Counterterrorism Expert: It's Time To Give Companies Offensive Cybercapabilities 220
itwbennett writes: Juan Zarate, the former deputy national security advisor for counterterrorism during President George W. Bush's administration says the U.S. government should should consider allowing businesses to develop 'tailored hack-back capabilities,' deputizing them to strike back against cyberattackers. The government could issue cyberwarrants, giving a private company license 'to protect its system, to go and destroy data that's been stolen or maybe even something more aggressive,' Zarate said Monday at a forum on economic and cyberespionage hosted by think tank the Hudson Institute.
As anyone familiar with Shadowrun knows... (Score:3, Informative)
... this isn't going to end well.
Re: (Score:2)
You may want to remember that the first deckers went insane from the shock of facing the Matrix...
Re: As anyone familiar with Shadowrun knows... (Score:2)
Mmm black ICE, so much better than Lemon ICE.
uhhh, yeah (Score:4, Insightful)
I'd expect such nonsense from a former employee of BushCheney Co. Would you also "deputize" a privately held corporation to get some F-16's and go bomb the attackers? It is virtually the same thing. I guess the BushCheney Corporation would have loved that.
Such attacks are attacks on U.S soil, and should therefore be handled by the military, and only the military.
Otherwise, this will create private, corporate owned, corporate sponsored armies. They will be, essentially, corporate warlords.
Re:uhhh, yeah (Score:5, Informative)
Otherwise, this will create private, corporate owned, corporate sponsored armies. They will be, essentially, corporate warlords.
You mean like Academi/Xe/Blackwater [wikipedia.org]?
Not at all a new concept (Score:5, Insightful)
It's called a "Letter of Marque," and they've been used in places where governments can't enforce their sovereignty for centuries.
It usually doesn't turn out all that well, but may well be better than nothing.
Re: (Score:2)
Letters of Marque and Reprisal, as I've heard it. And "reprisal" is certainly closer to the mark (no pun intended).
Re: (Score:2)
"Letter of Marque" is a shortened form, but still correct. And it was exclusively a nautical thing; I've never heard of anything really similar on land, probably because it would be even more dangerous there.
Re: (Score:2)
Re: Not at all a new concept (Score:2, Informative)
And let us not forget that it was giving tax CUTS to one of these trading companies that set of the Boston Tea Party.
Yes, you read that right. They teach you in school that it started because of a tax on tea and they let that little mistruth simmer for a while to reinforce the 'taxes always bad' mentality. What really happened was there was a tax on tea allright, but that wasn't what got people upset.
The British East India company had tea stores all over the Colonies, kind of like we have Wal-Marts. We a
Re: (Score:3)
"This person has been violating our copyrights which we view as a major cyber-attack. We've seized him and imprisoned him along with the other pirates in our private rehabilitation centers until they have been re-educated."
Re:Not at all a new concept (Score:5, Insightful)
Ah, yes, politician's logic. "Something must be done. This is something. Therefore we must do it."
No, it can be practical logic (Score:2)
You have to be careful about letting perfect be the enemy of better. Sometimes you don't have a perfect solution to a problem, or even a good one. But you may have one that is better than what you have now. It then makes sense to go with that.
Now please note I'm not saying this is one of those cases, just that it is not political logic, but practical. If your current situation is awful and you can improve it to just bad, well that is worth doing.
Re:No, it can be practical logic (Score:4, Insightful)
This isn't a case of "perfect is the enemy of the better." This is a case of "something is the enemy of nothing" - which means that, in the minds of politicians, doing something is better than doing nothing even if that something is worse than useless. Even if doing the something in question makes matters worse (say, by allowing the RIAA to form a private army to kill "copyright thieves"), it is better than doing nothing as far as the politician is concerned because he can claim "I did something" when re-election comes around.
In related news, this kind of thinking is what led to the TSA "security." Doing "something" about security (everyone has to remove their shoes) trumps taking the time to actually consider risks and benefits.
Re: (Score:2)
You have to be careful about letting perfect be the enemy of better.
There are always 3 options:
1. Be perfect
2. Do something
3. Do nothing
The main problem with (Western) politicians is that they want to have an image of Strong and Decisive. They think that deciding to do nothing can look weak, and they often choose to just do something, not because it is the best option, but because it makes them look good. With elections coming up, that is important.
