Yes, indeed: we give birth to Risk, nourish Risk, make it grow.
Some facts:
We all know that the Germans are quite maniac at safety – when they want: in a Factory making body steel parts for some BMW models, you have to wear a safety helmet when walking around a multi-tons steel-coils-handling crane. Now, what a poly-propylene crash helmet would do to protect your head, I leave it to your imagination. Continue reading
Will the soon to-be-released Standard be once more a scheme for quality management systems, or will it – hopefully – have grown up to quality-led and quality-leading systems?
Because managers are no leaders, and vice-versa: any Ship’s Captain it’s not her First Officer. Any Ship’s Captain has authority to marry you on-board, the First Officer hasn’t. Continue reading
From http://news.cnet.com/8301-1009_3-57428067-83/fbi-we-need-wiretap-ready-web-sites-now/:
FBI: We need wiretap-ready Web sites – now
CNET learns the FBI is quietly pushing its plan to force surveillance backdoors on social networks, VoIP, and Web e-mail providers, and that the bureau is asking Internet companies not to oppose a law making those backdoors mandatory.
by Declan McCullagh May 4, 2012 9:24 AM PDT
The FBI is asking Internet companies not to oppose a controversial proposal that would require firms, including Microsoft, Facebook, Yahoo, and Google, to build in backdoors for government surveillance.
In meetings with industry representatives, the White House, and U.S. senators, senior FBI officials argue the dramatic shift in communication from the telephone system to the Internet has made it far more difficult for agents to wiretap Americans suspected of illegal activities, CNET has learned.
The FBI general counsel’s office has drafted a proposed law that the bureau claims is the best solution: requiring that social-networking Web sites and providers of VoIP, instant messaging, and Web e-mail alter their code to ensure their products are wiretap-friendly.
“If you create a service, product, or app that allows a user to communicate, you get the privilege of adding that extra coding,” an industry representative who has reviewed the FBI’s draft legislation told CNET. The requirements apply only if a threshold of a certain number of users is exceeded, according to a second industry representative briefed on it.
The FBI’s proposal would amend a 1994 law, called the Communications Assistance for Law Enforcement Act, or CALEA, that currently applies only to telecommunications providers, not Web companies. The Federal Communications Commission extended CALEA in 2004 to apply to broadband networks.
FBI Director Robert Mueller is not asking companies to support the bureau’s CALEA expansion, but instead is “asking what can go in it to minimize impacts,” one participant in the discussions says. That included a scheduled trip this month to the West Coast — which was subsequently postponed — to meet with Internet companies’ CEOs and top lawyers.
A further expansion of CALEA is unlikely to be applauded by tech companies, their customers, or privacy groups. Apple (which distributes iChat and FaceTime) is currently lobbying on the topic, according to disclosure documents filed with Congress two weeks ago. Microsoft (which owns Skype and Hotmail) says its lobbyists are following the topic because it’s “an area of ongoing interest to us.” Google, Yahoo, and Facebook declined to comment.
In February 2011, CNET was the first to report that then-FBI general counsel Valerie Caproni was planning to warn Congress of what the bureau calls its “Going Dark” problem, meaning that its surveillance capabilities may diminish as technology advances. Caproni singled out “Web-based e-mail, social-networking sites, and peer-to-peer communications” as problems that have left the FBI “increasingly unable” to conduct the same kind of wiretapping it could in the past.
In addition to the FBI’s legislative proposal, there are indications that the Federal Communications Commission is considering reinterpreting CALEA to demand that products that allow video or voice chat over the Internet — from Skype to Google Hangouts to Xbox Live — include surveillance backdoors to help the FBI with its “Going Dark” program. CALEA applies to technologies that are a “substantial replacement” for the telephone system.
“We have noticed a massive uptick in the amount of FCC CALEA inquiries and enforcement proceedings within the last year, most of which are intended to address ‘Going Dark’ issues,” says Christopher Canter, lead compliance counsel at the Marashlian and Donahue law firm, which specializes in CALEA. “This generally means that the FCC is laying the groundwork for regulatory action.”
