The Legality of Government Critical Infrastructure Monitoring

Mason Rice, Robert Miller, and Sujeet Shenoi (2011), “May the US Government Monitor Private Critical Infrastructure Assets to Combat Foreign Cyberspace Threats?” International Journal of Critical Infrastructure Protection, 4 (April 2011): 3–13.

Abstract: The government “owns” the entire US airspace–it can install radar systems, enforce no-fly zones and interdict hostile aircraft. Since the critical infrastructure and the associated cyberspace are just as vital to national security, could the US government protect major assets–including privately-owned assets–by positioning sensors and defensive systems? This paper discusses the legal issues related to the government’s deployment of sensors in privately owned assets to gain broad situational awareness of foreign threats. This paper does not necessarily advocate pervasive government monitoring of the critical infrastructure; rather, it attempts to analyze the legal principles that would permit or preclude various forms of monitoring.

Tags: academic papers, cyberwar, infrastructure, laws

Posted on September 7, 2011 at 2:32 PM • 16 Comments

Comments

CMike • September 7, 2011 2:45 PM

If the assets in question are so vital to national security that monitoring and threat interception is needed, then why not federalize the assets in question? (I realize this flies in the face of private ownership of property, but the government long ago crossed that line…)

NobodySpecial • September 7, 2011 3:32 PM

to Combat “Foreign” Cyberspace Threats?

And of course there is no way that any government security agency would mostly be used to spy on internal threats!

mcb • September 7, 2011 3:42 PM

“Since the critical infrastructure and the associated cyberspace are just as vital to national security…”

Who said this is true? Oh wait, the International Journal of Critical Infrastructure Protection did…

Dirk Praet • September 7, 2011 5:35 PM

Which eventually begs the question: is there anything a government can’t or shouldn’t do as long as in some way it serves “national security”. I am pretty sure that in countries like China, Iran and the former USSR the answer to that is a unanimous no.

Whether or not this is also what the Founding Fathers had in mind is of course an entirely different issue. After all, these guys in their days were never exposed to the horrors of ubiquitous muslim terrorism or the perils of the digital age. They had fled Europe for quite frivolous reasons, drafting a constitution based on principles that for many today really are way out of touch with reality.

Jon • September 7, 2011 6:01 PM

The fundamental point of the Constitution was to limit what government could do.

However, being both the guardians and interpreters thereof, they’ve managed to pretty much subvert it (not surprising, really. What’s surprising is how long it lasted).

Peter E Retep • September 7, 2011 8:13 PM

Techno Capability limited by some other consideration is almost always a bias of some sort.

Osherin • September 8, 2011 3:42 AM

I looked into that issue a couple of years back (trying to understand the ownership of smart grids in years to come) by evaluating what’s publicly available on the CIP programs within 24 countries against the “ International CIIP Handbook“. and mapped the CIP programs against (More) or (Less) government Intervention. and came up with a diagram that show the following:

It’s clear that we are going towards state mandated compliance and powerful intervention ..you can check the diagram below

http://ciip.wordpress.com/2009/08/11/smart-grid-initiatives-and-government-intervension-world-wide/

vwm • September 8, 2011 4:30 AM

The analogy between airspace and cyberspace is wrong. There is only one limited airspace, but there can be as much cyberspace as someone is willing to pay for.

Instead of seizing control of privately-owned assets for obscure security reasons, one can simply install a similar, redundant asset and protect it in any suitable way.

grumpy • September 8, 2011 7:53 AM

Either this blog has a lot more readers than we think, or the /. crowd has found the article. ScienceDirect is down ATM. 🙂

Tyrone • September 8, 2011 8:15 AM

Even worse than the site being down-it’s behind a paywall. Abstract only available. Thanks but no thanks.

phred14 • September 8, 2011 8:51 AM

I don’t think that the concept of “critical infrastructure” even existed in the time of the founding fathers. About the only parallel to critical infrastructure would have been rivers and waterways. A little communing with Google brings up “Admiralty Law”, which as implemented by England was one of the driving factors behind the Revolutionary War.

But the US did have it’s own provisions for Admiralty Law in Article 3, Section 2 of the Constitution, however those powers were expressly not exclusive, and further weakened by the 7th Amendment. These references also have more to do with which court tries cases, rather than saying anything about administration or regulation.

Still, so much has been done (grabbed) using the Interstate Commerce, it might be nice to see different justification, for a change.

Ask yourself this: If the Wicked Emperor Wang and his evil minions from the planet Mongo were to hack into some vulnerable SCADA system and take down the electrical grid of the eastern half of the US, kind of like what happened by accident not that long ago…. Who would you blame?

Rather than out-and-out freedom-to-crack for DHS, I might suggest penetration resistance standards along with random testing. This should be “owned” by local PSBs, though probably contracted back out to DHS.

86 • September 8, 2011 10:18 AM

After reading the paper, it is apparent that the U.S. government already monitors such assets and even goes further — to the point of embedding federal workers in private companies.

full article • September 8, 2011 1:56 PM

http://www.sciencedirect.com/science/article/pii/S1874548211000047?_rdoc=3&_fmt=high&_origin=browse&_srch=doc-info(%23toc%2343672%232011%23999959998%233094760%23FLA%23display%23Volume)&_docanchor=&_ct=7&_refLink=Y&_zone=rslt_list_item&md5=b6c8c264c10f0b92829d447d703fa920

Notme • September 8, 2011 9:17 PM

For some reason, I thought this was already happening as part of government mandated cyber-security for utilities.

Benji • December 10, 2011 8:44 AM

To Mr. Osherin:
it seems your diagram is based on D. Assaf’s paper re Models of CIIP, International Journal of Critical Infrastructure Protection Volume 1. 2008.

C U Anon • December 11, 2011 1:04 AM

@ Benji,

“it seems your diagram is based on D. Assaf’s paper…”

If you look at the botom of the page Mr Osherin links to you will see the following note,

Note: The “Gov/CIP involvement” Diagram is Based on the article “Models of CIIP” by Dan Assaf. Published in elsavier’s “International Journal of Critical Infrastructure Protection” Volume 1. 2008

Did you miss it for some reason you would care to share?

Or are you asking a question which is not apparent from your post?

Schneier on Security

The Legality of Government Critical Infrastructure Monitoring

Comments

Leave a comment Cancel reply