SMBlog -- Steve Bellovin's Blog

Congress and Peer-to-Peer Filesharing

Fri, 20 Nov 2009 04:34:19 GMT

Some members of Congress have gotten extremely upset about peer-to-peer filesharing. Even the New York Times has editorialized about the issue. The problem of files leaking out is a real one, but the bills are misguided.

Fundamentally, the real issue is that files are being shared without the user intending that result. This is not a weakness unique to peer-to-peer software; more or less any mechanism for publishing files can do that. The real problem is that the targeted software -- whatever it is; the news stories full of outrage haven't identified which package or packages are implicated -- is bad software, either because they share files the user hadn't intended or because they make it too hard for the user to understand what will happen. Given the sub rosa nature of much peer-to-peer software, perhaps this is not surprising; developing good software is remarkably difficult. Perhaps Congress should instead decriminalize sharing of music and video...

I digress. The real issue I'm addressing is bad legislation. Quite apart from my general concerns, the bills are just poorly drafted.

The first bill, H.R. 1319, is in many ways more reasonable: it mandates notice to the user of what is happening, and bars software that is difficult to remove. However, it stumbles badly when trying to define peer-to-peer software:

the term `peer-to-peer file sharing program' means computer software that allows the computer on which such software is installed--
(A) to designate files available for transmission to another computer;
(B) to transmit files directly to another computer; and
(C) to request the transmission of files from another computer.

As best I can tell, any web browser is covered by that definition.

The newer bill, H.R. 4098, does a much better job on a workable definition, though it's fun to try to twist it into knots, too. I particularly like the way software "designed primarily to operate as a server that is accessible over the Internet using the Internet Domain Name system" is not covered; who would have thought that the DNS had such mystical shielding properties?

The problem with H.R. 4098 is that it bans the wrong thing. Yes, NASA's use of BitTorrent would be permitted because it is "instrumental in completing a particular task or project that directly supports the agency's overall mission", but NASA employees probably wouldn't be allowed to download such files on their home computers because the bill seeks to block "the download, installation, or use by Government employees and contractors of such software on home or personal computers as it relates to telework and remotely accessing Federal computers, computer systems, and networks". In other words, you can either view such files or you can save the government money by using your own computer to work from home.

I should add a personal disclaimer: I, like most professors in the sciences and engineering, receive substantial goverment grants and contracts; that technically makes me a government contractor, as best I can tell. Am I covered? My students who receive stipends from such grants?

For those who are wondering if this bill is really just another ploy by a paid shill for the content industry, campaign finance records do not seem to support the notion. According to OpenSecrets.org, while Rep. Towns (the introducer) did indeed receive considerable campaign funding from from PACs associated with content owners, he has also received a lot of money from PACs associated with companies like Verizon that have not been particularly sympathetic to the content industry's demands. I do not think that that claim is supported by the data.

Overall, what we have here is too much firepower being aimed in the wrong direction. If the incidents are taking place from home computers, the solution is to provide government employees with the government-owned equipment -- and government-provided sofware, support, and system administration -- to let them do their jobs properly. Using poorly managed or maintained machines carries many more security risks than just peer-to-peer software; I could make a very good case that such software is the least of the security problems. If the incidents have taken place on office computers, the issue is really a management problem: employees are making more than the normal and acceptable de minimus personal use of their employer's equipment. There is also likely a problem with the quality of systems administration in such organizations. Again, those issues pose many more risks. These are real problems; focusing on peer-to-peer software won't address them.

The Role of a Cybersecurity Czar

Wed, 04 Nov 2009 03:54:26 GMT

For years now, there have been calls for a high-level cybersecurity official, preferably reporting directly to the president. This has never happened. Indeed, there is a lot of unhappiness in some circles that President Obama has not appointed anyone as "czar" (or czarina), despite the early fanfare about the 60-day cybersecurity review. There are many reasons why nothing has happened, I'm sure, up to and including high-level disagreement over the need for such a post. But another reason, I suspect, is that there are (at least) three different roles that need to be filled. The different roles have different needs and different responsibilities, but all are very difficult.

The first role is effectively as chief security officer for .gov. That is, the government -- and I'm speaking of the civilian sector, not the military -- has a vast IT complex. Securing any one part of the government is very hard; securing all of it may be impossible. The czar's role, though, is to cadge, cajole, or coerce many different departments into doing something. Given how independent the departments are, it wouldn't be easy. Presidential authority might help, but Truman predicted that Eisenhower would say "Do this! Do that! And nothing will happen". A czar, by definition lower-level than the president, would have an even more frustrating time.

There have been attempts to set a single security policy for the government. The Federal Information Security Management Act (FISMA) tried it; unfortunately, it appears to have turned into yet another exercise in security by checklist. Beyond that, there's a more subtle problem: a proper security posture is site- and application-specific. The requirements for securing, say, an informational web server are very different than what an EPA monitoring project might use when polling air quality sensors around the country. One size does not fit all; a centralized policy won't work very well.