Subsentio, a Colorado-based company that sells CALEA compliance products and worked with the Justice Department when it asked the FCC to extend CALEA seven years ago, says the FBI’s draft legislation was prepared with the compliance costs of Internet companies in mind.
In a statement to CNET, Subsentio President Steve Bock said that the measure provides a “safe harbor” for Internet companies as long as the interception techniques are “‘good enough’ solutions approved by the attorney general.”
Another option that would be permitted, Bock said, is if companies “supply the government with proprietary information to decode information” obtained through a wiretap or other type of lawful interception, rather than “provide a complex system for converting the information into an industry standard format.”
A representative for the FBI told CNET today that: “(There are) significant challenges posed to the FBI in the accomplishment of our diverse mission. These include those that result from the advent of rapidly changing technology. A growing gap exists between the statutory authority of law enforcement to intercept electronic communications pursuant to court order and our practical ability to intercept those communications. The FBI believes that if this gap continues to grow, there is a very real risk of the government ‘going dark,’ resulting in an increased risk to national security and public safety.”
Next steps
The FBI’s legislation, which has been approved by the Department of Justice, is one component of what the bureau has internally called the “National Electronic Surveillance Strategy.” Documents obtained by the Electronic Frontier Foundation show that since 2006, Going Dark has been a worry inside the bureau, which employed 107 full-time equivalent people on the project as of 2009, commissioned a RAND study, and sought extensive technical input from the bureau’s secretive Operational Technology Division in Quantico, Va. The division boasts of developing the “latest and greatest investigative technologies to catch terrorists and criminals.”
But the White House, perhaps less inclined than the bureau to initiate what would likely be a bruising privacy battle, has not sent the FBI’s CALEA amendments to Capitol Hill, even though they were expected last year. (A representative for Sen. Patrick Leahy, head of the Judiciary committee and original author of CALEA, said today that “we have not seen any proposals from the administration.”)
Mueller said in December that the CALEA amendments will be “coordinated through the interagency process,” meaning they would need to receive administration-wide approval.
Stewart Baker, a partner at Steptoe and Johnson who is the former assistant secretary for policy at Homeland Security, said the FBI has “faced difficulty getting its legislative proposals through an administration staffed in large part by people who lived through the CALEA and crypto fights of the Clinton administration, and who are jaundiced about law enforcement regulation of technology — overly jaundiced, in my view.”
On the other hand, as a senator in the 1990s, Vice President Joe Biden introduced a bill at the FBI’s behest that echoes the bureau’s proposal today. Biden’s bill said companies should “ensure that communications systems permit the government to obtain the plain text contents of voice, data, and other communications when appropriately authorized by law.” (Biden’s legislation spurred the public release of PGP, one of the first easy-to-use encryption utilities.)
The Justice Department did not respond to a request for comment. An FCC representative referred questions to the Public Safety and Homeland Security Bureau, which declined to comment.
From the FBI’s perspective, expanding CALEA to cover VoIP, Web e-mail, and social networks isn’t expanding wiretapping law: If a court order is required today, one will be required tomorrow as well. Rather, it’s making sure that a wiretap is guaranteed to produce results.
But that nuanced argument could prove radioactive among an Internet community already skeptical of government efforts in the wake of protests over the Stop Online Piracy Act, or SOPA, in January, and the CISPA data-sharing bill last month. And even if startups or hobbyist projects are exempted if they stay below the user threshold, it’s hardly clear how open-source or free software projects such as Linphone, KPhone, and Zfone — or Nicholas Merrill’s proposal for a privacy-protective Internet provider — will comply.
The FBI’s CALEA amendments could be particularly troublesome for Zfone. Phil Zimmermann, the creator of PGP who became a privacy icon two decades ago after being threatened with criminal prosecution, announced Zfone in 2005 as a way to protect the privacy of VoIP users. Zfone scrambles the entire conversation from end to end.
“I worry about the government mandating backdoors into these kinds of communications,” says Jennifer Lynch, an attorney at the San Francisco-based Electronic Frontier Foundation, which has obtained documents from the FBI relating to its proposed expansion of CALEA.
