#cybersecurity act

What “Act 2” Would Mean in Practice Europe’s policy direction is clear: fewer silos, more enforceable trust. Conversations about an expanded EU cyber framework—call it a next-phase update to the Cybersecurity Act paired with targeted tweaks to NIS2—aim to reduce overlap, strengthen certification, and make supply-chain assurance less performative and more measurable. Whether or not the final…

New Post has been published on https://www.chiangraitimes.com/thailands-junta-government-defends-controversial-cybersecurity-law.html

Thailand's Junta Government Defends Controversial Cybersecurity Law

BANGKOK – Thailand’s Junta Government The National Legislative Assembly (NLA) on Friday defended a controversial cybersecurity law approved this week, following an outcry from rights groups and internet users over privacy and surveillance concerns.

Thailand’s rubber-stamp parliament approved the Cybersecurity Act unanimously on Thursday, the latest in a wave of new laws in Asia that assert government control over the internet.

Activists have called the legislation “cyber martial law”, saying it would sacrifice privacy and the rule of law, and warning compliance burdens could drive foreign businesses out of Thailand.

The government said the law was intended to protect networks from cyber attacks and would not enable state surveillance or violate rights.

“We have made sure that it would not allow for violation of individuals’ rights and arbitrary use of power,” Ajarin Pattanapanchai, permanent-secretary of the Ministry of Digital Economy and Society, told reporters.

“The law will not be used to regulate social media, or computers or devices belonging to the people.”

But experts argued the vague language of the laws would still allow for broad interpretations of actions authorities could perform, which may end up infringing on rights.

“The scope of the law is so broad, it’s like Big Brother,” Kanathip Thongraweewong, Director of Digital Media Law Institute at Kasembandit University, told Reuters.

Thailand’s military government has pushed for several laws it said would support the digital economy, including an amendment to the Computer Crime Act in 2017, which was intended to prosecute cyber crimes like phishing but has been used to crack down on dissent.

C’è voluto un anno ma, alla fine, Uber ha trovato le “giuste parole” per dichiarare di essere stata oggetto di un attacco hackerche ha sottratto dati personali riguardanti 57 milioni di utenti, tra passeggeri e autisti. Ieri la notizia è balzata su tutte le pagine di giornale, “Uber” è stata la parola più pronunciata, in queste ore, da chi segue il mondo del digital e della trasformazione delle…

This holiday season, Congress quietly gifted a major expansion in digital surveillance to the intelligence community by ratifying a version of the controversial Cybersecurity Information Sharing Act (CISA). This information-sharing legislation has been widely decried by privacy activists, computer scientists, and technology companies for empowering government agents to access massive new datasets under the guise of "cybersecurity." But it wasn’t enough for Congress to pass a standalone version of the bill that the Senate approved in October. Instead, our esteemed legislators snuck this big lump of security-state coal into the major omnibus budget bill that Obama signed into law December 18.

Like the much-maligned PATRIOT Act before it, CISA is the most recent incarnation of a bad idea that Congress has been hung up on for years now. First proposed in 2011 as the Cyber Intelligence Sharing and Protection Act (CISPA), the "information-sharing" policies at the heart of these measures are a not-so-subtle pretext for expanding the feds' ability to access data without a warrant. The government's line goes like this: Information systems in the U.S. are subject to constant and evolving cyberthreats, but organizations are unable to learn from each other’s experiences because sharing information about cyberattacks may expose themselves to lawsuits from customers whose data has been revealed. If intelligence agencies had access to this data, then they could swiftly and efficiently inform the relevant organizations about impending risks, allowing them to better defend themselves.

But the holes in this line of thinking are evident. Numerous information-sharing initiatives already exist within the private sector and federal government. Government agencies have been unable to adequately inform even their own offices about known cyberthreats, so it is extremely unlikely that they will become magically more efficient when tasked with informing the nation as a whole. And computer-security experts dispute that inadequate information-sharing is a core impediment to improving the nation’s cybersecurity. Meanwhile, some of the biggest CISA supporters actively attack the sort of strong encryption techniques that computer scientists advocate to actually improve cybersecurity.

CISA is not a cybersecurity bill at all, really, but a deceptive surveillance measure that will make us less secure.

