CISA stalled
The Senate has pushed back on the controversial Cybersecurity Information Sharing Act (CISA), with the Republicans leading a strategic revolt that has ensure that the Bill wont get a reading until September at the earliest.
Controversial surveillance legislation endorsed by the White House won’t breeze through the US Senate as quickly as its proponents wanted: after a revolt led by Republicans the body won’t address Cybersecurity Information Sharing Act (Cisa) until after its summer recess.

The move prompted praise of GOP leadership from Oregon Democratic senator Ron Wyden. “Once again, those who value Americans’ privacy more than political expediency have made sure this harmful, misguided bill won’t sail through the Senate without meaningful debate,” Wyden said. “The Republican leadership’s decision to put off a vote on Cisa indefinitely gives us more time to mobilize against this cyber-surveillance bill and to persuade Congress to take up legislation that will actually improve Americans’ security, while also protecting their privacy.”

With the delay, as with most activity in the Senate, there is horse-trading: Democrats will now get a limited number of 11 amendments to the bill. Republicans will have 10.

Cisa would allow everyone from banks to data brokers to Facebook to secretly share the information of private citizens with the federal government in a move the bill’s proponents have characterized as a tradeoff for greater security.

But the approach comes at the cost of defense, said Dan Kaminsky, co-founder of cybersecurity firm White Ops and keynote speaker at Black Hat, the annual conference of information security experts happening in Las Vegas this week.

“My feeling is that all of this stuff is really a distraction,” said Kaminsky. The government’s focus on collecting the data of people who might be hackers and testing established problems diverts valuable resources from fixing those problems and keeping hackers out, he said.

“There’s only so much oxygen,” said Kaminsky. “The dual approach of ‘Let’s hack more things’ and ‘Let’s analyze more data’ is a distraction from ‘Let’s build secure systems’. We need funding and attention on that. We need people working on systems that don’t leak data. I don’t know how else to say it. People are saying: ‘Things are on fire – let’s get better cameras to take photos of it!’ No, let’s put out the fire.”

The bill continues to meet with opposition: its co-sponsor, North Carolina Republican senator Richard Burr, said the Senate might not be able to vote on the bill before its summer recess, as planned. “Cybersecurity is an important national security issue and the Senate should take up this bill as soon as possible and pass it,” said a White House official earlier this week.

Lauren Weinstein, co-founder of Privacy Forum, pointed out that after a series of high-profile failures, the federal government’s data security track record could use some work before the public hands over vast quantities of personal information. Cisa, he said, doesn’t address the way the data would be handled as rigorously as necessary.

“Details are absolutely crucial especially when it comes to the sordid history the federal government has had protecting the kind of stuff you’d expect them to protect,” Weinstein said. “I mean, how many examples do you need to have of the basic inability of the government to protect what you’d think would be the most sensitive information out there? We had a young guy clean out NSA with a thumb drive. Then they say they’re going to ask for all this additional information and we’re supposed to believe they’re going to protect that.”



Hackers, said Weinstein, are easy to misidentify by nature. “The whole structure of cyber-attacks is that you never know where they’re coming from,” he said. “We’re still largely at a point where it’s hard to tell if a particular cyberattack is a result of a state-sponsored military operation or a 13-year-old in a basement in Cleveland.”

Collecting the browsing data of of every teenager in Cleveland would seem to be the wrong solution, but Steve Ward, of security company iSight Partners, said that knowledge of multiple cyber-attacks is sometimes the best way to determine who exactly is behind any one of them. “One thing that can often help us ... would be the source of domains used in attacks,” Ward said. “You see a specific email address connected to six different server infrastructures. You see that in one attack and then you see it another, and then you know you’ve got a single adversary that’s hitting, say, oil, gas, and healthcare.”

Of course, that’s the problem in a nutshell: Hackers – perhaps nation-states, perhaps individuals – have stolen troves of info from the US government’s Office of Personnel Management, schematics for the F-35 fighter jet from Lockheed-Martin, and sundry credit card numbers from Target customers, PlayStation users and many others, often posted on easy-to-find blogs that simply list one set of personal data after another.



Dave Levine, a fellow at Princeton’s Center for Information Technology Policy, said that information-sharing is hard to improve, given the reticence of companies to share (or admit the existence of) trade secrets. A major trouble with Cisa is “the interest in government in trying to solve problems that do not have much of a legal solution”, Levine said. “It’s better for the government to encourage the private sector to be more robust in increasing cybersecurity standards within corporations.”

Both Levine and Kaminsky praised US government efforts to make networks harder to break into. Levine noted a recent push by federal agencies for multifactor authentication during the White House’s “cyber sprint”; Kaminsky said government agencies had been “a lantern in the darkness” when the National Institute of Standards and Technology developed standards to avoid “cache poisoning attack” – better known (after its discoverer) as the Kaminsky Bug.

Kaminsky said the solution must be to make more secure systems. “We’re not gonna hack our way into networks that can’t be hacked, we’re not gonna get leaks from networks that leak less,” he said. “The government’s role is not to be the biggest, baddest hacker in the room.”

Those networks, he said, may need to be built by government employees, because there’s not sufficient profit motive for the public sector to generate them quickly enough for Kaminsky’s taste. “When does someone ever tell you there’s not enough bureaucracy?” he sighed. “But there’s no a bureaucracy that’s focused on making more secure technology. Wouldn’t it be nice if there was some sort of department? Of defense?”



Even Ward, who is much more enthusiastic about information sharing that Kaminsky, said that the wide variety of information supplied by so many different companies covered by Cisa means that cross-referencing becomes very difficult. “Let’s say Cisa passed,” said Ward. “Google gives up all their data, Facebook gives up all their data. OK, great! That’s not information, that’s just data.”

Not everybody loves government-sponsored security protocols, but they at least keep citizen data private. “I’d rather have the government running security technology than fighting encryption tooth and nail,” said Kaminsky. “That’s the weirdest thing. We’re in a world that needs more security and we’ve got people saying: ‘Perhaps the internet is too secure!’ Only in DC could that happen.”