The U.S. government is expanding a cybersecurity program that scans Internet traffic headed into and out of defense contractors to include far more of the country's private, civilian-run infrastructure. As a result, more private sector employees than ever before, including those at big banks, utilities and key transportation companies, will have their emails and Web surfing scanned as a precaution against cyber attacks.| Clearly we need to 'harden' critical communications, internet, electrical, etc facilities against cyber-attack. I'm all for being careful. I just get a creepy feeling watching this administration do this sort of thing... |
The Department of Homeland Security will gather the secret data and pass it to a small group of telecommunication companies and cyber security providers that have employees holding security clearances, government and industry officials said. Those companies will then offer to process email and other Internet transmissions for critical infrastructure customers that choose to participate in the program.
By using DHS as the middleman, the Obama administration hopes to bring the formidable overseas intelligence-gathering of the NSA closer to ordinary U.S. residents without triggering an outcry from privacy advocates who have long been leery of the spy agency's eavesdropping.
| How does using DHS accomplish that? It just turns DHS into a spy agency. |
| So statistics about an email talking about committing a terrorist attack somewhere will be aggregated with a bunch of statistics about other suspicious emails? That doesn't make a bit of sense. |
The administration is separately seeking legislation that would give incentives to private companies, including communications carriers, to disclose more to the government.
| What they call 'incentives' we might call 'coercion'... |
"There is a way to do this that ensures civil liberties and privacy and does ensure the protection of the country," Alexander told a congressional hearing.
In the past, Internet traffic-scanning efforts were mainly limited to government networks and Defense Department contractors, which have long been targets of foreign espionage. But as fears grow of a destructive cyber attack on core, non-military assets, and more sweeping security legislation remained stalled, the Obama administration opted to widen the program.
| It's a legitimate concern. Do we want Big Sis and Eric Holder running this? |
Under the program, critical infrastructure companies will pay the providers, which will use the classified information to block attacks before they reach the customers. The classified information involves suspect Web addresses, strings of characters, email sender names and the like.
Not all the cybersecurity providers will be telecom companies, though AT&T is one. Raytheon said this month it had agreed with DHS to become a provider, and a spokesman said that customers could route their traffic to Raytheon after receiving it from their communications company.
As the new set-up takes shape, DHS officials and industry executives said some security equipment makers were working on hardware that could take classified rules about blocking traffic and act on them without the operator being able to reverse-engineer the codes. That way, people wouldn't need a security clearance to use the equipment.
The issue of scanning everything headed to a utility or a bank still has civil liberties implications, even if each company is a voluntary participant.
Lee Tien, a senior staff attorney with the nonprofit Electronic Frontier Foundation, said that the executive order did not weaken existing privacy laws, but any time a machine acting on classified information is processing private communications, it raises questions about the possibility of secret extra functions that are unlikely to be answered definitively.
| Indeed, they can't be answered definitely: doing so tells the bad guys how to duck the screening process. |
One technique for examining email and other electronic packets en route, called deep packet inspection, has stirred controversy for years, and some cybersecurity providers said they would not be using that. In deep packet inspection, communication companies or others with network access can examine all the elements of a transmission, including the content of emails.
"The signatures provided by DHS do not require deep packet inspection," said Steve Hawkins, vice president at Raytheon's Intelligence and Information Systems division, referring further questions to DHS.
The DHS official said the government is still in conversations with the telecom operators on the issue.
The official said the government had no plans to roll out any such form of government-guided close examination of Internet traffic into the communications companies serving the general public.