Bill would give pres emerg control of Internet

[gski]

Politics and Law

August 28, 2009 12:34 AM PDT

Bill would give president emergency control of Internet

by Declan McCullagh


Internet companies and civil liberties groups were alarmed this spring when a U.S. Senate bill proposed handing the White House the power to disconnect private-sector computers from the Internet.

They're not much happier about a revised version that aides to Sen. Jay Rockefeller, a West Virginia Democrat, have spent months drafting behind closed doors. CNET News has obtained a copy of the 55-page draft of S.773 (excerpt), which still appears to permit the president to seize temporary control of private-sector networks during a so-called cybersecurity emergency.

The new version would allow the president to "declare a cybersecurity emergency" relating to "non-governmental" computer networks and do what's necessary to respond to the threat. Other sections of the proposal include a federal certification program for "cybersecurity professionals," and a requirement that certain computer systems and networks in the private sector be managed by people who have been awarded that license.

"I think the redraft, while improved, remains troubling due to its vagueness," said Larry Clinton, president of the Internet Security Alliance, which counts representatives of Verizon, Verisign, Nortel, and Carnegie Mellon University on its board. "It is unclear what authority Sen. Rockefeller thinks is necessary over the private sector. Unless this is clarified, we cannot properly analyze, let alone support the bill."

Representatives of other large Internet and telecommunications companies expressed concerns about the bill in a teleconference with Rockefeller's aides this week, but were not immediately available for interviews on Thursday.

A spokesman for Rockefeller also declined to comment on the record Thursday, saying that many people were unavailable because of the summer recess. A Senate source familiar with the bill compared the president's power to take control of portions of the Internet to what President Bush did when grounding all aircraft on Sept. 11, 2001. The source said that one primary concern was the electrical grid, and what would happen if it were attacked from a broadband connection.

When Rockefeller, the chairman of the Senate Commerce committee, and Olympia Snowe (R-Maine) introduced the original bill in April, they claimed it was vital to protect national cybersecurity. "We must protect our critical infrastructure at all costs--from our water to our electricity, to banking, traffic lights and electronic health records," Rockefeller said. The Rockefeller proposal plays out against a broader concern in Washington, D.C., about the government's role in cybersecurity. In May, President Obama acknowledged that the government is "not as prepared" as it should be to respond to disruptions and announced that a new cybersecurity coordinator position would be created inside the White House staff. Three months later, that post remains empty, one top cybersecurity aide has quit, and some wags have begun to wonder why a government that receives failing marks on cybersecurity should be trusted to instruct the private sector what to do.

Rockefeller's revised legislation seeks to reshuffle the way the federal government addresses the topic. It requires a "cybersecurity workforce plan" from every federal agency, a "dashboard" pilot project, measurements of hiring effectiveness, and the implementation of a "comprehensive national cybersecurity strategy" in six months--even though its mandatory legal review will take a year to complete.

The privacy implications of sweeping changes implemented before the legal review is finished worry Lee Tien, a senior staff attorney with the Electronic Frontier Foundation in San Francisco. "As soon as you're saying that the federal government is going to be exercising this kind of power over private networks, it's going to be a really big issue," he says.

Probably the most controversial language begins in Section 201, which permits the president to "direct the national response to the cyber threat" if necessary for "the national defense and security." The White House is supposed to engage in "periodic mapping" of private networks deemed to be critical, and those companies "shall share" requested information with the federal government. ("Cyber" is defined as anything having to do with the Internet, telecommunications, computers, or computer networks.) [/u]
"The language has changed but it doesn't contain any real additional limits," EFF's Tien says. "It simply switches the more direct and obvious language they had originally to the more ambiguous (version)...The designation of what is a critical infrastructure system or network as far as I can tell has no specific process. There's no provision for any administrative process or review. That's where the problems seem to start. And then you have the amorphous powers that go along with it."

Translation: If your company is deemed "critical," a new set of regulations kick in involving who you can hire, what information you must disclose, and when the government would exercise control over your computers or network.

The Internet Security Alliance's Clinton adds that his group is "supportive of increased federal involvement to enhance cyber security, but we believe that the wrong approach, as embodied in this bill as introduced, will be counterproductive both from an national economic and national secuity perspective."

Declan McCullagh is a correspondent for CBSNews.com who writes a daily feature called Taking Liberties focused on individual and economic rights. You can bookmark his CBS News Taking Liberties site here, or subscribe to the RSS feed. You can e-mail Declan at [e-mail].

Declan McCullagh, CBSNews.com's chief political correspondent, chronicles the intersection of politics and technology. He has covered politics, technology, and Washington, D.C., for more than a decade, which has turned him into an iconoclast and a skeptic of anyone who says, "We oughta have a new federal law against this." E-mail Declan.


