The stories you want. The opinions that matter.
No, thanks
Tag: cyberattack
Cybersecurity Measures Inch Forward, But Critics Doubt Their Effectiveness

Cybersecurity Measures Inch Forward, But Critics Doubt Their Effectiveness

By Ryan Lucas, CQ-Roll Call (TNS)

WASHINGTON — Lawmakers are pushing measures they say will help boost the nation’s security from cyberattacks, but experts warn the efforts will do little to shield the country from increasingly sophisticated online hacking.

The growing need to protect the government’s computers and private databases from cybertheft and espionage grabbed headlines this month after the Office of Personnel Management revealed that the records of more than 4 million current and former government employees had been compromised by hackers. That attack, the latest in a series to hit federal systems, private health care providers, retailers and even Sony Pictures, has put pressure on the Obama administration and Congress to bolster Internet security.

On Capitol Hill, senators have traded barbs about a bill that would encourage private companies and the government to share information about cyberthreats and data breaches, and create liability protection for firms that do so. The House passed similar legislation earlier this year.

The theory behind these measures is simple: If companies are able to share cyberthreat indicators, other firms and the government can move quickly to secure their systems from the same threat.

The sponsor of the Senate bill, Intelligence Chairman Richard M. Burr, has touted the legislation as a way to thwart cyberattacks while also ensuring privacy rights.

“We can no longer simply watch Americans’ personal information continue to be compromised,” the North Carolina Republican has said. “This bill is long needed and will help us combat threats to our country and our economy.”

Critics of the information-sharing legislation, including Internet-security experts and privacy-rights advocates, contest both of those premises.

On the security side, many argue that information sharing will do little to plug gaps in the nation’s cyberdefenses.

“This really only addresses only a fraction of a fraction of the problem,” said Martin Libicki, senior management scientist at the Rand Corp. “What I think is more troubling is that this (information sharing) is being treated as a panacea.”

Libicki challenged the basic premise of information sharing: that if one company can detect and capture the threat signature of an attack, then it can share it with others. One of the problems with that idea, Libicki said, is it presumes hackers won’t change the threat signatures — the unique components of malicious computer code — to evade detection.

“That’s a big presumption,” he said.

It also assumes companies will want to share information about cyberthreats. But with reputations and stock prices at stake, that’s not always the case — even if a company enjoys the sort of liability and anti-trust protections offered by the legislation.

In April, more than 60 Internet-security researchers and professionals sent a letter to the leaders of the House and Senate Intelligence committees to express their opposition to all three information-sharing bills. They said the legislation permits overly broad sharing and would not contribute to greater cybersecurity.

Some in the Internet-security field, however, don’t paint information sharing in entirely dark tones.

Denise Zheng, a senior fellow the Center for Strategic and International Studies, said having access to the contextual information of an attack — the intent, the motive, the general tactics — is useful.

“It’s a step in the right direction. It will encourage or incentivize information sharing. But information sharing is just one piece of the equation,” Zheng said. “After you get access to the information about the threat, you have to take action, and the bill doesn’t do anything to compel action.”

In the wake of the Edward Snowden leaks about the National Security Agency’s programs, a cloud of privacy and civil liberties concerns invariably hangs over any cybersecurity legislation.

Lawmakers tried to address some of the privacy concerns by mandating personal information be scratched out of any data before it is sent to a government agency. One of the House bills even calls for two rounds of personal information scrubbing.

Despite those measures, concerns remain over where the information shared with the government will end up and to what purpose it will be put.

The Senate bill would permit the government to channel the cyberthreat information it receives from companies toward run-of-the-mill law enforcement investigations unrelated to cybersecurity, said Greg Nojeim, chief counsel at the Center for Democracy and Technology, which advocates for Internet privacy rights and legal controls on government surveillance.

“So for example, the Department of Justice could pool the information it receives under this program and mine it repeatedly for use in criminal investigations,” Nojeim said.

Among Congress’ sharpest critics of the bill is Sen. Ron Wyden. The Oregon Democrat was the sole member of the Senate Intelligence Committee to vote against the measure at the committee level.

“If you have a cyber bill without real privacy protections, it’s not really a cybersecurity bill, it’s a surveillance bill,” Wyden told reporters this week.

On the Senate side, the information sharing bill made its way to the floor this month, where Majority Leader Mitch McConnell allowed it to be offered as an amendment to the annual defense policy bill, HR 1735.

That infuriated many Democrats, who want the bill presented as stand-alone legislation so that it can be the subject to debate and amendments. Senate Armed Services Chairman John McCain (R-AZ) eventually withdrew the amendment after it failed to achieve the 60 votes needed to overcome a Democratic filibuster.

(c)2015 CQ-Roll Call, Inc., All Rights Reserved. Distributed by Tribune Content Agency, LLC.