Re: (Score:2)
No, it won't. Let's give MS free reign to screw with Google's systems (even more than they are) by claiming they were going after cyber miscreants. And when they get caught, they'll simply throw up their hands, rock back and forth like a guilty Gates, and give non-committal answers pointing at the law that allows them reprisals.
Or how about giving that paradigm of virtue, Larry Ellison, the legal cover to commit sins against whomever he's worried about these days.
The Beltway Bandits would be tripping over t
OMG!!! (Score:5, Funny)
Oh sure (Score:5, Insightful)
Oh sure, let's trust the people who can't even protect their own networks to properly identify the perpetrators of a hack instead of some innocent bystander running a TOR exit node. I can't see any risks associated with that. No. Not at all... :(
Re: (Score:3)
Are you worried that they will be able to successfully attack anyone?
Re: (Score:3, Insightful)
They can certainly cause damage. Whether or not that will actually be the offending party is another matter entirely.
Re: (Score:3)
I'm worried that the only people they'll successfully attack are the innocent. The actual guilty parties will be well hidden and well protected.
Re: (Score:2)
Re: (Score:3)
Re: (Score:2)
Whoa, we really need to think this through... (Score:5, Insightful)
Giving private corporations the ability to identify anyone they don't like a "cyberattacker" and then attack them will be very dangerous. Imagine companies pursuing IP related complaints (whether real or imagined) being deputized to go after people and their systems in this manner. There are damn good historical reasons we have a legal system in place -- one of which is to the prevent abuses that vigilante systems foster.
No thinking needed, actually. This is just stupid. (Score:3)
No this is an unbelievably stupid idea, presented by an unbelievably stupid person (Juan Zarate, who is this ass clown?)
Re: (Score:3)
I saw the same shit with spam. I used to receive a lot of backscatter from some spammer using my E-mail address as a fake from address. I received a ton of threats, random DoS attacks, mailbombs, ping-floods, and a lot of stuff because various dipshits couldn't understand the basics about what an open relay was.
The more ironic thing was finding out that before the deluge happened, I got an extortion letter threatening that postmaster and other E-mail IDs on the web from the site would be used as fake orig
Re: (Score:2)
So some business with the absolute bargain-basement IT staff, chock full of bargain-basement novices is going to decide if a compromised workstation the receiving department at another company is sufficient cause enough to shut that firm down? This would be like carpet-bombing an entire office building because a bank robber ducked into the building's lobby.
It's more like carpet-bombing a shoe store chosen more or less at random because you heard that, yesterday, a bank robber had run into one.
Even though, today, the same place he ran into yesterday might already be a café and not even be a shoe store any longer.
Re: (Score:2)
It will just be used as way of fighting the on-going cyber cold war without taking military action. Corporate soldiers will do the actual fighting under the fig leaf of "defence", after some government agent launches a fake and ineffective attack on them.
Re: (Score:2)
Giving private corporations the ability to identify anyone they don't like a "cyberattacker" and then attack them will be very dangerous. Imagine companies pursuing IP related complaints (whether real or imagined) being deputized to go after people and their systems in this manner. There are damn good historical reasons we have a legal system in place -- one of which is to the prevent abuses that vigilante systems foster.
Time to register as an LLC! Then all my hacking will be nice and legal.
Great idea (Score:5, Interesting)
This is a great idea. What on earth could possibly go wrong?!?! Lets give the power hungry, egotistical, anti-social network security "experts" who are in charge of creating the insecure networks the right to use "deadly force" against those they think might be responsible.
I can't wait for the fecal matter to hit the CPU fan when the wrong company is targeted for retaliation er I mean offense.
Re: (Score:3, Informative)
Re: (Score:2)
To be fair, Neuromancer was a great book.
Re: (Score:2)
Re: Great idea (Score:2)
Re: Great idea (Score:2)
He covered that with "stupid."
Re: (Score:2)
This is a fucking re
Re: (Score:2)
I put it as "deady force" to mean the digital equivalent. What else would you call killing an attack against your server(s) if you're deputized?
From the summary:
What does "go and destroy data" mean? What does "something more agressive". If Company A attacked Company B, and Company B retaliated, how far shoul
Prove to me (Score:5, Insightful)
that you are competent enough on the defensive side of things first and we'll talk about it.
When your company can't even be bothered to properly secure our personal information on your servers ( plaintext files . . . really ? ) what sort of insanity is it to even CONSIDER giving these very same folks offensive capabilities ?
It's like giving a shotgun to a monkey and hoping nothing bad comes of it :|
Seriously. . . . wtf ?
