Senate bill rewrite lets feds read your e-mail without warrants

CNET ^ | |November 20, 2012 | Declan McCullagh

[Cheerio]

Proposed law scheduled for a vote next week originally increased Americans' e-mail privacy. Then law enforcement complained. Now it increases government access to e-mail and other digital files.

[Altariel]

It's S.3414, apparently. ***** It's backk!! Controversial proposal regarding public/private sharing via the DHS gets

In recent years the U.S. has struggled under the weight of constant cyberattacks from China.  But in recent months, a new threat has emerged -- Iran -- a nation the U.S. long wrote off a cyber-weakling.

I. Reviving S.3414

In the midst of this two-sided battle, the Obama administration is making a second pitch to members of Congress to revive and pass a slightly modified version of the Cybersecurity Act of 2012 (S. 3414).

The administration's argument is basically, "Hey, we'll take out the parts of the cybersecurity bill that you don't necessarily want to be seen supporting, and replace them with executive orders."

Most on both sides of the aisle agree that in the perfect world there would be some sort of exchange of threat information between the government and the private sector; the question is how to do that, without imposing onerous red tape on the private sector.

There is some base controversy about the fact that the administration's plan flows data through the U.S. Department of Homeland Security (DHS).  Rep. Ron Paul (R-TX) has attacked the bill, which he calls a "big brother writ at large", and also called out the DHS as an "inefficient and redundant entity, commenting, "It’s the inefficiency of the bureaucracy that is the problem. So, increasing this with the Department of Homeland Security and spending more money doesn't absolve us of the problem."

_{Businesses are mistrustful of the government's ability to secure their risk analyses.
[Image Source: Stream 20]}

But many Republicans are supportive of having the DHS handle terrorist threats -- including in cyberspace; after all it was a Republican who created the DHS in the post-9/11 aftermath.

The part that bothers the majority of Republicans is opposition from major businesses which fear Sec. 102 "Sector-by-sector cyber risk assessments".  The concern from the private sector lies not so much in the cost -- businesses will generally be forced to perform such risk analyses anyhow.  Rather, there's fear that the government could lose this data as it has lost masses of data in the past (Wikileaks, anyone?) exposing potentially embarrassing and damaging vulnerabilities.

So the Obama administration may snip the Sec. 102 language, while keeping the basic concept of the government sharing information on threats with private sector firms like banks and defense contractors.  Senator Majority Leader Harry Reid (D-NV) is reportedly preparing to introduce the slightly revised bill, according to Reuters.

Comments Jeffrey Ratner, senior adviser for cybersecurity on the Senate Homeland Security Committee, on the removal of the Sec. 102 language, "[Bill coauthor Joe Lieberman] wants legislation [on risk analysis], but he's willing to focus on the rest of this bill, because there are important things there that he believes need to be implemented."

II. Watered Down or Bipartisan Compromise?

Sen. Joe Lieberman (I-NH) is one of the bill's coauthors, who is working with Sen. Reid, a former party colleague on the draft.

DHS Secretary Janet Napolitano says the bill will not create new bureaucracy, merely improve and codify efforts that are already underway.  She comments, "We know there are … vulnerabilities. We are working with [private industry] on that."

The revised bill is likely to move closer to a bipartisan bill proposed by House of Representatives by Chairman of the House Intelligence Committee Rep. Mike Rogers (R-MI) and the top Democrat on that panel, Rep. C.A. Ruppersberger (D-MD).  That bill is known as the The Cyber Intelligence Sharing and Protection Act (H.R. 3523)

The plan is to pass the pared down bill, which some critics call a "watered down" version of S. 3414.  President Obama will then try to implement some of the removed features via executive orders, placing the blame or credit for them on his own administration, not Congress.
 

_{President Obama's cabinet is looking to implement the missing features of S.3414 with executive orders. [Image Source: Associated Press]}

But even if that plan may be palatable to Congress, not everyone thinks it will help safeguard the U.S.  Dmitri Alperovitch, chief technology officer of CrowdStrike, argued to Reuters that the real problem is that U.S. lacks the backbone to initiate digital counterstrikes or offline trade repercussions against those who attack it.

"We're having the wrong debate," he says, "What's the benefit of information-sharing if you're not going to act on the information?"
http://www.dailytech.com/Amid+Recent+Cyberattacks+Senate+Poised+to+Revive+Cybersecurity+Bill/article29086.htm

[zeugma]

Rapelcg rireglguvat jvgu ebg13. Vg’f gur bayl jnl gb or fher gung gurl pna’g ernq lbhe znvy.
Lrf, guvf vf fnepnfz. Qbjaybnq CTC, yrnea gb hfr vg. HFR vg!

[sanjuanbob]

I totally agree with you. Also if you change your ID to a Muslim name, you’ll probably be OK.

