Slashdot Mirror


NSA Director Says the US Must Secure the Internet

Trailrunner7 writes "The United States has a responsibility to take a leadership role in securing the Internet against both internal and external attackers, a duty that the federal government takes very seriously, the country's top military cybersecurity official said Tuesday. However, Gen. Keith Alexander, director of the National Security Agency and commander of the US Cyber Command, provided virtually nothing in the way of details of how the government intends to accomplish this rather daunting task. 'We made the Internet and it seems to me that we ought to be the first folks to get out there and protect it,' Alexander said. 'The challenge before us is large and daunting. But we have an obligation to meet it head-on.' It's unlikely that any of Alexander's comments Tuesday will do much to quiet the criticisms of the Obama administration's security efforts thus far. Speaking mostly in generalities, Alexander emphasized the administration's commitment to the Comprehensive National Cybersecurity Initiative, a plan developed by the Bush administration and recently partially de-classified by Obama administration officials."

250 comments

  1. Are they joking? by ak_hepcat · · Score: 5, Insightful

    Until you control all the INPUTS, you can't control the OUTPUTS

    I think these folks are actually trying to use scare-tactics in order to increase their own budgets short-term,
    knowing that there is no feasible method of performing such a task.

    --
    Support FSF: Stop thinking with your wallet, and think with your imagination. (cc/non-commercial)
    1. Re:Are they joking? by clang_jangle · · Score: 1

      Of course they're not joking. All just part of securing the planet, you know. Did you imagine they had some smaller goal in mind?

      --
      Caveat Utilitor
    2. Re:Are they joking? by cygnwolf · · Score: 1

      Of course they're not joking. All just part of controlling the planet, you know. Did you imagine they had some smaller goal in mind?

      FTFY

      --
      Free Pie! The Pie is Also Evil!
    3. Re:Are they joking? by Defenestrar · · Score: 1

      Obviously we need to protect it as thoroughly as we protect the First Amendment. Or perhaps the Fourth. One of them thingies anyway.

    4. Re:Are they joking? by Burz · · Score: 5, Insightful

      Exactly. What they are demanding is the banishment of anonymity at the very least.

    5. Re:Are they joking? by clang_jangle · · Score: 1

      Touché!

      --
      Caveat Utilitor
    6. Re:Are they joking? by Shikaku · · Score: 1

      How to be secure from the internet:

      Disconnect the ethernet cable and the Wifi.

      $1 million for my groundbreaking solution please.

    7. Re:Are they joking? by rwa2 · · Score: 4, Interesting

      Meh, joking aside, there's plenty of technical measures that they could be doing (not that we'd necessarily want these people to do this kind of thing for us)...

      * Plopping down firewalls at internet trunks, then using them to filter out spam and portscans. Propagate rules to shut down bot traffic at the edge routers.

      * Sniffing / logging all traffic with snort / ntop (but more likely something big commercial and expensive) for, uh, forensic analysis

      * Requiring some sort of RealID authenticated onramps, so net access can be traced back to a credit card or better yet an "internet license" associated with someone's passport or other unique government ID

      * Encrypted key escrow so they can peek inside encrypted data and streams.

      Scary stuff with lots of room for abuse, but really not any different than what a mildly competent corporate IT department already does.

      Maybe on the internet2 for mobile phones (the next generation).... the question is whether the new system will be "pre-secured" by the corporate walled gardens, or if the government will finally finish "securing" and thus killing off the first gen internet just as the new one comes online ;-P

    8. Re:Are they joking? by nine-times · · Score: 3, Insightful

      Well there's also relatively small steps like providing some better/simpler schemes for encryption/signing. PGP is pretty good, but poorly supported in most email clients. SSL is good, but CAs are lazy and expensive. SFTP provides encryption, but you generally need to blindly trust the host on the first connect.

      One of the suggestions I've read around here is to support public keys in DNS records. If the DNS records are signed, then you can verify the public key did, in fact, come from the domain owner. Not a perfect solution, but it seems like it could be a first step to getting rid of the current CA system, which sucks IMO.

    9. Re:Are they joking? by Anonymous Coward · · Score: 2, Insightful

      Where are they saying that?

    10. Re:Are they joking? by FudRucker · · Score: 1

      in this case, the NSA stands for "Not Something Attainable"

      --
      Politics is Treachery, Religion is Brainwashing
    11. Re:Are they joking? by AndrewNeo · · Score: 1

      I want my bear arms, damnit!

    12. Re:Are they joking? by Anonymous Coward · · Score: 0

      Don't forget that dial-up still exists.

    13. Re:Are they joking? by PopeRatzo · · Score: 2, Insightful

      the banishment of anonymity

      Of course.

      By "securing the Internet" they really mean, "stop filesharing and wikileaks".

      This is why neutrality regarding the infrastructure of the Internet has to be codified now. In a year, maybe two, it'll be too late. Once the telcos put up their toll booths and completely wipe out independent ISPs, it's all over.

      I suppose though that the minute the first advertisement appeared on the web years ago the future was written in stone. You can't allow just anybody to connect to the Internet and provide content because that would make it a real free market, instead of the "Free Market" for very few that we have today.

      The Internet was accidental, and the corporate elite has been working day and night to fix that happy accident. It won't happen again. That's why it's such a pity when you hear so-called "libertarians" talking about how we have to prevent "government regulation" of the Internet. They don't realize whose water they're carrying.

      --
      You are welcome on my lawn.
    14. Re:Are they joking? by Totenglocke · · Score: 3, Insightful

      How does any government ever "secure" something? By adding multiple layers of bureaucracy and requiring multiple forms of identification to use the service.

      --
      "The tree of liberty must be refreshed from time to time with the blood of patriots and tyrants." ~Thomas Jefferson
    15. Re:Are they joking? by Anonymous Coward · · Score: 0

      Your argument is based on the mistaken assumption that the internet exists as more than a convenient fiction which abstracts from the the origin and nature of global connectivity created by the interconnection of many autonomous networks operated by many different legal entities with a variety of motivations and under many different jurisdictions. Could you even non-arbitrarily define what the internet is? Why is my home network connected via wireless LAN to my friend's home network not the internet? Which service, which entity's presence makes a network of networks "the internet"? At what point does an alternative network which is created to work around restrictions become "the internet"? Any government can at best regulate the operators on its own soil, but even that kind of regulation is going to be inconsistent and arbitrary because the internet is an abstraction.

    16. Re:Are they joking? by bsDaemon · · Score: 1

      PGP is pretty good, ...

      Well, yeah... isn't that the point? /sarcasm (note to the uninitiated: PGP == Pretty Good Privacy).

    17. Re:Are they joking? by jgagnon · · Score: 2, Funny

      Shave them weekly for about 6 months then stop for 6 months and you shall receive that which you desire.

      --
      Remember to maintain your supply of /facepalm oil to prevent chafing.
    18. Re:Are they joking? by KDR_11k · · Score: 1

      That's vulnerable to social engineering attacks. Imagine your aunt being alone in your computer room and a "telco engineer" asks her to plug the network cable in to run some "routine checks"...

      --
      Justice is the sheep getting arrested while an impartial judge declares the vote void.
    19. Re:Are they joking? by mcgrew · · Score: 1

      Scary stuff with lots of room for abuse, but really not any different than what a mildly competent corporate IT department already does.

      The difference is that your employer owns his network and his employees' computers, and can do whatever he wants with them; they're his property. Not so the US and the internet and YOUR computer. The government has no right to restrict my computer use in any way, except to investigate and prosecute any criminal activity. And the investigation has to be legal and not trample my constitutional rights to free speech, free association, and freedom from warrantless searches of my property.

    20. Re:Are they joking? by Anonymous Coward · · Score: 0

      Wow, you're just frightened of everything, aren't you? Can't you see we're going to go toward a fractured internet and thats not just ok, its a good thing? You are being paranoid and ridiculous, like everybody is about net neutrality. None of your claims have any validity to them and you don't have a right to their network even you are correct.

    21. Re:Are they joking? by yahwotqa · · Score: 1

      Yeah, I saw that in Lonely Wifes 13. Fantanstic movie.

    22. Re:Are they joking? by dwiget001 · · Score: 1

      Oh, yeah "Internet license" -- that sounds good, huh? OMFG

    23. Re:Are they joking? by Erikderzweite · · Score: 1

      Our planet is already secure — you cannot escape it.

    24. Re:Are they joking? by arth1 · · Score: 2, Informative

      One of the suggestions I've read around here is to support public keys in DNS records. If the DNS records are signed, then you can verify the public key did, in fact, come from the domain owner.

      That feature has been in DNS and SSH for several years now. The optional SSHFP record contains a fingerprint of the public key, and if the ssh client has VerifyHostKeyDNS set to "yes", you don't have to manually verify the host key.
      The question then is whether the DNS can be trusted.

      Anyhow, to generate a couple of DNS entries for a host to insert into the zone file, do something like:


      #!/bin/sh
      ssh-keygen -l -f /etc/ssh/ssh_host_dsa_key | cut -d\ -f2 \
        | sed 's/://'g | xargs echo -e `hostname` "\t\tSSHFP 1 1"
      ssh-keygen -l -f /etc/ssh/ssh_host_rsa_key | cut -d\ -f2 \
        | sed 's/://'g | xargs echo -e "\t\t\tSSHFP 2 1"

      If your DNS server doesn't support the SSHFP RR identifier, you may have to use the numeric code, 44, instead.

    25. Re:Are they joking? by mazarin5 · · Score: 1

      Our planet is already secure — you cannot escape it.

      Then you aren't going nearly fast enough.

      --
      Fnord.
    26. Re:Are they joking? by nine-times · · Score: 1

      Good to know, but it'd still be good if there were a consistent, uniform, and comprehensive approach to these things.

    27. Re:Are they joking? by NevarMore · · Score: 1

      How does any government ever "secure" something? By adding multiple layers of bureaucracy and requiring multiple forms of identification to use the service.

      That only slows down and annoys law abiding citizens while criminals continue to get through and around such regulations.
      Sources -
        - prohibition
        - gun control
        - war on drugs
        - TSA
        - border fence

    28. Re:Are they joking? by Wowsers · · Score: 1

      I think these folks are actually trying to use scare-tactics in order to increase their own budgets short-term

      Dear citizens of the United States,

      In case you have not noticed, your government is spending and borrowing so much that the economy is seen by outsiders as being virtually on it's last legs, you cannot carry on printing money thinking it's going to fix the problem. You may fantasise that you can spend money on this and that, but you no longer can.

      Trying to "fix" the internet is the least of the US problems. Your budget deficit needs IMMEDIATE attention.

      Yours Sincerely,
      Someone who loves in another country who's previous government was in La-La land over their budget deficit and also wanted to control the internet

      --
      Take Nobody's Word For It.
    29. Re:Are they joking? by ydrol · · Score: 1

      They should prevent "typing 'Google' into Google" denial of service attack for starters.

    30. Re:Are they joking? by light_rock · · Score: 1

      We had a 'better' network once, at least along these lines. It was 'Switched' and was run by AT&T. To everything there is a season. Bring back the Star Topology. Isolate all end-points. Lord knows we could use the Operator Jobs. ;) Otherwise, I don't see what the big deal is. No pain, no gain. Where's the pain ? Did somebody leak all the NSA's back-door keys ? What are they really worried about ? Nothing else readily comes to mind...

    31. Re:Are they joking? by Anonymous Coward · · Score: 0

      And that is exactly what the original OSI directory was supposed to do: among other things, keep copies of public keys for entities on the network. But OSI is ****bad****, and Internet is ****good**** (mutter, mutter).

    32. Re:Are they joking? by Anonymous Coward · · Score: 0

      PGP is pretty good

      By definition....

    33. Re:Are they joking? by Anonymous Coward · · Score: 0

      You are being paranoid and ridiculous, like everybody is about net neutrality.

      That one's deep.

      As for "their network", its subsidized AND it requires extensive public spectrum / rights of way. So you prove how we do not have a right to net access.

    34. Re:Are they joking? by Sulphur · · Score: 1

      Cut the string from her tin can to his.

    35. Re:Are they joking? by Anonymous Coward · · Score: 0

      Not just budgets. They're in a panic because they can't run their conspiracies anymore. Thanks to organizations like Cryptome, Wikileaks, and even Slashdot, everything is transparent. And that's driving them up the wall. Oh they might have invented the thing but they gave it away. It's not theirs to run anymore. For once the digital evolution is not about creating new weapons systems. Hallelujah. And too fucking bad for them.

