Skating on Stilts

Dubious proposals for revising the Computer Fraud and Abuse Act

I've just looked at the new proposal for revising the Computer Fraud and Abuse Act (CFAA) offered by Orin Kerr, Jennifer Granick and the EFF. Essentially, they would set a higher threshold for deciding when a hacker has accessed a computer “without authorization,” by requiring that the defendant circumvent a technological barrier that “effectively controls” access.

On first impression, it looks to me like a pretty bad idea, for any number of reasons.

1. First, if this is meant to be “Aaron’s Law,” a cure for the overreaching by federal prosecutors in the Swartz case, it misses the mark. By the time he was through playing cat and mouse with MIT security officers, Swartz was clearly circumventing an effective technological control – unless you define “effective” very strictly, a bad idea I’ll get to in a minute.

2. The EFF proposal doesn’t come from thin air. It’s directly borrowed from the Digital Millennium Copyright Act, which lets copyright holders sue anyone who circumvents technical copy-protection measures, as long as those measures “effectively control access to a work” protected by copyright.

Let’s pause for a moment to consider why the EFF equates the DMCA and the CFAA. On one level it seems obvious. Aaron Swartz was trying to “liberate” IP-protected data in much the same way that, say, the authors of DeCSS sought to “liberate” movies sold from the DVD restrictions set by the studios. EFF wants to borrow the concepts it relied upon in the DMCA cases and use them to defend CFAA cases.

But the CFAA is not primarily about protecting intellectual property. It’s about protecting the security of all kinds of data – national security secrets, privileged client confidences, and the most private personal data stored online by governments, companies, and individuals themselves. Many CFAA defendants, in other words, are egregious privacy violators. So, faced with a choice between protecting privacy and protecting “open data” campaigners, EFF has decided to favor open data over privacy.

Put another way, the EFF isn’t comfortable admitting that there's a threat to privacy except from business and (mainly the U.S.) government. Acknowledging that ordinary people have a stake –- indeed, a privacy stake -– in prosecuting hackers puts too much strain on their worldview. To avoid that strain, though, they’re advocating measures that will actually harm our privacy.

3. That choice might make sense if the only kind of hacking that we faced was a handful of Aaron Swartzes. But in fact, we are in the middle of the worst cybersecurity crisis -– and the most massive loss of data to hackers -– since the dawn of the computer age. It’s an odd time for sophisticated technology observers to propose weakening our computer crime laws.

I recognize that the CFAA has problems, and that it’s been rewritten too often by prosecutors eager to ensure that they can win any case they choose to bring, but in light of the massive increase in cyberespionage, I think that Orin, Jennifer, and the EFF should at least show that their proposal will not interfere with prosecution of the hackers who are currently stealing us blind.

4. They don't make that showing, and I question whether they can. Making criminal liability turn on breach of an “effective technical control” will hamper a lot of legitimate prosecutions, or so it seems to me.

First, I assume that under their proposal the effectiveness of the technical control will be an element of the crime, one that the government must prove beyond a reasonable doubt. That’s a heavy burden, and it makes any ambiguities in the new test very risky for prosecutors.

Second, there’s a problem with the concept of “effective technical control” that resembles the problem of “obviousness” in patent law. Anything that’s been invented starts to look more and more obvious as time goes on. And any technical control that a hacker has successfully bypassed starts to look, well, ineffective. As I remember, groups like EFF argued in the context of the DMCA that encrypting copyrighted material with a 40-bit key was “ineffective” because the encryption could be broken by brute force cryptanalysis.

Do we really want hackers to be able to argue to juries that they can’t be prosecuted for stealing personal data because their victims used too small a key or too obvious a password -- or that their security wasn't proof against Metasploit or some other widely available penetration tool?

5. Do we even want to protect data only if access is effectively controlled by technology?

Let me offer the example of a government database containing passport or drivers’ license data. Because the access that government officials need to this database is not predictable, the system depends principally on a strong audit system to prevent abuse. Everyone who accesses a file is tracked, audited, and monitored for misuse after the fact. Now suppose that a government worker uses these files to settle some personal score and evades the audit system by stealing the login credentials of another worker.

He’s clearly subject to prosecution under today’s CFAA. But under the Kerr- Granick-EFF proposal, the government has to show that its audit system “effectively controls access” to the data. Even putting aside the hindsight problem I described earlier, an audit system doesn’t “control” access in the sense of preventing access; instead, it is designed to identify and punish improper access. It seems to me that even the most abusive access to that data would be hard to prosecute under the revised law.  

UPDATE:  To reflect Orin Kerr's reply to this post on the Volokh Conspiracy, in which he makes clear that he does not support the EFF's"effective control" test.