As CNET was the first to report in 2003, representatives of the FBI’s Electronic Surveillance Technology Section in Chantilly, Va., began quietly lobbying the FCC to force broadband providers to provide more-efficient, standardized surveillance facilities. The FCC approved that requirement a year later, sweeping in Internet phone companies that tie into the existing telecommunications system. It was upheld in 2006 by a federal appeals court.
But the FCC never granted the FBI’s request to rewrite CALEA to cover instant messaging and VoIP programs that are not “managed”–meaning peer-to-peer programs like Apple’s Facetime, iChat/AIM, Gmail’s video chat, and Xbox Live’s in-game chat that do not use the public telephone network.
If there is going to be a CALEA rewrite, “industry would like to see any new legislation include some protections against disclosure of any trade secrets or other confidential information that might be shared with law enforcement, so that they are not released, for example, during open court proceedings,” says Roszel Thomsen, a partner at Thomsen and Burke who represents technology companies and is a member of an FBI study group. He suggests that such language would make it “somewhat easier” for both industry and the police to respond to new technologies.
But industry groups aren’t necessarily going to roll over without a fight. TechAmerica, a trade association that includes representatives of HP, eBay, IBM, Qualcomm, and other tech companies on its board of directors, has been lobbying against a CALEA expansion. Such a law would “represent a sea change in government surveillance law, imposing significant compliance costs on both traditional (think local exchange carriers) and nontraditional (think social media) communications companies,” TechAmerica said in e-mail today.
Ross Schulman, public policy and regulatory counsel at the Computer and Communications Industry Association, adds: “New methods of communication should not be subject to a government green light before they can be used.”
Last updated at 12:30 p.m. PT
From http://newsmanager.commpartners.com/ieeecw/issues/2012-05-02-email.html:
IEEE ComputerWise
Software, Systems and IT: News and Analysis May 2, 2012
Two US Appeal Court Opinions Throw Software-related-theft Laws a Curve
by Robert N. Charette
The U.S. Congress may have to revamp laws that ostensibly set the rules regarding what constitutes illegal activity when it comes to information technology. The U.S. Court of Appeals for the Ninth Circuit overturned the conviction of someone charged with stealing proprietary data from a former employer, reasoning that the wording of the law that prosecutors said he violated points specifically to hacking into computer systems and not the misappropriation of information residing there by an otherwise authorized user. A day later, a separate appeals court overturned the conviction of another defendant whose lawyers successfully appealed his conviction for violating that same law and two others—again arguing that the facts of the case didn’t fit the wording of the criminal statutes.
Cybersecurity needs are not hypothetical, as the recent DHS warning of a cyberattack on the US natural gas industry shows. Why then was a post-9/11 initiative to secure US utilities dropped?
By Mark Clayton, Staff writer / May 17, 2012
A natural gas pipeline is seen under construction near East Smithfield in Bradford County, Pa., in this January 7 file photo.
Les Stone/Reuters/File
With America now trying to thwart a cyberattack on its natural gas industry, it is helpful to recall the hectic days after 9/11, when industry scientists raced to shield from potential terrorist cyberattacks hundreds of thousands of vulnerable devices that control vital valves and switches on America’s gas pipelines, water plants, and power grid.
It was a race that seemed winnable. After five years of intense effort, a 35-member team of industrial-control-system wizards from the gas, water, and electric utilities industries had created a powerful new encryption system to shield substations, pipeline compressors, and other key infrastructure from cyberattack.
But just weeks before it was to be finalized in 2006, the funding plug was pulled on the encryption system, called AGA-12, by the American Gas Association and its partners at the electric power and water utility industries, some who worked on the project recall.
To this day, the cancelation of the project has called into question whether US utilities will, on their own, invest in measures necessary to protect their networks.
Tested at a Los Angeles water treatment plant, a gas utility in Chicago, and other locations, AGA-12 worked well. National labs verified it. Experts said it was good to go. Yet with 9/11 receding in memory, utility industry executives had begun worrying anew about the cost of deploying the system, former project participants say.