    36. Re:Are they joking? by HungryHobo · · Score: 1

      At least the darknets should last a fairly long time.

    37. Re:Are they joking? by bill_mcgonigle · · Score: 1

      By "securing the Internet" they really mean, "stop filesharing and wikileaks".

      This is why neutrality regarding the infrastructure of the Internet has to be codified now.

      You really think they're going to stop at enforcing neutrality? How does Wikileaks and filesharing get stopped? Three words:

      Internet Drivers License

      --
      My God, it's Full of Source!
      OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
    38. Re:Are they joking? by Anonymous Coward · · Score: 0

      The raving lunatic Kim Jong started working for NSA under a pseudonym or what?

    39. Re:Are they joking? by exomondo · · Score: 1

      or better yet an "internet license" associated with someone's passport or other unique government ID

      What use would that be? They can never verify that the person using the license is actually the license-holder.

    40. Re:Are they joking? by ziggygushi · · Score: 1

      I kind of get your point but your analogy of SSH is bogus. PKI solutions like SSH are designed so that any part of the chain except the endpoints can be compromised and it makes no difference. It only matters in the sense of DDoS & DoS attacks.

    41. Re:Are they joking? by ziggygushi · · Score: 1

      Anomity ??? the net wasn't built for that... Just like it wasn't built to be secure

    42. Re:Are they joking? by ziggygushi · · Score: 1

      are you talking about DNSSEC? Cause I'm pretty sure old DNS has no idea what PKI is...

    43. Re:Are they joking? by Anonymous Coward · · Score: 0

      they already do this at the IAPs (Internet Access Points) where the Internet meets the NIPRNet.

    44. Re:Are they joking? by arth1 · · Score: 1

      No, I am not talking about DNSSEC. Follow the link I gave in the parent post to see what SSHFP is.

    45. Re:Are they joking? by rwa2 · · Score: 1

      Do they have to? Let's go all inappropriate car analogy and say:

      1. Someone else getting automated speeding camera tickets in your car = you get fined

      2. Someone else driving aggressively / causing accidents in your car = you get fined, and your insurance premiums go up

      3. Getting stopped/caught driving without a license = fine, why not?

      Laugh, but remember that cell phones have a SIM card or some other subscriber account tied to your credit card or billing account, so we're practically halfway there already as far as the mobile internet goes ;)

      Just hope they never figure out that there might be revenue to be made from policing the internets :P

    46. Re:Are they joking? by Threni · · Score: 1

      They can achieve this more easily with another Internet. Internet2 could require a license/ID. It could go some way to reduce spam/phishing/anonymous abuse, secure banking/shopping, provide kid-safe zones etc, and without porn/spam/warez/moviez etc it'd be faster. A lot of people would sign up to all that willingly, perhaps most people. ISPs would love it! The other internet can be turned off once Internet2 accounts for 95% of all data movement other than porn, warez etc.

    47. Re:Are they joking? by ciggieposeur · · Score: 1

      I suppose though that the minute the first advertisement appeared on the web years ago the future was written in stone.

      It wasn't the web, it was Usenet (Canter and Siegel).

      The Internet's fatal flaw in its design was that the original users were system and network administrators. This created an immediate conflict of interest: once the Internet was capable of passing messages between hosts they thought it was capable of passing messages between users because there would always be other system and network admins around to make that work. They did not design an Internet that could pass messages when no admins were around. And now 35 years later that's what we need: an Internet that works to connect users even when every ISP and "content provider" has a compelling business interest in preventing users from directly speaking to each other.

      We've returned to the world of 1981. The AT&T monopoly is still in force, only now it's the consumer ISP oligopoly. Today's ISPs oversell their capacity just as the Baby Bells did their voice lines. Hayes has just released their first Smartmodem, only we call it darknet today (I2P, TOR, etc). Today's SMTP email is 1981's mail box; today's HTML web browser is 1981's color television.

      Just as 1981's BBS technology connected fringe elements of society into their own distinct sub-culture that came to consider the mainstream "just noise", so will tomorrow's darknet users be able to develop their own culture out of the noise that is the public Internet. We'll still have Google and Comcast and Verizon and everyone else, but the darknets of tomorrow will be advertisement free, censorship free, and wiretap free. Users won't mind paying a small price in network latency to gain those freedoms, just as they didn't mind spending days if necessary to download just a few treasured minutes of music and video that would never be played over the mainstream radio and television.

      It's coming. They know it and we know it. We can all feel it in the air. Eben Moglin has written a call to arms. Projects are popping out of the woodwork with the stated goal of taking back our Internet. Daniel Suarez's awesome book "Daemon" which features a really cool darknet is shelved in the fiction section rather than sci-fi.

    48. Re:Are they joking? by PopeRatzo · · Score: 1

      but the darknets of tomorrow will be advertisement free, censorship free, and wiretap free

      I wish I could share your optimism.

      If countries are desperate enough to put into effect the ACTA treaty, I'm not so sure they won't act to put any darknet out of business too.

      Remember, these are people who've already tried to outlaw encryption.

      --
      You are welcome on my lawn.
    49. Re:Are they joking? by exomondo · · Score: 1

      1. Someone else getting automated speeding camera tickets in your car = you get fined

      No you don't. You aren't guilty of anything, you can nominate who was driving and the only reason it defaults to you on your car is because your license is tied to your car's registration.

      2. Someone else driving aggressively / causing accidents in your car = you get fined, and your insurance premiums go up

      What do you get fined for? Thats just your car rego which happens to be tied to your driver's license, it's nothing to do with you, you're just the person they go to first because they can easily identify that you actually own the car.

      3. Getting stopped/caught driving without a license = fine, why not?

      What? How is this even relevant with regard to licensing in the sense of the internet. This analogy makes absolutely no sense.

      In effect you've actually posted reasons why 'internet licenses' are an idiotic idea because, as your analogies point out, you were never the one at fault, you're just the person they go to first, which they can already do since you're the account-holder. Again, wtf would be the point of this license?

  2. What? by bhcompy · · Score: 5, Insightful

    Secure it from you control freaks? Sure.

  3. First by Anonymous Coward · · Score: 0

    Yes it's me!!!!

    1. Re:First by Anonymous Coward · · Score: 0

      ULTRA-MEGA-FAIL.

  4. The non-technical have lots of crazy ideas by Anonymous Coward · · Score: 0

    "... we ought to be the first folks..."

    This says it all for me, he's non-technical.

    1. Re:The non-technical have lots of crazy ideas by bsDaemon · · Score: 5, Insightful

      He has a masters degree in systems technology and another in physics, according to his biography, in addition to an MBA and a BS undergrad, plus lots of experience in intelligence and counter-intelligence, including in active combat scenarios, according to his biography. I suspect he's probably more "technical" than a large swath of people here, not to mention the general public. Just because he says folks doesn't mean his 'non-technical', so stfu.

    2. Re:The non-technical have lots of crazy ideas by poetmatt · · Score: 5, Insightful

      if you read the summary about "Securing the internet" you'd know that the comment by this individual, technical or not, would give you the impression that he's a fucking moron.

      I'm sure he's good at what he does, but "securing the internet" is not and will never be one of those things.
      Even DNSSEC and IPv6 do nothing for "Security", because they haven't gotten back the original security issue: computers and/or users. Adding encryption, adding anything to allow anonymity and all you do is make it easier to poke holes in security. Get rid of anonymity and all you do is make it easier for people to use fraudulent identities since it assumes that nobody can be anonymous, which is also impossible. You're at the PC, and I'm behind you telling you what to do? Guess what, I'm anonymous.

      Considering that security goes beyond the internet, shows how impossible the idea is. This is not even remotely reasonable.

    3. Re:The non-technical have lots of crazy ideas by Anonymous Coward · · Score: 0

      Just because he says folks doesn't mean his 'non-technical', so stfu

      Derp? Can someone grammar-hammer this sentence?

    4. Re:The non-technical have lots of crazy ideas by bsDaemon · · Score: 1

      A typo is not the same thing as a flawed argument, unless you're losing.

    5. Re:The non-technical have lots of crazy ideas by copponex · · Score: 5, Insightful

      At some point in history, there were doctors who were convinced that the four humours were the chief actors in the body, and developed some pretty strange and barbaric rituals to regulate their levels. The finest doctors at that time went to the finest schools and received the best education in the world, as far as they were concerned. The trouble was that everything they believed was absolutely untrue. The foundation of every bit of their knowledge was built upon a lie.

      Receiving a good education does not ensure that you are right or wrong, but it means you are very highly trained in the existing hubris of your culture. So I'm sure this guy worked very hard, and filled out all the right forms and kissed ass at the appropriate times and wrote brilliant regurgitations of his professor's theories to clamor his way to the top of the bourgeois dog pile of the desperately successful. But that doesn't mean his ideas are worth a damn.

      And it also doesn't mean that they're not worth a damn. But the guy works for the government, and specifically, the part of the government that exists to protect American (corporate) interests above all else. His job is to make the internet safe for commerce, not to protect the free flow of information. He's got his hammer, and he intends to find some nails.

    6. Re:The non-technical have lots of crazy ideas by bsDaemon · · Score: 4, Insightful

      DNSSec is intended to prevent query cache poisoning. It's not a catch-all silver bullet and its not meant to be. Similarly, requiring IPSec in IPv6 solves certain problems, while leaving others untouched.

      There will likely never be 100% security, for if there were, then you would have a 100% unusable system. But that doesn't mean that the current situation can't be made better. I just get the impression that a lot of people around here equate freedom with a reasonable expectation of getting away with a crime and have greasemonkey scripts to auto-respond with the Franklin security/liberty quote.

    7. Re:The non-technical have lots of crazy ideas by Anonymous Coward · · Score: 0

      How about validating the silicon in routers, hardening corse software, redesigning the DNS system to make it less vulnerable to MITM attacks, perhaps something newer than SMTP that's designed for a hostile world. BGP's got a lot of room for improvement, like replacement with something less vulnerable. There's a lot of room, you fucking idiot.

    8. Re:The non-technical have lots of crazy ideas by poetmatt · · Score: 1

      nobody said the current situation can't be made better. That has absolutely nothing to do with the statements at hand.

      Assuming you can make anything secure, however, is a completely false statement, and is specifically what was said. "We're going to secure the internet" is likewise a false statement.

    9. Re:The non-technical have lots of crazy ideas by poetmatt · · Score: 1

      also, the franklin statement is very very accurate, and very much a concern when it comes to the US government, which is well known to throw around abuse of power and let judges settle the constitutionality of their horrible decisions in the first place.

      The government clamoring for more security tells people that a: they want to monitor everything, b: they want to control everything, and c: who cares about the actual citizens of the US?

      Forget the republican angle on it, this has been a corruption issue more than 30 years in the making at this point.

    10. Re:The non-technical have lots of crazy ideas by nine-times · · Score: 1

      Adding encryption, adding anything to allow anonymity and all you do is make it easier to poke holes in security.

      You can always poke holes in any security scheme, but that doesn't mean it's not worth trying. Locks can be picked. Passwords can be guessed. Social engineering is always going to be a problem. Still, we do these things.

      Security is not about making unauthorized access impossible. It's about making unauthorized access difficult and risky so that fewer people try, and fewer still succeed.

    11. Re:The non-technical have lots of crazy ideas by X.25 · · Score: 1

      He has a masters degree in systems technology and another in physics, according to his biography, in addition to an MBA and a BS undergrad, plus lots of experience in intelligence and counter-intelligence, including in active combat scenarios, according to his biography. I suspect he's probably more "technical" than a large swath of people here, not to mention the general public. Just because he says folks doesn't mean his 'non-technical', so stfu.

      No "technical" person would ever say such a stupid thing, like "US must secure the Internet".

      I know quite few people with lots of degrees and shit, but they're still dumb as a brick.

    12. Re:The non-technical have lots of crazy ideas by bsDaemon · · Score: 3, Insightful

      No, we can't secure the whole internet. What we can do, however, is make highly critical segments more secure. Part of that is physical security, part of it is better monitoring infrastructure, such as fiber tap splitters off to an IDS system at a backbone peering point. vendors such as Net Optics make just such a device, among others.

