Slashdot Mirror
Why Laws Won't Save Banks From DDoS Attacks
kierny writes "Rep. Mike Rogers (R-Mich.) should know better. The chairman of the House Intelligence Committee claimed to told NBC News that the Operation Ababil U.S. bank disruption DDoS campaign could be stopped, if only private businesses had unfettered access to top-flight U.S. government threat intelligence. Not coincidentally, Rogers is the author of CISPA (now v2.0), a bill that would provide legal immunity for businesses that share threat data with the government, while allowing intelligence agencies to use it for 'national security' purposes, thus raising the ire of privacy rights groups. Just one problem: Numerous security experts have rubbished Rogers' assertion that threat intelligence would have any effect on banks' ability to defend themselves. The bank disruptions aren't cutting-edge or stealthy. They're just about packets overwhelming targeted sites, despite what Congressionally delivered intelligence might suggest."
These folks obsessed with a "negative peace" by making more laws should study history.
In the name of fighting money laundering--an activity primarily associated with the War on Drugs--Congress passed a law requiring all transactions around $5k or more to be logged and sent to federal law enforcement. Paying in cash for everything is now being called a sign you might be a terrorist. Paying in cash is also *gasp* resistant to DDoS attacks. The coralling of most of our commerce into the hands of banks has effectively made banks a target that can cripple unrelated businesses. If we were mostly a cash society, it'd be no big deal. The worst a DDoS could do is delay the processing of your paycheck or an ATM withdrawal.
... I don't think 'rubbished' is a legitimate word.
These people want this information shared for their own purposes.
This has nothing at all to do with protecting banks from DDoS -- it's about ensuring government access to all of our data. If they can get private industry to hand them data they can't collect on their own then they can circumvent other laws.
I agree with the assessment that no law is going to make this kind of attack hitting from all over the world (and probably on zombie computers) go away.
These people just want the total surveillance world that scares the rest of us.
Lost at C:>. Found at C.
What the hell are you going on about? Odds are the DDoS is taking down the target network before a single packet reaches anything running Microsoft software. Actually, the reason it's a DDoS is because packets aren't reaching anything running Microsoft software (clients and servers). You'd be making a tiny bit of sense if you said Cisco, but that would be like suing the New York City because the roads can't accommodate every single person in the country visiting NYC at once.
NO
There actually is, but the main body of Congress routinely ignores it because the seat of their collective pants tell them to.
Representatives like Rogers like to get laws on the books with their names bandied about them, to show that they're not just fooling around, then they can get back to the business of whatever their big campaign donors want them to do. Circus and bread.
A feeling of having made the same mistake before: Deja Foobar
I think he's talking about all those windows peecee's slaved into botnets because of their defective by design OS and are used in DDos attacks such as this. It all starts with malware ya know and Windows is the most pervasive form of malware on the planet.
Given that a lot of these problems stem from inherent design flaws with our current Internet protocols, perhaps we ought to start improving upon the 20 and 30 year old protocols we've been relying on. Fundamental scale and design flaws will continue to empower bad people to do bad things so long as it continues to be nearly effortless. BGP, DNS, IPv4... You can only build on a foundation for so long before its age and brittleness beings to cause serious problems.