Some things, such as intrusion monitoring, might (or might not) be better off centralized. Detailed security policy is probably better off decentralized -- if different departments will do it properly. The key to that is finding the right incentives, since we're not dealing with profit-making organizations for which money is a suitable metric. That, I think, is the challenge for securing .gov. It is not clear that a high-level czar would help; one cannot enforce a policy if that policy doesn't exist.

The second role I see for a cybersecurity czar is providing policy advice to the president. Cybersecurity (and cyber policy in general) are cross-cutting issues. Do you want a smart power grid? How will you secure the sensors, the actuators, and the computer systems that talk to them? Hunting cybercriminals? Is there a suitable agreement with the country they're in? Improving education by providing computers to schools and libraries? How will these be secured? The president needs to hear advice on such issues, from someone with a very broad grasp of not just cybersecurity, but the fields in which there may be security concerns. There needs to be someone at a very high level advising the president on such issues, but should this advisor report directly to the president, or just be part of an office of science and technology policy?

The cybersecurity advisor has another big responsibility, though: devising a national strategy. What policies should the government pursue to help improve the overall security of computers in general? To give one example, many people have advocated a liability-based model: make vendors liable for for problems caused by their security flaws, and let the market work its magic. Is this a good idea? Someone needs to look into this in detail, and make a recommendation to the president. Others having suggested replacing the Internet with something newer and more secure. Will this help? What about broad, national initiatives, like electronic health records, where the security and privacy risks are pervasive? All of these have very deep implications; someone needs to advise the president about them. Again, though, at what level should this advice be given, directly to the president or at one remove?

The third major cybersecurity role is liason to the private sector. Most of the national computing capability is in private hands; what these organizations and people do has a great impact on the nation's cybersecurity. Some changes can be accomplished by legislation or regulation, especially in critical infrastructure sectors; others, though, require persuasion. For example, suppose it was concluded that ubiquitous encryption would be a tremendous security advantage. The cybersecurity liason would try to jawbone vendors, web sites, etc., into implementing this. Does this need presidential access? It wouldn't seem to, but as Theodore Roosevelt noted, the presidency is a bully pulpit; the further the cybersecurity liason is from the center of power, the less influence he or she would have.

These, then, are the three roles: government CSO, cybersecurity advisor, and cybersecurity liason. The first and last need the presidency's power; the middle needs access. Is this one person, two, or three?

I'm certainly not privy to the debates going on inside the White House. I suspect, though, that some variant of the questions I've posed -- the exact role and (especially for the CSO option) powers this person would have -- are the reason for the delay. I also suspect that trying to combine all three roles in one position is counterproductive; the necessary skills are very different.

The Problem of Computerized Search

Sun, 27 Sep 2009 07:47:14 GMT

I've often written about the risks of unbridled wiretap or "data tap" technology, whether it is escrowed key cryptography or back doors in phone switches. Now, though, there is an arrest in what appears to be a very serious attempted terrorism incident, and the investigation was aided by computer searches. Was I naive? Or is the subject -- and my views -- far more complex and nuanced than yes or no? I submit that the latter is the case. (Note: we do not know all of the facts in this case yet. The NY Times article notes that frequently, "senior government officials have announced dozens of terrorism cases that on closer examination seemed to diminish as legitimate threats". The facts as recited by the government, and for that matter as seen on store surveillance videos are pretty damning -- but again, we've only heard one side of the story.)

Wiretaps are inherently intrusive. This is recognized by Federal law, which must "be conducted in such a way as to minimize the interception of communications not otherwise subject to interception". Taps are only authorized for certain serious crimes (though the list has been expanding over the years). Other methods of investigation must be found to be infeasible or too dangerous. But what are the rules for computer searches?

Computer searches have the potential to be far more intrusive. Indeed, a recent decision by the United States Court of Appeals for the Ninth Circuit imposed strict rules on how such searches can be conducted. But we know nothing of the criteria being used today.

We do not know if remote search techniques were used. The government's detention memo speaks of a "lawfully-authorized search" of Zazi's laptop, apparently after his car was towed for a parking violation. But the memo also notes that "Zazi transferred the bomb-making instruction notes onto his laptop and/or accessed the notes on his laptop in June and July 2009". Learning when a file was created or last modified is relatively straight-forward. Many computer systems will record when a file was last read, but any subsequent reads of the file will overwrite that date. To assert that a file was "accessed" in June or July solely from a search in September seems implausible, unless the file was never read in the interim. Did Zazi memorize the 9 pages of instructions? Print them out? Copy them to another file? All of these are possible; none seem especially likely to me.

