Skating on Stilts

Hmmm...

Two straws in the wind for the Snowden flap:

1. When Silicon Valley corporate leaders are grilled over their view NSA by an outraged Michael Arrington, he uncovers a remarkably diverse set of views and ends up complaining, ”I’m not getting anyone to care so far on stage.”

2. When Joseph Menn of Reuters does a deep dive to calculate Snowden-related losses suffered by US companies he finds ... nada:

Despite emphatic predictions of waning business prospects, some of the big Internet companies that the former National Security Agency contractor showed to be closely involved in gathering data on people overseas - such as Google Inc. and Facebook Inc. - say privately that they have felt little if any impact on their businesses.

Insiders at companies that offer remote computing services known as cloud computing, including Amazon and Microsoft Corp, also say they are seeing no fallout.

UPDATE: Fixed link; thanks, Jeffrey!

Surprise! Tor Privacy Technology Mainly Helps Botnets

According to the MIT Technology Review, a short-lived security flaw in the anonymousTor network allowed researchers to analyze and categorize the traffic that Tor was protecting.  The results weren't pretty:  

The Tor network is an online service that allows users to surf the web anonymously. Its main benefit is to reduce the chances of network surveillance discovering a user’s location or web usage. For that reason it is championed as an important tool for promoting free speech and protecting personal privacy, especially for people under authoritarian regimes such as that in China.

However, Tor is also often criticised for carrying illegal, shady or controversial content such as pornography and “Silk Road” traffic for illegal goods. So an interesting question is what kind of traffic prevails?

Today, we get an answer thanks to the work of Alex Biryukov, Ivan Pustogarov and Ralf-Philipp Weinmann at the University of Luxembourg. And the results are not as eye-sparklingly freedom-protecting as you might imagine.

These guys conclude that the Tor network is dominated by botnet traffic and that much of the rest is adult content and traffic related to black market and illegal goods.

First up, if Tor is so anonymous, how did these guys get their data? It turns out that until recently, the Tor protocol contained a flaw that allowed anybody in the know to track users back to their origin.

This flaw was actually discovered by Biryukov, Pustogarov and Weinmann earlier this year and immediately corrected by Tor. However, before the flaw became public, these guys took the opportunity to analyse Tor traffic to see where it came from and what it contained.

Of the top twenty most popular Tor addresses, eleven are command and control centres for botnets, including all of the top five. Of the rest, five carry adult content, one is for Bitcoin mining and one is the Silk Road marketplace. Two could not be classified.

The FreedomHosting address is only the 27th most popular address while DuckDuckGo is the 157th most popular, according to this analysis.

 PHOTO credit: Will Swan

 

Video of Stewart Baker's Recent Cyberespionage Speeches

I've been giving speeches lately on cyberespionage, the attribution revolution, and how it helps corporate boards and general counsels to think about the cybersecurity problem without trying to do the Chief Information Security Officer's job.  Video of a recent speech is embedded below:

 

Another version of this speech can be found here. And a somewhat more law-focused follow-on is here.

FISA: The Uncanny Valley of Article III?

I'm still working my way through all the FISA court material that was declassified today, and acquiring a new appreciation for how hard a journalist's job can be. But I've gotten far enough to start worrying, seriously, about the role we've given to the FISA court and what it does to the court and NSA.  

There's an old saying that megalomania is an occupational hazard for district court judges.  While Chief Judge Walton's opinion doesn't quite succumb to megalomania, there is a distinct lack of perspective in his approach that makes me wonder whether the FISA job slowly distorts a judge's perspective in unhealthy ways.  

