|
benelchi -> RE: Obama to pull plug on internet? (11/3/2009 2:23:24 PM)
|
quote:
ORIGINAL: GroupW
I think the article may be factually incorrect on some points. The actual bill would allow the president to "declare a cybersecurity emergency and order the limitation or shutdown of Internet traffic to and from any compromised Federal Government or United States critical infrastructure information system or network"
First - it's a legitimate concern that needs to be addressed. Currently, internet-related components are a key component of our national infrastructure - power grids, internal US government operations, etc. - and have proven themselves on a few occasions to be vulnerable to hacking.
A system needs to be more than "at risk" - it needs to actually have been compromised.
Second - This bill would not allow a shut down of all private internet access - only security-critical components of government networks, government contractors (but only critical components), and critical infrastructure components (e.g. power grid controls.)
Third - The last quote is indeed factually inaccurate. It would not apply to any private network and couldn't be used to shut down "all Americans' access to the internet." That would be a gross distortion of the actual language. The actual bill asks for certification only for government and government-critical networks. Makes sense to me - like you want any old yahoo in charge of security-critical infrastructure?
Below is the language regarding licensing (the key words being "critical infrastructure".)
SEC. 7. LICENSING AND CERTIFICATION OF CYBERSECURITY PROFESSIONALS.
(a) IN GENERAL- Within 1 year after the date of enactment of this Act, the Secretary of Commerce shall develop or coordinate and integrate a national licensing, certification, and periodic recertification program for cybersecurity professionals.
(b) MANDATORY LICENSING- Beginning 3 years after the date of enactment of this Act, it shall be unlawful for any individual to engage in business in the United States, or to be employed in the United States, as a provider of cybersecurity services to any Federal agency or an information system or network designated by the President, or the President’s designee, as a critical infrastructure information system or network, who is not licensed and certified under the program
Did you know that there are only about a dozen peering points on the Internet where the big Tier one and Tier two providers interconnect their networks? These peering points would count as "security-critical components" and most today reside in guarded highly secure locations i.e. with armed guards and concrete reinforced buildings. Because almost all traffic on the Internet passes through one of these points, a shutdown of these facilities would nearly disconnect all Americans from the Internet i.e. they would only be able to access the parts of the Internet that were directly connected to the networks to which they themselves are connected i.e. AT&T customers would only be able to access other AT&T customers, etc... Additionally because of the adoption of route registries (like RADB) alternative routing would be nearly impossible to setup because route filtering based on these registries would prevent the distribution of alternative routes. This kind of power really would allow the government to, in essence, shutdown the Internet; the question is whether or not we trust the government with that kind of power.
|
|
|
|