LibriumArcana.Games

US President Barack Obama would be granted powers to seize control of and even shut down the internet under a new bill that describes the global internet as a US "national asset".

Local lobby groups and academics have rounded on the plan, saying that, rather than combat terrorists, it would actually do them "the biggest favour ever" by terrorising the rest of the world, which is now heavily reliant on cyberspace.

The proposed legislation, introduced into the US Senate by independent senator Joe Lieberman, who is chairman of the US Homeland Security committee, seeks to grant the President broad emergency powers over the internet in times of national emergency.

Titled "Protecting Cyberspace as a National Asset Act", the bill stipulates any internet firms and providers must "immediately comply with any emergency measure or action developed" by a new section of the US Department of Homeland Security, dubbed the "National Centre for Cybersecurity and Communications".

Lobby group TechAmerica told ZDNet it worried that the bill would give the US "absolute power" over the internet and create "unintended consequences".

One of Australia's top communications experts, University of Sydney associate professor Bjorn Landfeldt, railed against the idea, saying shutting down the internet would "inflict an enormous damage on the entire world".

He said it would be like giving a single country "the right to poison the atmosphere, or poison the ocean".

"All our financial systems, all our security systems ... we're so reliant on the internet that if you shut it down there's a question of whether society will continue to operate normally anywhere in the Western world," Landfeldt said in a phone interview.

"By doing this they would do the terrorists the biggest favour ever because they would terrorise the rest of the world".

Landfeldt said the US would be the only country in the world with the ability to shut down the internet. He said such a move would be extremely difficult for the US to justify to other nations.

"Unfortunately, too much of the core of the internet resides in the US - let's put it this way, they cannot shut down machines in Australia, but they can completely isolate us and shut down certain core functions like the DNS ... they can render the internet fairly useless for the rest of the world," he said.

Senator Susan Collins, co-sponsor of the bill, has said: "We cannot afford to wait for a cyber-9/11."

Lieberman argued the bill was necessary to "preserve those networks and assets and our country and protect our people".

He said that, for all its allure, the internet could also be a "dangerous place with electronic pipelines that run directly into everything from our personal bank accounts to key infrastructure to government and industrial secrets".

US economic security, national security and public safety were now all at risk from new kinds of enemies, including "cyber warriors, cyber spies, cyber terrorists and cyber criminals".

Geordie Guy, spokesman for the online users' lobby group Electronic Frontiers Australia, said governments around the world seemed terrified of some unidentified risk that they believe the internet poses.

"The proposal is from Joe Lieberman, a repeat offender on rights versus regulation, in a bill called Protecting Cyberspace as a National Asset Act of 2010," he said.

"One wonders which nation Senator Lieberman considers the internet an asset of, and how proposing its destruction by presidential or homeland security order protects it.

"The internet is not a national asset of the United States, nor is it a media regulation problem of Australia. It is an international network used by millions upon millions of citizens and it needs to remain free and available."

Communications Minister Stephen Conroy did not respond to calls requesting comment.

Google, one of the world's biggest internet companies, declined to comment as it was not yet official US government policy.

Senator Susan Collins, co-sponsor of the bill, has said: "We cannot afford to wait for a cyber-9/11."

He said that, for all its allure, the internet could also be a "dangerous place with electronic pipelines that run directly into everything from our personal bank accounts to key infrastructure to government and industrial secrets".

US economic security, national security and public safety were now all at risk from new kinds of enemies, including "cyber warriors, cyber spies, cyber terrorists and cyber criminals".

Cyber 9/11? What does this even mean? It doesn't make any sense.

If you're worried about hackers stealing top secret government shit, don't put it on the internet!

The Minx wrote:Cyber 9/11? What does this even mean? It doesn't make any sense.

The Minx wrote:Of course cyber attacks are a real threat to a modern economy. But given a major attack where large sections of the internet are at risk of being shut down, I'm not sure what an "internet kill switch" would do to make things better. It looks sort of like setting your own house on fire to chase out the arsonist.

And again, can't other countries simply set up redundant systems to keep their own networks going in case the US pulls the plug?

Ace Pace wrote:Again, we're not talking about an internet kill switch. We're talking about the ability of the government to modify infrastructure rapidly. For example, shutting down specific transatlantic links. Or filtering away entire IP ranges (for pure internet stuff). Think.

