GOVNET In the Works

gtg010b writes: "According to USA Today, the U.S. government is considering a private network to be used for all government communications. This network would be "separate from the Internet to keep it safe from hackers or terrorists" according to Richard Clarke, the head of the president's "cyberspace security adviser." Whatever happened to government not being above the people?" Clarke is the guy who's been crying "cyber Pearl Harbor" for a few years; apparently if you cry wolf long enough you get promoted. His request (.doc format) is informative. I should point out that the U.S. military already has such a network (I'm not even going to ask why the Feds can't piggy-back on it), so GOVNET would be for critically-important government agencies like the Department of Agriculture to communicate.

Comments

uh?

[c0rtez]

Why not just encrypt across internet2 or something? i really don't understand why everyone is crying pearl harbor about everything anyway...

Sure...

[dghcasp]

GOVNET would be for critically-important government agencies like the Department of Agriculture to communicate.

and get spammed with MAKE WHEAT FAST!

Why not use Internet2 for the new network?

[WillSeattle]

I think this would be a good test case for the government. They could use IPv6 and Internet2 standards, with full encryption of messages and full security.

Would be a good test case - if it works, then we can expect to see a clone system roll out in major cities within two years.

Using the threat to accomplish hidden purposes.

[Futurepower(tm)]

People are using the terrorist threat to do things they wanted to do anyway, but would not normally be allowed.


Secrecy and weapons sales corrupt democracy: What should be the Response to Violence?

This is bad why?

[chinton]

So, they want to set up an intranet for the government. Why is this a bad thing? Should all corporations be required to use the internet for any and all communications between employees/remote sites/customers?

Re:This is bad why?

[MikeyNg]

So, they want to set up an intranet for the government. Why is this a bad thing? Should all corporations be required to use the internet for any and all communications between employees/remote sites/customers?

This is not a bad thing. It's a redundant thing. If you read up on DARPA and the creation of the Internet, you'll see that all that's being proposed has already been proposed some forty years ago or something. So commercial entities have the majority of sites on the Internet now. Big deal. The Internet was initially created just to handle this sort of thing.

Yes, if they want to do videoconferencing, etc., they'd need to beef up the bandwidth. You'd need something like an Internet2 or something like that. Oops. That's already in the works, isn't it?

(As an aside, when's the last time anyone used a .mil address? They're still valid TLDs, right?)

Re:This is bad why?

[dachshund]

Well, it sounds like it'll be a big intranet. We could eventually be talking about thousands of sites, all over the country. Presumably all of these links will operate over isolated (and hopefully secure) communications lines, which aren't cheap-- there shouldn't be any tunneling over other networks, otherwise it you might as well just use a big VPN setup across the public Internet.

I hope that they understand that a large-scale network like this isn't going to solve all of their problems. They'll still have to maintain heavy security on all of their sites, regardless of how much more secure this network is.

I think it's not a bad idea, if you're looking to avoid a William Gibson type scenario (where all sorts of critical resources can be accessed from the public networks, if you've got enough tools and skill.)

The main issue here seems to be cost. It's not going to be pretty. And it's entirely possible that this network will be more trouble than it's worth.

Re:This is bad why?

[MongooseCN]

So, they want to set up an intranet for the government. Why is this a bad thing? Should all corporations be required to use the internet for any and all communications between employees/remote sites/customers?

Because it's going to take our tax money, to pay for this.

Re:This is bad why?

[baptiste]

Because it's going to take our tax money, to pay for this

Well, considering how many of your tax dollars are wasted when folks hack into their systems and mess them up... Makes sense.

I think this is a great idea. If its thought out well. Heck many large companies do this - you have a set # of firewalsl controlled by ONE group of security professionals. They can link the major sites with some of the tons of dark fiber out there. Smaller sites - use VPN with high encryption over the Internet. That gives you a good cost point since its the small offices that can kill you for an Intranet. Link the large locations with private links. The next step would be to place all their public webservers under the auspices one a single web team to ensure the damn servers are setup properly and securly. But that'll never happen :) Isn't bureaucracy grand? :)

Re:This is bad why?