That was certainly true of Judge Lamberth, who spent most of 2001 persecuting a well-regarded FBI agent for not observing the "wall" between law enforcement and intelligence.  That's the wall that the court of appeals found to be utterly without a basis in law but that Chief Judge Lamberth nonetheless enforced with an iron hand.  Judge Lamberth forced FISA applicants to swear an oath that they were observing the wall, a tactic that allowed him to sanction the applicants for misrepresentation if they didn't live up to his expectations.  He was so aggressive in this pursuit that he had sidelined the most effective FBI counterterrorism teams in August of 2001.  The bureau knew by then that al Qaeda had terrorists in the United States but it couldn't use its best assets to find them them because Judge Lamberth had made it clear that he was willing to wreck their careers if they breached the wall.

I fear that Chief Judge Walton is going down the same road -- that the FISA court is the only agency of government not humbled by its failures on the road to 9/11 and is therefore the only agency that will repeat those failures.  My concerns are best illustrated by the court's opinion of March 2, 2009, about which I offer three thoughts:

1. In much covered language, the judge claims that the government engaged in "misrepresentations" to the court.  This is one of the three alleged misrepresentations mentioned by Chief Judge Bates in an opinion released last month.  Since that opinion was released, commentators have widely assumed that NSA has been lying to the court.  Because, frankly, that's what "misrepresentation" usually means.  But the other filings declassified today show pretty persuasively that there was no intentional misrepresentation. Here's what seems to have happened, in brief.  Back in 2006, scrambling to write procedures for the metadata program, a lawyer in NSA's Office of General Counsel wrote in a draft filing that a certain dataset of phone numbers always met the "reasonable articulable suspicion" standard.  Turns out that that wasn't true; only some of the numbers did.  The lawyer circulated his draft for comment, suggesting that he wasn't absolutely sure of his facts, but no one flagged the error, which turned out to be surprisingly difficult to verify.  From then on, NSA and Justice simply copied the original error, over and over, all of their submissions.  A mistake for sure.  But a "material misrepresentation"?  Only to a judge with a very warped view of the world, and the NSA.

2. How about the other headline-grabbing statement in the opinion, that the government's position "strained credulity"?  Here, I think the court is on even shakier ground.  The debate is about the court's minimization order, which declared that "any search or analysis of the [phone metadata] archive" must adhere to certain procedures.  NSA dutifully imposed those procedures on analysts' ability to search or analyze the archive.  The problem arose not from giving analysts access to the archive but from some pre-processing NSA performed as the data was flowing into the archive.  

If I'm reading the filings properly (and I confess to some uncertainty on this point), NSA keeps an "alert" list of terror-related phone numbers of interest to individual analysts. Since new data shows up at NSA every day, the agency has automated the job of scanning to find those numbers as they show up in the agency's daily take. The numbers on the alert list are compared to the day's incoming intercept data, and each analyst  gets a report telling him how many times "his" numbers appear in which databases. 

This alert list was run against data bound for the telephone metadata along with all the other incoming data.  The difference was that an analyst who got a "hit" on that database couldn't access it without jumping through the hoops already set up by the FISA court -- reasonable articulable suspicion, special procedures, etc. This must have seemed quite reasonable to the techies at NSA. They knew what it meant for an analyst to "access" the database, and an automated scanning system that yielded only pointers was not the same as giving an analyst access. In the end NSA's office of general counsel came to the same conclusion:  the court's orders regulated actual archive access, not scanning against a list for statistics and pointers.

But that's not how Chief Judge Walton saw it.  He held that it "strained credulity" to say that alert list scanning was different from "accessing" the archive. Maybe he just didn't understand the technology (the opinion offers some reason to think that).  Or maybe he just thought about the question like a judge, always alert to slippery slopes and unintended consequences: "If you can lawfully search this data without limit before the data gets into the archive, you will make meaningless all the limits I've set. Why would you think I'd let you undermine my order  in so transparent a way?"

Unfortunately, Judge Walton wasn't thinking like a techie.  The techies who implemented the court's order thought they'd been told to restrict access to the database, and they did.  They weren't told to restrict the use of statistical tools that scanned incoming data automatically, so they didn't. They certainly didn't believe they were undermining the court's order.  Quite the contrary, they had designed the system to make sure that the alert list was just a starting point.  Analysts who learned they had a hit in the database couldn't get any further information without meeting the FISA court's "reasonable articulable suspicion" requirement. 

