Cyber-curing what ails us will demand global remedies

Earlier this week (January 13, 2015), President Obama unveiled a slew of proposed cybersecurity-related initiatives, ranging from updated cyber-information sharing legislation to empowering and re-tooling law enforcement to battle cyber-crime; from new data breach reporting requirements to a February 2015 White House Summit on protecting consumers online.

These are all laudable initiatives, indeed, necessary initiatives (although, in light of countless Snowden-unveiled tidbits over the last couple of years, I have my worries about overly-broadly better-empowering law enforcement which, in cahoots with U.S. intelligence agencies, seems to have demonstrated a frighteningly consistent pattern of abuse of such power).

But, to some extent, these proposed initiatives all miss the broader and more critical point: Cyberspace is global, borderless. And, so too, is cyber-malice.  Thus, until and unless the Administration devotes similar – indeed, more forceful - attention to identifying and agreeing globally-applicable disciplines, domestic remedies such as proposed may be challenged to succeed, at least in the grand cyber-scale of things.

Yes, the proposed information sharing legislation would enable the public and private sector to better exchange information about and better analyze, understand and effectively address cyber threats, as well as better safeguard Americans’ personal privacy through the institution of stricter requirements for private companies that collect or use personal data.

Yes, modernizing the legal ecosystem to allow for the prosecution of the sale of things like spyware used to stalk or commit ID theft, as well as the criminalization of the overseas sale of stolen U.S credit card and bank account numbers, and the granting of authority to courts to shut down botnets engaged in DDOS attacks and other criminal activity, are all good and necessary things.

Yes, simplifying and standardizing existing State laws that require businesses to notify consumers of data breaches and corralling them into one Federal statute should indeed serve to both better incent businesses to upgrade their cybersecurity and, thus, better stem the tide of identity theft, financial compromise, etc. 

And, yes, the proposed February 13 “White House Summit on Cybersecurity and Consumer Protection” at Stanford - which will include Administration leaders, CEOs from a range of industries, law enforcement representatives, consumer advocates and technical experts – cannot help but contribute constructively to better educating and protecting American consumers and companies.

These initiatives all seem to acknowledge the need to restore consumer and corporate trust in the networks that power our digital lives and livelihoods, as well as the integrity of the data that funnels through or resides in such networks.  This is a good thing (notwithstanding that the initiatives seem to utterly ignore widespread concerns related to U.S. Government domestic surveillance, espionage, etc.).

While a “fortress America” approach to cybersecurity might be a welcome panacea for the masses, it is insufficient to deal with more global and more potentially devastating cyber-threats, whether Government-spawned malware like Stuxnet, massive-scale DDOS attacks, the theft of billions in intellectual property, or, the big fear, the disruption or destruction of critical infrastructure.

Pre-Snowden, the Administration was quite bullish on setting and enforcing global cyber norms and standards.  As Snowden’s Revelations have wreaked havoc on America’s cyber credibility, the U.S. seems to have hunkered down, shying away from the lead on global solutions, and, by virtue of that seeming withdrawal, to some extent actually perpetuating global insecurities and vulnerabilities.

This week’s White House announcements were heartening, and, hopefully, will lead to an improved State of the cyber-Union, as well as some level of restored confidence in the integrity of networks and data.  However, these initiatives are but domestic pieces of a much bigger global puzzle, the completion of which should remain of the highest priority to U.S. authorities if the domestic initiatives are to be truly meaningful in the long-term.

Surveillance Competition, Take Two...

Two days ago, I blogged on the recent revelation that U.S. intelligence agencies have been intercepting American-made routers and servers and inserting backdoors so that they can penetrate networks in markets in which the gear is deployed (link to my May 13 post).

Since then, the story has continued, including with ars technica running photos yesterday of busy beaver agents “upgrading" Cisco routers at a “secret location” (link).  No shit.

In the post I made a couple of days ago, borrowing from Glenn Greenwald’s Monday unveiling of the NSA’s export interception hijinks (link), I tied the new revelation to the politico-protectionist market access barriers that my employer Huawei Technologies has experienced in the U.S.