[MikeyNg]

Way back in the day there was a reason or two to visit a .mil site. Or to use a .mil address, like if you were archie'ing or something. I can't even remember the last time I typed in .mil. When you think about it, that's really weird, since it's one of the few valid TLDs. There's .com, .net, .edu, .mil, and .org. (Before the new .biz, etc.) Whatever. I think it's weird, OK? :)

F. Lee Ermey, "Well...No Sh!t..."

[Dolly_Llama]

Apparently, the concept is to build a decentralized network so that government officials, academicians, and others can communicate with one another via a technology called "electronic mail." Planned but not yet implemented is a feature whereby entire files can be sent via this "Inter-network." Proponents of the decentralized model tout that communications could be routed around damage in such a network, even perhaps, a nuclear attack!

In business news, Cisco Systems stock [CSCO] rose 60% today.

Thank god for USA Today: America's Pravda

Re:F. Lee Ermey, "Well...No Sh!t..."

[kfg]

As has already been noted:

"The difference between the Russian press and the American press is that in Russia the papers only print the government's lies, whereas here in America we can't get the press to quote its lies accurately."

KFG

Large != Private

[conan_albrecht]

A private, secure network is by definition fairly small. The larger the network became (as would be necessary given the size of the US gov't), the more opportunity crackers would have to get in.

The goverment is simply too large to expect that a separate network would make it that much harder for crackers to get in.

Government WAN

[nevis]

Most large government agencies already have extensive WANs. The Judiciary (third branch) has a WAN called the DCN (District Court Network) that connects all 92 Districts. To my understanding many agencies falling under the dept of Justice also have their own WAN's.

Looks like a lot of the "GOVNET" is already in place.

confusing

[SaberTaylor]

Government action:

#1 legally restrict secure communications
#2 build private network for security

The internet is based on ARPAnet..

[ldopa1]

If my memory serves me right, the Internet is the bigger grandson of ARPAnet, which was originally developed for secure voice and teletype transmissions.

I say "Bring it on!" Not for a hacking standpoint, because really, what's the point? I think that GOVNET will eventually become another arm of the Internet eventually. It only makes sense that at least one department (Office of Homeland Security comes to mind) will want a direct link to the Internet to make work easier, and then another and then another, and finally, the GOVNET will just be another section of the internet, the same way WAIS and GOPHER are today. I wouldn't worry.

BTW, my thought that ARPAnet was the start of it all is sort of correct. You can check it all out right here.

This is the dumbest thing I've ever heard of

[JoeShmoe]

This is our government's security expert? This is his big plan to keep government data safe?

The Internet is everywhere. It's so purvasive that there is zero chance you can have any isolated network. The second some low-level government flunkie at the Bureau of Railroad Employee Retirement signed onto AOL to check his e-mail, boom, there's a gateway.

My thinking is that they plan to use GOVNET as an excuse to be lazy. Everything will have minimal authentication because there's no way big bad hackers can get on the network, right? Except that any PC on the network can easily become a gateway. There are plenty of examples of "private" and "secure" networks that were breached through classic hacking techniques like social engineering and wardialing.

This is stupid. What bout PPTP/VPN? Why can't they just make a virtual network that runs over the Internet like every other business is doing? The infrastructure costs are minimal because you aren't running redundant wiring. It's just as secure, in fact, it's more secure because you are going to be extra paranoid about things like password schemes and encryption levels if it has to survive some public data transfer points.

A few years ago, AOL tried to market this to companies. They called it EOL for Enterprise OnLine. Basically, for a fixed fee per user, all your employees got AOL accounts and access to a private keyword with your company's Intranet.

Except no one but Century21 ever signed up, as I suspect they got a good deal for being a test case. No one saw the point when security, done properly, is going to produce a much more versitile and cheaper result.

To make an analogy, this guys is suggesting that every government office get a tin can and a string so that they can communicate securely because there's alwaye the potential for someone to tap the phone lines.