The Minx wrote:

Ace Pace wrote:Again, we're not talking about an internet kill switch. We're talking about the ability of the government to modify infrastructure rapidly. For example, shutting down specific transatlantic links. Or filtering away entire IP ranges (for pure internet stuff). Think.

That's not what I gather from the article which not only specifies "kill switch" in the title, but either says or suggests as much at several points. Do you have additional information about what the bill says?

Not that granting the government the kind of power you suggest sits well with me either.

It's no secret that Senator Joe Lieberman (I-CT) isn't the most popular guy in the Senate, or that his rather conservative positions on national security have left many people suspicious of his motives when it comes to national security legislation. So it should have come as no surprise when CNET chief political correspondent Declan McCullagh wrote that Lieberman intended to give the President the power of an "Internet kill switch" in the event of a national emergency -- and sparked an uproar.

But, surprising it was -- especially to Lieberman and his staff on the Senate Committee on Homeland Security and Government Affairs. They argued that, in fact, the bill limited the powers already invested in the President to shut down telecommunications providers. Leslie Phillips, the communications director for the committee, said, "The very purpose of this legislation is to replace the sledgehammer of the 1934 Communications Act with a scalpel." So, who is right?

A review of the 1934 Telecommunications Act (as amended in 1996) does indicate that the President has broad powers to simply shut off any and all regulated telecommunications if he deems it necessary for national security. Section 706 of the Act, entitled "War Emergency -- Powers of the President" says:

(c) Upon proclamation by the President that there exists war or a threat of war, or a state of public peril or disaster or other national emergency, or in order to preserve the neutrality of the United States, the President, if he deems it necessary in the interest of national security or defense, may suspend or amend, for such time as he may see fit, the rules and regulations applicable to any or all stations or devices capable of emitting electromagnetic radiations within the jurisdiction of the United States as prescribed by the Commission, and may cause the closing of any station for radio communication, or any device capable of emitting electromagnetic radiations between 10 kilocycles and 100,000 megacycles, which is suitable for use as a navigational aid beyond five miles, and the removal therefrom of its apparatus and equipment, or he may authorize the use or control of any such station or device and/or its apparatus and equipment, by any department of the Government under such regulations as he may prescribe upon Communications Act of 1934 just compensation to the owners. The authority granted to the President, under this subsection, to cause the closing of any station or device and the removal therefrom of its apparatus and equipment, or to authorize the use or control of any station or device and/or its apparatus and equipment, may be exercised in the Canal Zone.

(d) Upon proclamation by the President that there exists a state or threat of war involving the United States, the President, if he deems it necessary in the interest of the national security and defense, may, during a period ending not later than six months after the termination of such state or threat of war and not later than such earlier date as the Congress by concurrent resolution may designate, (1) suspend or amend the rules and regulations applicable to any or all facilities or stations for wire communication within the jurisdiction of the United States as prescribed by the Commission, (2) cause the closing of any facility or station for wire communication and the removal therefrom of its apparatus and equipment, or (3) authorize the use or control of any such facility or station and its apparatus and equipment by any department of the Government under such regulations as he may prescribe, upon just compensation to the owners.

In other words, as Phillips told us, the President already has an Internet kill switch: he can't shut off a website, but he can shut off any and all wireless or wired Internet access.

Lieberman's Protecting Cyberspace as a National Asset Act of 2010 (S. 3480) is, thankfully, somewhat more complex than that. It requires that owners of critical infrastructure, a definition that dates to the PATRIOT Act, work with the newly created director of the National Center for Cybersecurity and Communications within the Department of Homeland Security, to develop a risk assessment and a plan to mitigate their risks in the case of a national cyber emergency. If an emergency is declared, that director will:

(A) immediately direct the owners and operators of covered critical infrastructure subject to the declaration under paragraph (1) to implement response plans required under section 248(b)(2)(C);

(B) develop and coordinate emergency measures or actions necessary to preserve the reliable operation, and mitigate or remediate the consequences of the potential disruption, of covered critical infrastructure;

(C) ensure that emergency measures or actions directed under this section represent the least disruptive means feasible to the operations of the covered critical infrastructure

None of those response plans expressly require that telecommunications providers develop a kill switch; in fact, the director is prohibited from requiring an critical infrastructure owner or operators from using any specific mechanism.