It's hard not to see this as a misunderstanding, perhaps exacerbated by the difference between legal and technical cultures.  But that's not how Judge Walton sees it.  His opinion dismisses the possibility that this could possibly be a good-faith misunderstanding.  It's an outrage, he fumes, and efforts to explain it "strain credulity."  Frankly, if anything strains credulity in this case, it's that line in the opinion.

3. The chief judge is so sure there's evil afoot that he calls for briefing on "whether the Court should take action regarding persons responsible for any misrepresentations to the Court or violations of its Orders, either through its contempt powers or by referral to appropriate investigative agencies." For anyone steeped in the disaster caused by Chief Judge Lamberth's witch-hunt for violators of the wall, this is tragically familiar ground.  It's almost exactly how the FISA court drove the wall deep into the FBI. 

I'm sure we'll be told by the press that this opinion brings to light another scandal and an agency out of control.  But that's not how I see it.  It looks to me as though NSA was doing its best to implement a set of legal concepts in a remarkably complex network.  All  complex systems have bugs, and sometimes you only find them when they fail.  NSA found a bug and reported it, thinking that it was one more thing to fix.  Then the roof fell in.

The interesting question is why it fell in.  I think a fair-minded judge encountering the issue for the first time in the courtroom would not likely say that NSA's interpretations were disingenous or the result of bad faith or misrepresentation.  Yet Judge Walton went there from the start.  

I suspect that it's because we've unfairly given FISA judges a role akin to a school desegregation master -- more administrator than judge.  Instead of resolving a setpiece dispute and moving on, FISA judges are dragged into a long series of linked encounters with the agency.  In ordinary litigation, the judges misunderstand things all the time and reach decisions anyway, and they rarely discover all that they've misunderstood.  The repetitive nature of the FISA court's contacts with the agency mean that they're always discovering that they only half understood things the last time around.  It's only human to put the blame for that on somebody else.  And so the judges' tempers get shorter and shorter, the presumption of agency good faith gets more and more frayed.  Meanwhile, judges who are used to adulation, or at least respect, from the outside world, keep reading in the press that they are mere "rubber stamps" who should show some spine already.  Sooner or later, it all comes together in a classic district judge meltdown, with sanctions, harsh words, and bad law all around.

If I'm right about the all too human frailties that beset the FISA court, building yet more quasijudicial, quasimanagerial oversight structures is precisely the wrong prescription. We'll be forcing judges to expand into a role they are utterly unsuited for and we'll put at risk our ability to actually collect intelligence. In fact, the more adversarial and court-like we make the system, the more weird and disorienting it will become for the judges, who will surely understand that at bottom they are being asked to be managers, not judges.  

The further we go down the road, the more likely we are to turn FISA into the Uncanny Valley of Article III.    

UPDATE: Typo correction:  not instead of now. Thanks Raffaela!

Why did the Guardian destroy their Snowden files instead of returning them?

I've been struck by an aspect of the Snowden affair that hasn't been covered so far -- the Guardian's troubling decision to destroy its UK trove of Snowden documents rather than let the UK government see them.  Court filings in the UK tell the government's side of that story, and they don't make the Guardian look good.

The filings make clear that the UK government wanted the documents back, and that it persuaded the newspaper that  it could not keep the files in the UK.  Why then did the Guardian destroy them instead of returning them?

Ordinarily, that would be an easy question; journalists don’t disclose their sources. 

But that answer won’t wash here. Snowden had already outed himself. Nor would turning over the files have affected the Guardian’s access to the data.  By destroying the files, the Guardian was making them unavailable to its UK reporters, but its reporters in other countries still had copies.  The same would be true if the Guardian gave its files to the UK government. 

