Slashdot Mirror
Freedom of Information Act vs Homeland Security
psyki writes "Should vulnerabilities in our public infrastructure be handled like vulnerabilities in computer security? Wired has an interesting article about the state of the Freedom of Information Act, particularly how it is becoming increasingly difficult to obtain documents from reluctant agencies in the security-conscious post-Sept 11 era. What really made me think, however, was this line: "While keeping information about security vulnerabilities out of terrorists' hands is a legitimate goal, McMasters believes the government is taking secrecy a step too far. In the end, he said, communities would be safer and better able to plan for their own protection if they were aware of potential security holes in power plants, airport terminals or other facilities.". Sounds an awful lot like the raging debate in the computer security community regarding publicizing vulnerabilities."
What are you going to do about it? Pour the 15-foot thick concrete bunker around it yourself?
I have been pwned because my
First, michael put a "IN SOVIET RUSSIA" joke in the byline. Though it's completely nonsensical, since you most assuredly did not get much information from the government in Soviet Russia.
Second, if there is another terrorist attack on US soil, and another one which could have been prevented by stronger security measures, the blood of the victims will be on the hands of all those who feel that relatively unimportant civil liberties (such as the liberty to steal music online) are worth more than the lives of their countrymen.
I admit that I am a firm believer in publicizing software vulnerabilities and that it increases security. As such I believe that open systems are more secure than closed systems in the long run. In other words, I think that it's easier to hack into a closed-source system (via binary disassembly) than into an open-source system (by looking at source code).
But we're not just talking about software here. And there is no question that when an exploit is published that some individuals will take advantage of it. Publishing exploitable details could very well allow a single exploit, which IMHO is one too many.
The difference is that FOIA covers the government while the debate about security vunerabilities is in the private sector.
The analogy is a good one but let's not confuse private industry's interest in profit with our interest in an open government.
The arguement can be made that Microsoft is so vital that it has to be as equally transparent as the government is (supposed to be). But, as influencial and omnipotent as Microsoft is, it isn't government, it is owned by Bill Gates and stock holders not a voting public.
Civil liberties are the bedrocks of our society; however, the Constitution is not a suicide pact. Discuss.
I write in my journal
Demand that the government FIXES it rather than just relying on security through obscurity. . .
The U.S. Government seems intent on the idea that if they HIDE the security flaws that those flaws will not be exploited by terrorists. (and of course as a bonus side effect they don't have to hear the public keep on bitching about those security holes either!)
Well first off, it is fairly hard to stop people from WALKING THROUGH public places. Second off, copies of plans still exist in archives unscrupulous individuals (a category which terrorists definitely fall into the category of) are more than willing to find ways to gain access to.
So does hiding the security flaws make any difference? No, shit will still get blown up. The only difference is that the people won't get to realize how much danger they are in and thus will not be able to force their legislators to FIX those problems before those problems ARE exploited.
Democracy relies on the principle of a populous educated on issues pertinent to society. Kind of hard to have an EDUCATED populous when the government keeps on taking away the relevant data!
Need help treating your acne? Come here!
This is a response to several posts made here.
I've seen several posts so far that deal primarily with terrorists causing nuclear plants to meltdown, but really that's an extreme point of the kind of information that is being held back. One poster said, basically, that a dead man doesn't have any civil liberties, and that's certainly true and there are some things that the government should keep secret, like the locations of military weapons depots and our own nuclear arsenal. But the article isn't about just nuclear plants and military weapons. It's about all sorts of ways that communities could make themselves safer. Maybe folks could brainstorm some things that the government should be telling us, and then we can get of this extremist example.
To refer to another post, somebody asked if "you would pour the concrete yourself," presumably in reference to making some sort of architectural structure safer in the event of a terrorist attack. There are a lot of people out there who know how to pour concrete, and I would bet quite a few of them would be willing to provide their knowledge and experience to help make their communities safer.