Anonymous attacks again

Anonymous claims to have struck a blow in Aaron Swartz’s memory.  It has hacked the website of the US Sentencing Commission and posted a long manifesto and a group of files named after Supreme Court Justices.  The manifesto suggests that the files contain embarrassing secrets and declares that the secrets will be revealed in installments unless Congress adopts sentencing and computer crime changes.

Exactly what the files contain the screed leaves uncertain: "The contents are various and we won't ruin the speculation by revealing them. Suffice it to say, everyone has secrets, and some things are not meant to be public.”

It’s possible that this is an elaborate publicity ploy.  The manifesto’s authors don’t exactly say they have information stolen from Supreme Court justices.  And they are careful to suggest that if investigators find no sign of intrusion, well, that’s just proof that Anonymous is “far more ambitious, and far more capable” than investigators think: “Over the last two weeks we have wound down this operation, removed all traces of leakware from the compromised systems, and taken down the injection apparatus used to detect and exploit vulnerable machines.”  So this might be a big deal, or, having made a media splash out of simple website defacement, the hackers may announce in two weeks that all they wanted to do was cause a frenzy of investigative activity without actually hacking any Justice’s computer.

In the meantime, though, the episode is likely to sully Aaron Swartz’s memory. Swartz was egregiously overcharged, but there isn’t much doubt that he violated the Computer Fraud and Abuse Act.  We see the charges as unfair because Swartz’s “liberation” of data was motivated by a commitment to open data and not by any criminal intent.  Now comes Anonymous, claiming to be liberating data in Swartz’s name but doing so with unquestionably criminal intent -- to extort policy changes and to cause pain to government officials for their views and actions.

The exploit is probably counterproductive too.  Apart from turning those who want reform of computer crime law into the allies of lawbreakers, Anonymous has substantively hurt the case for amending the CFAA. Heavy criminal penalties are entirely appropriate for people who hack a Supreme Court Justice’s account and disclose personal secrets. But it’s not easy to redraft the CFAA so it reflects the difference between Swartz and the Anonymous hackers, at least not without relying on precisely the prosecutorial discretion that the Swartz prosecutors misused.

Finally, I wonder if this incident won’t affect the Supreme Court’s approach to cybercrime issues.  As Frank Rizzo once said, a conservative is a liberal who’s been mugged.  If that’s true, every time Anonymous mugs one of the Justices in cyberspace, it could be making the Court just a little less enthusiastic about limiting the tools the government uses to deter computer crime.

PHOTO: Victor Diamante

 

Iran Attacks US Banks; Privacy Groups Attack ... NSA?

The denial of service attacks now afflicting American banks are widely attributed to Iran. They’ve grown so serious that US banks have asked the National Security Agency for help.

That has provoked the usual response from privacy advocates.  Faced with a serious threat to the security of our online banking accounts, they are happy to tell us who we should really be worried about: “’The dual mission of the NSA, to promote security and to pursue surveillance, creates an intractable privacy problem,’ said Marc Rotenberg, executive director of the Electronic Privacy Information Center.” 

I’m more interested in the actual, uh, attacker. Assuming it’s Iran, as I do, what do these attacks mean?  One thing is sure, they’re the opposite of the cyber Pearl Harbor everyone’s talked about. Unless Adm. Yamamoto called up the Navy on December 7, 1941, and said, “We’ll be attacking Pearl Harbor for an hour and then the Philippines for an hour, but only on Tuesdays, Wednesdays, and Thursdays.” Because that’s pretty much how the bank attacks are going – short duration, scheduled disruptions.

That raises a couple of questions.  First, why would a country launch such a limited attack?  It could be a demonstration designed to show capability without actually provoking a response -- sort of like sending an aircraft carrier to a trouble spot but staying in international waters.  Indeed, some of the details of these DDOS attacks do show surprising sophistication, and there’s no doubt the actual impact of the attacks could be greatly ramped up if the attacker wanted to. Second, if that’s the case, the best response would be to demonstrate that our defense can counter the attacker’s offense – sort of like surfacing an undetected submarine alongside the carrier.

So, how are we doing at showing our defensive strength?  Not so good, I’m afraid.  The attacks persist, and we don’t seem to have a simple way to nullify them.  That’s pretty troubling from a security point of view, particularly if you believe as I do that denial of service attacks are the least dangerous form of cyberattack.  If we can’t defend against scheduled, short-duration, denial of service attacks, our vulnerability to other attacks is even more worrisome.

