your internet freedom to end sooner than you thought?
Posted: Thu Apr 16, 2009 4:50 am
Cybersecurity law would give feds unprecedented net control
* Track this topic
* Print story
For your own good
By Dan Goodin in San Francisco • Get more from this author
Posted in Security, 1st April 2009 21:45 GMT
Join the Intel seminar. IT has companies talking
US senators have drafted legislation that would give the federal government unprecedented authority over the nation's critical infrastructure, including the power to shut down or limit traffic on private networks during emergencies.
The bill would also establish a broad set of cybersecurity standards that would be imposed on the government and the private sector, including companies that provide software, IT work or other services to networks that are deemed to be critical infrastructure. It would also mandate licenses for all individuals administering to strategically important networks.
The bill, which is being co-sponsored by Senate Commerce Committee chairman John Rockefeller IV and Senator Olympia Snowe, was expected to be referred to a senate committee on Wednesday. Shortly after a working draft of the legislation began circulating, some industry groups lined up to criticize it for giving the government too much control over the internet and the private companies that make it possible.
"This gives the president too much power and there's too little oversight, if there's any at all," said Gregory Nojeim, senior counsel at the Center for Democracy and Technology. "It gives him the power to act in the interest of national security, a vague term that has been broadly defined."
Nojeim was pointing to language in the bill that permits the president to "order the limitation or shutdown of internet traffic to and from any compromised federal government or United States critical infrastructure information system or network" after first declaring a national cybersecurity emergency. A separate provision allows the executive in chief to "order the disconnection of any federal government or United States critical infrastructure information systems or networks in the interest of national security."
"It applies to any critical infrastructure," Nojeim added. "Surely, the internet is one."
The bill would also require NIST, or the National Institute of Standards and Technology, to draft "measurable and auditable cybersecurity standards for all federal government, government contractor, or grantee critical infrastructure information systems and networks." The standards would govern software configuration and security and would apply to vendors, contractors and federal employees who administer nationally vital networks.
Under the legislation, it would also be illegal for employees or contractors providing "cybersecurity services to any federal agency or an information system or network designated by the president, or the president’s designee, as a critical infrastructure information system or network, who is not licensed and certified under the program."
A second bill, also co-sponsored by Rockefeller and Snowe, would establish a national cybersecurity advisor who would report directly to the president. The advisor would serve as the executive branch's lead official on all cyber matters and would coordinate with intelligence officials and civilian agencies. The bill largely codifies recommendations issued in December by more than 60 security experts in government and the private sector.
The Obama administration has outlined a master plan that largely follows those recommendations pending a 60-day review.
The bills are intended to protect a broad range of the nation's infrastructure - including networks for the country's banking industry, utilities, transportation and telecommunications - from cyber attacks.
Few security professionals doubt that critical infrastructure is vulnerable to terrorist sabotage or criminal cyber attacks that could shut down large swaths of the economy. But they also look at the government's track record in defending its own networks and worry the measures could end up making matters worse.
"There's a lot of good stuff in here, but a lot of it is easier said then done," said Tom Parker, director of commercial security services at Alexandria, Virginia-based Securicon. "My concern about the bill in general is around what has not been specified, will be interpreted and implemented. There is a lot of wiggle room in there." ®
http://www.theregister.co.uk/2009/04/01 ... gislation/
WOW, a Rockafeller co-sponsering this shit? GO FIGURE!
* Track this topic
* Print story
For your own good
By Dan Goodin in San Francisco • Get more from this author
Posted in Security, 1st April 2009 21:45 GMT
Join the Intel seminar. IT has companies talking
US senators have drafted legislation that would give the federal government unprecedented authority over the nation's critical infrastructure, including the power to shut down or limit traffic on private networks during emergencies.
The bill would also establish a broad set of cybersecurity standards that would be imposed on the government and the private sector, including companies that provide software, IT work or other services to networks that are deemed to be critical infrastructure. It would also mandate licenses for all individuals administering to strategically important networks.
The bill, which is being co-sponsored by Senate Commerce Committee chairman John Rockefeller IV and Senator Olympia Snowe, was expected to be referred to a senate committee on Wednesday. Shortly after a working draft of the legislation began circulating, some industry groups lined up to criticize it for giving the government too much control over the internet and the private companies that make it possible.
"This gives the president too much power and there's too little oversight, if there's any at all," said Gregory Nojeim, senior counsel at the Center for Democracy and Technology. "It gives him the power to act in the interest of national security, a vague term that has been broadly defined."
Nojeim was pointing to language in the bill that permits the president to "order the limitation or shutdown of internet traffic to and from any compromised federal government or United States critical infrastructure information system or network" after first declaring a national cybersecurity emergency. A separate provision allows the executive in chief to "order the disconnection of any federal government or United States critical infrastructure information systems or networks in the interest of national security."
"It applies to any critical infrastructure," Nojeim added. "Surely, the internet is one."
The bill would also require NIST, or the National Institute of Standards and Technology, to draft "measurable and auditable cybersecurity standards for all federal government, government contractor, or grantee critical infrastructure information systems and networks." The standards would govern software configuration and security and would apply to vendors, contractors and federal employees who administer nationally vital networks.
Under the legislation, it would also be illegal for employees or contractors providing "cybersecurity services to any federal agency or an information system or network designated by the president, or the president’s designee, as a critical infrastructure information system or network, who is not licensed and certified under the program."
A second bill, also co-sponsored by Rockefeller and Snowe, would establish a national cybersecurity advisor who would report directly to the president. The advisor would serve as the executive branch's lead official on all cyber matters and would coordinate with intelligence officials and civilian agencies. The bill largely codifies recommendations issued in December by more than 60 security experts in government and the private sector.
The Obama administration has outlined a master plan that largely follows those recommendations pending a 60-day review.
The bills are intended to protect a broad range of the nation's infrastructure - including networks for the country's banking industry, utilities, transportation and telecommunications - from cyber attacks.
Few security professionals doubt that critical infrastructure is vulnerable to terrorist sabotage or criminal cyber attacks that could shut down large swaths of the economy. But they also look at the government's track record in defending its own networks and worry the measures could end up making matters worse.
"There's a lot of good stuff in here, but a lot of it is easier said then done," said Tom Parker, director of commercial security services at Alexandria, Virginia-based Securicon. "My concern about the bill in general is around what has not been specified, will be interpreted and implemented. There is a lot of wiggle room in there." ®
http://www.theregister.co.uk/2009/04/01 ... gislation/
WOW, a Rockafeller co-sponsering this shit? GO FIGURE!