Following, is my nutshell synopsis of what’s been going on and why the U.S. Government has been blockading Huawei at home, and attempting to blackball the company abroad (Australia, South Korea, etc.):

Over the last few years, Huawei has grown to become either the leading or number two telecommunications infrastructure provider globally, with Huawei routers and servers and other gear becoming commonplace across the planet.

This turn of events has made the NSA’s eavesdropping practices ever-so-slightly more challenging.  It is far easier to re-route U.S. exports through “secret locations” for beacon-implants than to similarly compromise Huawei gear shipping from elsewhere to elsewhere.

Nevertheless, the NSA has attempted to maintain its overwhelming surveillance footprint through its Shotgiant program which, among other things, stole Huawei proprietary product info with the intent to compromise Huawei gear where deployed (link to my March 25 post on the topic), but it would seem this is a far less efficient model than surreptitious interception and “upgrade” of outbound U.S. exports.

What do to, what to do?

Impede Huawei’s global business. Stymie and attempt to roll back Huawei’s worldwide share so that the NSA's eavesdropping activities could be most easily and broadly managed.

How?

Demonize the company, starting with the U.S. market blockade, then extending to arm-twisting in foreign markets.  The blockade was key.  If Huawei had been allowed an even marginally-significant footprint in the U.S., it would have both furthered the company’s global success and market share, and undermined U.S. Government smear and blackball campaigns in other markets.

I’m not sure this policy is working.

The U.S. strong-arm tactics had some success in Australia, in terms of Huawei not being considered for the government-sponsored national broadband network (NBN) project, but they haven't prevented Huawei from successfully serving Australian commercial network operators.  And, more recent U.S. Government attempts to undermine competition and choice in South Korea seem to have fallen flat altogether.

Worse yet, this week’s revelations from Greenwald may well have yet further adverse impact on the overseas prospects for networking gear from U.S. suppliers, yet further hampering the NSA’s ability to conduct surveillance (not to mention wreaking some potentially not-insignificant commercial havoc for the victimized companies).

Look, I’m not saying that the U.S. government should not be engaged in espionage and intelligence-gathering that is critical to maintaining our national security (although I would observe that the domestic overreach that the Snowden Revelations have detailed over the last 11 months is truly reprehensible).

But the policy and practices have failed, both in terms of the exposure of the NSA’s compromise of U.S. Internet and telecommunications service providers and, as recently learned, ICT gear-makers as well, but also in terms of demonizing a world-respected ICT leader like Huawei (and in so doing also depriving American service providers and consumers of innovative and competitive broadband equipment alternatives).

It’s time for a reset.  Across the board.

While we’ve not likely heard the last from Snowden, et al, the crisis of confidence in the ICT industry is reaching a fever pitch. At stake is a global and interdependent economy that increasingly relies on digital and virtual tools and processes.

It’s time for industry and governments to come together to restore confidence in network and data integrity and security – in the Internet itself – and to do so in a rational, pragmatic, and non-political fashion.   See any number of my posts over the last year for thoughts on how this might happen.

America’s Cyber-Contortionist (and Free Trade Champion? – Not)

Just a few days ago, cyber-security specialists and senior government representatives met in Germany at the 50^th annual Munich Security Conference.  

Since 1963, the MSC has served as “an independent forum dedicated to promoting peaceful conflict resolution and international cooperation and dialogue in dealing with today’s and future security challenges.” (More at: https://www.securityconference.de/en/).

Needless to say, in recent years, the MSC has focused on security challenges in the realm of cyber.  This year’s sessions were no different.  One session in particular stood out for me: The January 31 Panel Discussion focused on: "Rebooting Trust? Freedom vs. Security in Cyberspace."

The President of Estonia made an opening statement, and then the CEO of Deutsche Telekom introduced the panelists, including the German Minister of the Interior, the EU Commissioner for Home Affairs, Microsoft’s VP of Security, Huawei’s Chief Security Officer (reminder: Huawei is my employer), and the Chairman of the U.S. House of Representatives Permanent Select Committee on Intelligence (HPSCI), Mike Rogers. 