The version of CISA that made it into the passed omnibus bill was even worse than the standalone versions that were so controversial in the past. It explicitly authorizes agencies to use data gathered under the guise of "cybersecurity" to prosecute individuals for unrelated crimes involving things like terrorism and intellectual-property violations. And the final text was stripped of the few privacy clauses won by civil liberties-minded legislators, such as a requirement that corporations and agencies do their best to scrub and anonymize the shared data. The final version contains no such meager measures.

What’s worse, we will have no way of knowing whether our data has been shared by corporations or federal agencies because such information is immune from FOIA requests. And even if we could, we would lack any legal recourse against parties who improperly share our data.

Then there’s the new data portal that CISA creates. The Department of Homeland Security (DHS) is authorized to share information gathered through CISA with intelligence agencies like the FBI and the National Security Agency (NSA), provided that it first scrubs the data of any "personally identifiable information" such as names, addresses, or financial information. But CISA also authorizes the president to create a separate data portal for intelligence agencies if the DHS system is "flawed"—which, given the DHS’s history of subpar data management, is very likely to occur.

Many have compared the scale of expanded surveillance that CISA authorizes with the controversial PATRIOT Act of the post-9/11 period. Just as 9/11 terrorists were used to falsely justify bulk metadata collection, today’s hackers are used to falsely justify bulk cyberthreat sharing. And as with the PATRIOT Act, legislators were given almost no time to read the hairy details before voting a new digital security state into law. Rep. Justin Amash (R-Mich.) reports that a handful of legislators drafted the final CISA text behind closed doors just hours before the vote with little to no real debate.

But say what you will about the PATRIOT Act—at least Congress was forthright about the expansion of surveillance and curtailment of civil liberties that it would entail. In the case of CISA, legislators snuck in a massive expansion of surveillance as a footnote to a major spending bill. While legislators who voted for the PATRIOT Act were at least aware of the magnitude of the changes that they authorized, it’s likely that many in Congress were unaware of the CISA provisions in the omnibus bill at all, much less understood the new digital spying regime that they covertly create.

It appears as though the Cybersecurity Information Sharing Act (CISA), a.k.a. the Cybersecurity Act of 2015, is going to survive negotiations to pass the omnibus, at least for now.

To refresh memories from yesterday, CISA encourages businesses to share customer data with federal agencies in the event of cyberattacks in order to assist with or improve cybersecurity. In exchange, businesses who participate are granted immunity from lawsuits from customers for breaches. That's a plum deal for the businesses, but privacy and tech activists warned that it's a loss for customers and that it probably is unlikely to actually improve cybersecurity. Even further, though the law as promoted as a way to fight against cyberattacks and terrorism, the wording also permits using the data gathered by the government to investigate and prosecute other crimes that have nothing to do with either of these categories.

This legislation has been shoved into the 2,000-page omnibus "must pass" spending bill, much to the concern of privacy advocates on both the left and the right. The conservative House Freedom Caucus, not happy with many parts of the omnibus, proposed a bunch of amendments. They wanted to add the House bill that toughened vetting of refugees from Syrian and Iraq. They also wanted to stop funding for some Obama administration mining regulations and add some other riders related to abortion written by the Pro-Life Caucus. And they wanted to strip out the Cybersecurity Act of 2015.

But they failed. Yesterday evening the Rules Committee rejected all of the amendments from the Freedom Caucus. From The Hill:

The Rules panel's decision to leave the bipartisan omnibus largely unchanged clears the way for the bill to pass the House on Friday. The lower chamber is expected to pass a major tax package on Thursday that had been negotiated alongside the spending bill.

Both bills are expected to clear the Senate and be signed into law by President Obama.

Lodged toward the bottom of the 2000-plus page, $1.1 trillion omnibus spending bill is the Cybersecurity Act of 2015 (it starts on page 1,728 here if you're feeling like a masochist). This is what has come of the Cybersecurity Information Sharing Act (CISA), the controversial (in tech quarters where people are paying attention anyway) legislation that encourages private businesses to share customer data with the federal government in exchange for liability from lawsuits in the case of data breaches, all under the guise of fighting cybercrime.

The controversy is that this alleged cybersecurity legislation actually appears to be a new form of authorization for surveillance. Experts say it won't actually improve cybersecurity at all (partly because the federal government has a poor reputation for handling such data), and major tech companies like Apple, Google, and Twitter oppose it.

