[Infowarrior] - Congress cannot be taken seriously on cybersecurity

[Richard Forno]

Congress cannot be taken seriously on cybersecurity
Trevor Timm
@trevortimm
Saturday 18 April 2015 07.30 EDT

http://www.theguardian.com/commentisfree/2015/apr/18/congress-cannot-be-taken-seriously-on-cybersecurity

Members of Congress - most of whom can’t secure their own websites, and some of whom don’t even use email - are trying to force a dangerous “cybersecurity” bill down the public’s throat. Everyone’s privacy is in the hands of people who, by all indications, have no idea what they’re talking about.

Leaders are expected to bring its much-maligned series of “cybersecurity” bills to the floor sometime in the next couple weeks - bills that we know will do little to help cybersecurity but a lot to help intelligence agencies like the NSA vacuum up even more of Americans’ personal information. The bills’ authors deny that privacy is even an issue, but why we’re trusting Congress at all on this legislation, given their lack of basic knowledge on the subject, is the question everyone should be asking.

Just look at Congress’ own cybersecurity practices. None of the members of the Senate’s Intelligence Committee - the most influential cybersecurity oversight body in Congress - have websites that use HTTPS encryption, which is increasingly becoming the standard for websites who want to provide basic security protections for the people who visit them (Google and others have had it for years).

It’s such a vital tool that the executive branch recently promised to move all its websites over to HTTPS within two years - many of its agencies, though not all, have already made the switch. But there’s not even a hint that Congress is attempting to do the same. (The website of the Senate Intelligence Committee, which is in charge of cybersecurity oversight on the Senate side, also looks like it was designed in 1996.)

An overlooked but important Politico article published in January examined Congress’ own cybersecurity practices when it comes to defending their networks. Reporter Tal Kopan quoted several Congressional staffers saying Congress barely does anything to protect itself from cyberattacks, despite being a juicy target for foreign intelligence agencies. “Few could remember any kind of IT security training, and if they did, it wasn’t taken seriously”, Kopan reported

And how many Congressional staffers and their bosses protect their emails or phone calls with encryption? ACLU’s Chief technologist Chris Soghoian told me yesterday that using any sort of encryption tools “is the exception rather than the norm.” He said: “Most members of Congress and most congressional staff use unencrypted email and unencrypted telephones. Their communications are undoubtedly targeted by foreign intelligence services, just as the NSA targets the communications of foreign political leaders and their staff.” Not exactly encouraging.

Consider the qualifications of the members who are in charge of cybersecurity oversight and who are leading the push for these invasive new laws. The man in charge of the subcommittee on cybersecurity and the NSA in the House, Representative Lynn Westmoreland, has a background in construction and is best known for trying to pass a Ten Commandments law (while only being able to name three of them). His actual expertise in cybersecurity is anyone’s guess, besides having an NSA facility in his district.

It gets worse. The Congressman who oversees the appropriation of billions of dollars in cybersecurity funding for the Department of Homeland Security, Representative John Carter, said this about cybersecurity and encryption recently: “I don’t know anything about this stuff”. Yes, that is an exact quote.

And of course there’s Senator John McCain, who has been one of the loudest voices pushing several invasive “cybersecurity” spying bills and wants control of cybersecurity oversight to be placed under his Armed Services committee. McCain, who doesn’t even use email, has been consistently demanding more cybersecurity powers, but maybe he should try to fix his own cybersecurity problems first before moving on to everyone else’s. This is the security error message I got when trying to access his website on Thursday and Friday:

The only thing McCain seems to know a lot about when it comes to cybersecurity is hyperbole. He declared the Sony hack an “act of war” and called the voluntary, slight delay in the release of The Interview “the greatest blow to free speech that I’ve seen in my lifetime probably.” He also claimed that Sony’s negligent security practices were somehow Obama’s fault, though doesn’t seem to mind that Sony’s approach to security (termed “a complete joke” by one former employee) was so lax that they’re now being sued.

Congress never really bothered to ask actual security experts whether these bills really make sense. Earlier this week, 65 actual security professionals and academics signed a letter slamming these “info-sharing” bills as both unnecessary and dangerous.

Congress doesn’t have to be completely ignorant about technology issues. They used to have a whole office which would give them all the expert advice they asked for. It was called the Office of Technology Assessment and it gave Congress nonpartisan advice on technical matters. Newt Gingrich killed it when he became speaker of the House of Representatives in the mid-1990s. As Vox’s Timothy Lee explained, when Representative Rush Holt, a member of Congress who knew a thing or two (he was a nuclear physicist), tried to revive it, his plan was voted down almost 2-1.

So there you have it: Congress has intentionally chosen to stay ignorant of technical issues. When they try to reassure you about the bills that are coming up for vote not being about increasing surveillance, just remember: most of them have no idea what they’re talking about.

--
It's better to burn out than fade away.