      It would probably make more sense to run new lines, or light up some dark fiber, and move all the government stuff onto that, then have a few border crossings, like peerage points, where "real" internet access can be controlled and monitored to prevent breach of systems which aren't already on separate networks. They might do that already, I can't really say for sure.

      Although, it still doesn't keep some random employee from doing something stupid on the inside, you can at least mitigate the impact. Then maybe, just leave much of the rest of the infrastructure as-is and have fend for ourselves, or whatever.

      But yeah, we can just be picky and pedantic instead of just agreeing that there's a point of "good enough" that's more secure than what we have but less secure than just not having the system in the first place, or locking it away in a concrete bunker with no power.

    13. Re:The non-technical have lots of crazy ideas by poetmatt · · Score: 1

      Look, it all goes back to the same reality.

      If physical security is compromised (and it can, has been, and always will be), then the rest of the security is entirely and completely ineffective.

      Since even a military base has weaknesses for physical security, there really isn't a solution.

      This isn't an advertisement for anarchy, it's just reality.

      Want to know what the best thing is that can be done for security? Best practices. Create them, know them, have everyone follow them. Why? Because it's the (best) you can do.

    14. Re:The non-technical have lots of crazy ideas by poetmatt · · Score: 1

      who said there wasn't any room to improve? try reading the comments again. I didn't say it can't get better, but to declare it secure is another statement altogether.

      More secure, that's a legitimate statement. But "securing the internet"? please.

    15. Re:The non-technical have lots of crazy ideas by Anonymous Coward · · Score: 0

      Ha, and now he's writing about himself...
      Protect that shit.

    16. Re:The non-technical have lots of crazy ideas by ziggygushi · · Score: 1

      I wouldn't say DNSSEC doesn't do anything... A year and half ago with a few minutes of UDP packets you could change any DNS record you wanted at an ISP... DNSSEC will hopefully help improve things. I'm not saying its an end to end solution like PKI but hey take what you can get.

    17. Re:The non-technical have lots of crazy ideas by jonaskoelker · · Score: 1

      Receiving a good education does not ensure that you are right or wrong, but it means you are very highly trained in the existing hubris of your culture.

      Compare the amount of evidence going into medical learning at the heyday of the humor theory and today. You'll find considerable more evidence going into medicine today.

      Yes, there is a layer of interpretation on top of any collection of evidence. But if you collect evidence densely enough, and around the same problem from many angles, I believe you will converge towards an objective truth.

      This approximate truth (and the methods for finding and improving it) is among what you learn when you take a university education today. I think. At least in the natural sciences and social sciences (I don't know what you do in the humanities, but I guess you argue and discuss a lot).

    18. Re:The non-technical have lots of crazy ideas by Type44Q · · Score: 1

      But if you collect evidence densely enough, and around the same problem from many angles, I believe you will converge towards an objective truth.

      Or, you could just fill peoples' heads with lots of lots of data and yet fail to impart even the slightest qualitative understanding of what it all really means... which, if the kind if mentality displayed by the average MD is any indication, is exactly what's happening in medical schools.

    19. Re:The non-technical have lots of crazy ideas by Anonymous Coward · · Score: 0

      To "secure" something doesn't mean to make it utterly impregnable, unless that was the implied meaning, but to fasten it against intrusion -- just like you "secure" a car when you lock its door; the car isn't suddenly not breachable anymore... just made more difficult to penetrate.

  5. Can we have our money back? by blair1q · · Score: 5, Insightful

    We did make the Internet, and between government and business and private citizens we spent about $1 Trillion bringing it up to the state where Carly Fiorina and the other outsourcing robber-barons could use it to ship the whole information economy to India and China, cratering the return we expected from our investment, so they could pocket a few $billion in quick profit.

    We'd like our money back. Someone tell Carly she owes us.

    1. Re:Can we have our money back? by garyisabusyguy · · Score: 1

      Then send over some programmers with pliers and a blowtorch and get medieval on her ass

      --
      Wherever You Go, There You Are
    2. Re:Can we have our money back? by frank_adrian314159 · · Score: 1

      Someone tell Carly she owes us.

      Don't worry! She'll pay it back in service as California's next Senator!!! I can't wait until she starts outsourcing citizen positions to India - we could cut Social Security and Medicare payments by 70%! Go, Carly!!!!!

      --
      That is all.
    3. Re:Can we have our money back? by Kjella · · Score: 1

      I'd love to see you try again only to see computers and networks merge into the Internet somewhere else, the US information economy would have fallen before it had even properly risen. Like that quote people pull out about the MPAA and RIAA, you don't have the right to halt progress just to preserve your profits and that goes for countries too. The rest of the world would have moved on and the US would be the one left behind.

      --
      Live today, because you never know what tomorrow brings
    4. Re:Can we have our money back? by blair1q · · Score: 1

      The US was leading on everything. The rest of the world would have played catch-up. But rather than continue to compete, Carly & Co. shut down American jobs and moved the Internet economy across the ocean. It made her money and destroyed America's economy, and the shock to the financial sector almost took the world's economy with it. If there hadn't been a coincidental situation brewing with the real-estate/credit fraud market there would have been no bubble/bust in the mid-00s to camouflage it.

      See, how that happens is, corporations own the patents, so once they move the production of patented items overseas, you and I can't pick up the slack with trained workers here.

      You do, in fact, have the right to halt progress to preserve your profits, and screw your own country and the rest of the world.

    5. Re:Can we have our money back? by Anonymous Coward · · Score: 0

      Screw the rest of the world? The people that got the jobs are pretty happy about it, the non-tech people get cheaper services out of it.... seems like you're just bitter my friend.

    6. Re:Can we have our money back? by BenoitRen · · Score: 1

      We did make the Internet

      CERN disagrees.

    7. Re:Can we have our money back? by Anonymous Coward · · Score: 0

      Outsourcing is a failed experiment. It's hard enough to get the guys down the hall to build the right thing, let along the guys from a different culture, in a different timezone...

    8. Re:Can we have our money back? by Anonymous Coward · · Score: 0

      WTF is that supposed to mean? If you're referring to Berners-Lee, he created the World Wide Web, which runs on top of the Internet.

    9. Re:Can we have our money back? by ZFox · · Score: 1

      No they don't. Unless, they mistakenly consider the WWW and "the internet" as one in the same.

    10. Re:Can we have our money back? by BenoitRen · · Score: 1

      But CERN's WWW had a very important role in the Internet. So important that these days "Internet" and "WWW" are used interchangably.

    11. Re:Can we have our money back? by Device666 · · Score: 1

      I don't agree with you. Internet maybe first started at ARPA to have a communication network system that could still work if some catastrophe would happen. However later it was used to share information between universities and later businesses. Since we all like freetrade and don't like tight government control over business, it is America who has to keep up or lead. A way to lead is by creating products cheaper and of higher quality than others (the combination of those two). If you can't do it cheaper, you must do better. Preventing by putting a lock on it is called protectionism. And protectionisme only leads to tradewars. Better it would be to invest in education institutions, in Reasearch and development. Stimulate smart people to share information and learn. maybe Americans will never work for a low incomes like those people in outsourcing countries. However better quality, better process technologies, leading on cutting edge science, etc will bring America to the frontwave. This is how it always worked, and it will still keep working that way. If you really want a secure internet and like government control, the best you can do is tax Microsoft for damage to productivity of businesses and use that money to sponsor the open source movement, especially business applications and open source operating systems ;) That will sure make things better ;)

    12. Re:Can we have our money back? by blair1q · · Score: 1

      The world got crappy services and the world's greatest economy got raped while the world's worst became an even bigger object lesson in sweatshop economics.

      I'm bitter that Carly Fiorina has the testicles to run for public office after committing treason. The change in fortunes is as if India and China had defeated America in a war.

    13. Re:Can we have our money back? by ciggieposeur · · Score: 1

      So important that these days "Internet" and "WWW" are used interchangably.

      Only by the people who don't know what either of them really are.

    14. Re:Can we have our money back? by kpainter · · Score: 1

      We did make the Internet

      CERN disagrees.

      So does Al Gore

    15. Re:Can we have our money back? by HungryHobo · · Score: 1

      or to translate blair1q's complaints:

      "Dey tuk er jerbs!"
      "Durka Dur!"

      because people in countries are less important than americans and shouldn't get a chance at those jobs.

    16. Re:Can we have our money back? by HungryHobo · · Score: 1

      America was highly involved in the early internet but the claim that america invented/created the internet is a load of nationalistic bullshit only repeated by the poorly educated.

      http://www.nethistory.info/History%20of%20the%20Internet/origins.html

      Not only US projects were involved in the beginnings of the Internet.
      Not only government funded US research programs were involved in the beginnings of the Internet.
      Not only telcos and the commercial sector were involved in the beginnings of the Internet.

    17. Re:Can we have our money back? by exomondo · · Score: 1

      The internet's hiding WMDs and harboring terrorists! Quick, get it!

    18. Re:Can we have our money back? by dargaud · · Score: 1

      So important that these days "Internet" and "WWW" are used interchangably.

      Only by the people who don't know what either of them really are.

      Exactly. Which is 99% of them. So if you remove the WWW, the internet basically drops dead. What are you gonna do ? Use Gopher to find files to FTP ?

      --
      Non-Linux Penguins ?
    19. Re:Can we have our money back? by mrrudge · · Score: 1

      I enjoyed this on the subject: Where Wizards Stay Up Late

    20. Re:Can we have our money back? by ciggieposeur · · Score: 1

      So if you remove the WWW, the internet basically drops dead.

      Email, IM, BitTorrent, VOIP, networked games, and mobile phone apps are already using more bandwidth than the WWW.

      What are you gonna do ? Use Gopher to find files to FTP ?

      I'm personally looking forward to a Daemon darknet, probably built out of I2P or TOR.

    21. Re:Can we have our money back? by blair1q · · Score: 1

      America put a trillion dollars into the Internet, between the government's deliberate kickstart and industry's capitalizing on it. The point was to create a new future for America.

      It created a depression for America and a new future for China and India, and made a few of the industrialists a little richer at the rest of America's expense.

    22. Re:Can we have our money back? by Device666 · · Score: 1

      Ok what then? Do you want to take the protectionist approach? Well this topic has nothing to do with the recession for crying out loud.

      I think the American invention of the internet and all the investment is definately something to be proud of. It has brought the best of America to the world, freedom of speech, better media, etc. It has brought without any doubt more freedom than any premptive war has done...

      I also think it had brought more jobs to America that if they would have patented it or used some form of protectionism. I think the investment in the free, sharing and open qualities of the net has not only payed out itself financially, but also intellectually and morally.

      The reason America once prospered as worlds wealthiest creditor nation. They had a comparative advantage in economic freedom. Taxes were much lower and the government was less intrusive. They borrowed a lot of money from the Europeans in the 19th century. America used that money for like infrastructure and factories; they did capital investments. And by building factories they became the worlds leading manufacturer and exporter of high quality, low cost consumer goods, also even when the paid the highest wages in the world. And because they made productive use of the money they borrowed of the Europeans, they were able to repay the debt by selling those manufactured consumer goods to Europeans. By 1980 Americans owned more foreign assets than all the creditor nations in the world combined, they were the worlds most wealthy lenders with a high savings rate.

      Today is the exact opposite. They no longer flood the world with low cost high quality goods, but they flood the world with dollars. The United States routinely borrows from the poorest nations in the world. The relationship is now: America consumes and everybody else produces. America borrows and everybody else saves. Without American consumption, what would all these Chinese do for jobs? Well it's not about jobs. You don't want jobs so you can work, you want jobs so you can consume; a higher standards of living. The fact that the Chinese get jobs in exchange for the products they give us doesn't do any good for the Chinese. The Chinese are perfectly capable of consuming their output themselves. They don't need their government to artificially suppress the exchange rate of the Yuan so that they can artificially elevate the value of the Dollar so that the Americans get to consume all the goods that the Chinese could have consumed had it not been for that monetary policy.

      This current dynamic where Americans don't save and not produce is not viable. America convinced the foreigners painting their fence and pay them is a privilege. But the minute the Chinese, the Japanese stop buying these Dollars, the show is over.

      All this borrowed consumption is going to have to be paid. American consumers are now loaded up with debt to their eyeballs, and the very nature of that debt.

      It is stupid from the governent to stimulate ownership of residential property by stimulating people and banks to use NINJA-mortgages(No Income, No Jobs or Assets). Credit for people with no money is insane, ofcourse they cant pay back. Ofcourse that means trouble for banks, and so on. Predatory lending also took a part of the blame. Also not wise was to use the value of a house as a kind of slot machine. It was a mania on the housing marktet that made it to a bubble bound to collapse.