Which brings me to a third point: If these are Iranian attacks, Iran is probably doing us a favor.  It’s teaching us some important lessons, exposing the weakness of our defenses in dramatic form without actually destroying any infrastructure or causing serious harm.  It’s also revealing the weird priorities of the privacy groups, which seem to hate parts of our government more than Iran’s, even when they’re faced with an actual Iranian attack. And it’s giving us a kind of live-fire exercise in which to practice our cyberdefenses until we find something that works.  With enough time, maybe we’ll find a way to get our planes in the air, our ships out to sea, and our anti-aircraft guns unlimbered before a second wave of planes appears in the sky.

An Internet of Things ... That Hate Us

Turns out that hackers can use Cisco phones to monitor our communications, says Sal Stolfo of Columbia University, and Cisco evidently has taken its own sweet time to fix the problem.

And the FAA's fancy new NextGen traffic control system will allow hackers with $1000 worth of equipment to send fake GPS signals to commercial planes, says Paul Rosenzweig of Red Branch Consulting. That would apparently be enough to get the planes to land in unexpected places. Like the Capitol.

Computer Security: When Seconds Count, the FBI is Years Behind

Ellen Nakashima of the Washington Post has another ground-breaking article on novel approaches to network defense. I've blogged before about honey tokens, deceptive files that leave hackers with false data while flagging the intrusion to defenders.  Nakashima's article suggests that their use is growing, as other defensive techniques prove ineffective:

Brown Printing Co.,...began planting fake data in Web servers to lure hackers into “rabbit holes” in the hopes of frustrating them into giving up. The bait was varied — including bogus user log-ins and passwords and phony system configuration files. Anyone who took it was being watched by Brown, their computer locations tagged and their tactics recorded.

“We’re taking the hackers’ strengths and we’re making it their weaknesses,” said Nathan Hosper, a senior information technology officer at Brown. “They get caught up in this cycle of fake information.”

So far, so good.  What's sad is the FBI's reaction, which will be familiar to those who know how big city police departments view homeowners who use guns to defend themselves:

U.S. officials and many security experts caution companies against taking certain steps, such as reaching into a person’s computer to delete stolen data or shutting down third-party servers.

Those actions probably would violate federal law, FBI officials said. The bureau also warns that the use of deceptive tactics could backfire — hackers who identify data as bogus may be all the more determined to target the company trying to con them.

Actually, I'm being too kind to the FBI.  If you call 911 to report a home invasion, at least the police will send someone to your house who is armed and ready to take on the intruder. (Whether they'll arrive in time is a different question, leading to the familiar saying, "When seconds count, the police are just minutes away.")  

If you call the FBI to report a network intrusion, though, you'll get a stifled yawn and a request to meet with your CEO for relationship building purposes. Given the government's feeble capabilities against cyberespionage, discouraging corporate self-help is particularly irresponsible.

Not everything the bureau said was wrong. Shutting down third party servers probably is illegal under the Computer Fraud and Abuse Act. In contrast, I doubt that companies are acting unlawfully when they delete their own files from a hackers' computer, though I recognize that Orin Kerr has a different view, and the Justice Department may be closer to Orin than to me on this. 

But I don't know anyone who thinks that it violates federal law to deploy honeytokens on your own network.  So when FBI officials caution that using deceptive files that way could make you more of a target, they aren't giving legal advice.  They're giving "leave it to the FBI" advice, in a field where leaving it to the FBI is a recipe for failure. 

Also, I suspect they're talking through their, uh, hats. In what way will deploying fake files "backfire"?  OK, fake files may not work forever; the hackers may come back and look harder for the real stuff, but is that really a reason not to deploy them? 

Let's perform a thought experiment: In option A, you don't use fake files, so bad guys who break into your network steal your data.  In option B, you do deploy fake files, so the bad guys steal bad data, and you find out that you're a target whose current security isn't sufficient. After that, either the bad guys are fooled by the bad data and they waste time and money acting on it, or they figure out that it's bad data and they have to go back and find the real data on a system that you've had time to harden. And the FBI thinks that option B is the one that might "backfire"?

(I recognize that it's also possible that the hackers will get mad about being fooled and will destroy files or take other retaliatory actions that they wouldn't take if they got the good stuff right away.  But I'm skeptical. First, that's a big escalation in tactics that we haven't seen yet from cyberspies, probably for good reason. Second, that would be astonishing advice from a law enforcement ageny, the equivalent of:  "Better let these criminals steal you blind; otherwise they might burn down the store" or  "Cooperate with hijackers so they don't have to kill any hostages" or "Resisting a rapist will only get you beaten, stabbed or shot." If that's the FBI's official position on cybercrime, it means they've oficially given up.)