{tech}.Ben Buckman.net

James Lewis at the Center for Strategic and International Studies was on Jon Gordon's Future Tense recently, discussing (in 2 parts) the risk of a cyber war attack on the U.S. (In a nutshell, he thinks the U.S. is the most vulnerable nation to cyber attack, but that use of such weaponry by states is unlikely for a while.) He also argues that the U.S. legal framework for cyber security needs to be revamped (starting around 2:40):

"The biggest limitation [of the current framework] is the ability to monitor traffic. Say that and everyone thinks 'warrantless surveillance,' and that's basically right. What if you could monitor traffic to look for malicious code, but you didn't look at content? We have that capability, but right now our laws don't distinguish between monitoring for malicious code and monitoring for content. They were written back in the old days when you couldn't do that. Do we want to have the kind of NORAD of cyberspace, but it isn't reading your email, and how do we persuade people to trust the government that it isn't doing that?"

Listen:

The other view is presented by another of my favorite podcasts, Search Engine (from Jesse Brown at Canada's TVO). They discuss ACTA (Anti-Counterfeiting Trade Agreement), a global treaty that would impose draconian restrictions and monitoring requirements on internet traffic under the guide of a treaty, circumventing (at least in Canada) the democratic and legislative processes. I don't know why ACTA hasn't gotten more coverage here, and I plan to keep on top of it now.

On the Nov. 10 episode, Jesse interviews Ron Diebert, founder of the Citizen Lab, an independent cyber-sleuthing (and online-freedom agenda-advocating) organization at UToronto. Diebert argues against the push for ISPs to monitor and collect more and more information on users and pass it to law enforcement and intelligence:

The need hasn't been demonstrated. In fact, it's not a matter of lack of access to information that is preventing law enforcement from doing their job, it's actually the opposite. The NSA sucks up the equivalent of the entire contents of the Library of Congress 6-8 hours every single day. To me there's something wrong with that paradigm. And then of course when you factor in that what's being requested here violates some basic civil liberties, I think we need to take stock of what's going on here.

He also talks about some huge international cyber-crime and cyber-espionage rings that the Citizen Lab cracked, without any extra-legal surveillance, all with already open data sources.

As for the technology, I'm not sure if it's as simple as Lewis makes its out to be. As I understand it, he's arguing for the equivalent of an anti-virus scanner for all online traffic, a dragnet that only looks for and collects malicious code. But law enforcement will never be happy with that. If malicious code from some IP one day, they'll want to look back retroatively at that IP's records. It's like surveillance cameras: once the camera's recording, with disk space being so cheap, they might as well keep everything in a very long-term archive.

Where does that leave us? I agree with Diebert in principle, but civil liberties arguments rarely win against law enforcement, especially when terrorism or warfare is brought into the picture. So the free world will soon go the way of China and Iran, where anything you do can be traced back to you and a blog post can have the police knocking on your door. In Iran it's for political speech; in the case of ACTA it'll be for copyright infringement, but the definitions are so broad and so draconian that it's already set to criminalize content that's taken for granted today.