Photo: Bob Micah via Flickr

Sony Hack Leaves U.S. In Quandary On How To Deal With North Korea

Sony Hack Leaves U.S. In Quandary On How To Deal With North Korea

By Christi Parsons and Brian Bennett, Tribune Washington Bureau (TNS)

WASHINGTON — With U.S. intelligence analysts quietly pointing to North Korea as having a hand in the destructive hack of Sony Pictures Entertainment computers, Obama administration officials scrambled Thursday to consider what, if anything, they should do in response.

Options are limited, partly because the United States already imposes strict sanctions on North Korea’s economy and because the country’s leader, Kim Jong Un, relishes confrontation with the West. White House officials are wary of playing into an effort by nuclear-armed North Korea to provoke the U.S. into a direct confrontation.

“How do you sanction the world’s most heavily sanctioned country?” asked John Park, a specialist on Northeast Asia at Harvard University’s John F. Kennedy School of Government.

Hackers caused tens of millions of dollars in damage last month to Sony Pictures’ computers, destroyed valuable files, leaked five unreleased films and exposed private employment information including 47,000 Social Security numbers.

In response to the cyberattack and a threat against movie theaters, Sony canceled the Christmas Day release of The Interview, a comedy starring Seth Rogen and James Franco that depicts a fictional assassination of Kim.

The Obama administration has stopped short of saying openly that North Korea was involved in the intrusion. Such an allegation would probably bring about calls for a response, and with an unwillingness to lay out its evidence, lack of available economic punishments and little desire for acts of war, the White House so far appears reluctant to make a public accusation.

Spokesman Josh Earnest would say only that the White House considers the breach of one of Hollywood’s largest studios to be a “serious national security matter.”

The administration is considering a range of options, he said, but wants to take care not to respond in a way that legitimizes those behind the attack. The attackers might try to provoke the U.S. to “enhance their standing,” Earnest said, indirectly nodding to North Korea’s appetite for needling other countries.

An unwillingness to go public leaves the U.S. with few choices.

One possibility would be to unleash the United States’ own hackers in the military’s Cyber Command to disable the computers that launched the attack and stop them from doing more damage. But to do that runs the risk of damaging computer systems in China, where, experts say, North Korea bases some of its cyber capabilities.

Such a counterattack would probably be done in secret and not announced. Earnest would not rule it out, however.

Sen. John McCain (R-AZ), who called Sony’s decision to cancel the movie’s release “profoundly troubling,” has long demanded the U.S. step up cyber operations and said the Obama administration was slow to respond to the attack.

Earnest insisted that responses under consideration may be ones “that we wouldn’t want to telegraph in advance.”

To name North Korea publicly, the U.S. would also need strong evidence linking the country to the attack, and administration officials gave somewhat differing accounts about the degree of its involvement.

One senior administration official, speaking anonymously to discuss internal assessments, said intelligence agencies have linked North Korea to the breach, but gave no details about how closely it was involved.

The FBI had not confirmed the North Korean government, directly or through a second source, was behind the hacking operation, said federal law enforcement officials, including bureau agents.

“We are still working it,” said one official, speaking confidentially because the case is underway. “We are not close yet to drawing any conclusions. Frankly, we’ve been surprised by the reports that say we are,” the official said.

Proving that North Korea was involved won’t be easy. The attack was reportedly routed through servers in Singapore, Thailand and Bolivia. Experts believe that North Korea lacks the capability to infiltrate Sony’s computers on its own and would have required the assistance of mercenary computer hackers, and possibly disgruntled Sony insiders.

Though most citizens in isolated, impoverished North Korea have no access to computers or the Internet, a small stable of highly skilled hackers are believed to work for the country. Computer attacks are a useful tool for North Korea’s aims of provocation because they are inexpensive to carry out and can be plausibly denied, experts said.

North Korea is “really working on their cyber capability; it gives a poorer nation international reach,” retired Brig. Gen. Michael McDaniel, a former Pentagon official, said.

The public information linking North Korea to the attack is largely circumstantial.

In June, the nation called the plot of The Interview an “act of war.” After the attack on Sony began, though, North Korea said it had no part. Still, it lauded the hacking as a “righteous deed of supporters and sympathizers.”

North Korea has a history of lashing out at those who criticize or ridicule it. Last year, South Korea concluded the North was behind a hack of banks and media outlets known as critical of North Korea.

“The hacking code that was used in the attack on Sony was very similar to the code that North Korea has used in cyberattacks on South Korea, so I believe it was them,” said Kim Seung-joo, a professor at Korea University Graduate School of Information Security.

North Korea might have simply cooperated with whoever carried out the attack. “It’s likely that they were involved and somehow initiated it, but the damage that Sony sustained was beyond North Korea’s interest and capabilities,” said Leonid Petrov, a Korea studies researcher at Australian National University.

President Barack Obama, in an interview Wednesday on ABC News, acknowledged that the attack against Sony shows the U.S. has more work to do to strengthen its information security.

He said the FBI should know more about the attacks in coming days.

“We will be vigilant,” Obama said. “But for now, my recommendation would be that people go to the movies.”
___
(Times staff writer Julie Makinen in Beijing and special correspondent Steven Borowiec in Seoul contributed to this report.)

AFP Photo