The panel was moderated by the President of the EastWest Institute, an organization founded in 1980 which “seeks to make the world a safer place by addressing the seemingly intractable problems that threaten regional and global stability.” (More on EWI at http://www.ewi.info/).

Generally speaking, the panelists (almost all) acknowledged the shattered trust in the information communication technology industry (and select governments) in the wake of the Snowden revelations.  Likewise, the panelists (most) detailed possible steps towards restoring confidence.

One panelist, however, stuck out like a sore thumb (one cannot imagine the countless phrases I considered and rejected for that analogy): Chairman Mike.

Go figure.

Mike opened with an acknowledgment that there is “a trust issue,” but pondered aloud about why the group was really gathered: “Damaging classified information that was leaked?  Maybe so.”  But, Mike thinks not.  Indeed, Mike commented that he was “a little surprised” that people were talking about “the problems with the NSA.” 

The Chairman then transitioned into scare-mongering about Iran, North Korea, Russia, China, etc., oozed into an explanation that reports of U.S. spying on French phone calls were misrepresented, and, subsequently, segued to his key mis-direction of the day:  

“The most recent release of information…the United States engages in economic espionage…I have been on the oversight committee doing oversight for our 16 intelligence agencies…for the last ten years…It is against the law in the United States to use our intelligence services for industrial espionage…If they do it, they are going to jail. Period. End of story.” 

Now that’s only part one of the mis-direction, but let’s take a brief time-out to consider it.

Last September I posted on Mike’s utter failure to conduct the oversight with which he is charged (link), so I won’t belabor that point.  But, since he has raised laws and jail, let’s hold him to it: If future revelations show that such industrial espionage did take place, then Mike, by virtue of his position, is aware of and as such complicit to such “illegal” activity and he should be summarily incarcerated…

…But let’s get back to the Chairman’s key mis-direction, part two:

Per Mike: “Now wouldn’t you find it interesting that that information was released at a time when we’re trying to arrange a trade arrangement that I think benefits both Europe and the United States…  I do…”

This little nugget doesn’t get fully matured until the Q&A session, but, the gist: The Russians are managing Snowden in order to time his revelations to tank U.S.-EU Free Trade talks.

In the Q&A session, Mike hammers it home: “I think it’s a huge mistake to allow this issue…to step in the way of a trade agreement between Europe and the United States.  These are two very separate issues…but by tying them together I will guarantee you that you will see more disclosures like we saw last week that the Americans engage in economic espionage…” 

He went on: “You’re gonna see more of that because it breeds distrust – the Russians have a specific purpose for driving a wedge between us and our European allies.”

The Chairman is wrong.  

Not in terms of our seeing further revelations, but in terms of his interpretation of the “tie” between European privacy concerns and the U.S.-EU Free Trade talks.

Europeans have every right to consider privacy protections in the context of U.S.-EU Free Trade negotiations – the former might (albeit unlikely) serve as leverage towards achieving some sort of protections in the context of agreeing the latter, although not likely in the actual substance of any trade agreement.  That is a legitimate tie.  Mike’s suggestion that the Russians are somehow orchestrating the tie borders on absurd.

It gets worse.  Following his initial suggestion that the Russians are orchestrating revelations, and in advance of his Q&A session elaboration on this point, Mike goes on to propel himself headlong into a trap he has set for himself more than once in recent months: 

In defending the integrity and due process of U.S. espionage activities, the Chairman refers to “an oversight mechanism that is not seen anywhere else in the world.  Our judicial branch, our…legislative branch, and our executive branch have to go through an approval process for these activities… that is an important distinction and we argue that is our transparency.”

Sigh. 

Really?  That reference, and the Chairman’s subsequent Q&A session reference to the FISA court and 4^th Amendment protections, are both to processes that only apply to American citizens, and, seemingly, only within U.S. borders, and, from what we have had revealed to us by Mr. Snowden, perhaps not at all. 

One thing is certain though: Europeans and other non-Americans do not benefit from any such oversight or Constitutional prophylaxis (as was pointed out by one clued-in questioner).

C’mon Mike. C’mon America.  Is this the best we have, is this the best we can do?  