Re: (Score:2)
Afterthought:
This is coming from a counter-terrorism " expert ". :|
Dear Anti-Terrorist Experts:
We won't tell you how to do your jobs if you agree to keep your $boogeymanofthemonth sensationalism and " The sky is falling " mentality out of ours.
Re: (Score:2)
Obviously, you don't understand the job of a "counter-terrorism expert." His job is to stir up as much fear of terrorism as possible to secure more anti-terrorism funding for his group.
Wait, you wanted actual anti-terrorism planning with actual weighing of costs vs. benefits? *bursts into laughter*
Re: (Score:2)
This is a great idea (Score:5, Informative)
Companies have demonstrated how careful and responsible they are with the DMCA takedowns, so it's only logical that we allow them to go further and actively attack the evil-doers out there.
Re: (Score:3)
Re: (Score:2)
I can see it now:
RIAA: "We shot the dirty pirate who was pirating 'Uptown Funk."
People: "Um, that person just tweeted 'Heading Uptown and saw a chipmunk.'"
RIAA: "Close enough. You can never be too careful."
How about securing things correctly for a change? (Score:4, Insightful)
There are security models and systems perfected in the 1970s in response to the data processing needs of the air war in Viet Nam. There are commercially available systems which work for multilevel security. This model can be ported to the open source world, if enough people are interested. I'm waiting for the Genode project from Germany to get something I can use in the next few years, and I hope there will be others.
I hereby suggest we just eliminate the possibility of a cyber-war, instead of getting stuck in an arms race.
Re:How about securing things correctly for a chang (Score:4, Insightful)
Since this is Slashdot, I'll explain with a car analogy. Lots of people die in car accidents, and we could easily stop that by doing things like a) Not use cars, b) not let them drive more than 20mph, etc... all sorts of things that would greatly interfere with the way people actually use cars to do stuff. Our cars also used to be a lot less safe too - at one point they didn't even come with seat belts.
As much as I'd love to see proper security implemented, it's just not going to realistically happen. Too many users (customers) don't want the hassles that come with serious security, and too many businesses aren't will to pay the up front costs for it (yet, at least). It's going to take some hard lessons before they start putting on seat belts, air bags, abs breaks, and the equivalents of everything else we've done (and are doing) to make cars safer. The Adama solution, as much as it makes sense from a security standpoint, doesn't take into account the needs of either the people using the stuff, or the people paying for the stuff. We need those people to understand and demand more secure features up front - and even then we're still only talking about reducing things to an acceptable/tolerable level, not eliminating them.
Re: (Score:2)
Good luck with that! There are no security models that will keep breaches from happening. Even the NSA couldn't keep Snowden for walking away with tons of highly secure data.
Re: (Score:2)
A US company would have to rent or buy into the new US security teams and ensure they had the latests products to reach around the world and report back the data was found and removed.
A new product to market with new cash flows. A new US system of cyberwarrants, private license issues from the US gov to cleared US brands only.
Global reach and no establi
Evidence (Score:4, Insightful)
Let's look at something nobody does, which is look at evidence. OK, I know that sounds like a bad idea .. but anyways .. RIAA, MPAA, and SPA already does this exact same thing. They have ruined lives for no reason. What happens when the company hacks back and causes more damage than what was stolen? We don't let the victims decide punishments. If victims could decide punishment even petty thieves would be murdered. If you think that sort of draconian punishment helps a society, then you probably want to move to Saudi Arabia or ISIS.
Cyberpunk (Score:3)
Re: (Score:2)
Why only cyber weapons (Score:3)
I see no reason to limit companies to cyber weapons. Once they have located an attacker, having privately owned armed drones would be very handy. if the attacker is a nation state, even more aggressive measures could be used. I can see aircraft carriers, and maybe even ballistic missile subs with corporate logos.
Re: (Score:3)
The Trans-Pacific Partnership gives them the right to use "even more aggressive measures". It's called "corporate sovereignty" and it will be our undoing. Basically, it says that a corporation can sue governments for damages for any law that might conceivably cost them money.
We already have a mercenary military. Imagine the armies t
Sounds entertaining (Score:3)
So if you make it look like someone else did it....
Um, No. (Score:2)
This is an incredibly stupid idea. Of course I'd love to sit back and watch the fireworks the first time someone attacks, say, Sony, and spoofs it so they think it was perpetrated by, let's say, Samsung. That would be amusing.