But here it is, being shoved into a "must pass" bill, escorted in by new Majority Leader Paul Ryan (R-Wisc.). Evan Greer, campaign director of Fight for the Future, an activist group fighting the passage of CISA-style privacy-threatening Internet regulations, has a dim view of the legislation.

"There's been a bunch of negative changes to the bill over the last couple of weeks," Greer says. "It went from something that was supposed to be a cybersecurity bill and has become a surveillance bill. It has even become a mass incarceration bill. … They'll be able to investigate, prosecute and jail people for a wide variety of offenses that having nothing to do with cybersecurity and terrorism."

I noted last week the problems with some of the privacy components being stripped out. What privacy advocates want is for the Department of Homeland Security (DHS) to handle making sure identifiable information gets redacted from information before it gets disseminated to organizations like the NSA. Why does it matter? Greer explained that the DHS, as a "civilian" organization has stricter rules about protecting private information than the NSA. Here's how TechDirt describes the weakening of the already weak CISA privacy protections:

Removes the prohibition on information being shared with the NSA, allowing it to be shared directly with NSA (and DOD), rather than first having to go through DHS. While DHS isn't necessarily wonderful, it's a lot better than NSA. And, of course, if this were truly about cybersecurity, not surveillance, DHS makes a lot more sense than NSA.

Directly removes the restrictions on using this information for "surveillance" activities. You can't get much more direct than that, right?

Removes limitations that government can only use this information for cybersecurity purposes and allows it to be used to go after any other criminal activity as well. Obviously, this then creates tremendous incentives to push for greater and greater information collection, which clearly will be abused. We've just seen how the DEA has regularly abused its powers to collect info. You think agencies like the DEA and others won't make use of CISA too?

Removes the requirement to "scrub" personal information unrelated to a cybersecurity threat before sharing that information. This was the key point that everyone kept making about why the information should go to DHS first -- where DHS would be in charge of this "scrub". The "scrub" process was a bit exaggerated in the first place, but it was at leastsomething of a privacy protection. However, it appears that the final version being pushed removes the scrub requirement (along with the requirement to go to DHS) and instead leaves the question of scrubbing to the "discretion" of whichever agency gets the information. Guess how that's going to go?

A handful of privacy-oriented legislators from both parties, Rep. Justin Amash (R-Mich.), Rep. Zoe Lofgren (D-Calif.), Rep. Jared Polis (D-Colo.) and Rep. Ted Poe (R-Texas), sent a letter to other legislators expressing concerns about privacy protections being stripped out.

In response, Rep. Adam Schiff (D-Calif.) a supporter of CISA, sent out a letter decrying some of the privacy fears as myths. Of course, since the 2,000-page Omnibus just dropped late last night, legislators and lawyers are going to have to go through the bill with a fine-tooth comb and try to figure out what actual privacy protections are real and what is simply smoke and mirrors.

Despite the White House's threats of vetoing predecessors to CISA, new information seems to show the Obama administration wanting to use CISA for other forms of law enforcement besides cybersecurity and wants to make sure the NSA and Department of Defense may still have access to the information from private companies through other agreements outside CISA. The memo (read here, courtesy of Dustin Volz of Reuters) says at one point, "The final bill should track the Administration's proposal and allow for limited, specific law enforcement use of cyber threat information for non-cybersecurity purposes."

That concept did indeed make it into the final draft of the bill included in the omnibus. Here's a list of the non-cybersecurity, non-terrorism-related purposes the government would be able to use the information they gather from the Cybersecurity Act of 2015:

Any "specific" threat of serious bodily harm or serious economic harm. This includes terrorist acts but is not specific only to terrorism.

Investigating, preventing, or prosecuting any specific threat to a minor, including "sexual exploitation" and threats to physical safety.

Investigating some types of fraud and identity theft.

Investigating offenses related to espionage.

Investigating offenses related to protections of trade secrets.

Those are some pretty big loopholes in using the information domestically to track Americans for reasons that have absolutely nothing to do with fighting terrorism.

