[Infowarrior] - Privacy experts question Obama's plan for new agency to counter cyber threats

[Richard Forno]

Privacy experts question Obama's plan for new agency to counter cyber threats

White House to unveil on Tuesday the Cyber Threat Intelligence Integration Center but critics fear an expansion of government monitoring of online data

Spencer Ackerman in New York

http://www.theguardian.com/world/2015/feb/10/obama-cyber-threat-agency-privacy

Tuesday 10 February 2015 14.12 EST

Cybersecurity and digital privacy experts are questioning the need for Barack Obama’s latest bureaucratic initiative, a new agency spurred by the massive Sony hack that critics fear will expand the government’s role into monitoring online data networks on security grounds.

White House security adviser Lisa Monaco unveiled on Tuesday the Cyber Threat Intelligence Integration Center, the name of which speaks to its position within a US intelligence community whose ongoing, surreptitious reach over the internet has attracted global skepticism.

Monaco said the remit of the new center, subordinate to the office of the director of national intelligence and modelled on the National Counterterrorism Center, is said to be the combination of the various intelligence, security and law enforcement agencies’ understanding and analysis of new or emerging malicious cyber-attacks.

“We’re going to have to work in lockstep with the private sector,” said Monaco, who called the December hack of Sony, which she blamed on North Korea, a “game changer”.

“We want this flow of information to go both ways,” Monaco said.

Over the past five years, the administration has stood up new entities, such as the National Security Agency’s military twin US Cyber Command, or expanded the remit of others, like the Department of Homeland Security, to safeguard government – and increasingly civilian – networks.

“Given the number of other agencies that have cybersecurity threat integration responsibilities, it’s not clear that a new agency is needed,” said Greg Nojeim of the Center for Democracy and Technology.

“We are keen to hear from the White House about the measures it will impose to ensure that this new agency operates transparently, with effective independent oversight, and does not become a repository for personal information unnecessary to counter cyber threats.”

A senior US official said the center, initially budgeted at $35m, is intended to give the government awareness of new online threat patterns “in as close to real time as possible”. While it will “facilitate and support efforts by the government to counter foreign cyber threats,” the official said it will have no offensive role, and is limited to “strictly intel fusion and analysis”. Monaco added that it will not collect intelligence.

Yet earlier government cyber efforts, such as those from the Department of Homeland Security’s National Cybersecurity and Communications Integration Center (NCCIC), have previously promised near-real time identification of threats at its “24-7 cyber situational awareness, incident response, and management center,” prompting skepticism from security experts about the ability of the center to deliver on its stated promise.

“They really could have just restructured at DHS how the NCCIC works to really move threats together in a comprehensive fashion, and a real-time fashion, where you could actually get some value out of it,” said Tony Cole, a top executive at the cybersecurity firm FireEye, who said he was hearing similar puzzlement from industry leaders about the new center.

“If you still are not restructuring agencies to be able to share in an automated fashion, then there’s probably little value to be had out of creating a new organization.”

After the Edward Snowden leaks, legislation seeking to expand business’ sharing of threat pattern data – one of the top priorities of the NSA in the new Congress – has stalled in the Senate. While the Obama administration and congressional advocates intend DHS to be the primary interlocutor for businesses, the NSA will be able to access the information, raising concerns amongst privacy advocates that more customer data, including financial information, will pass to US intelligence agencies.

Monaco pressed again for passage of cybersecurity legislation that would legally immunize companies that take “reasonable steps” to remove customer and other private data before providing threat information to the government – leaving the door open to that information indeed passing to security and intelligence agencies, a critical privacy concern.

The NSA – which, along with Cyber Command, performs so-called “offensive cyber” operations – declined to specify its role in the new center. The senior official, while speaking generically, confirmed that “staff will be drawn from across departments and agencies, including the IC”, or intelligence community.

A divide has emerged in recent months between how data-privacy advocates and the Obama administration view cybersecurity in the aftermath of huge data breaches from Sony, Target, Home Depot and now the Anthem health insurance company.

Digital security campaigners want the government to emphasize techniques private firms can use to harden their network defenses, such as the expanded use of encrypted data. The administration prefers expanded data-sharing from the private sector to stay atop of online threats – and the director of the FBI has recently described encryption as an unacceptable hindrance to law enforcement.

Amie Stepanovich, a lawyer with the digital rights group Access, said the center “has real potential to violate privacy in a very meaningful and widespread manner” if it serves primarily as a threat-pattern clearinghouse.

If the center instead serves as an interlocutor to promote “standards and incentives” for data hygiene and security “to protect these very harmful data breaches, it could be very positive, if done in a transparent way,” Stepanovich said.

Monaco spoke to that point in her Tuesday speech. She said a major focus of Obama’s cybersecurity approach will be to encourage “basic cyber hygiene”.

Existing government initiatives for cybersecurity, which the new center builds upon, have come in for legislative criticism. A report last month from the former senator Tom Coburn claimed it was “unclear” if the $700m DHS spends on cybersecurity to aid “the private sector in preventing, mitigating, or recovering from cybersecurity incidents are providing significant value or are worth the tax dollars spent on them.”

On Friday, Obama plans to attend a cybersecurity summit at Stanford University with leading business figures and academics to forge a post-Snowden cybersecurity consensus.

Monaco disputed that the new center would be a redundant bureaucracy. She argued it would provide “critical, rapid, coordinated intelligence to feed operations. It’s not duplicative at all”.


--
It's better to burn out than fade away.