Very loose interp. of the 2A ? (Score:2)
So... for a long time, various encryption algos were considered weapons and subject to ITAR controls. The same is starting up again now.
So... if code can be a weapon, a (very) loose interpretation of the 2nd Amendment and some Castle Doctrine would already allow someone to hack back ...
Re: (Score:2)
Under the castle doctrine you can't attack someone who is not on your premises or engaged in an attack. They have to be either in your castle or attacking it. Furthermore, if they are attacking from outside .. you can't fire haphazardly hurting bystanders. When you hack back, you could very well end up flooding networks and slowing the internet for everyone.
Re: (Score:3)
So... for a long time, various encryption algos were considered weapons and subject to ITAR controls. The same is starting up again now.
So... if code can be a weapon, a (very) loose interpretation of the 2nd Amendment and some Castle Doctrine would already allow someone to hack back ...
Even that very loose interpretation doesn't quite fit.
The second amendment after all only says we the people may posses weaponry, it isn't a blanket licence to shoot at just anyone willy nilly, let alone a license to kill someone.
At least so far it is still not illegal to simply own an exploit or its source code, which is a more fair comparison.
One might argue that it should/is legal to counter-hack a system, but to keep the comparison, only so long as they are the one that attacked you first.
The moment you
let me guess (Score:4, Insightful)
Only corporations of s certain size will be allowed to do it. Someone with a small business who has no value to the gov will be punished.
You wouldn't even need to do that (Score:2)
When the government is too lazy or incompetent (Score:3)
What the hell is cybercapability (or cyberweapon)? (Score:5, Insightful)
There is no such thing as a cyberweapon. There is hacking/cracking and that is generally done through technical weaknesses and/or social engineering. There is no such thing as a cybertank or a cybergun, something that can actively break through something that it was not intended to go through. There is no software that can simply break through a web server by sheer force.
Using any kind of military jargon with what amounts to a technical capability of a piece of software is (car analogy) like telling us that foreign car mechanics and imported engines are capable of destroying our infrastructure and instead of fixing the engines or building our own to counteract it we have to deploy our own car mechanics and engines to foreign countries.
Using these analogies of cyberweapons with technical experts just sounds like a bunch of military people heard of the printing press and now they want to destroy people with paper cuts.
Re: (Score:2)
This point is really the crux of the matter. But the larger point is; why have companies try and "attack" or hack someone who hacked them? Wouldn't they also then be guilty of hacking?
Did anyone really think this through?
The simple solution is to have an offensive hacking team, and have companies JUST CALL the experts and present their proof. Every company cannot be an expert, will not be an expert and can't afford to be an expert.
Arrrrr Matey!!!!! (Score:2)
Yes! Letters of Marque and privateers again.
Got to love it
Re: Arrrrr Matey!!!!! (Score:2)
Thing is, if a privateer attacked a neutral, the captain and crew were hanged as pirates.
just kidding (Score:2)
When they screw up? (Score:2)
Bottom line, if someone clobbers your company by mistake, whom do you sue?
Norton/Symantec already has this (Score:2)
Ohhh ... (Score:2)
I wanna be a company.. I wanna be a company...
BTW Hudson Institute - right wing reactionary extemism in think-tank form brought to you by Olin, Koch, Scaife, Walton (Walmart) and featuring on its board Scooter (Plamegate) Libby, Dick Cheney and Richard Pearle.
http://www.sourcewatch.org/ind... [sourcewatch.org]
Riiiiight.... (Score:2)
Breach territorial jurisdiction? (Score:2)
An empty house with optical thats for rent, owners on holiday and another deeper air gapped network? But the fast network has a computer connected 24/7 and is been used to store data... that was copied out hours or days ago
A small firm with optical networking that has an extra hidden box in its computer room? No storage, just the final hop to sneaker net... CCTV might
William Gibson's Future is Coming Soon (Score:2)
Black Ice!
Black IC Baby! (Score:2)
Seriously though, its often the case that corporations are left without any viable legal recourse. China is not going to help an American company recover stolen information, and it's government may even be responsible. We already allow the use of force in self defence, against intruders, and at least in some States, to recover stolen property. I see no reason not to extend that to corporate persons. Especially when law enforcement can't fill the role.
What will the MPAA do with this? (Score:2)
Dumbest thing I've ever read .. (Score:2)
"Zarate
How about not running Homeland Security on computers that can be hacked by opening an email attachment or clicking on a malicious URL.