By Thomas Rid, Foreign Policy, March 13, 2013 The White House likes a bit of threat. In his State of the Union address, Barack Obama wanted to nudge Congress yet again into passing meaningful legislation. The president emphasized that America's enemies are "seeking the ability to sabotage our power grid, our financial institutions, and our air traffic control systems." After two failed attempts to pass a cybersecurity act in the past two years, he added swiftly: "We cannot look back years from now and wonder why we did nothing in the face of real threats to our security and our economy." Fair enough. A bit of threat to prompt needed action is one thing. Fear-mongering is something else: counterproductive. Yet too many a participant in the cybersecurity debate reckons that puffery pays off.

The Pentagon, no doubt, is the master of razzmatazz. Leon Panetta set the tone by warning again and again of an impending "cyber Pearl Harbor." Just before he left the Pentagon, the Defense Science Board delivered a remarkable report, Resilient Military Systems and the Advanced Cyber Threat. The paper seemed obsessed with making yet more drastic historical comparisons: "The cyber threat is serious," the task force wrote, "with potential consequences similar to the nuclear threat of the Cold War." The manifestations of an all-out nuclear war would be different from cyberattack, the Pentagon scientists helpfully acknowledged. But then they added, gravely, that "in the end, the existential impact on the United States is the same."

A reminder is in order: The world has yet to witness a single casualty, let alone fatality, as a result of a computer attack. Such statements are a plain insult to survivors of Hiroshima. Some sections of the Pentagon document offer such eye-wateringly shoddy analysis that they would not have passed as an MA dissertation in a self-respecting political science department. But in the current debate it seemed to make sense. After all a bit of fear helps to claim--or keep--scarce resources when austerity and cutting seems out-of-control. The report recommended allocating the stout sum of $2.5 billion for its top two priorities alone, protecting nuclear weapons against cyberattacks and determining the mix of weapons necessary to punish all-out cyber-aggressors.

Then there are private computer security companies. Such firms, naturally, are keen to pocket some of the government's money earmarked for cybersecurity. And hype is the means to that end. Mandiant's much-noted report linking a coordinated and coherent campaign of espionage attacks dubbed Advanced Persistent Threat 1, or "APT1," to a unit of the Chinese military is a case in point: The firm offered far more details on attributing attacks to the Chinese than the intelligence community has ever done, and the company should be commended for making the report public. But instead of using cocky and over-confident language, Mandiant's analysts should have used Words of Estimative Probability, as professional intelligence analysts would have done.

An example is the report's conclusion, which describes APT1's work: "Although they control systems in dozens of countries, their attacks originate from four large networks in Shanghai--two of which are allocated directly to the Pudong New Area," the report found. Unit 61398 of the People's Liberation Army is also in Pudong. Therefore, Mandiant's computer security specialists concluded, the two were identical: "Given the mission, resourcing, and location of PLA Unit 61398, we conclude that PLA Unit 61398 is APT1." But the report conspicuously does not mention that Pudong is not a small neighborhood ("right outside of Unit 61398's gates") but in fact a vast city landscape twice the size of Chicago. Mandiant's report was useful and many attacks indeed originate in China. But the company should have been more careful in its overall assessment of the available evidence, as the computer security expert Jeffrey Carr and others have pointed out. The firm made it too easy for Beijing to dismiss the report. My class in cybersecurity at King's College London started poking holes into the report after 15 minutes of red-teaming it--the New York Times didn't.

Which leads to the next point: The media want to sell copy through threat inflation. "In Cyberspace, New Cold War," the headline writers at the Times intoned in late February. "The U.S. is not ready for a cyberwar," shrieked the Washington Post earlier this week. Instead of calling out the above-mentioned Pentagon report, the paper actually published two supportive articles on it and pointed out that a major offensive cyber capability now seemed essential "in a world awash in cyber-espionage, theft and disruption." The Post should have reminded its readers that the only military-style cyberattack that has actually created physical damage--Stuxnet--was actually executed by the United States government. The Times, likewise, should have asked tough questions and pointed to some of the evidential problems in the Mandiant report; instead, it published what appeared like an elegant press release for the firm. On issues of cybersecurity, the nation's fiercest watchdogs too often look like hand-tame puppies eager to lap up stories from private firms as well as anonymous sources in the security establishment.