Re-freakin-diculous.

- JoeShmoe

Keep those drugs flowing.

[Nathaniel]

"So GOVNET would be for critically-important government agencies like the Department of Agriculture to communicate."

Yeah, if the government isn't able to keep the flow of drugs coming into the country, society might fall apart.

Seperation of GOVNET and the military network

[Hal_9000@!!!@]

I'm all in favor of the civilian government (even the all important USDA) and the military having separate networks. In the ideal world, this would
be fine. The civilian governmental agencies could use the same network without problems and without interference.

Needless to say, this is not an ideal world. Do you think Billy Bob the Forest Ranger and Gordon the Beef Inspector (to use USDA examples) are going to do his part to keep the same network secure that James the Spy or Steve the Strategic Planner use? As the ./ readership knows, you average pubic worker/ 9-5er doesn't know enough and hasn't been trained enough to do his/her part in network security (i.e. not writing password on sticky note posted on monitor with phrase "Network Password Don't forget!!!")

Moreover, the separation of civilian powers and military powers is an important American ideal. If some civilian agency (the GSA maybe?) is investigating the military, you usually don't want them seeing or interfering with your communications. That can't happen when your network admin takes military orders, and will knowingly break the law under orders. A civilian government employee, on the other hand, can legally refuse to break the law without retribution by the employer.

So, all in all, its probably a good idea to keep the networks separate.

The goverment needs network security, too

[dillon_rinker]

Whatever happened to government not being above the people?

Nice troll. I suppose suppose you think that the government should allow us all into their LANs - firewall separate the people from the government. And they shouldn't use private WAN links - they should transmit all their packets on public internet (and no VPNs!). Nor should they use encryption - that's just another barrier between the people and the information.

Come on, we're not talking about hiding stuff that's not already (theoretically) hidden. We're talking about basic security. I'd be shot if I seriously proposed to my employer any of those tongue-in-cheek items in my first paragraph - and we're a private firm. You don't let just anybody look at you're business. "But we're the people," you cry. "We have a right!" So you do. Consider the privacy implications of unsecured governmental communications. The feds have HUGE amounts of information about the citizenry, and I think that info should be secured from the likes of J. Random Cracker. Whether or not the government should have all that info is a question for another day, but surely they should secure what they have.

If you want to know what the government knows, use FOIA. Consider it a public interface; don't worry about the implementation details. Use your vote to eliminate bad implementors. encourage investigative journalism. Demand accountability in recordskeeping - make Ollie North a traitor. But for heaven's sake, don't be so pigheaded as to think that we should take phones out of government offices because ureaucrats use them to have point-to-point, uneavesdropped conversations.

P.S. I'll bet some proactive GS IT types are using current events to finally get some long-needed network security into place.

Some suggestions and alternatives

[ShannonClark]

As is often the case this sounds like people who only know a bit about the technology and options making very expensive suggestions.

A few alternatives to consider:

The government expanding the network already in place for the "Internet 2" initiative (high bandwith application testing) which currently exists between a network of universities, is already in place, and already has the fiber allocated and lit.

The government buying (or leasing in some form) some of the thousands of miles of dark fiber strung recently in the massive network infrastructure buildout.

Then, a second more practical and imporant suggestion. The government's goals are to ensure secure communication, ensure access to critical government data (not so much websites but FBI photo files, salelite imagary, even census data), and ensure critical command infrastructures.

Look at how non-goverment agencies accomplish very similar tasks - Banks use a web of network providers (usually at least two, often three) providing basic network connectivity to data centers; they often layer this with dedicated encryption (so that any traffic across public switched networks is encrypted); sometimes there are networks with-in networks (VPN tunnels etc); and there is extensive (and expensive) redundancy of all systems (and usually key people).

This redundancy would be rather expensive and difficult for most government agencies - but it is likely required. This includes physical as well as technical redundancy (i.e. serious data centers have power from multiple power grids entering the building at multiple locations; similarly they have data leaving the data center in multiple ways.

