Howard Schmidt
Longtime Internet security-policy pioneer Howard Schmidt died on Friday.
He will be missed.
Entries Tagged "national security policy"
Page 21 of 61
Me at the RSA Conference
This is my talk at the RSA Conference last month. It’s on regulation and the Internet of Things, along the lines of this essay.
I am slowly meandering around this as a book topic. It hasn’t quite solidified yet.
Palantir and the NSA
The Intercept has a long article on the relationship between Palantir Technologies and the NSA, based on the Snowden documents.
CSIS's Cybersecurity Agenda
The Center for Strategic and International Studies (CSIS) published “From Awareness to Action: A Cybersecurity Agenda for the 45th President” (press release here). There’s a lot I agree with—and some things I don’t—but these paragraphs struck me as particularly insightful:
The Obama administration made significant progress but suffered from two conceptual problems in its cybersecurity efforts. The first was a belief that the private sector would spontaneously generate the solutions needed for cybersecurity and minimize the need for government action. The obvious counter to this is that our problems haven’t been solved. There is no technological solution to the problem of cybersecurity, at least any time soon, so turning to technologists was unproductive. The larger national debate over the role of government made it difficult to balance public and private-sector responsibility and created a sense of hesitancy, even timidity, in executive branch actions.
The second was a misunderstanding of how the federal government works. All White Houses tend to float above the bureaucracy, but this one compounded the problem with its desire to bring high-profile business executives into government. These efforts ran counter to what is needed to manage a complex bureaucracy where greatly differing rules, relationships, and procedures determine the success of any initiative. Unlike the private sector, government decisionmaking is more collective, shaped by external pressures both bureaucratic and political, and rife with assorted strictures on resources and personnel.
How the US Secret Service Breaks into Smartphones
Here’s an article about the US Secret Service and their Cell Phone Forensics Facility in Tulsa.
I said it before and I’ll say it again: the FBI needs technical expertise, not backdoors.
New Rules on Data Privacy for Non-US Citizens
Last week, President Trump signed an executive order affecting the privacy rights of non-US citizens with respect to data residing in the US.
Here’s the relevant text:
Privacy Act. Agencies shall, to the extent consistent with applicable law, ensure that their privacy policies exclude persons who are not United States citizens or lawful permanent residents from the protections of the Privacy Act regarding personally identifiable information.
At issue is the EU-US Privacy Shield, which is the voluntary agreement among the US government, US companies, and the EU that makes it possible for US companies to store Europeans’ data without having to follow all EU privacy requirements.
Interpretations of what this means are all over the place: from extremely serious, to more measured, to don’t worry and we still have PPD-28.
This is clearly still in flux. And, like pretty much everything so far in the Trump administration, we have no idea where this is headed.
Security Risks of the President's Android Phone
Reports are that President Trump is still using his old Android phone. There are security risks here, but they are not the obvious ones.
I’m not concerned about the data. Anything he reads on that screen is coming from the insecure network that we all use, and any e-mails, texts, Tweets, and whatever are going out to that same network. But this is a consumer device, and it’s going to have security vulnerabilities. He’s at risk from everybody, ranging from lone hackers to the better-funded intelligence agencies of the world. And while the risk of a forged e-mail is real—it could easily move the stock market—the bigger risk is eavesdropping. That Android has a microphone, which means that it can be turned into a room bug without anyone’s knowledge. That’s my real fear.
I commented in this story.
EDITED TO ADD (1/27): Nicholas Weaver comments.
Obama's Legacy in Internet Security
NextGov has a nice article summarizing President Obama’s accomplishments in Internet security: what he did, what he didn’t do, and how it turned out.
New White House Privacy Report
Two days ago, the White House released a report on privacy: “Privacy in our Digital Lives: Protecting Individuals and Promoting Innovation.” The report summarizes things the administration has done, and lists future challenges:
Areas for Further Attention
- Technology will pose new consumer privacy and security challenges.
- Emerging technology may simultaneously create new challenges and opportunities for law enforcement and national security.
- The digital economy is making privacy a global value.
- Consumers’ voices are being heard—and must continue to be heard—in the regulatory process.
- The Federal Government benefits from hiring more privacy professionals.
- Transparency is vital for earning and retaining public trust.
- Privacy is a bipartisan issue.
I especially like the framing of privacy as a right. From President Obama’s introduction:
Privacy is more than just, as Justice Brandeis famously proclaimed, the “right to be let alone.” It is the right to have our most personal information be kept safe by others we trust. It is the right to communicate freely and to do so without fear. It is the right to associate freely with others, regardless of the medium. In an age where so many of our thoughts, words, and movements are digitally recorded, privacy cannot simply be an abstract concept in our lives; privacy must be an embedded value.
The conclusion:
For the past 240 years, the core of our democracy—the values that have helped propel the United States of America—have remained largely the same. We are still a people founded on the beliefs of equality and economic prosperity for all. The fierce independence that encouraged us to break from an oppressive king is the same independence found in young women and men across the country who strive to make their own path in this world and create a life unique unto to themselves. So long as that independence is encouraged, so long as it is fostered by the ability to transcend past data points and by the ability to speak and create free from intrusion, the United States will continue to lead the world. Privacy is necessary to our economy, free expression, and the digital free flow of data because it is fundamental to ourselves.
Privacy, as a right that has been enjoyed by past generations, must be protected in our digital ecosystem so that future generations are given the same freedoms to engage, explore, and create the future we all seek.
I know; rhetoric is easy, policy is hard. But we can’t change policy without a changed rhetoric.
EDITED TO ADD: The document was originally on the whitehouse.gov website, but was deleted in the Trump transition. It’s now available at the Obama archives site.
A Comment on the Trump Dossier
Imagine that you are someone in the CIA, concerned about the future of America. You have this Russian dossier on Donald Trump, which you have some evidence might be true. The smartest thing you can do is to leak it to the public. By doing so, you are eliminating any leverage Russia has over Trump and probably reducing the effectiveness of any other blackmail material any government might have on Trump. I believe you do this regardless of whether you ultimately believe the document’s findings or not, and regardless of whether you support or oppose Trump. It’s simple game-theory.
This document is particularly safe to release. Because it’s not a classified report of the CIA, leaking it is not a crime. And you release it now, before Trump becomes president, because doing so afterwards becomes much more dangerous.
MODERATION NOTE: Please keep comments focused on this particular point. More general comments, especially uncivil comments, will be deleted.
Sidebar photo of Bruce Schneier by Joe MacInnis.