(Link to video of the full 1.5 hour panel discussion)

A Thickening Plot; A Devil's Bargain?

Over the last two weeks since the uncloaking of the U.S. Government's PRISM and related global  surveillance and data-mining activities, I have twice suggested that perhaps one of the most damaging outcomes will be the fragmentation of the Internet (link to June 7 post; link to June 14 post).

In both posts, my focus was not on the technological architecture of the Internet, but, rather, on what has to date been a remarkably global Internet service ecosystem, led by innovative and first-to-market American companies. 

I have expressed concern that the reports of leading U.S. Internet companies in cahoots with the American intelligence apparatus could lead to a profound lack of trust in these companies, particularly outside the U.S., resulting in a mass migration to alternative (existing or greenfield) non-U.S. Internet destinations, social networks and other Internet services that market themselves as "safe" or independent from spy agencies.

While such a power-shift in the Internet service industry could well introduce a new era of Internet innovation and competition, it might not bode terribly well for the American incumbents, or even U.S.-based newcomers.  

Of equal or greater concern, however, is that such a trend could lead to the fracturing or Balkanization of the Internet, at least on a service level, undermining the openness and freedom and global exchange of information that the Internet has fostered over the last two decades.

As mentioned above, what my recent musings haven't focused on is the impact that the PRISM+ and related revelations might have on the global ICT industry.

Over the last couple of years I have rather regularly commented on the prejudicial treatment my employer - China-headquartered Huawei Technologies - has experienced in the U.S.  When you peel away all of the histrionic fear-mongering, you come up with not a shred of remotely substantive cause for any unique-to-Huawei cyber- or national security concern.  It all boils down to the company being domiciled in China.  And given that every one of our competitors do as much R&D and coding and building in China as we do, the domicile of headquarters is hardly an indicator of a unique threat.

In many of those posts on anti-competitive U.S. policies, I have raised the concern that the political protectionist  policy model being pursued in the U.S. - however poorly veiled as cyber security initiative - might set a precedent for similar such policies in other markets, to the detriment of U.S. companies doing business overseas.  There were any number of times over the last two years when I thought such mimicking of or retaliation against U.S. policy might be triggered.

It seems PRISM+ may have done the trick.

TechInAsia ran an article today titled "Chinese Media: Snowden Says Cisco Helped the US Spy on China" (link).  The article quotes from and links to multiple Chinese Media outlets noting that Cisco equipment powers much of the Chinese Internet and reporting that Cisco had been identified as somehow linked to the U.S. Government's PRISM or related spying tools.  

While the article notes that it is unclear if PRISM leaker Snowden or anyone else has actually specifically charged Cisco with such collusion, it adds: "...It probably doesn't matter at all...regardless of what Snowden actually said, Cisco and other American companies are going to have a much harder time winning Chinese contracts than they used to."

I'm not certain that such challenges will be limited to Chinese contracts.  Indeed, will Cisco and other American companies have any more success proving negatives in China or elsewhere than Huawei has had in the U.S.?  Can these companies expect treatment somehow different than the hybrid Star Chamber-witch hunt experience that Huawei has suffered in the U.S.?  Did American policy-makers and politicians not anticipate that their antics and precedents might backfire on them?

The TechInAsia article concludes with a poignant point which takes a slightly different direction on the Balkanization concern that I have been expressing in recent posts: "Just a decade or so after Internet and communications technology brought the whole world closer together, it increasingly looks like hacking and surveillance scandals and suspicions are likely to tear it back apart."

Sad, but seemingly true.

Protection of our nation's networks and data is a paramount policy goal.  But, equally important should be policy which further encourages the blossoming of the open Internet, open and free communications and exchange of information, freedom of speech and democratic values.  

As of this point in time, we seem to have sacrificed or are in the process of sacrificing the latter - not only in terms of practice and integrity within the homeland but also in terms of our ability to export such values abroad - for the former.  A devil's bargain indeed.