[driftdiver]

they have backdoors into any commercial encryption software plus the computing power to break most others.

[madison10]

Exactly.

[zeugma]

Some in law enforcement claim that everyone is guilty of something and that the first words out of any “perp’s” mouth are a lie.

Well, given that you can commit a 'felony' by putting prescription drugs in one of those boxes designed for daily meds, yeah, just about every american is guilty of something.

[meowmeow]

"Well, given that you can commit a 'felony' by putting prescription drugs in one of those boxes designed for daily meds, yeah, just about every american is guilty of something."

Did you really think we want those laws observed? said Dr. Ferris. We want them to be broken. You'd better get it straight that it's not a bunch of boy scouts you're up against... We're after power and we mean it... There's no way to rule innocent men. The only power any government has is the power to crack down on criminals. Well, when there aren't enough criminals one makes them. One declares so many things to be a crime that it becomes impossible for men to live without breaking laws. Who wants a nation of law-abiding citizens? What's there in that for anyone? But just pass the kind of laws that can neither be observed nor enforced or objectively interpreted and you create a nation of law-breakers and then you cash in on guilt. Now that's the system, Mr. Reardon, that's the game, and once you understand it, you'll be much easier to deal with.

Ayn Rand,
Atlas Shrugged 1957

[Eagle of Liberty]

I like your tagline and the mindset behind it.

THANK YOU!

[DBrow]

Gurer vf n serrjner TAH CTC irefvba gung vf fhccbfrq gb or tbbq, gbb. CTC vf abg gur bayl fbhepr. Naq nf V fhfcrpg lbh xabj Sversbk unf n YRRGXRL cyhtva jvgu frireny bcgbaf.

Thanks!

[familyop]

E-mail is not private, in effect. But passing a law allowing it to accessed and read would allow it to be used as evidence against you.

For example, hypothetically, you receive investment advice spam through e-mail as part of a personal effort to learn more about economics. Intruder, looking for a case and maybe some extra revenues/debt, reads it and assumes that you have extra money to invest, even though you’re poor and haven’t hidden any income from anyone. Heh...there you are. Trouble.

Imagine uses of exaggerations and false assumptions from such information used against you in the current, hysterical political atmosphere. As for snail mail, I saw a case where police illegally received and opened letters from a postal employee during the ‘70s with no punishment for doing so.

We’re morally bankrupt as a nation. We’ve become un-American in regards to what our country once was. Look closely at the demographics of politicians and other leaders of the past for a clue.

[familyop]

"But after law enforcement groups including the National District Attorneys' Association and the National Sheriffs' Association organizations objected to the legislation and asked him to "reconsider acting" on it, Leahy..."

Interesting. Support your local federal funding recipients. [Little irony, humor and sarcasm there.]

[generally]

X3ll3n7 AdV1C3. w3 n33d 70 D3v3L0P n0n-3l3c7r0N1C n37W0RX 0f 7rU573D pa7R107Z.

[DBrow]

You got me on that one!

[DBrow]

oops nope I got it. Agree. As for non-electronic, the old BBS systems, computer-to-computer, might be viable with encryption. Otherwise steganography, or snail-mail encrypted messages.

[Forgotten Amendments]

Tonight, Mark Levin will go on and on about liberty, the Constitution, Montesquieu, etc. But when it comes to real issues like this ... silence. His affiliates cater to little old ladies who love the police state and Levin won’t rock the boat. It’s a shame.

[Tzimisce]

Yeah well - I’m sure they have a good reason.

Now go pay your taxes - your government is broke. :)

/sarc(?????????)

[zeugma]

V hfr TCT, fvapr gur cnpxntrf sbe vg ner ernqvyl ninvynoyr va Yvahk. V’ir hfrq CTC be fbzr inevnag bs vg fvapr vg jnf n pbzznaq-yvar-bayl QBF cebtenz. Zl ovttrfg ceboyrz unf orra pbaivapvat bguref vg vf jbegu gur gebhoyr gb frg hc xrlf.

[zeugma]

If software backdoors to your encryption programs concern you (and it should IMO), you should use one of the free alternatives that are fully open source, like GPG.

As for breaking good encryption, good luck. Unless they have made a fundamental and previously unknown breakthrough in the mathematics involved, modern encryption, properly implemented is not crackable. Computational speed doesn't matter when the brute force attack on a key requires more power than exists in the universe. A 4k key should be safe until the heat death of the universe. That's long enough IMO.

[driftdiver]

” Unless they have made a fundamental and previously unknown breakthrough in the mathematics involved, modern encryption, properly implemented is not crackable. “

I’ve watched a guy from China sit down and break a AES256 encrypted message with a desktop computer.

[SaraJohnson]

If the Senate GOP had a brain they would be raising cain over Reed trying to end the constitution in the name of national security. If they would become concerned about freedom for a change, they would actually have something valuable to offer to voters for a change.