      I can strongly advice you to read the standard economic work of Niall Ferguson: "The Ascent of Money" . Innovation in financial products has always followed a bust and boom cycle.

      Having no supervision on complex financial products like derivations is insane, even by any measure of common sense. The innovated product of securitizes mortgages in trenches for mortgages give to people with no income, no jobs or assets is also insane. Especially when it gets a AAA stamp fr

  6. Already secure by sakdoctor · · Score: 1

    The internet is already secure for me, when using SSH to a trusted host.
    Job done.

    1. Re:Already secure by arth1 · · Score: 4, Insightful

      And how do you know that the host you SSH to is secure? It has at least one exposed attack vector if you can SSH to it, and probably more. And it's not enough that it's secure right now -- if it was broken into in the past (visibly or without traces), and someone made off with the host key, you can't protect against a man-in-the-middle attack.
      Then there's the possibility of breaking in to the router in front of that host, which might give you access to other and less secure hosts in the same zone. Do you control that too?
      And what about your system? Has it been 100% safe from day one until now?

      No chain is stronger than the weakest link, including the endpoints.

    2. Re:Already secure by FriendlyLurker · · Score: 2, Insightful
      Obligatory Pentagon War on Internet Video.

      The internet is already secure for me, when using [Insert Technology Here]

      I think that is missing the point somewhat - It is not secure against you speaking your mind on their corruption and organizing against it.

    3. Re:Already secure by Anonymous Coward · · Score: 5, Insightful

      You're missing the point entirely. When US gov. officials use the term "secure" they mean precisely "control and oppress those in question" or often "retain power at all costs". You must learn to read these statements properly.

    4. Re:Already secure by digitig · · Score: 2, Interesting

      "Secure" means different things to different people.

      There's an old saying that if you ask the army to secure a building then they place armed guards at intervals around the perimeter and at strategic points within the building. If you ask the navy to secure a building then they make sure the doors and windows are locked before they leave. And if you ask the air force to secure a building then they take out a ten-year lease with an option to extend to twenty-five.

      Which meaning is this one?

      --
      Quidnam Latine loqui modo coepi?
    5. Re:Already secure by gorzek · · Score: 3, Insightful

      For the US government (and likely any individual national government), the Internet has only one valid purpose: commerce. It must be a safe place to do business, first and foremost. Any other perks, such as free expression, political activism, and unbridled creativity are expendable if it makes pacifying the electorate and corporate interests easier.

      When "national security" is discussed in context of the Internet, let's make no mistake, it just means "keep people from saying things we don't want them to say."

    6. Re:Already secure by betterunixthanunix · · Score: 2, Informative

      You are assuming that SSH is secure; I know of at least one attack on SSHv1, and it is likely that there are other attacks on SSHv2 (and yet-undiscovered attacks).

      --
      Palm trees and 8
    7. Re:Already secure by KDR_11k · · Score: 1

      Practical attacks or merely theoretical "well, it's broken under mathematical rules" attacks?

      --
      Justice is the sheep getting arrested while an impartial judge declares the vote void.
    8. Re:Already secure by gregrah · · Score: 2, Insightful

      The internet is already secure enough for me, when using SSH to a trusted host.

      Fixed parent's post for him.

      I like the approach to personal security suggested in this article that was posted on Slashdot a while back. The basic gist is that the amount of effort we put into preventing an attack should be less than the probability of a successful attack occurring times the expected loss from a successful attack.

      Now, I didn't RTFA, but I assume the types of attacks that the NSA director is referring to are more severe than loss of credit card theft and loss of personal data. Things like taking down our air traffic control systems or power grid. For those sorts of systems - yes I think we would want to invest the same level of effort into keeping those systems secure as we do keeping, say, our nuclear reactors secure.

    9. Re:Already secure by Jackie_Chan_Fan · · Score: 1

      exactly right.

      This is about absolute control and power.... Not security

    10. Re:Already secure by Weirsbaski · · Score: 1

      You're missing the point entirely. When US gov. officials use the term "secure" they mean precisely "control and oppress those in question" or often "retain power at all costs". You must learn to read these statements properly.

      It's naive to only call out "US gov. officials". Every gov't wants this power, and quite a few (maybe more than you'd like to admit) are working hard to get it.

      --

      I am not a sig.
    11. Re:Already secure by mazarin5 · · Score: 1

      Practical attacks or merely theoretical "well, it's broken under mathematical rules" attacks?

      Over time, these converge.

      --
      Fnord.
    12. Re:Already secure by Anonymous Coward · · Score: 0

      Hopefully the one you would get by asking anyone outside the military, for example a construction worker.

    13. Re:Already secure by arth1 · · Score: 2, Interesting

      I like the approach to personal security suggested in this article that was posted on Slashdot a while back. The basic gist is that the amount of effort we put into preventing an attack should be less than the probability of a successful attack occurring times the expected loss from a successful attack.

      Should it? The whole justification for insurance is that we are willing to pay MORE than ( the probability of a disaster times the expected loss from a disaster ) whenever we are unable or unwilling to absorb the loss from a disaster.
      The difference between actual risks and how much more we're willing to pay is what keeps insurance companies afloat.

      Anyhow, the best way to strengthen security isn't through greenbacks but through intelligent implementations. A single gullible person in the chain of design can have extraordinary negative consequences.
      I.e. don't put an MBA to do a man's job.

    14. Re:Already secure by jewens · · Score: 3, Funny

      CJCS to JCS: Gentlement, secure that building (points to building) and report back to me tomorrow.
      JCS: Yes sir!
      -24 hours later-
      Admiral: Sir, we've repainted the entire building and made sure all the doors are closed and locked.
      Army General: Sir, we've dug defensive fighting positions and established clear fields of fire 360 degrees around the building.
      Marine General: Sir, my men will secure the building in (checks watch) 3..2..1.. (Explosion heard in distance)
      Air Force General: D*****t! We just signed a 99-year lease on that building.

      --
      That group of bovine standing over there appears quite portentous. That's right it's an ominous cow herd.
    15. Re:Already secure by dodobh · · Score: 1

      The probability of a successful attack tends to 1 given sufficient time.

      --
      I can throw myself at the ground, and miss.
    16. Re:Already secure by betterunixthanunix · · Score: 1

      The SSHv1 attack was most certainly practical. Basically, SSHv1 essentially sent a packet for each keystroke, so while a user was entering their password, you could time the delay between packets, which is correlated with the letters being typed (so you could greatly reduce the search space and mount a practical attack). This is why using SSHv1 is a very bad idea, at least if you log in using passwords.

      --
      Palm trees and 8
    17. Re:Already secure by NotBornYesterday · · Score: 2

      You just made my friggin' day. Normally, I'd be obliged to snort a beverage on my keyboard, thus ruining it, but I am without a drink at the moment. So, as a substitute, I'll simply smash it.

      --
      I prefer rogues to imbeciles because they sometimes take a rest.
    18. Re:Already secure by gregrah · · Score: 1

      I'll revise my previous equation describing rational expenditure on security as follows:

      preventionEffort <= attackProbability * recoveryEffort + x

      where x is "small" (single digit percentage or lower) relative to attackProbability*recoveryEffort. This leaves room for the overhead charged by insurance companies to make a profit. It also doesn't change my previous assertion that SSH is sufficiently secure for the vast majority of conceivable personal uses.

    19. Re:Already secure by gregrah · · Score: 1

      That doesn't mean anything. Given sufficient time the amount of effort spent trying to prevent a successful attack can be much larger than amount of effort required to recover from a successful attack.

      To put it into monetary terms, would you choose to spend $50,000 over a 10-year period in order to prevent an attack that will only cost you $10,000? Even if there is a 99% chance that attack will occur in that period?

    20. Re:Already secure by arth1 · · Score: 1

      To put it into monetary terms, would you choose to spend $50,000 over a 10-year period in order to prevent an attack that will only cost you $10,000? Even if there is a 99% chance that attack will occur in that period?

      If you don't have liquidity to survive a random $10,000 expense, but can survive a $416 monthly expense, yes, that seems like a good idea.

    21. Re:Already secure by ziggygushi · · Score: 1

      I kind of get your point but your analogy of SSH is bogus. PKI solutions like SSH are designed so that any part of the chain except the endpoints can be compromised and it makes no difference. It only matters in the sense of DDoS & DoS attacks....

    22. Re:Already secure by Psaakyrn · · Score: 1

      Not to mention there's always the fail-safe physical method.

    23. Re:Already secure by arth1 · · Score: 2, Informative

      One of the endpoints being compromised is the issue. Either the server, or the ssh client, or the person operating the ssh client has been compromised into believing that the end point doesn't extend into his own gullible brain.

      SSH is vulnerable to man-in-the-middle attacks if someone obtains a copy of the private host key, or if the client side accepts a changed host key despite warnings that it has changed. In fact, it being vulnerable is the sole reason for the warning!

      Scenario 1:
      Between client A and server B, insert malicious host X.
      Client A tries to connect to server B, but reaches host X instead. Host X, having previously obtained server B's host key, answers like if it was server B, including giving client A the correct public key. Host X then completes the key exchange with server B on behalf of client A, keeping two connections open.
      All traffic that A sends is decrypted and saved to disk, and also forwarded to B. Similar for traffic from B to A. Neither A nor B notices anything different, except increased latency.

      Scenario 2:
      Between client A and server B, insert malicious host X.
      Client A tries to connect to server B, but reaches host X instead. Host X replies with a different key than the verified host key for B, but the user at client A has seen so many "the host key has changed" messages that he automatically accepts it (or runs ssh-keygen -R hostname to get rid of the cached key). Host X then completes the key exchange with server B on behalf of client A.
      All traffic that A sends is decrypted and saved to disk, and also forwarded to B. Similar for traffic from B to A. Neither A nor B notices anything different, except increased latency.

      Scenario 1 can happen if a server has been compromised earlier, with or without the knowledge of the admins. Or if an inside tech sets up a listening man-in-the-middle host before quitting. Or someone gets ahold of a failing and discarded disk. Or the government subpoenaing a backup tape from your bunker storage provider. Or when someone has tricked another service at the host into reading the private key. Or...
      The reason why it's doable is that dual-key SSH depends on the host key never falling into the hands of others.
      To protect against this, host key pairs should be changed whenever someone with root access to the machine leaves, or there is reason to believe that the key may have been copied outside your full control. And the keys should be excluded from backups.

      Scenario 2 can be done by someone at your ISP (including a government tap). If it's the first time the user connects to the site, and he doesn't call a sysadmin to read the fingerprint, he won't even have to disregard a warning that the key has changed -- when he accepts it, he accepts the middleman's key.
      The reason why it's doable is that dual-key SSH depends on the initial key exchange being verified, and it almost never is.
      To protect against this, you have to always verify the public host key fingerprint when asked, and NEVER blindly accept it.

      And, of course, there is the third possibility of your ssh client having been compromised and replaced with one that gives away all your traffic. Or simpler yet, your cached host key file has been modded. How sure can you be that your endpoint isn't compromised?

      Man-in-the-middle exploits are also possible with SSL. A typical scenario is an internet cafe, where the CA certificates have been replaced with generated certificates, and there's a transparent proxy intercepting, decoding and saving a copy of all internet traffic.
      Or a government tap at the ISP that intercepts your SSL traffic to a certain site, with a bogus certificate created by a signing authority that is under your government's control.

      In short, for the chain of trust to work, every single link has to hold. Including the endpoints, which are much bigger than most people think -- they include not only the client keys, but the cached host key, the client software, th

    24. Re:Already secure by arth1 · · Score: 1

      At first, I misread that XKCD strip.

      And to be frank, I think "drug him and hit him with a $5 wench" is likely to work even better than the wrench on undersexed geeks.

    25. Re:Already secure by mldi · · Score: 1

      Now, I didn't RTFA, but I assume the types of attacks that the NSA director is referring to are more severe than loss of credit card theft and loss of personal data. Things like taking down our air traffic control systems or power grid. For those sorts of systems - yes I think we would want to invest the same level of effort into keeping those systems secure as we do keeping, say, our nuclear reactors secure.

      For important infrastructure like the power grid, safety communications like traffic control, and hell in a core like nuclear reactors, I wouldn't think those are hooked up to the 'net anyway.