From the Guardian’s point of view, either choice had the same effect on its reporting.  But from the UK government’s point of view, the choice was momentous.  Turning over the documents, rather than destroying them, would have helped the UK government evaluate and mitigate the harm likely to be caused when foreign governments get access to the Snowden files.

So it appears that the Guardian deliberately chose a route that harmed UK national security, even though it helped journalism not at all. Why?

The decision began to take shape earlier this summer, when the UK government approached the Guardian's editors and gave them briefings to show that the paper could not hope to protect Snowden’s files from foreign intelligence services:

 We made clear to The Guardian from the outset that we were extremely concerned by their possession of' our sensitive information and that they should not be holding it. We in informed them that we had no confidence in their ability to keep the material safe. Nor could they understand the damage that might flow from its further compromise. We made clear that the information would be targeted by any number of hostile actors and could cause further damage to UK counter terrorism operations….

 The Guardian appeared to accept our assessment that their continued possession of the information was untenable. The Guardian continued to refuse to hand over the material and would not move on this point.

The UK government may not have been quite as convincing as it thinks; the Guardian seems to have held on to the (forlorn) hope that an "air gap" would keep foreign spies at bay. But eventually the Guardian was persuaded that it could not keep the Snowden files in the UK.  

That left only two choices:  Give them back to the UK government or destroy them.  As we know, it chose to destroy them. Since it could have given them back without compromising its reporting, my question is, “Why?” 

Alan Rusbridger, the Guardian’s editor, slid past the question when he first described the incident in print.  In a video interview, though, he elaborated a bit:

 “I would rather destroy the copy than hand it back to them …. I don’t think that we had Snowden’s consent to hand the material back, and I didn’t want to help the UK authorities know what he had given us, so to me I was not going to hand it back to the government, and I was happy to destroy it because it was not going to inhibit our reporting.  We would simply do it from America and not from London.”

 The line about Snowden’s consent is surely a throwaway.  Journalists may have an obligation to protect their sources, but they certainly don’t have an obligation to follow their source’s wishes in how they use the source’s information, a distinction the Guardian has no difficulty grasping when it gets quasi-official leaks from government sources.  I suspect that the “consent” rationale only sounds plausible to Rusbridger because it fits his preferences, which he candidly states:  “I didn’t want to help the UK authorities know what he had given us.”

Now that we’ve heard the government’s side of that conversation, Rusbridger’s comfortable assertion betrays a breathtaking willingness to sacrifice UK intelligence sources and methods for what sound like ideological preferences. 

Thomas Rid, a thoughtful commentator known mainly for his skepticism about claims that cyberwar is imminent, recently called on the Guardian and other journalists to destroy the remainder of the Snowden files because the national security damage of further disclosures does not justify the likely contribution to informed debate about intelligence oversight.

I expect hell to freeze over before the Guardan takes Rid's advice. But perhaps we can at least get the Guardian's answer to a different question;  "When it would have cost you nothing to protect British security, why did you kick it to the curb instead?"

Stewart Baker testimony on DHS and cybersecurity

I'll be testifying tomorrow, September 11, about DHS's progress in over a decade of existence.  A copy of the full testimony is Download Baker testimony to Senate Homeland Sep 2013, but I suspect that  the most interesting section concerns cybersecurity, which I've excerpted below.

"Sometimes it's easier to persuade the team to give you the ball than to actually run with it after you get it.  That is DHS's problem right now. 

 "DHS seems to have successfully fended off the many agencies and committees that wanted to seize parts of its cybersecurity mission.  Recent presidential orders have given DHS a large role in civilian cybersecurity.  This is consistent with the Homeland Security Act, which clearly gave DHS authority over those issues, but that Act does not provide specific or explicit authorization for many of the cybersecurity activities that the Department is now carrying out, especially with respect to protecting critical infrastructure.  It is reasonable, then, to codify authority for DHS’s existing activities, thereby cementing the Department’s role for the future.  This basic step may seem obvious, but this is Washington, and doing the obvious is not easy.