Now the good news - the government could probably pick up seriously redundant data centers, servers, networking equipment, fiber (dark or lit but already in the ground) for a very reduced price with the recent consolidation and collapse of hosting providers and network equipment vendors.

Rather than using this to build an entirely seperate network - if the government took the appropriate steps to secure and protect the system if could overlay the existing Internet without much difficulty.

(I would recommend of course that the government look at using the appropriate equipment for this job - i.e. secure and reliable OS's runing on physically secured machines)

Hope someone reads this and expands on my suggestions.

- some disclusures - I do not currently work for the government - my company is a software and consulting firm that may in the future do business with the government.

You have never worked in corporate have you ?

[q-soe]

I read your post and think it offers some interesteing points but its clear that you havent worked in corporate IS which might change a few perceptions.
1. The second some low-level government flunkie at the Bureau of Railroad Employee Retirement signed onto AOL to check his e-mail, boom, there's a gateway. - Nope - i can lock it down so he cannot even get to the site and without local admin cannot install anything - we already do this with hotmail and yahoo etc due to people getting round our virus scanning and mail attachment restrictions by using hotmail - thus infecting us in this way - its simple proxy control and group policy application
2. VPN and PPTP are great concepts but shitty in practical terms - we use it here for remote clients and it is the bane of my existence with failed clients and forgotten passwords - its find with a limited number of remote sites but is cannot be used to replace infrastructure in larger (5+ people sites ) the only solution there is Frame/ATM
3. EOL sucked as it ws simply AOL attempting to give corporates a cheaper intranet option back before internet access was a standard thing

Drawing the TIN can analogy is a joke - the guy who wrote the article is an idiot in many ways but dont oversimplify the argument like that. The fact is with IDSL and Frame and ISDN running a routed network for communication and a good firewall and admin policy (and staff) you can have a secure environment (even on MS products) and totally private - the environment this guy is describing covers this and i suspect in most cases is already in place, as for offsite i think stronger mail encryption for them and PPTP would be sufficient for limited exchange.

This is one guy trying to make a name for himself and hes doing it by stating the obvious.

Re:You have never worked in corporate have you ?

[cnkeller]

I just think it's impossible to prevent crossovers between GOVNET/Internet because users are going to balk at having two boxes on their desk. Someone, somewhere is going to present a business case for Internet access (how are the GOVNET techies supposed to download drivers unless everything is mirrored internally?)

This is exactly how intelink (the classified version of in the internet) works dude. It is secure, guess why, because it ain't connected to the internet. You don't get access to it unless you need to have it. Sure you can tap the cable somewhere or steal sensitive info from work and post it on Yahoo. But assuming your a hacker not a traitor, good luck breaking in. I'm sure it's possible, though in the years I worked at NSA/DoD I never heard of someone hacking it.

You want to use the internet from your desk? Tough. You sign up, get permission and walk to a room where unclassfied internet exists. You want the latest device driver? You submit a request, it's downloaded a day or so later, virus scanned, logged in a file, and given to you on a floppy or internal ftp site. Last year I posted a length article on slashdot about pros and cons of working for the classified government. No net access was a big minus. Every friday, someone was nice enough to import Linux weekly news in it's entirety and post it. That's how I got my linux news at work. Note that NSA is working with VMware on a solution to provide internet access and classified access on the same desktop; not sure it will ever happen. Anyway, just some insight from someone who has been there and done that.

Safeguarding Government pr0n

[Alien54]

Well, it sounds like it'll be a big intranet. We could eventually be talking about thousands of sites, all over the country. Presumably all of these links will operate over isolated (and hopefully secure) communications lines, which aren't cheap-- there shouldn't be any tunneling over other networks, otherwise it you might as well just use a big VPN setup across the public Internet.

It's part of the internet as envisioned by Clinton, a complete private government network for Pr0n. Eventually all pr0n will be outlawed, available only in special government archives for use by government investigators and officials in thier research projects.