      This isn't Die Hard 4.

      Then again.... I could be wrong. It never ceases to amaze me how stupid people are. If those ARE exposed, pull the damn plug.

      --
      If you aren't suspicious of your government's actions, you aren't doing your job as a responsible citizen.
    26. Re:Already secure by gregrah · · Score: 1

      Here's the story I was referencing: CIA Says Hackers Have Cut Power Grid.

      The story refers to accounts of power grids outside of the US falling victim to cyber attacks (real "production" systems), and a lab demonstration of a successful software attack on a US power generator. The article is extremely short on details, of course, so I'm skeptical as to how severe the problem is in reality. But to assume a system is secure just because it ought to be secured, would be to go against most of what I've witnessed working as a software engineer.

    27. Re:Already secure by mldi · · Score: 1

      Amen to your last statement.

      I'm amazed. I just think it's batshit crazy that a power generator or anything like that is hooked up to the Internet in some fashion. It's absolutely insane that these aren't closed systems.

      --
      If you aren't suspicious of your government's actions, you aren't doing your job as a responsible citizen.
    28. Re:Already secure by dodobh · · Score: 1

      But will the value of the compromised information be limited to $10000 as it is today, or will the damages a few years later be bigger?

      --
      I can throw myself at the ground, and miss.
    29. Re:Already secure by gregrah · · Score: 1

      Maybe a few years from now the damages will be limited to 25 cents. What's your point?

  7. Easy Fix by Kagato · · Score: 2, Funny

    Block all traffic to .ru and .cn.

    1. Re:Easy Fix by Anonymous Coward · · Score: 0, Insightful

      Ban all Microsoft products from connecting to the Internet.

    2. Re:Easy Fix by AnonymousClown · · Score: 1
      Well, that'll be hard because many of those NSA-Gov-security types get their penis enlargement pills from those internet sites.

      A collection of Desert Eagle .50 caliber handguns just doesn't cut it.

      --
      RIP America

      July 4, 1776 - September 11, 2001

    3. Re:Easy Fix by avgapon · · Score: 1

      And also to all those who didn't block traffic to .ru and .cn.

  8. The age old problem by Pojut · · Score: 1

    So long as the smarter people remain outside the law, it will never be secure. /generalization

  9. Re:America ... Fuck yeah !!! by Anonymous Coward · · Score: 0

    FTFY. There is something very ironic about censoring that phrase.

  10. Read by Anonymous Coward · · Score: 0

    Read: Power Grab.

  11. I don't want a "protected" internet. by wcrowe · · Score: 4, Insightful

    The way to "protect" it is to not use it for stuff that, um, needs protecting.

    --
    Proverbs 21:19
    1. Re:I don't want a "protected" internet. by Anonymous Coward · · Score: 0

      The way to "protect" it is to not use it for stuff that, um, needs protecting.

      Or they could just design a new one with secure messaging, end-to-end authentication, non-repudiation, etc, etc, etc and keep it to themselves.

      I don't know why of all people, /. readers can't see that the private sector have failed to make the Internet a safe place for the continuous stream of sensitive activities creeping onto it, and that is happening at too fast a rate for regulation to possibly keep up.

      The other day someone said the Information Age is over, we're in the Lulz Age.

      I think they were right, as most Internet users would LOL@ someone being duped out of large sums of money at fake EBay auctions using obvious (in the technical sense, not to the user) email forgeries. Instead of you know, being the IT professional so many of you claim to be and recognizing that this BS has gone on too long.

      All this "it doesn't need to be fixed" nonsense paints a pretty clear picture in my mind which way this is going to go. If you don't particularly care if public or private entities secure the Internet, um.. GLFH.

    2. Re:I don't want a "protected" internet. by Grand+Facade · · Score: 2, Insightful

      It's not broke and can't be "fixed".

      All any attempts will do is F it up.

      I'd say to help they could put some effort into enforcing the existing abuses spam and cyber fraud, but that would sadly be ineffective. Asshats won't enforce anything but the most blatant TOS violations.

      Education is the answer, just like street savvy, folks need internet savvy.

      Some are so gullible they should not be allowed on the Net, but it's not for me to say who.

      --
      Rick B.
    3. Re:I don't want a "protected" internet. by 0123456 · · Score: 1

      -Or they could just design a new one with secure messaging, end-to-end authentication, non-repudiation, etc, etc, etc and keep it to themselves.

      And they could give us FREE PONIES at the same time.

      I think they were right, as most Internet users would LOL@ someone being duped out of large sums of money at fake EBay auctions using obvious (in the technical sense, not to the user) email forgeries.

      How would tying those emails to an 'Internet Drivers' License' claiming that I'm 'Samuel El Jackson, Nigeria 90210' help prevent such scams?

  12. We Made the Internet... by Anonymous Coward · · Score: 0

    But the morons now in charge just don't understand how it actually works, nor do they care to learn.

    1. Re:We Made the Internet... by singingjim1 · · Score: 1

      They need to recruit the inventor of the Internet to help secure it. Al Gore finally has a real job!

  13. Why? by garyisabusyguy · · Score: 1

    Because we can!
    Or at least that was 'good enough' of a reason for the Thunderbirds

    Allwe need now are some 'net savvy puppets with supersonic jets

    --
    Wherever You Go, There You Are
  14. He's right! by Anonymous Coward · · Score: 1, Interesting

    Gen. Keith Alexander is absolutely correct.
    It is a daunting task, but the USA should be leading the fight in securing the internet from nefarious organizations like the NSA.

  15. Protection by D3 · · Score: 4, Interesting

    I think it would be more accurate to say we need to protect ourselves from the Internet vs. we should protect the Internet.

    --
    Do really dense people warp space more than others?
  16. Re:America ... F*** yeah !!! by Anonymous Coward · · Score: 0

    COMING TO FIREWALL THE FUCKING NET YEAH!

    IPV4, Your days are through
    Now you must
    Answer to
    ARPAAAAAAAAAAAAA
    FUCK YEAH

  17. Why.? by Anonymous Coward · · Score: 1, Insightful

    Why would they be worried about securing the net when they won't secure our boarders...

    1. Re:Why.? by ScentCone · · Score: 2, Funny

      Why would they be worried about securing the net when they won't secure our boarders...

      Well, a lot of us don't have boarders, even if most of us have internet access. Some of us who do have boarders will allow them to use our internet access, but I don't know if that matters. I don't want to have to watch them use it, just to secure them, and I don't want the Feds to get involved in the relationship between me and any boarders that stay in my house. But we do have to watch 'em, especially the boarders from over the border. Those Canadian boarders are nothing but trouble, and never pay their rent on time. In fact, I'm completey tired of renting out rooms. That last guy, from Quebec, wouldn't stop using French names for food. I'm done with him. I'm over the boarder, for sure. The broader issue of boarders, especially Swedish broads, bordering on being boarders but bartering room and board in exchange for making smorgasbords, is bordering on being a bore.

      --
      Don't disappoint your bird dog. Go to the range.
    2. Re:Why.? by spamking · · Score: 1

      Might be time to start the /. internet militia . . .

  18. Not quite by Burz · · Score: 4, Insightful

    You could be placed under investigation because of Who you ssh with.

    1. Re:Not quite by elkstoy · · Score: 0

      I wouldn't worry about it...you/we already are under constant Surveilance and investigation.

    2. Re:Not quite by hairyfeet · · Score: 1

      Unless of course you work at the Pentagon or the NSA, in which case you can buy kiddie porn and not have to worry about being arrested. Funny how the rules that apply to everyone else DON'T apply to them, huh?

      Just more greedy power hungry piggies wanting more power for themselves. Is anyone surprised?

      --
      ACs don't waste your time replying, your posts are never seen by me.
    3. Re:Not quite by Anonymous Coward · · Score: 0

      Been there, done that, got the tshirt, turned both keys...............all your base belong to us!
      New world time, we took the gloves off
      If you are unwilling to take a stand, perhaps you should cease screwing up the oxygen for the rest of us

  19. Alexander Is Another FUDster Who Joins by Anonymous Coward · · Score: 0

    the one and only Richard Clarke:

    ""A cyberattack could disable trains all over the country," he tells Fresh Air host Terry Gross. "It could blow up pipelines. It could cause blackouts and damage electrical power grids so that the blackouts would go on for a long time. It could wipe out and confuse financial records, so that we would not know who owned what, and the financial system would be badly damaged. It could do things like disrupt traffic in urban areas by knocking out control computers. It could, in nefarious ways, do things like wipe out medical records."

    A cyberattack could also disrupt my game of Medal Of Honor.

    Yours In Krasnoyarsk,
    K. Trout

  20. Plug a barrel with 10,000 holes? by crackerjack911 · · Score: 2, Insightful

    Should the government really be trying to manage security across the ENTIRE internet? Would you rather plug 10,000 holes in an old barrel or just build a new barrel? Maybe I just don't understand the issue enough, but wouldn't a separate Government/Military/infrastructure internet be more viable and easier to implement on existing systems thus costing less? And if you really needed access to the public internet, you could control the points of entry and monitor them much easier and more effectively.

    --
    You tried your best and you failed miserably. The lesson: never try.
    1. Re:Plug a barrel with 10,000 holes? by nomadic · · Score: 3, Insightful

      Should the government really be trying to manage security across the ENTIRE internet? Would you rather plug 10,000 holes in an old barrel or just build a new barrel? Maybe I just don't understand the issue enough, but wouldn't a separate Government/Military/infrastructure internet be more viable and easier to implement on existing systems thus costing less? And if you really needed access to the public internet, you could control the points of entry and monitor them much easier and more effectively.

      Step 1) Set up the infrastructure you suggest; Step 2) allow academic researchers in; Step 3) allow college students in; Step 4) let other countries link up; Step 5) start allowing commercial enterprise in; Step 6) listen to the commercial enterprise whine how they should have more control over the internet; Step 7) listen to other countries whine since the US was nice enough to let them link up to the network, those countries are now entitled to equal control over the network; Step 8) listen to the open source crowd whine how the government is exercising too much control and security should be handled by them in a libertarian free-for-all. We've been through this before, the network won't stay secure.

    2. Re:Plug a barrel with 10,000 holes? by crackerjack911 · · Score: 1

      Simple answer? Say 'No' a few times. Design it with one mission, secure critical systems for us. Screw the researchers, college students, thats what the public internet playground is for.

      --
      You tried your best and you failed miserably. The lesson: never try.
    3. Re:Plug a barrel with 10,000 holes? by swillden · · Score: 1

      Simple answer? Say 'No' a few times. Design it with one mission, secure critical systems for us. Screw the researchers, college students, thats what the public internet playground is for.

      The US military already has numerous networks like the one you describe. If the NSA director was talking about those, he'd say so. He's talking about the public Internet playground, and the need to "secure" it (whatever that means).

      --
      Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
    4. Re:Plug a barrel with 10,000 holes? by Anonymous Coward · · Score: 0

      Step 1) Set up the infrastructure you suggest; Step 2) allow academic researchers in; Step 3) allow college students in; Step 4) let other countries link up; Step 5) start allowing commercial enterprise in; Step 6) listen to the commercial enterprise whine how they should have more control over the internet; Step 7) listen to other countries whine since the US was nice enough to let them link up to the network, those countries are now entitled to equal control over the network; Step 8) listen to the open source crowd whine how the government is exercising too much control and security should be handled by them in a libertarian free-for-all. We've been through this before, the network won't stay secure.

      Posting as an Anonymous Coward...

      How about the following;

      Don't repeat the same 'mistakes' you made before :/

    5. Re:Plug a barrel with 10,000 holes? by mdielmann · · Score: 1

      Maybe it's just me and my Hollywood-colored upbringing, but whenever I hear a black-suit-type say something is secured, I expect to see bodies with rather large holes cooling nearby...Hmm, where's that list of spam and botnet admins?

      --
      Sure I'm paranoid, but am I paranoid enough?
    6. Re:Plug a barrel with 10,000 holes? by Myrimos · · Score: 1

      Maybe I just don't understand the issue enough, but wouldn't a separate Government/Military/infrastructure internet be more viable and easier to implement on existing systems thus costing less? And if you really needed access to the public internet, you could control the points of entry and monitor them much easier and more effectively.

      Are you being sarcastic? In any case, you've admirably and succinctly described the DoD's SIPRNet which is precisely a separate, government controlled Internet for classified information. There's also the NIPRNet, from which the public Internet is accessible.

