Slashdot Mirror
Counterterrorism Expert: It's Time To Give Companies Offensive Cybercapabilities
itwbennett writes: Juan Zarate, the former deputy national security advisor for counterterrorism during President George W. Bush's administration says the U.S. government should should consider allowing businesses to develop 'tailored hack-back capabilities,' deputizing them to strike back against cyberattackers. The government could issue cyberwarrants, giving a private company license 'to protect its system, to go and destroy data that's been stolen or maybe even something more aggressive,' Zarate said Monday at a forum on economic and cyberespionage hosted by think tank the Hudson Institute.
... this isn't going to end well.
I'd expect such nonsense from a former employee of BushCheney Co. Would you also "deputize" a privately held corporation to get some F-16's and go bomb the attackers? It is virtually the same thing. I guess the BushCheney Corporation would have loved that.
Such attacks are attacks on U.S soil, and should therefore be handled by the military, and only the military.
Otherwise, this will create private, corporate owned, corporate sponsored armies. They will be, essentially, corporate warlords.
It's called a "Letter of Marque," and they've been used in places where governments can't enforce their sovereignty for centuries.
It usually doesn't turn out all that well, but may well be better than nothing.
He's accessing vons.com with Chrome and Adblock +, Privacy Badger, and Scriptblock. He's obviously a Chinese terrorist subverting our capitalist ways, reformat his hard drive!
Oh sure, let's trust the people who can't even protect their own networks to properly identify the perpetrators of a hack instead of some innocent bystander running a TOR exit node. I can't see any risks associated with that. No. Not at all... :(
I do not fail; I succeed at finding out what does not work.
Giving private corporations the ability to identify anyone they don't like a "cyberattacker" and then attack them will be very dangerous. Imagine companies pursuing IP related complaints (whether real or imagined) being deputized to go after people and their systems in this manner. There are damn good historical reasons we have a legal system in place -- one of which is to the prevent abuses that vigilante systems foster.
This is a great idea. What on earth could possibly go wrong?!?! Lets give the power hungry, egotistical, anti-social network security "experts" who are in charge of creating the insecure networks the right to use "deadly force" against those they think might be responsible.
I can't wait for the fecal matter to hit the CPU fan when the wrong company is targeted for retaliation er I mean offense.
that you are competent enough on the defensive side of things first and we'll talk about it.
When your company can't even be bothered to properly secure our personal information on your servers ( plaintext files . . . really ? ) what sort of insanity is it to even CONSIDER giving these very same folks offensive capabilities ?
It's like giving a shotgun to a monkey and hoping nothing bad comes of it :|
Seriously. . . . wtf ?
Companies have demonstrated how careful and responsible they are with the DMCA takedowns, so it's only logical that we allow them to go further and actively attack the evil-doers out there.
There are security models and systems perfected in the 1970s in response to the data processing needs of the air war in Viet Nam. There are commercially available systems which work for multilevel security. This model can be ported to the open source world, if enough people are interested. I'm waiting for the Genode project from Germany to get something I can use in the next few years, and I hope there will be others.
I hereby suggest we just eliminate the possibility of a cyber-war, instead of getting stuck in an arms race.
Let's look at something nobody does, which is look at evidence. OK, I know that sounds like a bad idea .. but anyways .. RIAA, MPAA, and SPA already does this exact same thing. They have ruined lives for no reason. What happens when the company hacks back and causes more damage than what was stolen? We don't let the victims decide punishments. If victims could decide punishment even petty thieves would be murdered. If you think that sort of draconian punishment helps a society, then you probably want to move to Saudi Arabia or ISIS.
Look up "letters of marque and reprisal", and perhaps "privateering", too.
I for one plan to change my business card to read Buccaneer instead of Engineer. Being a privateer did not end so badly for all of them.
Nullius in verba
I'm sure it would be used with the same level of integrity as the DMCA is.
"National Security is the chief cause of national insecurity." - Celine's First Law
Only corporations of s certain size will be allowed to do it. Someone with a small business who has no value to the gov will be punished.
by TheSpoom (715771) Uncaring Linux user here. I have nothing to add to this but please continue. *munches popcorn*
It's never been about the possibility of security though.
Since this is Slashdot, I'll explain with a car analogy. Lots of people die in car accidents, and we could easily stop that by doing things like a) Not use cars, b) not let them drive more than 20mph, etc... all sorts of things that would greatly interfere with the way people actually use cars to do stuff. Our cars also used to be a lot less safe too - at one point they didn't even come with seat belts.
As much as I'd love to see proper security implemented, it's just not going to realistically happen. Too many users (customers) don't want the hassles that come with serious security, and too many businesses aren't will to pay the up front costs for it (yet, at least). It's going to take some hard lessons before they start putting on seat belts, air bags, abs breaks, and the equivalents of everything else we've done (and are doing) to make cars safer. The Adama solution, as much as it makes sense from a security standpoint, doesn't take into account the needs of either the people using the stuff, or the people paying for the stuff. We need those people to understand and demand more secure features up front - and even then we're still only talking about reducing things to an acceptable/tolerable level, not eliminating them.
That hasn't worked too well with the NSA. I can't imagine that a private corporation with a financial incentive would be able to restrain themselves from attacking their competetors once they were given the go-ahead to start lashing out when their network gets DDOSd.
There is no such thing as a cyberweapon. There is hacking/cracking and that is generally done through technical weaknesses and/or social engineering. There is no such thing as a cybertank or a cybergun, something that can actively break through something that it was not intended to go through. There is no software that can simply break through a web server by sheer force.
Using any kind of military jargon with what amounts to a technical capability of a piece of software is (car analogy) like telling us that foreign car mechanics and imported engines are capable of destroying our infrastructure and instead of fixing the engines or building our own to counteract it we have to deploy our own car mechanics and engines to foreign countries.
Using these analogies of cyberweapons with technical experts just sounds like a bunch of military people heard of the printing press and now they want to destroy people with paper cuts.
Custom electronics and digital signage for your business: www.evcircuits.com
This isn't a case of "perfect is the enemy of the better." This is a case of "something is the enemy of nothing" - which means that, in the minds of politicians, doing something is better than doing nothing even if that something is worse than useless. Even if doing the something in question makes matters worse (say, by allowing the RIAA to form a private army to kill "copyright thieves"), it is better than doing nothing as far as the politician is concerned because he can claim "I did something" when re-election comes around.
In related news, this kind of thinking is what led to the TSA "security." Doing "something" about security (everyone has to remove their shoes) trumps taking the time to actually consider risks and benefits.
My sci-fi novel, Ghost Thief, is now available from Amazon.com.
Given that most "cyberattacks" are caused by crappy software, making software companies liable for their bugs looks like a better option to me.
It wouldn't last a week before we'd be seeing attacks against competitors.
It's not competitors I'd be worried about but the copyright trolls. Using their interpretation of copyright law practically everyone would be guilty of "stealing" their data in some form or other and so would be open to be hacked "just to check". The truly ironic thing of course is that by acting under a letter of marque they would actually be far more like a pirate than those they accuse.
Competitors? You act as it there is actual competition out there. Competition is a myth they use to sell capitalism with. Sure, the car wash place down the street may have competition, but not the multinationals. That's just another illusion they try to maintain.
What they will do is retaliate against whistleblowers and activists. They already look on people who tell the truth about them as terrorists, with the full support of their bought and paid for law enforcement allies.
Don't forget pirates and copyright infringers, whether those people are actually involved in such activity or not. They're already pursuing legislation that would criminalize interfering with their ability to make a profit.
"What the American public doesn't know is what makes them the American public." -Ray Zalinsky (Tommy Boy)