Internet Balkanization Yet More Likely - PRISM+

A little over a week ago, it became known that Verizon was surrendering data on all telephony traffic over its networks to U.S. security agencies.  A day later, a young U.S. intelligence operative – a rare and anomalous “patriotic traitor” – leaked the details of a top secret U.S. Government global digital surveillance and data mining program built on access to the rich and almost-endless data reservoirs of leading American Internet companies (PRISM). 

This morning, Bloomberg reported (link) that “Thousands of technology, finance and manufacturing companies are working closely with U.S. national security agencies, providing sensitive information…” ranging from advance notice of “zero day-exploit” flaws in software, other vulnerabilities, hardware and software specifications of gear shipped overseas, metadata from any individual device.  Further, as Bloomberg reports, “some U.S. telecommunications companies willingly provide intelligence agencies with access to facilities and data offshore that would require a judge’s order if it were done in the U.S.”

Among other things, the existence of such programs calls into question the purpose of the much bally-hooed Cyber Intelligence Sharing and Protection Act (CISPA), introduced in the House of Representatives in 2011, which would allow for the sharing of vulnerability information between the U.S. government and technology and manufacturing companies to help the U.S government investigate cyber threats and ensure the security of networks against cyberattacks.  It seems that this is already happening in the absence of any statutory authority.  (Aside: Ironically, in terms of recent PRISM and related news, the White House has in the past opposed CISPA because it “lacks confidentiality and civil liberties safeguards”).

More importantly, what Bloomberg exposed today goes well beyond sharing of vulnerability information.  Indeed, according to Bloomberg, “In some cases, the information gathered may be used not just to defend the nation but to help infiltrate computers of its adversaries.”  This is certainly true in terms of zero-day vulnerabilities.  Consider the following excerpt from Gigaom’s reporting today (linked):

“Imagine you’re a government customer of Microsoft’s, in some country that isn’t the U.S. You’re already anxious over the PRISM scandal and its implications for data processed in the firm’s cloud. Now this: according to a Bloomberg report on Friday, when Microsoft finds a vulnerability in its software it informs U.S. intelligence agencies before its own customers. 

So, in theory, apart from having advance notice to patch their own systems, those agencies could exploit that zero-day vulnerability to hack into your data, before Microsoft gives you a chance to patch the flaw. And it’s not just Microsoft. According to the report, “thousands of [U.S.] technology, finance and manufacturing firms” are closely aligned with American national security agencies.”

Equally concerning, or more so from an individual perspective, in terms of the metadata that is collected from compromised U.S. hardware vendors in accord with another recently-unveiled U.S. Government program code-named “Blarney.”  While it remains unclear to what extent Blarney relies on “backbone hacking” as referenced by PRISM leaker Snowden and/or the “software and hardware specifications” that Bloomberg reports U.S. tech companies are sharing with security agencies, whatever the combination, the information gathered includes, per Bloomberg, “which version of the operating system, browser and Java software are being used on millions of devices around the world, information that U.S. spy agencies could use to infiltrate those computers or phones and spy on their users.”

To the extent such activities are truly extra-territorial, they are not subject to U.S. law nor is any oversight or permission required by the Foreign Intelligence Surveillance Act or the FISA Court.  Interestingly, per Bloomberg, “Most of the arrangements are so sensitive that only a handful of people in a company know of them, and they are sometimes brokered directly between chief executive officers and the heads of the U.S.’s major spy agencies.”

As for any potential violation of U.S. law or the privacy and liberties of American citizens, Bloomberg reports that “before they agreed to install the system on their networks, some of the five major Internet companies…asked for guarantees that they wouldn’t be held liable under U.S. wiretap laws. Those companies that asked received a letter signed by the U.S. attorney general…granting them immunity from civil lawsuits.”

In a related and somewhat heartening report, the New York Times detailed today (link) how Yahoo!, one of the companies named as part of the NSA's PRISM data collection program, didn't go quietly.  The company was behind a 2008 FISA court challenge to fight a court order requiring the company to give data to the U.S. Government without a warrant. 

According to the Times, "the company argued that the order violated its users’ Fourth Amendment rights against unreasonable searches and seizures. The court called that worry “overblown.”  Yahoo! lost.  While Yahoo! was not identified as the plaintiff at the time of the case, limited information about the case and its resolution was made partially public, putting other American Internet companies on notice a legal challenge would likely be fruitless.