      --
      Internet scofflaw
  21. The Internet is insecure? by Nkwe · · Score: 2, Interesting

    I didn’t realize the Internet itself was insecure.

    We could talk about securing applications that run on top of the Internet, but that would be a different conversation and I am not sure that is where we want the government to be.

    1. Re:The Internet is insecure? by Anonymous Coward · · Score: 0

      It is actually semi fragile. Some of the bedrock applications were not ever thought to be 'attacked'. Such as BGP, DNS, source/dst in TCP etc... Some of these applications just take their input and merrily go along their way doing dumb things.

      It really is 1 dorked route from some mom and pop ISP can take out the entire internet. It has happened a few times. It will again.

      At its lowest level the internet is not secure (or reliable). Unfortunately the stuff that makes up the internet 1 level up is not either. That is the issue. They have known about man in the middle attacks on DNS for about 15 years yet only within the last year have we seen secdns take off. One part of the problem is you can even DO man in the middle. Yeah that is a pretty big problem. There are dozens of such issues. That are core to what makes up the internet as we know it.

    2. Re:The Internet is insecure? by Profane+MuthaFucka · · Score: 1

      I had the same confusion. Do they mean the Internet, or do they mean the hosts on the Internet?

      And how exactly would you secure the Internet? Does it make you safer if GoDaddy and every other place where you can inject a packet into the Internet starts checking your driver's license?

      --
      Fascism trolls keeping me up every night. When I starts a preachin', he HITS ME WITH HIS REICH!
    3. Re:The Internet is insecure? by Nkwe · · Score: 1

      Then I would say that these sorts of things need to be corrected. I am just concerned that the concept of "securing" will include control of application level content and attempts to eliminate or reduce anonymity.

    4. Re:The Internet is insecure? by KlomDark · · Score: 1

      Bob Laublaw... Show us where a bad routing entry can "take out the whole internet"? Yer fulla shit.

      Somebody's doing something stupid on the backbones if that's the case.

      Secure DNS is just the first nail in the coffin of the internet as we've known it the last 20 years.

      But, continue speaking nonsense.

    5. Re:The Internet is insecure? by Anonymous Coward · · Score: 0

      I didn’t realize the Internet itself was insecure.

      It is. Infact a famous hacker testified to congress he could take down the internet in 30mins. In 1998. The fact remains that if anything the internet is even more vulnerable as a network for data transport now as we increase our dependency on it. Some Indian ISP took Youtube.com offline with a misconfiguration. Same kind of thing allows almost anyone to hijack and/or intercept traffic on the Internet.

    6. Re:The Internet is insecure? by exomondo · · Score: 1

      It really is 1 dorked route from some mom and pop ISP can take out the entire internet. It has happened a few times.

      Like when? When did one bad routing entry from an ISP take down the entire internet?!

  22. Kind of but not really by stealth_finger · · Score: 1

    "We made the Internet and it seems to me that we ought to be the first folks to get out there and protect it,' Alexander said." That's like saying the guy who dug the foundations built the house and is responsible for it? And when he says "securing the Internet against both internal and external attackers" surely by it's nature all attacks are internal.....or external, whatever.

    --
    Wanna buy a shirt?
    https://www.redbubble.com/people/stealthfinger/shop?asc=u
    1. Re:Kind of but not really by Anonymous Coward · · Score: 0

      You can take a network down physically. Bombing datacentres, ripping up the undersea cables etc. I'd say they where external attacks.

  23. Not possible... by Last_Available_Usern · · Score: 2, Interesting

    The internet is basically hosted on public infrastructure. Until the government decides to lay down it's own lines (above and beyond what it currently has, which in no way would support national bandwidth requirements) and host it on hardened equipment there's little the administration can do other than wave their finger and say, "Hey you guys, make this safer!" And to be honest, this has a lot less to do with protecting us from cyber threats and a lot more to do with implementing federal taxation on usage/commerce as well as visibility of data in and out of any node on the national network without all the red tape that's currently involved. You can call me a conspiracist, but it doesn't sound as crazy when you consider all the truly critical Government/Military traffic is already hosted on dedicated government-owned lines/equipment.

    1. Re:Not possible... by misexistentialist · · Score: 1

      After they get a "switch" to turn off the internet they can demand anything.

    2. Re:Not possible... by gamecrusader · · Score: 1

      well that dedicated sever/ equipment is being hacked and attacked daily from asian countries (don't need to say which ones we all know)
      and countries in the middle east (we all know who just think who hates us)

    3. Re:Not possible... by winwar · · Score: 1

      "After they get a "switch" to turn off the internet they can demand anything."

      They don't need the switch first. Do you really think that the government couldn't get the providers to shut down the lines that carry the internet already? Willingly? In an emergency? They didn't have a problem with illegal wiretaps after all. The problem with shutting down the internet is that you tend to shut down the country with it. Which makes it less than useful for things that you would really like to use it for.

    4. Re:Not possible... by falconwolf · · Score: 1

      Do you really think that the government couldn't get the providers to shut down the lines that carry the internet already? Willingly? In an emergency? They didn't have a problem with illegal wiretaps after all.

      Except not everyone cooperated. Just to name 2 examples, Google and Qwest told the Bush admin to get lost. Then those who did, like ATT, got eggs on their face. Obama gave then immunity for their cooperation. Google, Microsoft, Sun, and Yahoo! all spoke out in opposition to the granting of immunity.

      Falcon

    5. Re:Not possible... by misexistentialist · · Score: 1

      While anything goes in an emergency, using extra-legal powers for no good reason like the wiretapping program can't be sustained for too long, at least once they're exposed. Creating a totally legit means to turn off an ISP or disconnect a company makes government control much smoother.

  24. Good... by DigitalSorceress · · Score: 1

    Good... tell you what NSA, you go ahead and when you've managed to actually track down the spammers and the phishers and we have some "extrordinary rendition" (I was thinking of rendition more in the soap sense), then I'll believe you're serious. /It's fun to be an Internet Touch Chick //but I DO so wish they'd take me up on the challenge

    --

    The Digital Sorceress
  25. Um... I have an idea... by thestudio_bob · · Score: 1

    ...Why doesn't the government worry about securing their own networks before acting like they have the "expertise" to secure the entire internet.

    --
    The real Sig captains the Northwestern. This one captains /.
  26. Let me guess by elrous0 · · Score: 1

    The first step is to stop movie and music piracy, right? Truly the biggest threat to our country (if you ask any politician getting big campaign donations from Hollywood and big media, that is).

    --
    SJW: Someone who has run out of real oppression, and has to fake it.
  27. Simple Solution! by JoshDM · · Score: 1

    Just add an "s" to your "http"!

    1. Re:Simple Solution! by CannonballHead · · Score: 1

      [pedantic] append, not add... [/pedantic]

    2. Re:Simple Solution! by JoshDM · · Score: 1

      [pedantic] append, not add... [/pedantic]

      Hey you, shttp!

    3. Re:Simple Solution! by CannonballHead · · Score: 1

      hehe... touché.

  28. you username by Anonymous Coward · · Score: 0

    i think the rest of you username got cu

  29. Its the OS that is not secure by Jadeinfosy · · Score: 1

    The Internet is quite secure, it's the software systems that are attached to the internet that are not. Time to develop a trusted opererating system and a secure browser.

    1. Re:Its the OS that is not secure by ratboy666 · · Score: 1

      No, the internet is not secure.

      Africa can be cut off with EASSy http://www.eassy.org/

      Or, if you want to disrupt Stanford (Palo Alto)

      http://personalpages.manchester.ac.uk/staff/m.dodge/cybergeography/atlas/paloalto_fibre_largemap.gif

      As far as I know, none of this stuff is "secure". And, I am sure that you can find fiber maps for your neighborhood as well.

      --
      Just another "Cubible(sic) Joe" 2 17 3061
  30. huh? by mosdave · · Score: 1

    "...a network that many security experts see as hopelessly broken and flawed by design."
    wait, what?

  31. Trying to cure the symtpoms .... by AnonymousClown · · Score: 1
    The article is "blah blah blah security blah blah risks blah blah blah ...."

    Why not concentrate on the folks who are exposing critical systems to the internet - if, in fact, they are?

    I know folks in the defense industry - all the critical stuff has not physical path to the internet. To access that information means switching machines.

    Same goes for other industries. I mean, network admins aren't stupid - it's pretty obvious that if it's really critical you don't connect it to the internet. Even the PHBs get that.

    --
    RIP America

    July 4, 1776 - September 11, 2001

    1. Re:Trying to cure the symtpoms .... by Ungrounded+Lightning · · Score: 1

      I know folks in the defense industry - all the critical stuff has not physical path to the internet. To access that information means switching machines.

      Same goes for other industries. I mean, network admins aren't stupid - it's pretty obvious that if it's really critical you don't connect it to the internet. Even the PHBs get that.

      Actually, the PHBs DON'T get it. They outsource the administration of their networks , including fileservers containing their critical IT (both technical and business-secret), to contractors. They mandate the use of notoriously security-bug-ridden software products in business-critical infrastructure roles. Then they depend on firewalls and signature-driven commercial anti-malware products to try to keep the mice out of the resulting swiss cheese.

      Last month Datamation magazine estimated that 75% of the major tech and high-end businesses had already had their IP compromised by spear-phishing attacks on their IT infrastructure. (Spear-phishing tools go right past signature-based antimalwre products, which typically don't know about them until they get to "general-availability" or a customer of the malware vendor (typically a low-tier customer who gets the tool late) gets caught. This is estimated as occurring about two YEARS after a given exploit is built into an attack tool.)

      --
      Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
  32. How do you plug all the holes in a screen door? by kawabago · · Score: 1

    Trying to secure the internet is like trying to stop air flowing through a screen door. They might have better luck securing critical infrastructure and implementing a backup communication channel for that infrastructure should the internet be compromised.

  33. Aliens by sea4ever · · Score: 1

    "secure the internet against internal and external attackers?"
    What does external mean here? The first thing that comes to mind would have to be some kind of E.T..
    Someone explain what 'external' means in relation to the internet. Unless it's referring to some kind of physical world outside of the internet..!!
    Is there a world outside of the internet!!?

  34. Please help us NSA... by Anonymous Coward · · Score: 0

    At least the NSA contributed selinux. With their budgets if they want to help make the network more secure the single best thing they could do is develop analysis tools (Stanford checker et al) to find defects in the computer codes running the network and systems connected to it and not just hoard these capabilities.

    The actual statement sounds kind of lame in that it provides zero effective information on either what is meant or how it would be done.

    Personally I think the best outcome is that efforts are made to make the network itself as reliable as possible but NOT secure. In other words DNS works to the extent that you can't blindly inject bogus responses into systems UNLESS you have direct control over the network path between systems. DNSSEC and its planet scale trust anchor is a poster child for futility.

    End-to-End security where the network is assumed to be insecure is the only architectural method for security that makes any sense whatsoever at the scale of the Internet.

  35. What is it exactly that needs protection here? by Anonymous Coward · · Score: 0

    it seems to me that we ought to be the first folks to get out there and protect it

    What is it exactly that needs protection here?

    I thought the Internet was designed to "heal itself" from attacks by using a flexible routing system.

    In fact, wasn't that a primary goal for ARPA when it designed the network? To ensure that its architecture did not have a single point of failure?

    Does this call for "protection" mean that the Internet is somehow not robust as originally designed? What is the proof of this supposed lack-of-robustness?

  36. secure = kill switch? by spook+brat · · Score: 1

    This press statement makes me really worried. Considering the recent news about Congress wanting a kill switch for the Internet, an NSA announcement that it will "secure" the internet sounds like spin.

    Have you ever heard the joke about how different branches of the U.S. military "secure" a building? The NSA puchline would be "rig the building for demolition, then put the Big Red Button right next to the light switch.

    Between my experience with STU-IIIs and being a Dune fan ("He who can destroy a thing, controls a thing") I'm really worried that the NSA has been tasked to create an internet kill switch, and that the "security" efforts they will soon recommend will be a pretext for the kill switch's creation. The NSA is the logical government agency to implement a kill switch, and designing the new security system would give them the access they'd need. Normally I hate conspiracy theories, but this is just creepy to me.

    Footnotes:
    For all you coders out there, I meant "=", not "=="; in my opinion the NSA getting involved assigns the value "kill switch" to "secure".