Finally, a lot of words have been given to the comparison of community security issues to open vs. closed software. Well, I have to say that it's simply not true that secrecy is the best policy because, as any Thursday-night sitcom can tell you, no matter how "secret" you keep something, it's going to be found out sooner or later. Last year sometime I remember hearing a report on NPR about how the government was trying to get libraries to remove from circulation CDs that contained information about reservoirs and water supply sheds, etc., because this information could be used to make a terrorist attack. But the problem with this, besides the fact that the information is already "out there" (you can't close Pandora's box, at least not effectively), is that terrorists obviously do their research, and they're gonna find the reservoirs they want anyway. Heck, all they need to do is read Stephen King's "Dreamcatcher" to take care of greater Boston...perhaps we should ban that! But it's not just about terrorist attacks. People should have the right to know where the water they drink comes from. Sure, a lot of people will do nothing with the information, but should the day come that they need it, god forbid the info isn't there!
Essentially, I do believe that some things should be kept secret, but not many things. Plans for WMDs? Certainly! The structural integrity of the bridge I drive over everyday to go to work? Certainly not!
"The evil of the world is made possible by nothing but the sanction you give it." -- Ayn Rand
suicide pact
You say "suicide pact" without offering any meaning or definition. That's every bit as fear-mongering and irresponsible as the current U.S. govt's actions have been of late.
Is it suicidal to want to know that the government is doing its job? Is an opaque government to be trusted? Will elected and appointed officials perform their duty to protect us? What if they slack off? Will we know before its too late?
It's called accountability. Our safety is dependent upon it.
Unaccountability is the not-too-secret wet-dream of conservatives and big business. Welcome to unaccountability legislated (Patriot Act and siblings) and decreed (Ashcroft's FOIA directives and Bush's executive orders.)
Big Daddy, Johnny, Burp, Aunt Zelda, Scott, Slurp, Big Momma
Ronald Reagan signed orders that his papers be released 20 years after leaving office. This is customary, and usually includes GOOD AND BAD things about presidents and their entourage.
:-)
... imagine how embarrased the Bush administration would be if recent events caused this to become news again? Say, an anthrax attack on US troops is analyzed and genetically determined to have come from US weapons stockpiles? Oops.
This is why presidents like to wait 20 years before releasing papers.
However, many of the SAME people under Reagan are now under Bush Jr. with Very Important Jobs. They don't WANT those papers released, so many Reagan papers marked for release have been re-classified as National Secrets.
How many folks know that Donald Rumsfeld shook Saddam Hussein's hand?
How many folks know that Donald Rumsfeld wrote in 1985 - in a memo - that Saddam was ruthless enough to use chemical and biological weapons, and after coming to this conclusion, decided to sell VX, anthrax, West Nile and Botulin technologies to Iraq.
Or, how many people know the Reagan/Bush government sold satelite photos of Iran's troop deployments, so Iraq would know where to launch their gas attacks?
How many people know the binLaden family is business partners with the Bush family via Carlysle Group. Osama Bin Laden's family is laundering money for him, and does so in Bush's company.
All of this has been published or leaked by pro-democratic forces within the US government. Much of this information was obtained through Freedom Of Information act. But all of it was released as a trickle...
Some of these folks are on record saying things that put them right in the same fascist ballpark as the terrorists they're inspiring.
Where are the US Founding Fathers when you need them??
It can be logically argued about exactly where the point of balance should be between full information disclosure about public vulnerabilities and total secrecy.
Like many, I believe that the optimum lies between the two extremes. And I think every situation is different in terms of the trade-offs between the value of public disclosure in warning the public, getting them to take the threat seriously, and the flip sides of inducing needless panic, giving saboteurs a helpful roadmap, etc.
The key issue in my mind is
Often it is the government who decides the level of disclosure.And the problem is a conflict of interest, because sometimes helpful disclosure of information for the public good may make the government, people in the government, or friends of people in the government look bad.
Consequently, you can guess then that the level of disclosure is generally going to be less than the optimum if the government has made bad embarrassing choices in the past, but the level of disclosure may be very high if the government has generally been making good decisions.
"Provided by the management for your protection."