A week ago today, just as PRISM was being unveiled for the public, I posted my concern that PRISM might herald a fracturing of the Internet as non-U.S. customers – governments, enterprises and individuals – may well lose trust in American Internet incumbents and leaders (link to my June 7 post).  Today’s additional information - claims that thousands of U.S. tech vendors are apparently engaged in voluntary information exchange with America’s spy agencies – amplifies my worry.

Indeed, Gigaom reported yesterday (link) that “a division of the Swedish government has prohibited government bodies from using Google Apps.”  While the Swedish review predates the outing of PRISM, per Gigaom,“it’s fair to view the news as the latest proof point in the resistance to relying on shared infrastructure certain United States companies run because the U.S. government can access data.”

We will doubtless see more of this.

It is true that the Internet has ushered in a new era of and architecture for espionage and crime.  And our Government is correct to take measures to ensure our national security and safety. The over-reaching that has been reported over the last week should be of concern to every American in terms of the potential – or very real - violation of their personal privacy and liberties.  But we should also be concerned about the broader impact. 

Notwithstanding that spies and criminals wield the Internet to their own ends, the benefits that the Internet has extended far eclipse such concerns, as does the potential sacrifice of those benefits (and I’m not just talking about the devastating commercial impact that a global loss of trust might have on American Internet and tech companies, and, by extension, the broader U.S. economy).  

The Internet – intrinsically global in nature by virtue of the globalization of information and communications technologies – has been a powerful force for the exchange of information, for freedom of speech, for democratic values.  The fracturing, fragmentation or Balkanization of the Internet is in no-one’s long-term interest, including even the U.S. national security agencies whose overreach via PRISM and otherwise may well have backfired in terms of future access to global intelligence.

PRISM and Internet Balkanization

Yesterday's outing of the U.S. Government's PRISM intrusions into the lives of virtually every Netizen on the planet - with some level of complicity from the likes of Google, Facebook, MS, Yahoo! and others (notwithstanding their remarkably consistent protestations of not having allowed "direct access" to the NSA) - may well herald a fracturing of the Internet.

On the one hand, we are witnessing a digital business opportunity unseen since the blossoming of the commercial Internet.  While Google, Facebook, et al are sure to survive in the homeland - although there's a hue and cry coming once the average American realizes what's been done - what once seemed relatively secure global hegemony is now in peril.

Trust is fragile.

Let's consider Europe, a market in which people take their privacy rather seriously, where the American pre-Internet (and still) experience with direct mail marketing is, in some countries, outright illegal.  Indeed, in Europe, because of such concerns, it is illegal for an EU citizen's personal data to be processed or even hosted on servers outside the EU, unless the company doing the processing is in a country that has data protection laws of as high a standard as the EU.

Even before the PRISM outing, the U.S. was not deemed to conform to these standards, but the PRISM-compromised Internet companies benefited from an EU "Safe Harbor" provision through which they could self-certify their conformity to EU-style standards.

Needless to say, no-one's gonna put much credence in such self-certifications in the wake of yesterday's news.

It is a distinct likelihood that alternative social networking and Google-esque platforms will emerge in Europe - and other markets - where Netizens perceive more meaningful data protection rules and checks on Government intrusion.  This is the commercial opportunity I referenced above.  And the Euro-nationalists will eat it up.

Balkanization? No, but a re-ordering?  Quite likely.

And it gets worse for America - now tossed down from the moral Internet high ground - from a political perspective.

Granted, PRISM doesn't equate to the Internet censorship and related digital and very real-world suppression of free speech in markets like Iran and, to lesser extent, China.  But, no matter what is happening with the data being PRISM'd, just the fact that it is being collected undermines America's credibility in terms of Internet freedom, perhaps empowering some authoritarian regimes to extend their online restrictions and crackdowns, or - worse yet - their own cyber mischief targeted at Americans online.

And, sadly, I think PRISM may just be the tip of the iceberg.  Stay tuned...