Finally, the intelligence community tags along with the hype because the NSA and CIA are still traumatized by missing 9/11. Missing a "cyber 9/11" would be truly catastrophic for America's spies, so erring on the side of caution seems the rational choice. Yes, Director of National Intelligence James Clapper's recent testimony was more nuanced than reported and toned down the threat of a very serious cyberattack. But at the same time America's top spies are not as forthcoming with more detailed information as they could be. We know that the intelligence community, especially in the United States, has far better information, better sources, better expertise, and better analysts than private companies like Symantec, McAfee, and Kaspersky Lab. But for a number of reasons they keep their findings and their analysis classified. This means that the quality of the public debate suffers, as experts as well as journalists have no choice but to rely on industry reports of sometimes questionable quality or anonymous informants whose veracity is hard to assess.

The tragedy is that Obama actually has it right: Something needs to be done, urgently. But Washington's high-octane mix of profiteering, protectiveness, and politics is sadly counterproductive for four reasons:

First, the hype actually makes it harder to focus on crucial engineering details. Security standards in industrial control systems and SCADA networks--the networks that control stuff that physically moves around, from trains to gas to elevators--are shockingly low. The so-called Programmable Logic Controllers widely used in critical infrastructure are designed to be safe and reliable in tough factory-floor conditions and harsh weather, not secure against outside attack. This year's S4-conference in Miami Beach, organized by the small and specialized security outfit Digital Bond, again showcased how vulnerable these systems are. But Washington is too busy screaming havoc and too ill-informed to do something meaningful about concrete engineering issues. Just sharing information, as the inspector general of the Department of Homeland Security recommended in a report last month, is useful but it will not deliver security. Connecting critical infrastructure that was never designed to be linked to the Internet is also not the root of the problem--the built-in security flaws and fragility of these systems needs to be fixed, as Digital Bond's Dale Peterson pointed out last week in response to the timid DHS report. The political dynamic behind this logic is clear: The more is declared critical, the harder it becomes to act on the really critical.

Second, the hype clouds badly needed visibility. A fascinating project at Free University Berlin has produced a vulnerability map. The map uses publicly available data from Shodan, the Google for control system hackers, and adds a layer of information crawled from the web to geo-locate the systems that often should not be connected to the Internet in the first place. Red dots on the map show those systems. The United States looks as if it has the measles. But note that the map is incomplete: It is biased towards German products, the project's founder told me. If that flaw can be fixed, the United States and other countries would look as bloody red as Germany does already. The U.S. government's attention-absorbing emphasis on offensive capabilities means it has very little visibility into what this vulnerability map would actually look like.

Third, sabotage and espionage are rather different things--technically as well as politically. SCADA systems are highly specific kit, often old and patched together over years, if not decades. That means these systems are highly specific targets, not generic ones. Affecting critical operations requires reprogramming these systems, not just disrupting them; the goal is modifying output parameters in a subtle way that serves the saboteur's purpose. With Stuxnet, the U.S. government provided the--so far--most extreme and best-documented case study. The operation showed that successful sabotage that goes beyond just deleting data is far more difficult than successful espionage: It requires testing and fine-tuning an attack over many iterations in a lab environment, as well as acquiring highly specific and hard-to-get target intelligence. Stealing large volumes of intellectual property from a commercial competitor, by contrast, is a technically rather different operation--there is little to no valuable IP hidden inside control systems. To put it bluntly: China and others have a high commercial incentive to steal stuff, but they have no commercial incentive to break stuff. All threats are not created equal. What's needed is nuance, surgical precision, differentiation, and sober analysis--not funk, flap, and fluster.

Finally, hype favors the offense over the defense. The offense is already sexier than the defense. Many software engineers who consider a career in public administration want to head north to the dark cubicle at Fort Meade, not bore themselves in the Department of Homeland Security--if they are not working happily in the Googleplex on bouncing rubber balls already. If the NSA sucks up most of the available talent and skill and puts it to work on the offense, the defense will continue to suffer. By overstating the threat, and by lumping separate issues into one big bad problem, the administration also inadvertently increases the resistance of powerful business interests against a regulatory over-reaction.

August 4, 2012. Washington. Like a number of Congressional Bills before it, the Cybersecurity Act of 2012 was defeated this week by a narrow margin. Democrats left President Obama and Senate President Harry Reid (D-NV) to vote with the Republicans to block the Act in the Democrat-controlled chamber. This marked the second time in recent weeks where Democrats crossed the aisle to aid Republicans taking a libertarian stand.