 "That’s particularly true when the technology is changing as fast as our attackers change tactics.  When I left the Department, it was just getting started on Einstein – an effort to detect malware and other intrusion signatures aimed at the federal civilian agencies.  Deployment of Einstein is now widespread, covering perhaps 60% of the federal workforce.  Of course, detecting intrusions is not the same as stopping them.  Einstein 3A is meant to automate intrusion prevention, and it is just rolling out now.  What’s more, as security researchers have realized how hard it is to stop attacks at the edge of the network, watching inside networks has become a higher priority, and DHS has taken responsibility for deploying Continuous Diagnostics and Mitigation (“CDM”) technology to scan civilian networks for flaws and signs of compromise.  These are all necessary and very large programs that pose implementation and turf challenges.  Not surprisingly, some agencies have questioned whether DHS has the authority to do what is necessary, and providing a statutory basis for DHS’s programs would be a valuable contribution that this committee could make to cybersecurity. 

 "One problem that should be of particular interest to the committee is the risk of conflict between the Federal Information Security Management Act (“FISMA”) and CDM.  In essence, CDM performs many of the functions that FISMA requires.  However, FISMA envisions a paper-centered audit process that is far too slow for the current threat, while CDM performs its audits electronically, on a 72-hour cycle.  Everyone recognizes that CDM is better than a paper process, and FISMA should be modified to reflect changes in both the threat and the solution, as well as to make clear that DHS has responsibility for implementing the operationally demanding solution.

 "These are all complex systems that DHS is essentially running for most of the civilian government.  That would be a challenge for an established agency with a veteran workforce, but DHS does not have nearly the number of trained personnel it needs.  Finding talented cyberwarriors is a challenge even for private sector firms.  Attracting them to the Department has been doubly difficult, especially with a hiring process that in my experience was largely dysfunctional.  The Department's biggest challenge is hiring and maintaining a cybersecurity staff that can earn the respect of private cybersecurity experts.  There are bright spots.  Doug Maughan, in the S&T Directorate, has the respect of his counterparts at NSA and Goldman Sachs.  Phyllis Schneck, recently named as the Department’s deputy undersecretary for cybersecurity, has great technical and private sector credibility in the field.  DHS is on the right track, but the way is steep.  It must keep expanding its technically competent cybersecurity staff, because that is the foundation of all the other things it must do.  That likely means that it must have authority to hire workers in ways that do not fit the standard federal process.

 "The other challenges for DHS in cybersecurity are many.  They include:

 "Building a clear relationship with NSA.

"I am one of the few officials who has worked at a policy level for both the National Security Agency (“NSA”) and DHS.  There are certainly days and even weeks when I feel like the child of a troubled marriage.  But the fact remains that the outlines of a working relationship between DHS and NSA are obvious.  As a concerted campaign of leaks has left NSA reeling and mistrusted by the public, it must be clear that on cybersecurity matters affecting the civilian sector, DHS is calling the policy shots.  At the same time, DHS must rely heavily on NSA's technical and operational expertise to succeed. This fundamental truth has been obscured by personalities, mistrust, and impatience on both sides.  It's got to end, especially in the face of adversaries who must find the squabbling email messages especially amusing because they are reading them in real time.

 "Gaining authority to insist on serious private sector security measures.  

 "DHS has plenty of authority to cajole and convene in the name of cybersecurity.  It's been doing that for ten years. The private sector has paid only limited attention.  In part that's because DHS had only modest technical expertise to offer, but it's largely because few industries felt a need to demonstrate to DHS that they were taking its concerns seriously.  I fully recognize that cybersecurity measures do not lend themselves to traditional command-and-control regulation, and that information technology is a major driver for economic growth.  But the same could have been said about the financial derivatives trade in 2007.  We cannot allow the private sector to cut costs by vastly increasing risk, whether in cybersecurity or in financial markets.