Eventually all the best pr0n will be there, leaving all of the junk out on the net as a collection of blind links going in an endless circle.

This is as good a reason as any for this network, to safeguard the government pr0n collection

Re:God, i'm tired of this...

[roystgnr]

Its composed of people like you and I, not evil robots that try to strip us of everything we own in some gigantic conspiracy to "ruuuule the wooooorld"

A few questions:

How many times, in the last century alone, has a nation killed tens of thousands of it's own people in a consolidation of government power? Hundreds of thousands? Millions? The fact that you probably need to research an accurate answer to the first two, and that the answer to #3 is not "zero", should worry you just a little.

Given the above answers, do statements like: "Some civil servants might not care about my privacy as much as they should" really seem that outlandish?

If the government were as truly evil as you think they are, they would have already killed you, or would have prevented you from being born in the first place, let alone let you (gasp) speak openly in public!

Oh, of course! They're not committing genocide yet, so obviously everything is hunky-dory in the binary "perfect good" vs. "infinite evil" world you live in. Sorry if we're confusing you by suggesting the existance of gray...

why piggybacking wont work

[jeffy124]

'piggy backing' (as michael put it) wont work for many reasons. I'll explain one major reason:

A person's security clearance. There are multiple levels: Secret and Top Secret are the two most common for military and intelligence uses (there are other levels of classification, but I'm singling out these two for simplicity's sake). Hence, the mil and IC share TWO separated networks, a Secret and a Top Secret (both separate from each other and separate from teh Internet). People with a S clearance cannot access the TS network. But people who are TS cleared can access the S network if their job deems it necessary.

Now for to the rest of the government. Many agencies dont require a security clearance at all (ok, they do require criminal bkgd checks, but that's about it). Question to ask is do you really want uncleared people accessing a network made for classified data?

What I think is being proposed here is a third network that's an Unclassified standalone network (standalone meaning separated from the Internet). This will allow agencies like USDA or Agriculture and state/local gov'ts to be separate from the Internet so that they become more immune to attacks and viruses.

The only issue here is when these people need to access the internet for real. Currently in the military, that means a few internet workstations shared by 30-50 people and each person having a classified box at their cube. If the job deems it necessary, people can have both at their desk. The problem here is an increasing number of computers.

IIRC, DARPA (or one of their contracts) is developing something that can allow a machine access to multiple networks simultaneously, yet keep everything separate. Whenever that gets done, that'll save money on buying physical workstations.

(Note: S and TS are shorthand for Secret and Top Secret)

Re:why piggybacking wont work

[jeffy124]

you're absolutely correct. Military networks are meant to be used for military purposes, not random people from congress snooping on activities so that they can tell the press stuff. In my example, I used security clearances to illustrate my point using simplified terms outsiders (non-military/govt people) would understand more easily.

Some of what I said is proably a tad innacurate, but I think the point of having multiple separated networks is made.

I should probably say something about Bush's irateness over press leaks. I'm a former DoD contractor with a clearance. (Contract ended Sept 20, thank god!) We got an email the day after the attacks saying that if the media approaches you, direct them to the Office of Public & Media Affairs and answer all questions 'no comment'. People in Congress proabably also got similar emails/memos.

I should note that the 'anonymous sources' the media uses are commiting espionage. Yes, espionage. IANAL, but my interpretation of espinage laws indicate that any disclosure of classified info, regardless of who the info is being disclosed. (that's also the drift I got during my exit briefing form the DoD)

This is the smartest thing I've ever heard of

[marxmarv]

This is stupid. What bout PPTP/VPN? Why can't they just make a virtual network that runs over the Internet like every other business is doing?

Because every other business isn't doing that. Every other business is buying cheaper-than-Internet point-to-point bandwidth and getting service guarantees. The government at least recognizes that outsourcing isn't as good deal as the PHB's say it is. T-1's have dropped precipitously lately.

