an Unclassified standalone network (standalone meaning separated from the Internet). This will allow agencies like USDA or Agriculture and state/local gov'ts to be separate from the Internet so that they become more immune to attacks and viruses.
The only issue here is when these people need to access the internet for real. Currently in the military, that means a few internet workstations shared by 30-50 people and each person having a classified box at their cube. If the job deems it necessary, people can have both at their desk. The problem here is an increasing number of computers.
IIRC, DARPA (or one of their contracts) is developing something that can allow a machine access to multiple networks simultaneously, yet keep everything separate. Whenever that gets done, that'll save money on buying physical workstations.
(Note: S and TS are shorthand for Secret and Top Secret)
The One Rule Of Chess You'll Ever Need: Don't play someone who carries a kit in their bookbag.
You lose a lot. First, the government is no longer supporting the public network.
The Internet MUST be made secure. We need to accomplish that, not just allow it to be insecure and then pay for a lot of separate networks. It would be great to have the government help everyone else accomplish security.
Second, having a separate network creates a sense of separateness among government employees. There is too much of that already.
Remember, a separate network means that employees no longer have access to the Internet. They can't join in with the discussion on Slashdot, for example. They can't see what people are saying. They can't do research on other ways of achieving security. They can't check their e-mail. A democracy should try to accomplish security, but not separateness.
Third, having a completely separate network is EXPENSIVE. We lose the right to spend our money on something else.
There are cheaper ways of accomplishing security.
Every time someone proposes to do something that doesn't make sense, and costs a lot of money, look for the real reason.
President Bush's father is connected with a company that wants to put a pipeline across Afghanistan: What should be the Response to Violence?
Bush's education improvements were
You're speaking of Intelink. If I recally correctly, everything on Intelink is classified at one level or another. Government documents (a memo to you boss) is not classfied. If you put everyone on Intelink, you're going to have to give everyone in the government security clearances (which is costs money and time) and you have to classify all your documents. Bad idea. You are effectively making all government operations classified. Again bad idea. It's blantanly obvious the government can't secure their systems (hell, they lose laptops left and right), so this is probably the only way to fence them off from hackers.
there are no stupid questions, but there are a lot of inquisitive idiots
I'll take it the way most government networks are connected now are via VPN or just plain old TCP/IP into the wild, wild, net.This is either a problem, or actually helpful the way I look at it. The infrastructure for the existing network can bounce around the net if X Router is disabled or Y backbone is cut. There is massive redudancy
By putting all government computers on one easily identifiable network, aren't you just making a bigger, easier target? Doesn't this just paint a big huge bullseye on the government network infrastructure? You would need a very, very large distributed network to achieve the levels of backup redundancy current internet routing provides.
On the other hand, segmenting the network off from the internet as a whole eliminates (most) of the electronic attacks. If you have a seperate network tightly controlled by physical security this could definietly work. For this to work I think you would need some heavily guarded data centers distributed liberally throughout the country.
Comments anyone?
2001: Privacy advocates scream Big Brother up to no good and bemoan loss of civil liberties. GOVNET building commences.
2002: Microsoft proposes "GOV.NET". U.S. Government is impressed with plan to hand control of U.S. Government Information Technology Infrastrucure over to private company in return for promises that Microsoft Operating Systems on exisiting Infrastructure will function more reliably.
2003: GOVNET protocol figured out by shadowy hacker or group of hackers known as DarthBilbo and disseminated in Spam Usenet posts: 14 year old turns Department of Interior server into Gnutella node, 22 year old uses California Homeland Defense Office server to stash 100 gigs of porn and pirate music. Chinese hackers splash "F*** Poisonbox" on homepage of over 100 government servers.
2004: FARC and IRA Terrorist sympathizers, despondent at the decimation of their ranks in the past 3 years by U.S. Anti-Terror activity, launch crippling DoS attacks with Code Red, White, and Blue worm. Unpatched versions of IIS9 installed on 98% of GOVNET Servers. Entire GOVNET shut down. Worm works via social engineering exploit whereby all GOV.NET Server Admins get email saying: "Hi! How are you? I send you this file in order to have your advice. See you later. Thanks". IIS9 patch would have prevented this exploit by denying the Admins access to Server rooms by revoking the revolving monthly license for their Microsoft Passport service on their National Identification Cards. Nation awaits crippling of U.S. Infrastructure and mass confusion.
Nothing happens. An office worker in a State Department office building is quoted on the evening news as saying "Those GOVNET boxes? They never worked anyway. We just use them to play Solitaire and FreeCell. We all use our personal AOL email accounts and chat rooms to conduct important government business."
2005: President Rudolph Giuliani announces plans for GOVNET2. Based on earlier work on the RFC 1149 implementation. Privacy advocates scream Big Brother up to no good and bemoan loss of civil liberties. Building commences.
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
You said it. It's supposed to be secret. No we have to kill everyone on /. without a security clearance. I wonder if JohnKatz has a security clearance?
OK so the Gov't is going to implement a "secure NW"
OK so the Gov't already has some "secure NWs"
OK so the Gov't is "wasting" money
Why is any of this news? The US gov't does this sort of thing all the time.
The US gov't gave the Airline industry 17 BILLION dollars. This is a group of people who couldn't move all the people who wanted to be moved AND still lost money! We're feeding a country we're bombing.
I say, "Let'em have their secure network," more jobs for me!
This
I work for a federal agency on a contract basis and I have some doubts about the feasibility of doing this stuff. As an example, there are about a dozen sub agencies in this single agency and each of them implement their own firewalls. The building itself is segmented off and there is a lack of uniform networking principles. In the end it doesn't hamper security that much, but it is *very* hard to consolidate the efforts into a single network idealogy.
