Slashdot Mirror
Tech Industry In Search of Leadership At White House Cyber Summit
chicksdaddy writes: President Obama travels to Stanford University on Friday to join Apple CEO Tim Cook in talking about the need for more private-public sector cooperation to fight cyber crime. But technology industry executives attending the White House Summit on Cybersecurity and Consumer Protection complain that a major obstacle to cooperation is a lack of legislative action that clarify the rules of the road for private firms when it comes to sharing information about customers with the government and each other.
The controversy over government surveillance has put the ball in the government's court, said Michael Brown, RSA's Global Public Sector Vice President. "They need to articulate what amount of access to private information is 'appropriate and legal' for law enforcement and the government," Brown said. "It's not just about 'when, where, and how.' They also need to clearly articulate 'why' – for example: this is a matter of public safety and this is the only way we can get this information."
Also on the to-do list, say executives: a re-writing of the 80s-era Computer Fraud and Abuse Act and a federal data breach notification law that creates a consistent, national standard. Currently, 48 states have passed such laws, creating a compliance mess for private firms that discover they have leaked customer data.
The controversy over government surveillance has put the ball in the government's court, said Michael Brown, RSA's Global Public Sector Vice President. "They need to articulate what amount of access to private information is 'appropriate and legal' for law enforcement and the government," Brown said. "It's not just about 'when, where, and how.' They also need to clearly articulate 'why' – for example: this is a matter of public safety and this is the only way we can get this information."
Also on the to-do list, say executives: a re-writing of the 80s-era Computer Fraud and Abuse Act and a federal data breach notification law that creates a consistent, national standard. Currently, 48 states have passed such laws, creating a compliance mess for private firms that discover they have leaked customer data.
Saw this in the news earlier.
So, Obama wants software companies to cooperate with the Feds more to help deal with cyber-security issues...
So, anyone else see this as government-mandated backdoors in everything?
"I do not agree with what you say, but I will defend to the death your right to say it"
Post the current cybersecurity issues faced by the White House to Slashdot and get all your answers for free
You're welcome
Wherever You Go, There You Are
I nominate Edward Snowden.
Let's do the right thing here - grant him clemency and welcome him home.
Political correctness is really just herd psychology pushed by insecure people who desperately seek social conformity.
... instead of hoarding zero-days and working to make our hardware and software more insecure.
tech industry: we need guidelines on what we can and cant do
WH: ok, so how about letting users opt out of data collection and tracking entirely
tech industry:JESUS FUCKING CHRIST YOURE KILLING US WITH REGULATIONS STALIN. here lets just take it to the courts on a case by case basis.
Antonin Scalia: what the hell is an E-Mail. is that what the kids do now? email? is that why they listen to hip hops?
Clarence thomas: zzZZZzzzzZZZZ
John Roberts: this talking sack of unmarked large bills keeps sending me on vacations when I try to form an opinion.
Stephen Breyer: the cafeteria is out of those little breakfast eggroll things again. who wants lox?
Good people go to bed earlier.
"They need to articulate what amount of access to private information is 'appropriate and legal' for law enforcement and the government,"
No I think we the people need to do that. We should get out in front of government by designing systems that keep private information private. The best way to ensure rights like privacy survive is to create a public expectation of it.
Right now the public expects government can just backdoor anything it wants, and THAT IS THE PROBLEM.
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
Is it different if I yell 'Fire' in a crowded movie or if I tweet it? Fifty years ago if the government wanted to monitor communications or get customer records from a company what did they do? If someone hacks my computer and locks up my files for ransom, why is that different from breaking into my home and stealing my file folders? I know there are scale factors: customer records for hundreds vs tens of thousands (or more), breaking into one house at a time vs hacking a million systems with one email, etc. but why does all of this have to be re-invented? It seems like we (government) make it more complicated than it needs to be. Just wondering. (Please do not tell that it is all just different just because it is on a computer. I have been in the business for 30 years, build my own computers, read 2600, etc. so I have some exposure to the field.)
If the national security hawks would pass a bill that categorically prohibits the sharing of criminal evidence between national security agencies and law enforcement except where the criminal accusation is based upon violent terrorism, solicitation to terrorism, provision of material aid, treason, efforts to overthrow the United States Government, sabotage the functioning of the United States Government for the direct benefit of a terrorist organization or conspiracy to commit any of the aforementioned. If they really wanted to make the case, they'd make it black letter of the law, strict liability (ie no intent or motive required to be fully guilty) that any assistance involving intelligence methods in ordinary criminal investigations results in immediate revocation of security clearance and life-long removal from civil service qualification.
There are two categories of cyber crime, and the solutions to solving each are mutually exclusive.
The first category of cyber crime is that which exploits insecure networks and computers. Hackers accessing classified data, security breaches in banking records, MITM attacks, etc.
The second category of cyber crime is "real world" crime facilitated by and hidden within secure networks. For instance, the buying and selling of contraband online, such as with Silk Road.
With more secure networks, the first category solves itself. The bad guys can't do bad things if they can't break through the firewalls. However, with more secure networks, engaging in the second kind of crime becomes easier.
Note that by "secure networks" I'm including a social aspect to complement the technical aspect. What I mean by that is you don't have people involved in the communication deliberately giving out information to third parties.
So there's a dilemma with any government plan to combat cybersecurity. You can't reduce one category of cyber crime without increasing the other. In other words, there is no "one size fits all" solution to cyber crime.
The government has made their decision clear. They want weak networks so they can catch the bad guys committing "Silk Road" style cyber crime, and are willing to sacrifice everyone's security in the process, thereby increasing the occurrence of the other category of cyber crime.
Is that the right choice? In my opinion, no. Read the text of the fourth amendment, and the implication is clear. The security of the people and their papers (and if I may interpolate, this should cover their computers and networks as well) is more important than the government's duty to catch the bad guys.
Perhaps a more proper approach to cyber crime would be to put research into computer security, promoting technology and standards that are less easily exploited. True end-to-end encryption of all data on the internet, such that even the ISP's don't know who their customers are communicating with. As well as technology and practices to make data breaches less likely. And I know I'm dreaming here, but I would consider a company selling my personal information a data breach. Let's formalize that into law. The less people who have information on me, the less likely it is that someone will make use of that information in unethical ways. (Blackmail, identity theft, etc)
We need more H1B's to fix the issue
The first thing they need to do is not run the Department of Homeland Security on Microsoft Windows.