Today, six years after AGA-12 was aborted and 11 years after the World Trade Center attacks, the US natural gas industry is trying to thwart a real cyberattack campaign, according to the US Department of Homeland Security (DHS). Congress, meanwhile, is still debating whether voluntary or mandatory security standards are the best way to secure America’s critical infrastructure.
All of which leaves researchers who helped develop AGA-12 frustrated and a little wistful about the digital shield that they say would have provided a badly needed layer of security – especially in light of a trend toward cyberattacks on critical infrastructure companies.
“Technically it was an excellent standard and we were almost done with it when the project was terminated,” says William Rush, a now-retired scientist formerly with the Gas Technology Institute, who chaired the effort to create the AGA-12 standard. “One of the things I wake up in the middle of night and worry about is what to do if we’ve just been attacked. That’s not the time to worry about it – now’s the time.”
AGA-12, he says, was designed to secure older industrial control system devices out in the field, many of which still today communicate by modem and phone line, radio, or even wireless signal, but were never designed with cybersecurity in mind and remain highly vulnerable today.
It’s not clear that AGA-12 could have stopped the “spear-phishing” type of cyberattack now under way against the natural gas industry, experts say. But it could stop at least one kind: attacks directly on systems in the field of the kind DHS has highlighted in numerous studies and reports.
Installed in front of each vulnerable device would have been an AGA-12 gatekeeper, a sealed black box with a processor and cryptographic software inside, he explains. That “bump in the wire” would sift and decipher commands coming in from legitimate operators, but shield the vulnerable industrial control systems behind them from any false signals that might allow a hacker to take over.
“It was never intended to be a silver bullet,” Dr. Rush says. “But it would definitely have provided quite a lot more protection for critical infrastructure like gas pipelines and the power grid than we have right now.”
The reality of the cyberthreat was driven home in late March, when DHS issued the first of four confidential “alerts” warning of a cyberattack campaign against US natural gas pipeline companies’ computer networks. Some researchers have linked the attack to a 2011 attack for which US officials blame China.
Those recent attacks follow a trend in which corporate and industrial networks belonging to critical infrastructure companies are seen to be a growing target. In April, the cybersecurity company McAfee and the Center for Strategic and International Studies (CSIS), a Washington think tank, found that 40 percent of electric utility company officials in 14 countries said their networks were under attack and more vulnerable than ever.
Meanwhile, in an election year, Congress and the Obama administration are wrangling over new cybersecurity standards for critical infrastructure companies – primarily whether they should be based on a voluntary or mandatory approach.
“The issue isn’t a lack of standards,” says James Lewis, director of the Technology and Public Policy Program at CSIS. “It’s the lack of a business case for individual companies to spend for public safety. This [AGA-12 case] just confirms it. They know what to do to make things secure and have chosen not to do it for sound business reasons. A voluntary approach doesn’t work.”
At least six energy industry organizations that have developed voluntary cybersecurity standards for their industrial control systems would disagree. They include the North American Electric Reliability Corporation (NERC), International Electrotechnical Commission, American Petroleum Institute, and the AGA. But because the standards are voluntary or are “guidelines,” it’s unclear how widely they have been acted upon.
Asked if field devices have received added protections that supplanted the need for AGA-12, Jake Rubin, an AGA spokesman, says the AGA, federal government, and industry groups “have put cybersecurity guidelines in place that independent operators are using currently in the field.” However, he adds, “The ‘bump in the wire’ concept cannot be applied to all existing systems.”
“AGA members are committed to the safe and reliable delivery of clean natural gas to their customers at affordable and stable prices,” says Mr. Rubin, an AGA spokesman in an e-mail response. “They must make decisions that balance these factors, with safety always being the top priority for America’s natural gas utilities.”
But other observers say that while some newer equipment with better security has been adopted in recent years, many of the same vulnerabilities remain because long-lived industrial control systems are rarely replaced if still functioning. Without a mandate, few companies will incur the cost to deploy enhanced security systems, they say.
“We found that the adoption of security measures in important civilian industries badly trailed the increase in threats over the last year,” Stewart Baker, a former DHS official who led the CSIS and McAfee study, said in a statement in April.
Previous 