"Sometimes the businessmen arguing against regulation are wrong – so wrong that they end up hurting their own industries.  I believe that this is true of those who oppose even the lightest form of cybersecurity standards.  Even on their own terms, the businesses lobbying against a substantive cybersecurity bill are likely to fail.  Most of the soft quasi-regulatory provisions business groups rejected last year in talks with the Senate were incorporated into an executive order that they had little ability to influence.  Those provisions will in turn become the basis for future, harder regulations, particularly if Congress delays action until we have a cybersecurity meltdown. 

 "For now, however, it will be up to DHS to use the soft authorities and the mandate conferred by an executive order with energy and wisdom.  And, to be candid, that is a big enough job for the near future. 

 "Action beyond the legislative and executive order.

 "The legislative stalemate does not mean that DHS can only improve cybersecurity by pushing the private sector to do things it doesn’t want to do.  There are many other steps that DHS could take to improve cybersecurity without touching the regulatory third rail. Here are some:

 "Information-sharing.  Everyone understands why the targets of cyberattacks need to share information.  We can greatly reduce the effectiveness of attacks if we use the experience of others to bolster our own defenses.  As soon as one victim discovers a new command-and-control server, or a new piece of malware, or a new email address sending poisoned files, that information can be used by other companies and agencies to block similar attacks on their networks.  This is not information-sharing of the “let's sit around a table and talk” variety.  In a world of zero-day attacks and polymorphic malware, it must be automated and must occur at the speed of light, not at the speed of lawyers or bureaucrats.

 "I supported the Cyber Intelligence Sharing and Protection Act (“CISPA”), which would have set aside two poorly-conceived and aging privacy laws that made it hard to implement such sharing.  I still do.  But if CISPA is blocked by privacy groups, as seems likely, we need to ask whether the automated system we need can be built without falling foul of those aging privacy laws.  A more creative and determined approach to the law is needed.

 "To take one example, many of the privacy rules that restrict sharing can be waived if a service’s customers consent to the sharing.  Since the purpose of the sharing is to protect the cybersecurity of those same customers, they are highly likely to consent in large numbers.  Working with government, service providers could find ways to obtain consent to a data-sharing regime designed to protect both privacy and cybersecurity – all without amending existing law. 

 "This committee can move information-sharing forward by calling on DHS to lead an interagency effort that would work within existing law to improve information sharing by considering the adoption of statutory interpretations, standard customer terms, and other techniques that serve everyone’s interest in better cybersecurity.

 "Emphasize attribution.  We will never defend our way out of the cybersecurity crisis.  I know of no other crime where the risk of apprehension is so low, and where we simply try to build more and thicker defenses to protect ourselves.  We started on this Maginot Line exercise because attribution of cyberattacks seemed too difficult; attackers could hop from country to country and server to server to protect their identities.  

 "But that view is out of date.  Intelligence agencies have stopped trying to trace each hop the hackers take.  Instead, they've found other ways to compromise the attackers, penetrating their networks directly, observing their behavior on compromised systems and finding behavioral patterns that disclose much.  In short, we can know who are our attackers are.  We can know where they live and what their girlfriends look like.  That’s because it’s harder and harder for hackers to function in cyberspace without dropping bits of identifying data here and there.  The massive amount of data available online makes the job of attackers easier, but it can also help the defenders if we use it to find and punish our attackers. 

"Sometimes the best defense really is a good offense; we need to put more emphasis on breaking into hacker networks and gathering information about what they're stealing and who they're giving it to.  That kind of information will help us prosecute criminals and embarrass state-sponsored attackers.  It will also allow us to tell the victim of an intrusion with some precision who is in his network, what they want, and how to stop them. 

 "Again, this committee can put DHS at the center of a new emphasis on attribution.  Its Computer Emergency Readiness Team and intelligence analysis arms should be issuing more detailed information about the tactics and tools being used by individual attack units and fewer bland generalities for local law enforcement agencies. 

