Is the Hacking Threat to National Security Overblown? | Threat Level | Wired.com - The Diigo Meta page

• 04 Jun 09
  

  TransTracker

  cyberwar

  • Is hacking a real threat to the United States or is it just the latest overblown threat to national security, whose magnitude is being exaggerated to expand government budgets and power?

  • Amit Yoran, a former Bush Administration cybersecurity czar, argues the answer is easy.

    
    

    “Is hacking a national security threat?” Yoran said. “The one word answer is ‘Yes.’”

    
    

    As proof, Yoran pointed to stories about the denial-of-service attacks in Estonia, attacks on government contractor Booz Allen Hamilton and the recently reported breach of defense contractor computers that let hackers get at information on the Joint Strike Fighter.

    
    

    “Cyber 9-11 has happened over the last 10 years, but it’s happened slowly so we don’t see it,” Yoran said.

    • 

      TransTracker on 2009-06-04

      Cyber 9-11 in slow motion! Nice! This is the first time I've heard this rationale. All those cyber-doom scenarios we've heard for almost 20 years now have yet to come close to being realized. So, take the cyber 9-11, cyber Katrina, cyber Pearl Harbor, etc. and turn them into long, slow events. But, by definition, a long slow 9-11 is NOT 9-11 anymore!
  • 6 more annotations...
  • • Poulsen called the threat of cyber-terrorism “preposterous,” citing the long-standing warnings that hackers would attack the power grid — despite the fact that it has never happened. And he argued that calling such intrusions national security threats means information about attacks gets classified unnecessarily.
    • Dr. Herb Lin, a cyberattack expert at the National Research Council, called the scoffing naive, saying he could imagine hackers getting into classified command-and-control systems, for one.

      • 

        TransTracker on 2009-06-04

        Yes, so can I. I can IMAGINE all sorts of crazy shit! So can lots of other people. (Authors of sci-fi novels and movies have been making boat loads of money based on this capability for years.) But just because you can imagine it does not mean it is a real threat! So far, cyberwar discourse is long on imagined cyber-doom scenarios and short of real, empirical evidence.
    • But he lamented that much of the current dialogue is about about cyberwar and cyber-terror, when the largest threat is in cyber-espionage — which is not considered an act of war.

      • 

        TransTracker on 2009-06-04

        So, is he suggesting that espionage, when conducted via cyberspace, should now be considered an "act of war?" If so, that's complete bullshit.

    • Yoran did admit that cyber-terrorism was improbable, but stuck to his point that there are significant national security threats from hackers.

      
      

      Lin says the government needs to think about getting its own cyberattack capability.

      • 

        TransTracker on 2009-06-04

        Translation: "We admit that a large part of what we tried to use to scare you in the past has turned out to be a bunch of BS, but believe us about the new scenarios we're trying to use to scare you, and then give us lots of money so that we can learn to attack people ourselves."

    • Lin was dumbstruck by Poulsen’s dismissal of the examples that the government, including President Obama, have used as evidence that there is a massive cybersecurity threat — specifically Obama’s recent description of a November USB thumb-drive virus attack as one of the biggest cyberattacks against the U.S. military.

      
      

      “Why is something that is an obvious threat not considered a threat to national security?” Lin asked.

      
      

      “The point is that the way you frame these issues matters,” Schneier explained.

      • 

        TransTracker on 2009-06-04

        Classic use of the realist style by Lin. Act as though all of this is just "obvious"; anyone who doesn't see it that way is just "naive." And yet, if it really were obvious, he and Yoran, and others, wouldn't have to work so hard to scare folks with IMAGINED cyber-doom scenarios that never seem to come close to be realized in REALITY. Indeed, Schneier is correct, the "framing" of all of this is important; the process of "securitization" taking place is really the interesting part.
    • In fact, they do matter — since now the government is pouring billions of dollars into cybersecurity for its own networks, and possibly the general public’s net — a far change from the government’s relative indifference to such issues until about two years ago.

      • 

        TransTracker on 2009-06-04

        Exactly! It matters because if we're going to spend billions of dollars on to combat a threat, that threat needs to be based on something more than an "expert" saying "trust me, it's real because I can imagine it!"

Public Stiky Notes

• 
  TransTracker on 2009-06-04
  Cyber 9-11 in slow motion! Nice! This is the first time I've heard this rationale. All those cyber-doom scenarios we've heard for almost 20 years now have yet to come close to being realized. So, take the cyber 9-11, cyber Katrina, cyber Pearl Harbor, etc. and turn them into long, slow events. But, by definition, a long slow 9-11 is NOT 9-11 anymore!
• 
  TransTracker on 2009-06-04
  Yes, so can I. I can IMAGINE all sorts of crazy shit! So can lots of other people. (Authors of sci-fi novels and movies have been making boat loads of money based on this capability for years.) But just because you can imagine it does not mean it is a real threat! So far, cyberwar discourse is long on imagined cyber-doom scenarios and short of real, empirical evidence.
• 
  TransTracker on 2009-06-04
  So, is he suggesting that espionage, when conducted via cyberspace, should now be considered an "act of war?" If so, that's complete bullshit.
• 
  TransTracker on 2009-06-04
  Translation: "We admit that a large part of what we tried to use to scare you in the past has turned out to be a bunch of BS, but believe us about the new scenarios we're trying to use to scare you, and then give us lots of money so that we can learn to attack people ourselves."
• 
  TransTracker on 2009-06-04
  Classic use of the realist style by Lin. Act as though all of this is just "obvious"; anyone who doesn't see it that way is just "naive." And yet, if it really were obvious, he and Yoran, and others, wouldn't have to work so hard to scare folks with IMAGINED cyber-doom scenarios that never seem to come close to be realized in REALITY. Indeed, Schneier is correct, the "framing" of all of this is important; the process of "securitization" taking place is really the interesting part.
• 
  TransTracker on 2009-06-04
  Exactly! It matters because if we're going to spend billions of dollars on to combat a threat, that threat needs to be based on something more than an "expert" saying "trust me, it's real because I can imagine it!"

Would you like to comment?

Join Diigo for a free account, or sign in if you are already a member.