Now we need to have the internet controlled too?

[dgriffin]

I'm thinking the above is now true for telephone networks as well as radio and tv stations. True now. We might be surprised at what powers have quietly accrued in the "national emergency" bucket.

[dgriffin]

National Emergency Powers


Report by the Congressional Research Service


Updated August 30, 2007

www.fas.org/sgp/crs/natsec/98-505.pdf

SUMMARY:

"Federal law provides a variety of powers for the President to use in response to
crisis, exigency, or emergency circumstances threatening the nation. Moreover, they
are not limited to military or war situations. Some of these authorities, deriving from
the Constitution or statutory law, are continuously available to the President with
little or no qualification. Others — statutory delegations from Congress — exist on
a stand-by basis and remain dormant until the President formally declares a national
emergency. These delegations or grants of power authorize the President to meet the
problems of governing effectively in times of crisis. Under the powers delegated by
such statutes, the President may seize property, organize and control the means of
production, seize commodities, assign military forces abroad, institute martial law,
seize and control all transportation and communication, regulate the operation of
private enterprise, restrict travel, and, in a variety of ways, control the lives of United
States citizens. Furthermore, Congress may modify, rescind, or render dormant such
delegated emergency authority."

[Clipper]

I was always under the impression that the president had the power already to control media, communications etc. when necessary to the national security. I also thought that the government was the driving force behind the changeover to digital TV signals from analog due to the need for the government to free up those frequency bands for government use.

I guess I may be confused, but why do we need additional legislation to cover these government powers? I am not savvy when it comes to understanding frequency allocation or the terminology and workings of such electronic transmissions. One would think that the government could simply take control if, and when, necessary such as other countries do. One would also think that it would be done only in time of war or extreme national emergency or pending danger.

Maybe someone more informed could clarify the legalese and simplify the content of the report for me.

[gski]

Guys,

A cyber threat. That means internet or anything connected to the internet.

Guess, what, virtually everything is. That means, denial of service attacks, as an example, could be "deemed" an emergency or crisis. The language has been changed to be vague at best.

Second, the bill states that, the government will "map, private networks"

The new version would allow the president to "declare a cybersecurity emergency" relating to "non-governmental" computer networks and ... certain computer systems and networks in the private sector be managed by people who have been awarded that license.

What business does the government have mapping or telling a private business that they must be allowed to map their network? That means if they deem your company necessary for whatevery reason you have to open up your network to them so they can map the network.

Probably the most controversial language begins in Section 201, which permits the president to "direct the national response to the cyber threat" if necessary for "the national defense and security." The White House is supposed to engage in "periodic mapping" of private networks deemed to be critical, and those companies "shall share" requested information with the federal government. ("Cyber" is defined as anything having to do with the Internet, telecommunications, computers, or computer networks.)

You can think of it this way. If they deem that Road Runner, a large ISP is critical, then they have to open up their network to the federal government to map. This is even before there's an emergency.

When vague and broad terms are used in our current government, without any specifics of why or what private sector control they want, I have an issue with it.

It's one thing to say, a government defense contractor, it's another to say "engage in mapping of private sector networks deemed critical".

[dgriffin]

Well, this is where we're going, technologically. As gski points out, virtually everything today ... business, defense, utilities ... run on computers and most of it over the Internet. In fact, one reason why we pay only access charges to an ISP as we sit here and shoot the breeze on this forum is because the government and large companies have borne the cost of originally developing and establishing such networks.

Any potential enemy of the US ... and the scary part is that group not only includes countries who own nuclear attack submarines, but also now a college kid on a PC in his dorm room ... can annihilate the US by attacking our networks (theoretically) and must be met by immediate and draconian measures as outlined by the Powers Act. Yes, the powers are outrageous. How could it be effective and be otherwise?

We are moving toward a controlled society. It isn't a sea change of ideology that is the cause of this avalanche falling on our civil rights. Liberals aren't the problem. They are rather only a symptom.
The root of the problem is the arithmetic of too much population and the technology now available to provide what appear to be relatively cheap and easy solutions to each dilemma. If you want to stop crime on James St., you have to know when it's taking place. Cameras are cheaper than patrolmen, so the near term solution is obvious. But the long term implications for society as a whole are not being considered. Whose job it that?

I don't know, either. But was there any serious and successful effort after World War II? Did anyone form a government agency with power to consider where weapons research had landed us and what could we do to stop it, if it could be stopped? (It can't.) Do you remember what Oppenheimer said as he watched the first atomic bomb light the sky? "“I am become death, the destroyer of worlds.”

We ain't headed to Oz, Tinman. We're headed to perdition.

(Dave now passing the basket. But at least he's stopped preaching!)