Be careful (Score:2)
Terrible Idea! (Score:3)
The correct approach is to use the government for defensive cyber capabilities. The NSA (and others) are focused almost entirely on offensive capabilities and weaponizing exploits that they discover. Instead, they should be reporting, patching, and/or issuing reports on their discoveries. There's no point in protecting 'Murican data if there's nothing left to protect because we're ignoring defense.
As far as their spying -- sorry, "collection" -- mission, they can still hack existing systems without using software exploits.
What is old is new again (Score:5, Insightful)
Re:What is old is new again (Score:5, Interesting)
Look up "letters of marque and reprisal", and perhaps "privateering", too.
Yes and look deeper at history to see how badly that turned out. Law outside of the
law is not a solution.
The one missing executive order that could help internet security is that
all federal TLA class agencies report defects to vendors. Some will elect
to use a proxy... but defects are serious trouble and need to be squashed.
Follow that with failure to act legislation...
Of all the parts in Windows 10 the update policy may prove to be the
most important policy decision they made. Because the update is free
to the globe many bot systems will be eliminated. Perhaps millions of
compromised systems will be recovered.
Re: (Score:2)
Re: (Score:2)
Good luck taking over a Microsoft update server or kernel.org.
You mean like kernel.org was hacked in 2011?
Re: (Score:2)
Thank you! I was coming here to post the same thing.
Re: (Score:2)
I always figured they were already secretly doing it anyway. How else do you stop a determined attacker?
Copyright Piracy (Score:4, Interesting)
It wouldn't last a week before we'd be seeing attacks against competitors.
It's not competitors I'd be worried about but the copyright trolls. Using their interpretation of copyright law practically everyone would be guilty of "stealing" their data in some form or other and so would be open to be hacked "just to check". The truly ironic thing of course is that by acting under a letter of marque they would actually be far more like a pirate than those they accuse.
Re: Dumbest idea ever (Score:5, Insightful)
Competitors? You act as it there is actual competition out there. Competition is a myth they use to sell capitalism with. Sure, the car wash place down the street may have competition, but not the multinationals. That's just another illusion they try to maintain.
What they will do is retaliate against whistleblowers and activists. They already look on people who tell the truth about them as terrorists, with the full support of their bought and paid for law enforcement allies.
Don't forget pirates and copyright infringers, whether those people are actually involved in such activity or not. They're already pursuing legislation that would criminalize interfering with their ability to make a profit.
Re: (Score:2)
I wish I could locate that Onion article claiming that Walmart had eight nuclear bombs.
Re: (Score:3)
That article has been nuked.
One down, seven to go.
Re: (Score:3, Funny)
Re:Cyber-Letters of Marque & Reprisal! (Score:4, Funny)
Re: (Score:3)
Yeah, some of them managed to make a fair amount of money before they ended on the gallows.
The authorities tended to put down their attack dogs once they'd become no longer expedient to keep around.
Re:If you deputize them (Score:5, Insightful)
Re: (Score:2)
Re: (Score:2)
Re:If you deputize them (Score:5, Interesting)
Re: (Score:2)
That hasn't worked too well with the NSA. I can't imagine that a private corporation with a financial incentive would be able to restrain themselves from attacking their competetors once they were given the go-ahead to start lashing out when their network gets DDOSd.
No, this could be great! We could appoint a secret TCP packet court, issue arrest warrants against packets of data and store them in privatized prison segmented storage on the NSA data center and put the cost on everyone's intertubes bill.
Then again, might just be easier to prosecute the builders of the federal reserve system on a Ponzi scheme, fine them the amount of gold they emptied the central banks of and then figure out if they belong in England, Germany or Mongolia. Let the decided country deal wit
Re:If you deputize them (Score:5, Insightful)
Re: (Score:2)
I cna't remember the article which sort of spoils this post but there's a technical fix for DDoS which ISPs are simply and webiste owners are simply not implementing. Maybe someone knows the article or set of facts I am forgetting and enlighten the rest of us.
Re: (Score:2)
Any random network can be built to end up in any location short or long term.
Make it a really interesting location and see who drives past a very isolated site. Counter surveillance teams then have options.
A local hired, any undercover tourist visa, NGO staff can be flagged by local officials.
Working in other nations is really tricky, down a random network or physically.
Re: (Score:3)
And to carry on the analogy, the more successful ones will swallow up or destroy the less successful ones until you have a small handful at most of really massive ones who are accountable to no one.