Rome Burns. We Fiddle.
Steve King, CISM, CISSP
Cybersecurity Marketing and Education Leader | CISM, Direct-to-Human Marketing, CyberTheory
Those who welcome the Obama Administration’s announcement last week that it is issuing an executive order to set up a national Cyber Threat Intelligence Integration Center, might want to think some more about that. This came as part of Obama’s White House Summit on Cybersecurity and Consumer Protection at Stanford University on Friday. The stated purpose of the Center is to “integrate all data from government agencies and the private sector, and disseminate it appropriately.”
I’m not sure what disseminate it appropriately means and I would argue that you don’t either. I’m also not sure that any government agency that I can think of is going to be willing to share anything. If history is a fair guide, then we know that U.S. intelligence agencies have had their own silos of information about cybersecurity and cyberterrorism for years and have been doggedly stingy about sharing anything with anybody.
Top executives from several powerful Silicon Valley “private sector” companies, (Facebook's Mark Zuckerberg, Yahoo's Marissa Mayer and Google's Larry Page) did not attend the summit amid ongoing and increasing concerns about government surveillance. Really? However, Bank of America and PG&E did attend which may tell us all we need to know.
The third problem is that the Center as described will rely on private sector participation, which means private sector cost, which will never get private sector funding. While the security community is always big on information sharing, they have zero impact on spending. There are no businesses that I know of including Google that will spend money to give the Federal Government data out of some sense of national pride or patriotism.
Cooperation with the private sector has always been a major tenet of the Obama administration's approach to cybersecurity, but it has repeatedly met with at best a lukewarm reaction in the past.
As an example of our government intelligence community’s view of information sharing with the private sector, the recent Sony breach is a good example (and, no … I am never giving up on my theory of that breach until proven wrong). The U.S. National Security Agency (reportedly) knew in advance about the attack because it had penetrated North Korea’s computer systems, but did not warn Sony it claims now because its mandate is to protect national security and not the private sector. So, great start huh?
My other favorite part of this whole thing is the announcement that the Center will initially have a staff of 50 and a budget of US$35 million and will be led by James Clapper, the Director of National Intelligence.
Yes, this would be the same James Clapper who lied to Congress under oath about the NSA's activities, denying the agency had spied on Americans, only to be unmasked by Edward Snowden's revelations. No, I am not making this up.
In addition to the phot-op rich announcement in Silicon Valley, The White House forgot to tell Congress about its plan to establish the new intelligence center, leaking the information to the Washington Post on Monday instead.
This of course prompted several senators to dash off a letter to President Obama, calling for among other things, Clapper's immediate dismissal.
So, what we have here is a large, grandiose announcement that sounds like a great plan for everybody to stick their oars in and start rowing in the same direction to support a centralized program led by a known criminal with $35 million of our taxpayer dollars, presumably to work together with Darpa-Dan down the street with another $500 million, while all of the agencies and private businesses stand on the docks with their oars in their pockets.
In the meantime, the cyber-outlaws are laughing and scratching while perpetrating the largest bank heist in history, hacking into 100 banks in 25 countries and stealing over $300 million and counting, even as you read this.
It "takes a lot more than a speech, handshake and a promise to build complex, robust and scalable information sharing systems," said Ken Westin, senior security analyst at Tripwire. "Like many others, I really want to see this program work, but a lot of us are skeptical because we understand the complexities and pitfalls of getting something like this done."
Obama said, explaining the order. “Everybody is online, and everybody is vulnerable.” Amen, brother.
Federal Unified Cyber Knowledge Education and Distribution - an acronym worthy of this effort! Obama's initiative is just an effort to appear as if the government cares. Oh, and Facebook announces they will have a threat information sharing service soon. Will they be publishing their source code? :-)