 "Move from attribution to deterrence. The committee could also perform a service by calling on DHS to take the lead in identifying ways to use attribution more effectively to deter cyberattacks.  There are many ways to improve deterrence.  While the administration has become more open about identifying Chinese cyberattacks as a particular problem, the Snowden affair has made “naming and shaming” less effective in this context.  Instead, we should be looking for other ways to identify individual attackers and their enablers and then bring U.S. legal pressure to bear on them.  This is a target-rich environment:

• The Magnitsky Act, passed in 2012, imposes trade sanctions on Russian officials for human rights violations they committed in Russia.  Yet government-sponsored hackers have been violating the human rights of Americans in the United States, spying on and sabotaging Tibetan rights groups, for example.  How can it be that we are doing more to punish human rights violations in Russia than right here at home?  Sanctions of this sort can be imposed on the basis of intelligence that remains classified, and it does not require legislation.  It requires only that the Administration consider cyberattacks to constitute an economic emergency.

• Some of the hackers identified publicly by private security researchers do business in the West.  Others  may have jobs with Chinese multinationals.  Some got their start as hackers at Chinese universities.  This creates an opportunity.  Foreign multinationals and universities need visas to come to the United States.  Before we issue visas to entities that have hired or enabled the hacking of American companies, we should require them to cooperate in our efforts to identify and penalize hackers.

"Use DHS law enforcement authorities more effectively. The law enforcement agency most associated in the public mind with cybercrimes is the Federal Bureau of Investigation (“FBI”).  This is a little odd because two DHS law enforcement agencies, the Secret Service and ICE, both have strong cybercrime units and may between them handle as many cases as the FBI.

"My concern is not who gets the credit for these investigations.  But we cannot let law enforcement determine our cybersecurity posture.  Agencies like the FBI and Secret Service only occasionally solve hacking cases, and even more rarely are they able to actually arrest the hackers.  If they are allowed to hoard evidence of cyberintrusions, we may lose valuable intelligence about the intruders’ tactics and targets.  This committee should consider legislation calling for a coordinated approach to all computer intrusions to ensure that detailed information sharing occurs across agency lines.  At the same time, it is often law enforcement that tells businesses they have been compromised.  This is a “teachable moment,” when all of DHS's cyberdefense and industry-outreach capabilities should be engaged, talking to the compromised company about the nature of the intruder, his likely goals and tactics, and how to defeat them.  But that happens less than it should, judging by the experience of my clients.  A deeper, Congressionally mandated coordination would make these encounters far more useful to the private sector.

"Finally, I fear that letting law enforcement take the lead on a case-by-case basis means that investigations are not being prioritized in ways that would maximize their intelligence value.  (Since these investigations rarely lead to prosecutions, using criminal authorities to gather information about attackers should be a particularly high priority – even when there is no prospect of criminally prosecuting the attackers.)  While interagency coordination with the FBI can be a challenge, coordination between DHS's cybersecurity offices and the ICE and Secret Service investigators also seems to be equally ad hoc at best.  This committee should consider requiring DHS’s law enforcement agencies to work computer crime cases under the coordinating and deconflicting authority of the National Protection and Programs Directorate (“NPPD”) to ensure strategic use of law enforcement authorities and proper sharing of information.

"Recruit private sector resources to the fight.  In my private practice, I advise a fair number of companies who are fighting ongoing intrusions at a cost of $50,000 or $100,000 a week.  The money they are spending is almost entirely defensive.  At the end of the process, they may succeed in getting the intruder out of their system.  But the next week, the same intruder may get another employee to click on a poisoned link and the whole process will begin again.  It is a treadmill.   Like me, these companies see only one way off the treadmill:  to track the attackers, to figure out who they are and where they're selling the information, and then sanction both the attackers and their customers.  But under federal law, there are grave doubts about how far a company can go in tracking their attackers.  I think some of those doubts are exaggerated, but only a very brave company would ignore them.