The infrastructure costs are minimal because you aren't running redundant wiring. It's just as secure, in fact, it's more secure because you are going to be extra paranoid about things like password schemes and encryption levels if it has to survive some public data transfer points.

What does bandwidth from a "real" Internet provider at $1/bandwidth and $1/short-haul pipe buy you over direct lines at $1.50/long-haul pipe? Not latency, not reliability, not price, and certainly not administrative flexibility. Your comment about intentionally introducing holes into a network to impose discipline on its engineering is, frankly, an insult to those of us left who aren't into fucking around and like to go home at 5pm.

To make an analogy, this guys is suggesting that every government office get a tin can and a string so that they can communicate securely because there's alwaye the potential for someone to tap the phone lines.

By your logic, the government shouldn't buy its own private PBX systems or use VoIP or lease trunk lines to other branch offices because, well, isn't the public switched telephone network already there? He's suggesting that they use existing technology to, among other things, build a government-wide internal phone system, which happens to be a sound money-saving idea. The government has just as much reason to do so as any other large corporation.

Not that making information sharing quite so easy will be good for civil liberties or anything.

-jhp

Oh please...a network that's unhackable?

[Pollux]

That's like saying there's a wire that's not bendable.

Okay, let's figure this thing out. Government wants to separate themselves completely from the WWW. This means that they need to lay their own network of wires.

Let's figure out this deductively:

Step #1: Wireless: If they are dumb enough to use satellite communication for networking, all it would take is someone to go driving along in their van with a good enough receiver who knows where a receiver would be along the network, park their van close by, and tap into the mainframe with a large enough receiver. Honestly, there's no way you can completely guard an entire "wireless airspace." If they use hard cable...

Step #2: Cable: My assumption would be that they'd lay cable instead. Alright, no problem. Play the game by the network's rules (just like phreakers did back in the 70s and 80s)...find a line and tap into it. Again, all it would take is for someone to figure out that one of those cables is the GOVNET cable (or someone obtain a map of the GOVNET network...even if it's classified, I'm sure one would leak out eventually). Even if it's out in the middle of the Utah desert, all someone would need is a shack and an electric pole running nearby the cable and he could easily break into the data stream.

Of course, I'm sure that GOVNET would also be using some style of encryption (hopefully...I want to assume that they would hire technicians that are THAT ignorant, but they do pay $1000 for a toilet seat, so who knows what bozos they'll hire). But even so, the point is that once you have some way of tapping into the line itself, you could broadcast it however you like to the surrounding region with a wireless tranceiver (heck, go for 802.11b ... give us all a chance).

I probably don't have all my wireless networking tools correct, but the point I'm trying to make still stands out: any network can be physically broken into, since it cannot all be guarded throughout the US. And after it's physically compromised, it's just a matter of time before we see Bush on GOVNET VidConference Viewer v1.0!

Nothing New

[nathanm]

The US gov't already has worldwide networks that aren't connected at all to the internet, at least in DOD.

In the US Air Force, they refer to the internet as NIPRNET (Non-secure IP Router Network). Only unclassified info is sent across it, and sensitive unclassified or privacy act info is restricted to .mil or .gov users only.

The other network is called SIPRNET (Secret IP Router Network). On military installations its conduit is encased in concrete, junction boxes are alarmed, & cable drops are only in secure areas. Off the installations it's encrypted. I imagine the encryption is pretty strong since NSA designs the algorithms.

For more info check out these AF regulations:

AFI 33-202: Computer Security

AFMAN 33-221: Computer Security: Protected Distribution Systems (PDS)

and slashdot gets trolled again...

[mosch]

Since when is the concept of a private network a BAD thing? Sure it costs a little money, but the government HAS a little money, and it'll create jobs of the geek variety.

Also it's well known that gov't computer security is fairly pathetic, this would be a nice first step towards remedying that problem. Just have seperate networks with an airgap between this network and the internet, and the gov't would be shielded from any number of plausible attacks.

After all, if you show me a Network Admin who can't hack a .gov/.mil site, I'l show you an incompetant Network Admin.