    Joke punchline origin: every piece of NSA designed hardware I've handled has a kill switch built in, and one of my biggest headaches was people asking "what does (PRESS) this do?". Quote from the STU-III handbook:

    The STU-III battery backup allows power to be removed, as in a power failure or unplugging the unit to move it, without losing the encryption data. The zeroization button bypasses this backup and erases the encryption data. After zeroization, the STU-III must be rekeyed and the CIKs must be remade. The STU-III is zeroized:

    In an Emergency. - If the STU-III is ever in danger of falling into hostile hands, zeroize it to prevent the adversary from obtaining a functional unit. . .

    By Accident. - The accident usually follows an employee's curiosity. The employee starts playing with the buttons and zeroizes the unit. Be sure to brief your employees on the importance of not pressing or playing with the zeroization button. Refill the STU-III using a new seed key [or operational key].

    --
    Travel the Galaxy! Meet fascinating life forms... ...and kill them - http://schlockmercenary.com
  37. An analogy.... by OldHawk777 · · Score: 1

    A house can be considered secure when doors and windows are closed and locked. Is the hose secure from criminal invasion? No
    The house is secured from unauthorized access. Can the house be secured? No

    So, How do you stop criminal entry? Stop the criminal. In the process of stopping the criminal can the home be used? No
    Using the home will endanger or at least penalize the private home owners, and may inadvertently criminalize the home owner,
    because there is a pot-plant growing (not for use/distribution) in the back yard.

    Anyway good police work, investigation tools, reasonable response (offensive and defensive) weapons, and sensible laws are (IMO)
    the only acceptable ways to stop criminals without harming your people, culture, economy....

    Any blanket solution to crime (like the drug-war and god-sex laws) is always dumb as dirt and will never work.
    Crime is flexible "Asymmetric" you can only lose while playing catch-up.

    Good police work always adapts to the crime and times to get the dirt on the perps.
    Holy-Drug/Sex/Alcohol... laws always create an ungovernable underground economy that makes citizens criminals (USA is the example).
    When citizens are made criminals, then you must increase the protection for the remaining parochial-dogma citizens.

    Good security always starts at the borders (points of entry). [i.e. Doors, Windows, Customs, Air/Sea Port, Top-Level gateways and routes...].
    The laws already exist to stop criminals and locks and latches won't help US, EU, RU, CN....

    --
    Unaccountable leaders are masters, and unrepresented people are slaves. How do US and EU fare?
    1. Re:An analogy.... by Aladrin · · Score: 1

      Should have gone with the car analogy. Since they were invented here (like the internet) they fit a little better. ;)

      --
      "If you make people think they're thinking, they'll love you; But if you really make them think, they'll hate you." - DM
  38. More U.S. government corruption? by Anonymous Coward · · Score: 0

    Agreed. Except that it is "increase the budgets long term".

    "NSA Director Says the US Must Secure the Internet"

    Translation:

    We in the NSA have several reasons for wanting control over the internet:

    1. When we say "secure the internet", we mean make it less secure for everyone but us.
    2. Those who want continued corruption of the U.S. government want control, control, control. We must serve our masters.
    3. More control means raises and promotions. Get more of that taxpayer money. Yeah!!
    4. Most of us are clueless about the technology, but we want people to think we are important.
    5. If we have sufficient equipment and control, we can trade stocks within 50 milliseconds after they start rising or falling, as does Goldman Sachs. Later than that is for the losers.
    6. The U.S. government should spend huge amounts of taxpayer money to spy on the entire world. It's an arrogance thing.
    7. The U.S. government has killed so many Arabs that we need to know if they are plotting to kill us.
    8. You mere U.S. citizens are not allowed to know the other reasons.
  39. But.. by nanospook · · Score: 1

    But we don't want you (the NSA) to secure the internet..

    --
    Have you fscked your local propeller head today?
  40. NSA Director Says the US Must Destroy the Internet by Anonymous Coward · · Score: 0

    It looks like the internet is a dangerous thing because it allows unsanctioned free speech.
    And unsanctioned free speech is dangerous.
    Perhaps we can have some govt. issued permits that authorize "journalists" to speak.
    This way if someone posts something unsanctioned the permit can just be revoked and since all "Journalist" are registered we know who to imprison.
    We can still have free speech we just have to make sure it's properly sanctioned by a "Journalist".

  41. Who, what and why? by Mathness · · Score: 1

    "We made the Internet and it seems to me that we ought to be the first folks to get out there and protect it,"

    Protect it from who, what and why?

    And if you are serious, start by getting rid of spam. And if you should somehow manage that, you have most likely also killed the (free) internet as we know it.

    --
    Carbon based humanoid in training.
    1. Re:Who, what and why? by dwiget001 · · Score: 1

      Protect it from who, what and why?

      Why, our enemies, of course. ;)

  42. Ignore the NSA and pull the plug on China by WillAffleckUW · · Score: 1

    You don't deal with issues like this by inaction, or by battening down the hatches while leaving a giant pipeline of hackers and botnets flowing from China into the US.

    You pull the plug on the root servers recognizing China until THEY shut them down.

    Actions speak louder than Fear.

    --
    -- Tigger warning: This post may contain tiggers! --
  43. Perhaps offer some standards? by mlts · · Score: 2, Interesting

    There are ways the US government can do some in advancing Internet security as a whole. Some that come to my mind (usual long list):

    1: Subsidizing an OATH compatible OTP system. Perhaps get Aladdin/SafeNet or RSA to make tokens which support numbers that change every 30 seconds, and apps for devices. Now, a thief has to do more than just slurp a password to compromise a bank account. They would have to actively mess with the Web browser. This leads to #2.

    2: A ZTIC-like system. This way, transactions are confirmed actively, so malware present on the system can't actively transfer money even if a bank account's password is compromised. This can be a hardware device, or a phone app.

    3: Crypto contest for a RSA successor. RSA has stood strong, but another public key algorithm that is quantum computer resistant is needed. Of course, this isn't an easy task, compared to making symmetric key algos.

    4: A backbone between businesses similar to NIPRnet, but for civilian transactions.

    5: A civilian CAC for client certificates, with good mechanisms in place to deal with cards that are lost, stolen, locked out due to bad PIN retries, or accidentally microwaved.

    6: SELinux's successor. Preferably a hybrid between it and AppArmor. The more technology in keeping applications to just what they need to run, the better.

    7: This isn't directly Internet affecting, but perhaps find some R&D into backup technologies? It used to be a while back that companies were through about backups, and if you even thought about being a sysadmin, you knew how to do dumps, tars, full/incremental/differential backups, tape rotations (grandfather/father/son), offsite tapes, and so on. These days, people don't even bother with backups, and if they do, they think the cloud can do it, forgetting the time it takes to suck all that info back through a WAN connection on restore. Yes, backups are boring as all get-out, but in case other security measures fall apart, backups are what one uses to piece things back together.

    1. Re:Perhaps offer some standards? by Anonymous Coward · · Score: 0

      I bet you think the problem in Afghanistan is that the army doesn't have big enough guns..

  44. Why don't we try a much simpler 'proof of concept' by ChaoticPup · · Score: 1

    ...and secure our physical borders?

  45. My first thought was physical security by the+Gray+Mouser · · Score: 1

    Amazing how everyone immediately thinks of encryptions and sniffers in terms of security.

    But how many well-placed bombs would it take to take down the entire internet (or at least most of it). It's not nearly as redundant a network as some would like to believe, and if you can take down the backbone, the trunks have nothing to talk to.

  46. Yeah... by Anonymous Coward · · Score: 0

    Good luck with that.

  47. RTFS, FFS by canajin56 · · Score: 3, Insightful

    I know you can't ask Slashdot to read the article, but can't we even read the summary anymore? From the headline "US Must secure the Internet" (A change from the actual headline "US has a duty to secure the internet" to the actual NSA Director "has a responsibility to take a leadership role in securing the internet") maybe you can say they're talking about making online ID mandatory so all activities can be traced to an individuals internet license ID. Or something. But they're not. They're talking about providing expertise and advice to help others secure both public networks (like the Internet) as well as private networks (such as corporate and government networks.) This is similar to how the FDA advises the public on the proper temperature to cook your hamburger to to avoid e.coli, but doesn't send in the stormtroopers if their spy sats detect you BBQing undercooked meat. You can say that, given the government track record for incursions into their own networks, they have no business telling others how to secure their networks. And you'd probably be right, but you wouldn't be saying anything that TFA didn't say.

    But, the majority of TFA is talking about how the government plans to improve the security of their own networks, and the steps that they have already taken. Very little is spent talking about their planned "leadership" roll in helping secure public and private networks across the country. It sounds an awful lot like leadership by example, however. There's no mention of new laws making security features mandatory, for example. More like just providing advice on how to secure a network, with examples of how they have improved their own security. It's being criticized as being overly broad and generalized. Which, again, is probably valid, since it's exactly the field of the people leveling the critiques. But nothing sounds malicious at all. Nothing sounds like, as people have been saying, they plan to eliminate anonymity by making all internet connections require a traceable license. That's pretty absurd, and if it's been brought up by the government, it wasn't by TFA or anybody in it. What he's saying is, the internet is important, and the government has a duty to protect it from attacks. Such as, a DDoS or other sort of attack taking down key points and knocking a substantial amount of the country offline. That would be a serious blow to the economy, so yes, the government does have a duty to do what it can to prevent that kind of attack.

    Last but not least, is the quote that ends TFA.

    "Our citizens take a lot of interest in the government's activities in this area, and I have an obligation to the law and the American people to ensure everything we do preserves and protects their rights while protecting our interests," he said. "That's an obligation that's never compromised."

    --
    ASCII stupid question, get a stupid ANSI
    1. Re:RTFS, FFS by losfromla · · Score: 1

      So, similar to how the FDA says that you don't have the right to purchase raw milk if you want to, it is illegal for you to be told that your food products do or don't contain GMOs (only indirectly through "Organic" certifications), be informed that certain nutrients prevent or even cure certain diseases? I'd rather the government take a leadership role in minding its own business and leaving private things private. The FDA is not some innocuous little agency, they are another arm of the agribusiness conglomerate, so, terribly bad example. Got a better one by chance?

      --
      Only I can judge you.
  48. its ok to dislike the us govt by circletimessquare · · Score: 1

    but disliking the us govt for what all govts do just makes you look silly

    --
    intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
  49. SIPR by Anonymous Coward · · Score: 0

    The DOD already has a secure internet. Look at SIPR http://en.wikipedia.org/wiki/SIPR

  50. self-aware @ 2:14 am EST August, 2027 ... by Fippy+Darkpaw · · Score: 1

    When the Internet becomes self-aware security will greatly improve. The extermination of humanity will begin. As so many Slashdotters remind us daily, humans are the weakest link in any security scheme.

  51. done by Venik · · Score: 3, Informative

    NSA Director Says the US Must Secure the Internet

    As of 10am EST this morning I have completely secured the Internet. The NSA director and my immediate management have been notified. I closed the ticket.

    1. Re:done by carp3_noct3m · · Score: 1

      1. Re-open ticket
      2. Let it sit there for a year or so
      3. Pretend to work on it
      4. Bill them a couple billion for your work
      5. ?????????
      6. Profit!!!

      --
      "It's ok, I'm completely secure as long as my iron is off"
  52. Suitable project acronym by Anonymous Coward · · Score: 0

    Perfect Online Resource Kontrol - PORK

    You are welcome, my invoice is in the mail - I don't trust this new-fangled intertubes thingy.

    1. Re:Suitable project acronym by Docboy-J23 · · Score: 1

      Perfect Online Resource Kontrol - PORK

      Do they know, "kontrol" doesn't start with a K... /singing

  53. Can't we just by bugs2squash · · Score: 1

    wrap the tubes with tape.

    --
    Nullius in verba
  54. Define "Securing" by ratboy666 · · Score: 1

    The "Internet" provides a pipe into my network. My network is secure. I am not sure how anyone would go and secure the inter-networking connection between my network and others. Well, yes, I can see the value of hardening the infrastructure (protecting fiber-optic and cable links). And, taking this literally, that is the meaning.

    But, for some reason, I am sure that is not what is meant. What I suspect is that anyone who connects to the main backbones, or a subsidiary will need to have some confirmation that they will not be a source of "attacks". (leading us to attempt to define what "attack" means).