"Now, there's no doubt that U.S. intelligence and law enforcement agencies have the authority to conduct such an operation, but by and large they don't.  Complaining to them about even a state-sponsored intrusion is like complaining to the DC police that someone stole your bicycle.  You might get a visit from the police; you might get their sympathy; you might even get advice on how to protect your next bicycle.  What you won't get is a serious investigation.  There are just too many higher priority attacks. 

"In my view, that's a mistake.  The United States should do some full-bore criminal and intelligence investigations of private sector intrusions, especially those that appear to be state-sponsored. 

"But if we want a solution that will scale, we have to let the victims participate in, and pay for, the investigation. Too many government officials have viewed private countermeasures as a kind of vigilante lynch mob justice.  That just shows a lack of imagination.  In the real world, if someone stops making payments on a car loan but keeps the car, the lender doesn't call the police; he hires a repo man.  In the real world, if your child is kidnapped, and the police aren't making it a priority, you hire a private investigator.  And, if I remember correctly the westerns I watched growing up, if a gang robs the town bank and the sheriff is outnumbered, he deputizes a posse of citizens to help him track the robbers down.  Not one of those solutions is the equivalent of a lynch mob. Every one allows the victim to supplement law enforcement while preserving social control and oversight.

"DHS very likely has sufficient authority to try that solution tomorrow , as does the FBI.  DHS’s law enforcement agencies often have probable cause for a search warrant or even a wiretap order aimed at cyberintruders.  But they rarely have the resources to use that authority fully and strategically against the intruders.  I know of no legal barrier to relying on private resources to conduct a deeper investigation under government supervision. (The Antideficiency Act, which prohibits acceptance of free services, has more holes than my last pair of hiking socks, including exceptions for protection of property in emergencies and for gifts that also benefit the donor.)  If systematic looting of America's commercial secrets truly is a crisis, and I believe that it is, why have we not already done this?

"I understand the concern expressed by some that we cannot turn cyberspace into a free-fire zone, with vigilantes wreaking vengeance at will.  No one wants that.  Government should set limits and provide oversight for a true public-private partnership, in which the private sector provides many of the resources and the public sector provides guidance and authorities.  The best way to determine how much oversight is appropriate is to move cautiously but quickly to find alternatives to the current failed cybersecurity strategy.  Again, this committee can move the ball forward by authorizing DHS and its law enforcement agencies to develop a pilot project -- working with hacking victims and their security firms to use government authorities in a cooperative fashion.

"Use existing funds to improve state and local cybersecurity preparedness.  There may still be low-hanging fruit in the Department’s budget to improve cybersecurity.  For example, we can make it easier for state and local governments to use existing grant funding to beef up their cybersecurity.  Over the last decade DHS has provided billions of dollars to state and local governments to fund the purchase of a wide range of security capabilities.  Cybersecurity tools – from installing basic firewalls to deploying advanced defenses that rely on virtual “detonation chambers”  – are allowable purchases, along with hazmat suits and interoperable communications tools.  However, DHS can do more to encourage state and local governments to spend grant funds on cybersecurity, and Congress should support those efforts.

Playing Pick Up Sticks with National Security

Back from a fine hiking vacation, I have a short op-ed in USA Today:

Many of us played Pick Up Sticks in our youth, slowly pulling first one then another stick from the jumble. You lost the game by pulling out the stick that collapsed the pile. It's a great way to pass a rainy afternoon, but a bad way to set national security policy....

[W]e've seen aggressive civil liberties campaigns in the second term of every president since at least Bill Clinton. In the 1990s, these campaigns made it politically impossible to object when the Foreign Intelligence Surveillance Act court imposed a "wall" between intelligence and law enforcement. Then, in George W. Bush's second term, Congress put new limits on intelligence wiretaps. And now, right on schedule, another round of civil liberties attacks is being launched, this time at President Obama.

We seem unable to separate our feelings about the occupant of the Oval Office from the agencies that protect all Americans. Every few years, in a fever of opposition to whoever has been re-elected to the White House, we look over the country's security measures and pull another one out of the pile.