Why? For starters, it is a political thing. One group likes NT, another Sun and another HP. There are vested skills and talents for managing the network for each sub agency. It may not look pretty on paper, but does anyone think you can really turn that sort of establishment on its head and impose a single network policy on the whole Government, let alone one agency?
A fresh start would in some ways be nice, and the terrorism as of late may be a strong impetus to get this off the ground, but I have some doubts about how productive it will be.
-- Solaris Central - http://w
A separate and private internet for the government is an excellent idea. Despite the fact that many Americans feel that the government should have nothing to hide from its citizens, there are often details of life that necessarily must be kept from citizens in order to keep things ... smooth. National security is a very touch subject, and conspiracy theorists may swear that GOVNet is just another weapon of the "Leviathan" government of ours to make itself stronger or better. I might agree that our government is too large and too strong in too many ways, but I think we can agree that a secure information network is a necessity.
Not that making information sharing quite so easy will be good for civil liberties or anything.
-jhp
/. -- the Free Republic of technology.
This is a great move. Essentially, they want to create a large, secure, reliable, high-bandwidth infranet. That's a huge task. It will mean huge contracts, lots of money, and many jobs for networking companies that have recently hit hard times.
Will the network actually be more secure? Maybe, maybe not. If it isn't...so what? Just the act of trying circulates money.
I consider this an utterly irresponsible attitude for the government and I hope this is not implemented. To wash your hands of it and declare the Internet insecure and not fit for government transfers leaves millions of corporations - who in America provide the national infrastructure to a far greater extent than the government - who need security and reliability online out to dry.
We need a government who is going to say the opposite, that they will spearhead crypto & security research, put pressure on Microsoft and other weak security companies, and lead the way to making the Internet as secure, redundant, and failsafe as possible. *That* would be a service to the nation. Govnet is not.
Code red took IBM's internal network down for about a week. You don't think that this network won't go down as soon as your favorite senator and mine dials out to the internet proper so they can spank it to the scenes of nubile young goats? It'll never fly...
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
And on a related story, they plan to add a new Top Level Domain just for the GOVNET. Although there is no offical word, sources claim the new TLD will be ".FU".
Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant
That's like saying there's a wire that's not bendable.
... give us all a chance).
Okay, let's figure this thing out. Government wants to separate themselves completely from the WWW. This means that they need to lay their own network of wires.
Let's figure out this deductively:
Step #1: Wireless: If they are dumb enough to use satellite communication for networking, all it would take is someone to go driving along in their van with a good enough receiver who knows where a receiver would be along the network, park their van close by, and tap into the mainframe with a large enough receiver. Honestly, there's no way you can completely guard an entire "wireless airspace." If they use hard cable...
Step #2: Cable: My assumption would be that they'd lay cable instead. Alright, no problem. Play the game by the network's rules (just like phreakers did back in the 70s and 80s)...find a line and tap into it. Again, all it would take is for someone to figure out that one of those cables is the GOVNET cable (or someone obtain a map of the GOVNET network...even if it's classified, I'm sure one would leak out eventually). Even if it's out in the middle of the Utah desert, all someone would need is a shack and an electric pole running nearby the cable and he could easily break into the data stream.
Of course, I'm sure that GOVNET would also be using some style of encryption (hopefully...I want to assume that they would hire technicians that are THAT ignorant, but they do pay $1000 for a toilet seat, so who knows what bozos they'll hire). But even so, the point is that once you have some way of tapping into the line itself, you could broadcast it however you like to the surrounding region with a wireless tranceiver (heck, go for 802.11b
I probably don't have all my wireless networking tools correct, but the point I'm trying to make still stands out: any network can be physically broken into, since it cannot all be guarded throughout the US. And after it's physically compromised, it's just a matter of time before we see Bush on GOVNET VidConference Viewer v1.0!
In the US Air Force, they refer to the internet as NIPRNET (Non-secure IP Router Network). Only unclassified info is sent across it, and sensitive unclassified or privacy act info is restricted to
The other network is called SIPRNET (Secret IP Router Network). On military installations its conduit is encased in concrete, junction boxes are alarmed, & cable drops are only in secure areas. Off the installations it's encrypted. I imagine the encryption is pretty strong since NSA designs the algorithms.
For more info check out these AF regulations:
AFI 33-202: Computer Security
AFMAN 33-221: Computer Security: Protected Distribution Systems (PDS)
Well here in Oz there are National guidelines for the viewing of online adult content by government staff. This was worked up for National web archiving projects where someone had to makea call on "adult" content. I believe it stipulates things like "Only one staff memeber to view the material and no more than two staff members standing around the screen".
Xix.
"Everything is adjustable, provided you have the right tools"
What's the bets Microsoft are contracted for the new network's systems, swallowing millions of taxpayer dollars, and probably running the whole thing on MSTCP or NetBEUI... - and, in the normal microsoft fashion leaving the entire thing wide open to their friends the scientologists...
Choice of masters is not freedom.
Also it's well known that gov't computer security is fairly pathetic, this would be a nice first step towards remedying that problem. Just have seperate networks with an airgap between this network and the internet, and the gov't would be shielded from any number of plausible attacks.
After all, if you show me a Network Admin who can't hack a .gov/.mil site, I'l show you an incompetant Network Admin.
And old school connection for all the "leet" people.
Outdoor digital photography, mostly in New Engl
hope that they understand that a large-scale network like this isn't going to solve all of their problems. They'll still have to maintain heavy security on all of their sites, regardless of how much more secure this network is.
Sounds like much more trouble. If they build their own private wires, the terrorists will know exactly what to break and listen to. I can see it now, "Ah yes, as prommised there it is, the red wire! Cut it quickly for there is no reason for the animal to suffer.", and the Bat Phone dies.
Friends don't help friends install M$ junk.