Slashdot Mirror
Counterterrorism Expert: It's Time To Give Companies Offensive Cybercapabilities
itwbennett writes: Juan Zarate, the former deputy national security advisor for counterterrorism during President George W. Bush's administration says the U.S. government should should consider allowing businesses to develop 'tailored hack-back capabilities,' deputizing them to strike back against cyberattackers. The government could issue cyberwarrants, giving a private company license 'to protect its system, to go and destroy data that's been stolen or maybe even something more aggressive,' Zarate said Monday at a forum on economic and cyberespionage hosted by think tank the Hudson Institute.
I'd expect such nonsense from a former employee of BushCheney Co. Would you also "deputize" a privately held corporation to get some F-16's and go bomb the attackers? It is virtually the same thing. I guess the BushCheney Corporation would have loved that.
Such attacks are attacks on U.S soil, and should therefore be handled by the military, and only the military.
Otherwise, this will create private, corporate owned, corporate sponsored armies. They will be, essentially, corporate warlords.
It's called a "Letter of Marque," and they've been used in places where governments can't enforce their sovereignty for centuries.
It usually doesn't turn out all that well, but may well be better than nothing.
Oh sure, let's trust the people who can't even protect their own networks to properly identify the perpetrators of a hack instead of some innocent bystander running a TOR exit node. I can't see any risks associated with that. No. Not at all... :(
I do not fail; I succeed at finding out what does not work.
Giving private corporations the ability to identify anyone they don't like a "cyberattacker" and then attack them will be very dangerous. Imagine companies pursuing IP related complaints (whether real or imagined) being deputized to go after people and their systems in this manner. There are damn good historical reasons we have a legal system in place -- one of which is to the prevent abuses that vigilante systems foster.
that you are competent enough on the defensive side of things first and we'll talk about it.
When your company can't even be bothered to properly secure our personal information on your servers ( plaintext files . . . really ? ) what sort of insanity is it to even CONSIDER giving these very same folks offensive capabilities ?
It's like giving a shotgun to a monkey and hoping nothing bad comes of it :|
Seriously. . . . wtf ?
There are security models and systems perfected in the 1970s in response to the data processing needs of the air war in Viet Nam. There are commercially available systems which work for multilevel security. This model can be ported to the open source world, if enough people are interested. I'm waiting for the Genode project from Germany to get something I can use in the next few years, and I hope there will be others.
I hereby suggest we just eliminate the possibility of a cyber-war, instead of getting stuck in an arms race.
Let's look at something nobody does, which is look at evidence. OK, I know that sounds like a bad idea .. but anyways .. RIAA, MPAA, and SPA already does this exact same thing. They have ruined lives for no reason. What happens when the company hacks back and causes more damage than what was stolen? We don't let the victims decide punishments. If victims could decide punishment even petty thieves would be murdered. If you think that sort of draconian punishment helps a society, then you probably want to move to Saudi Arabia or ISIS.
Look up "letters of marque and reprisal", and perhaps "privateering", too.
I'm sure it would be used with the same level of integrity as the DMCA is.
"National Security is the chief cause of national insecurity." - Celine's First Law
Only corporations of s certain size will be allowed to do it. Someone with a small business who has no value to the gov will be punished.
by TheSpoom (715771) Uncaring Linux user here. I have nothing to add to this but please continue. *munches popcorn*
It's never been about the possibility of security though.
Since this is Slashdot, I'll explain with a car analogy. Lots of people die in car accidents, and we could easily stop that by doing things like a) Not use cars, b) not let them drive more than 20mph, etc... all sorts of things that would greatly interfere with the way people actually use cars to do stuff. Our cars also used to be a lot less safe too - at one point they didn't even come with seat belts.
As much as I'd love to see proper security implemented, it's just not going to realistically happen. Too many users (customers) don't want the hassles that come with serious security, and too many businesses aren't will to pay the up front costs for it (yet, at least). It's going to take some hard lessons before they start putting on seat belts, air bags, abs breaks, and the equivalents of everything else we've done (and are doing) to make cars safer. The Adama solution, as much as it makes sense from a security standpoint, doesn't take into account the needs of either the people using the stuff, or the people paying for the stuff. We need those people to understand and demand more secure features up front - and even then we're still only talking about reducing things to an acceptable/tolerable level, not eliminating them.
There is no such thing as a cyberweapon. There is hacking/cracking and that is generally done through technical weaknesses and/or social engineering. There is no such thing as a cybertank or a cybergun, something that can actively break through something that it was not intended to go through. There is no software that can simply break through a web server by sheer force.
Using any kind of military jargon with what amounts to a technical capability of a piece of software is (car analogy) like telling us that foreign car mechanics and imported engines are capable of destroying our infrastructure and instead of fixing the engines or building our own to counteract it we have to deploy our own car mechanics and engines to foreign countries.
Using these analogies of cyberweapons with technical experts just sounds like a bunch of military people heard of the printing press and now they want to destroy people with paper cuts.
Custom electronics and digital signage for your business: www.evcircuits.com
This isn't a case of "perfect is the enemy of the better." This is a case of "something is the enemy of nothing" - which means that, in the minds of politicians, doing something is better than doing nothing even if that something is worse than useless. Even if doing the something in question makes matters worse (say, by allowing the RIAA to form a private army to kill "copyright thieves"), it is better than doing nothing as far as the politician is concerned because he can claim "I did something" when re-election comes around.
In related news, this kind of thinking is what led to the TSA "security." Doing "something" about security (everyone has to remove their shoes) trumps taking the time to actually consider risks and benefits.
My sci-fi novel, Ghost Thief, is now available from Amazon.com.
Given that most "cyberattacks" are caused by crappy software, making software companies liable for their bugs looks like a better option to me.
Competitors? You act as it there is actual competition out there. Competition is a myth they use to sell capitalism with. Sure, the car wash place down the street may have competition, but not the multinationals. That's just another illusion they try to maintain.
What they will do is retaliate against whistleblowers and activists. They already look on people who tell the truth about them as terrorists, with the full support of their bought and paid for law enforcement allies.
Don't forget pirates and copyright infringers, whether those people are actually involved in such activity or not. They're already pursuing legislation that would criminalize interfering with their ability to make a profit.
"What the American public doesn't know is what makes them the American public." -Ray Zalinsky (Tommy Boy)