The owners and operators of covered critical infrastructure shall have flexibility to implement any security measure, or combination thereof, to satisfy the security performance requirements described in subparagraph (A) and the Director may not disapprove under this section any proposed security measures, or combination thereof, based on the presence or absence of any particular security measure if the proposed security measures, or combination thereof, satisfy the security performance requirements established by the Director under this section.

Phillips reiterated this point with TPMDC: "There is not a 'kill switch.'" When asked what measures might be envisioned by the legislation, she said, "A software patch, or a way to deny traffic from a certain country. All these measures were be developed with the private sector, not imposed on it."

In addition to the measures that allow companies to come up with their own ways to mitigate the risks to their companies (and customers) from cyber attacks, and the requirement that they use the least disruptive means possible and attempt to mitigate larger impacts, the legislation also only allows the President to impose the state of emergency for 30 days, with a potential extension of 30 days. Under current law, he is allowed to shut down any and all telecommunications infrastructure for as long as he likes.

McCullagh said, in his initial analysis, that "The legislation announced Thursday says that companies such as broadband providers, search engines, or software firms that the government selects 'shall immediately comply with any emergency measure or action developed' by the Department of Homeland Security." That is slightly misleading, as owners and operators of critical infrastructure have already been identified by the Department of Homeland Security as part of the PATRIOT Act and the 2002 Homeland Security Act.

Although the full list of pieces of critical infrastructure isn't available for download for obvious reasons, the membership of the Critical Infrastructure Partnership Advisory Council -- which is designed to give those owner-operators a chance to work closely with DHS when they are developing their regulations and assessing the ways to best protect critical infrastructure -- is publicly available. And, if gives a pretty comprehensive look at what, exactly, DHS considers "critical infrastructure."

There are 17 sector committees -- everything from chemical companies to nuclear facilities and shipping companies to dam operators. There is also one committee for communications infrastructure and another for information technology. The Communications Committee and Information Technology Committee have some overlap in terms of membership, but the exclusively consist of Internet infrastructure providers, telecommunications companies, some hardware companies and software companies that work in the security area. They do not include search engines, news web sites or anything of the kind -- sorry, folks, the government just doesn't consider you "critical" enough.

Phillips told TPMDC, "This language was developed with the companies who would be affected by it... The Senator [Lieberman] discussed the bill with privacy experts, civil liberties experts, companies affected by it, the Administration and the House." She expressed a certain level of shock about the backlash, pointing us to the committee's statements of support, which includes quotes from McAfee and Symantec executives (both members of the DHS Information Technology Committee); from the Center for Democracy and Technology -- which gave a quote seemingly not in support of the bill to CNET; and from the regulation-hating U.S. Chamber of Commerce.

On the one hand, yes, it does appear that this gives the government power over marginally more companies than it has now: there are critical infrastructure owners and operators not covered by the 1934 law that would be required to come up with a plan to respond to cyber attacks that meets certain standards set by the government. On the other hand, the Emergency Broadcast System, which requires that all television and radio stations interrupt their programming with a loud buzzing noise and carry the emergency message from the government might become a thing of the past if owners and operators could find better (and less disruptive) ways to alert Americans that there is an emergency. And, regardless, the President would only have 30 days to impose the state of emergency with little oversight, and the companies would be required to be as minimally disruptive to the rest of us as possible in the emergency plans they develop.

The "kill switch," though, won't be coming to the underside of the President's desk anytime soon, though. In fact, Lieberman's people seem to be correct: their bill actually just takes it away. The bill, by the way, faces a committee mark-up on Wednesday.

Ace Pace wrote:The government already has the power to shut down air, land and sea transportation. It can take over the radio waves in an emergency. All these things are sane and understandable in some situations.

The Minx wrote:
That may be, but the less ability they have to misuse such power the better, and control of the internet is a rather different from control of physical communications or radio.

Ace Pace wrote:The Internet != the internet lines, fibers, etc. But I repeat myself. The internet, in the end, is nothing more than backhaul lines and some heavy duty routers. No different from any other method of communication that the government has legitimate control over.