Questions like this will no doubt be resolved at trial; the legal and technial issues, though, are far broader than any one case. Technical surveillance measures carry their own risks: the entry pointed used by law enforcement can be abused by others. Even if Zazi were planning to bomb transportation facilities (and I commute to campus by commuter rail and subway, so I take this very personally), the preconditions for remote search to work may be worse. Imagine if hackers affiliated with a nation-state or terrorist group successfully attacked the power grid during a Chicago winter. The CIA claims that extortionists have already done things like this in other countries.

It is certainly possible that some of the actual techniques used for remote search would be endangered if the details were revealed. That said, there are questions that can and should be asked -- and answered -- in public, for the sake of the Constitution and public safety.

Is remote search a technique that is lawfully used by the FBI and other law enforcement agencies? (We do know that the FBI has a "computer and Internet Protocol address verifier" (CIPAV), which apparently is an executable that they can introduce onto a suspect's computer.)
What are the legal and procedural criteria for such warrants? How do they compare to the restrictions on wiretaps?
How often are such searches done?
What are the risks if the next Robert Hanssen were to disclose the necessary techniques, tools, or passwords to, say, Al Qaeda? (If it seems improbable that an FBI agent would betray secrets to Al Qaeda, remember that Hanssen was a devout Catholic who nevertheless aided a country that was avowedly atheist.)

These issues can certainly be discussed without endangering national security. Most criminals and terrorists have not stopped using phones because wiretaps exist; the Attorney-General is legally required to file reports on the subject. (If they do stop using the Internet, that's a benefit, too; the Internet is a productivity enhancer for everyone, good and bad.) There is no reason to suppress such issues because computers are involved, and the Constitution applies to everyone.

A Good Mailer for Mac OS?

Mon, 21 Sep 2009 05:32:49 GMT

I'm curious what mailers people are using on Macs. For assorted reasons, I'm using MacOS more these days, and I don't really like Mail.App very much. Any better suggestions? (Requirements include good support for IMAP with SSL, and preferably include support for local MH mailboxes as well. Client-side certificate support is useful. I need robust auto-sorting, including the ability to move incoming messages to folders belonging to other mailboxes. I need it to operate offline, which in turn implies a need for local copies of IMAP mail. It has to be able to cope with a large number of folders, some of them quite large. It must be able to operate well on relatively slow links.)

On NetBSD, I use Claws Mail, which meets most of my needs. Unfortunately, I have not found the Mac versions of it to be as good.

Update to Skype's EULA

Tue, 15 Sep 2009 17:17:54 GMT

A few days ago, I posted an entry questioning some provisions of Skype's End User License Agreement. I'm happy to report that they've contacted me to report a change to the agreement. The new text in 3.2.4:

You hereby grant to Skype a non-exclusive, worldwide, perpetual, irrevocable, royalty-free, sublicensable and transferable licence to: (i) reproduce, modify and publish any Content that you Use on the publicly accessible areas of the Skype Website (e.g. Skype forum, blogs) for the purpose of displaying and distributing such Content on the Skype Website for such time as You continue to Use such Content on the Skype Website; and (ii) distribute and/or display through the Skype Software any Content that You provide or make available using the Skype Software for the sole purposes of making the Skype Software and the Products available to You.

answers my objections completely.

Thanks, Skype.

Skype's EULA

Sat, 12 Sep 2009 20:36:42 GMT

I was looking at the End User License Agreement to which Skype wants people to assent. I noticed the following odd provision (Section 3.2.4):

You hereby grant to Skype a non-exclusive, worldwide, perpetual, irrevocable, royalty-free, sublicensable and transferable licence to Use the Content in any media in connection with the Skype Software, the Products and the Skype Website.

And what is "Content"? According to Section 1, it

means any and all content consisting of text, sounds, pictures, photos, video and/or any type of information or communications.

People have to give Skype a license to use what they say via its service? People want Skype to transmit sound and images, not use it "in any media".

Perhaps I'm being too cautious here. Section 3.3 of their Terms of Service states that

Skype does not control, or have any knowledge of the content of any communication(s) spread by the use of the Products.

Certainly, Skype has always claimed that they can't peek through their own encryption to hear what is said on Skype-to-Skype calls. But what about voice mail? SkypeOut and SkypeIn, which permit connections -- obviously, unencrypted -- to the regular phone network. Are they truly asserting they have license to use what is said on such calls "in any media"?

Possibly, their lawyers were too cautious or drafted the agreement inartfully. Maybe the intent is to give Skype permission to relay your calls over whatever channels are needed to deliver your communications. "In any media in connection with the Skype Software, the Products and the Skype Website" might mean they can use the Internet, the phone network, etc., to deliver your calls. On the other hand, "media" can refer to the press, and their own PR could certainly be seen as "in connection with the Skype Software, the Products and the Skype Website".

I hope I'm being too paranoid...