    Maybe the US will finally secure its own government computers (preventing the fiasco started by McKinnon).

    I am still not sure what "securing the Internet" means.

    --
    Just another "Cubible(sic) Joe" 2 17 3061
  55. Clearly he's never heard of neighborhood watch... by macraig · · Score: 1

    ... or doesn't see the sub-contractor profit in it.

  56. Nice internet ya got there, be a shame if.... by Anonymous Coward · · Score: 0

    How about the american corporate reich stays the fuck away from "protecting" the internet in the mafioso sense they no doubt intend?

  57. Dammit by Zixaphir · · Score: 1

    I'll meet you all in the undernet.

    --
    "Now I am become Death, the destroyer of worlds"
  58. Who's the enemy this time? by bazorg · · Score: 1

    a responsibility to take a leadership role in securing the Internet against both internal and external attackers,

    When the man says "external attackers" does he mean people who are not current users and should be forcibly kept out of the internet, or does he mean *reaaaally external* attackers, such as the Borg?

  59. Take it easy, Charlie. I've got an angle. by __aaasvk1266 · · Score: 1

    1) Air Gap

    2) Sneaker Net

    3) f28R^VD(*

    4) Profit!

  60. Here It Comes... by BlueStrat · · Score: 2, Informative

    They've been working themselves up to this for a while now, and it appears that the lead-in propaganda campaign has heated up. I can't believe that I haven't seen another post discussing this yet. It fits perfectly with TFA/TFS. Two words.

    Trusted Computing.

    Here is a paper by Ross Anderson on some of what implementing Trusted Computing will mean.

    This had better be nipped before implementation or there won't be another chance. The internet is a tool with more than one use, just as with nearly any tool. While the internet has tremendous power to empower, inform, and enrich, it also has tremendous power to monitor, control, and suppress if Trusted Computing is allowed to be implemented.

    Strat

    --
    Progressivism (aka US 'Liberalism'): Ideas so good they need a police/surveillance-state to enforce.
  61. US Govt get your priorities straight! by Anonymous Coward · · Score: 0

    First of all, secure our fucking borders NOW!

    Next, get all our security-sensitive govt computer systems the fuck off the Internet.

    We as hardworking taxpayers, do not want the systems our tax dollars pay for, to be carelessly hooked up to the public Internet. Doing that goes beyond incompetance and becomes willful negligence. The Internet is not a cheap WAN link. The Internet exists for entertainment, education, advertisement and limited commerce. Cybersecurity for important government computer networks should be enforced by making them connect only by secure "private" network links with no route to the public Internet at all, and allow only specifically authorized users to access them.

  62. The national security total makeover by 32771 · · Score: 1

    They should have thought of that in the seventies.

    Or how about security eye for the promiscuous guy.

    --
    Je me souviens.
  63. I have an idea by Anonymous Coward · · Score: 0

    Let's make sex secure for the human race by forcing everybody on earth to have a permanent condom stiched to their genitals... And while we're at it, let's embed sophisticated tracking and vibration detection devices to it. Never again will you have to worry that your wife might be doing your neighbor while you're at work.

  64. "Protect" it? by Arancaytar · · Score: 1

    From credit card scammers, or from Wikileaks?

  65. two simple things... by steeleyeball · · Score: 1

    Run your browser of a bootable USB stick or better a Live CD... Get a Ham Radio for a Modem, Other people can too. Implement your own security. If you decide to be a sheep you will end up as mutton on someone's plate.

  66. Impossible to do by TheGoodNamesWereGone · · Score: 1

    The way the Net is currently implemented, there's no way to secure it. PEBKAC. I'm skeptical it can be secured in any form, because people are frickin' stoooooopid. This is not to say we shouldn't *try*, any more than we should *try* to stop all murders from occurring. I know this will be an unpopular thing to say on SD, but nearly all shenanigans would stop if a way could be found to erase anonymity. Criminals depend on not being identified or caught; this is why more houses get burgled at night. Before you cry foul at the idea, realize that the world is getting ever more connected and therefore ever more vulnerable. All information and all media will be on the Internet. Sooner or later a decision will have to be made as to whether anonymity or a usable world is more important.

  67. I never... by mindwhip · · Score: 1

    Realized there was oil in the Internet...

    Why else would the US want to 'secure' it?

    --
    [The Universe] has gone offline.
  68. Welcome to by Anonymous Coward · · Score: 0

    Welcome to the World Wide One Way Network we will send you what we think you want to see please connect credit card reader ...

  69. It must be at least as secure as it was... by Anonymous Coward · · Score: 0

    It must be at least as secure as it was during the Cold War. In fact, we still have the possibility of a loose nuke strike if we aren't careful. But wait, for much of the Cold War, there was no Internet.

    The point being, your stupid FaceBook and/or MyMail account don't need jack. If you get 500,000 Viagra spams in your Inbox, it's nonoe of the government's business. That's between you, your provider, and the upstream idiots who let spambots jack their systems. The Stuff the Really Matters (TM) should be old school code double-red-teamed by guys with ties and pocket protectors. Everything else can melt and it really shouldn't matter.

    Anybody who runs mission critical DoD stuff through the public Internet should drop a rank or get canned as appropriate.

  70. cyber attacks from outside the internet.... by Anonymous Coward · · Score: 0

    "Protect the internet from ... EXTERNAL attackers"

    I'm sorry, but who is this referring to? Aliens?

  71. ... trained in the existing hubris of your culture by DrJimbo · · Score: 1

    Receiving a good education does not ensure that you are right or wrong, but it means you are very highly trained in the existing hubris of your culture.

    Great phrase! Have you read Masks of the Universe? Here are some excerpts from the introduction (pdf):

    The theme of this book is that the universe in which we live, or think we live, is mostly a thing of our own making. The underlying idea is the distinction between Universe and universes. It is a simple idea having many consequences.

    ... the Universe is everything. What it is ... we never fully know.

    ... the universes are our models of the Universe. They are great schemes of intricate thought -- grand belief systems -- that rationalize human existence. ... Each determines what is perceived and what constitutes valid knowledge, and the members of a society believe what they perceive and perceive what they believe.

    ... This oldest of human conceits, which confuses universe with Universe, is alive today as much as at any time in the past. We are afflicted with the hubris that denies our descendants the right to different and better knowledge.

    --
    We don't see the world as it is, we see it as we are.
    -- Anais Nin
  72. In other news by Anonymous Coward · · Score: 0

    Robotic dick improves sexual intercourse by 500%

  73. NSA calls for it and volunteer to do it! by Anonymous Coward · · Score: 0

    Of course the NSA would want this, it makes their job easier, gets them more money, and gets them more power. They portray it as a burden, but it's one they probably foam at the mouth to suffer through. All that power and money, and of course they would need unregulated power to handle such a task as the internet..because the internet is so scary and full of terrorists.

    And in the future when mind reading technology comes out but they have to drive a big spike into your head to monitor it, they'll volunteer to handle that as well...because anyone could go all terrorist at any point and they need that kind of information.....plus the rest of the information they could scrape in the process.

    And the very act of monitoring, increasing tax burdens and other side effects will create the very terrorists they are searching for at some point. People will only endure so much bullshit, which is probably why they don't tighten the screws down quickly. It's easier to deal with what's squeezed out via the pressure when it's a slow trickle.

  74. Insecurity secures Microsoft profit. by Anonymous Coward · · Score: 0

    Who would buy the next version of Windows if the last version worked well? No one.

    1. Re:Insecurity secures Microsoft profit. by exomondo · · Score: 1

      They almost made XP too good, the push to upgrade from XP stumbled out of the starting gate a bit.

  75. This writer is behind the times by falconwolf · · Score: 1

    The government also has come under fire for attempting to tell companies how to improve their security while suffering a slew of embarrassing intrusions on its own public and classified networks. The most well-known of these attacks is the compromise of a classified Department of Defense network through an infected USB drive in 2008.

    From DoD Takes Criticism From Security Experts On Cyberwar Incident posted this Saturday "this James Bond-like scenario doesn't stand up to scrutiny."

    Falcon

  76. We did make the Internet by falconwolf · · Score: 2, Informative

    CERN disagrees.

    CERN does not disagree. CERN was the birthplace of the World Wide Web" and the internet is much more than just the web. Here's A Short History of Internet Protocols at CERN from the horse's mouth.

    Falcon

  77. stupid guy by Anonymous Coward · · Score: 0

    stupid does

    that's why human civilization has come to an end
    the end doesn't mean 'doomsday'

    just means we are not improving anymore
    we still live in a world of 'no trust at all'

  78. What a load of.. by Seth+Kriticos · · Score: 1

    ..crap.

    Seriously, what every government is obliged to do is secure their own damn networks and protect the private data of citizens.

    The rest of the Internet is none of their business (well, except jailing the SPAM-ers and black hat hackers). ISP's have to take care that things work out (data flows through the tubes), and everyone has to make sure to either not have sensitive data on their end or properly secure it.

    You have a door with a lock on your house and you shut it closed when you leave. You don't expect some government force to babysit your entry. Why should they do with the "Internet" then?

  79. We made the Internet by Anonymous Coward · · Score: 0

    "We made the Internet" - what has he been smoking?

  80. Yeah, but... by Anonymous Coward · · Score: 0

    Make it secure. Does that mean I'll finally be done cleaning XP Antivirus 2001 (and all it's annual iterations to the current Protector Plus 2010) off of peoples computers? Oh glorious day! Let's celebrate!

    Then when it's secure, why not try securing our borders. And securing the Constitution and Bill of Rights. Don't forget about securing your personal information stored at banks and credit card places.

    Security, a safe word for the paranoid.

  81. Their other announcement was: by MoriT · · Score: 1

    We must secure the air! Did you know anyone can just reach out and touch it!?! Anything could be in the air. From now on we will be providing government-issued plastic bags to all citizens. Simply place the bag over your head, secure with the included duct t... I mean, highly technical securing device and enjoy your new-found safety. You won't come into contact with any unsecured air particles for the rest of your life!

  82. Outlaw Windows by Anonymous Coward · · Score: 0

    Granted all your ideas are good. So are a lot of other ideas on here. I am kind of amazed no one has pointed out the main attack vector on the network. Windows. If we look at the attacks on government systems and private systems we see that the door way in was through a Windows box. The network will never be secure until Windows is secured. Sure key algos are great and work really well still if you box is hacked and the private key stolen so much for strong crypto. The case of DoS attacks. These are never done by machines bought or leased for this purpose but by botnets comprised of "Owned" Windows machines. Will this ever happen? I think not their are too many people making billions of dollars selling so called "Security Products" to secure Windows. Shouldn't an OS be secured by default instead of selling security as an addon?

    Its sad to think that my lowly little laptop is more secured than most security agencies computers. What makes it sad is instead of needing a bunch of complex and broken applications to secure it I follow a few simple rules we all here on Slashdot know. I have NO in-bound ports open and even ICMP packets are dropped. I never work under root. I only load applications that come from a known repository. I run Linux and yes use SELinux.

    So why can't the security gurus at the government figure this out? After all wasn't the NSA the ones that made SELinux? Well they are using the Windows attack vector so they can lock person freedoms and privacy.

    Why is it that they want locks and hold all the keys to my life yet freak out when their own dirty secrets are leaked out? what happen to "By the People"

  83. Not a good business move by professorguy · · Score: 1

    Oh, I see your mistake--you forgot there is such a thing as credit. If I can't absorb $10,000--I'll borrow it and pay it back monthly. And not at your usurious 50% APR ($416/mo), but more likely at <10% APR (<$132/mo).

    1. Re:Not a good business move by arth1 · · Score: 1

      Assuming you have good enough credit, and haven't already used the credit for something else.
      And what happens the second time disaster strikes, and you've already used up your credit? You go bankrupt, and the credit institution's other customers have to pay the price of your greed?

      No, I think insurance is a very good idea for many companies even if more expensive on average.
      I also believe that in some cases it should even be legislated as mandatory, when not having the necessary liquidity if disaster strikes would harm more than the business itself.
      Just like insurance is mandatory for driving a car most places in the world, and for the same reasons.

  84. Like the 'OFF SWITCH' by Anonymous Coward · · Score: 0

    Like the OFF SWITCH they wanted last month, this demonstrates that they're terrified of their citizens exercising free speech in a venue where others can hear them. It looks like V was right. " Citizens should not be afraid of their governments, governments should be afraid of their citizens"