Hacker News Reader

Comment by tptacek | Hacker News Reader

This article is awful. Instead of doing actual reporting, which would quickly have unearthed the actual purpose of a "cyber" (gag) - command --- which is to protect the integrity of critical information systems (particularly military and utilities) and to develop mechanisms to deny those capabilities to adversaries --- the writer of this piece contents himself with quips like "commander in geek" and "glasses-wearing general" and "world's most powerful IT guy".

I sympathize with Reason's philosophy in general (though I'm not a libertarian), but isn't a strong military one of the very few things that even libertarians agree we should be letting the government take care of?

View on HN

...but isn't a strong military one of the very few things that even libertarians agree we should be letting the government take care of?

A fact, which is often lost in modern political discussions: goals != results. One can oppose a law or program because of poor implementation (or expected poor implementation) even while agreeing with it's goals.

For instance, I favor some banking regulation to reduce leverage and the possibility of contagion. However, I oppose the particular bill currently likely to be passed, because it makes speculation (particularly shorts) more difficult and codifies bailouts/government forced bankruptcy into law. Similarly, I expect the author of this article favors national defense, but opposes this program since it appears to be ineffective and potentially harmful.

OTOH, I'm also tired of complaints about the way something is run without presenting a reasonable alternative.

Complaining is easy.

If anything, the most painful complaint you can make about the modern military's role in information security is their lack of involvement. We're far more likely to lose billions of dollars due to a concerted attack on our utilities or financial markets than China is.

So, while I see what you're saying, I don't think it's a coherent response to my comment or the article.

the most painful complaint you can make about the modern military's role in information security is their lack of involvement.

On the contrary. Given that the Internet is the creation of DARPA, indeed, was once called "ARPAnet", they're already up to their eyeballs. And to their credit, they've done an excellent job. I don't have citations handy, but I recall reading over the past year about many supposed "cyber attacks", yet for the most part, we all go about our business and surfing without even noticing that anything was going on.

The folks that designed the protocols on which this network runs (everything from ethernet through TCP/IP through DNS) did a phenomenal job. The network just may be the most robust thing ever engineered by man.

So perhaps they've already done their job. The front-loaded engineering gave us something that can withstand huge amounts of abuse, and so doesn't require an army (literally) to babysit it.

You and I aren't having the same conversation. I tend to agree with everything you just said, but the issue isn't the government's role in running the Internet. It's the government's role in offensive and defensive computer security. In other words: it's preventing China from paying 20 year olds to shut down the power grid (note: plausible) and directing research that would allow us to do that to China.

In your comment, you suggested that even libertarians (such as the author) should be supporting a strong military: "... isn't a strong military one of the very few things that even libertarians agree we should be letting the government take care of?"

This article doesn't address that issue one way or the other. All they do is criticize a specific program for having poorly defined goals and for (by their estimation) it's significant odds of collateral damage.

No, it's not awful. What the hell is Cyber Command actually trying to do? The NSA's IAD has long had responsibility for securing classified networks (and done a damn good job at it). Cyber command is not about defense. It's about a move to militarize the internet. Too bad the security community is only too happy to jump on the bandwagon for the federal dollars, rather than countering that the military has no business creating an arms race on the net.

I find the notion that any branch of the government has done a good job securing sensitive networks pretty much laughable. Since you could mean a lot of different things by "classified networks", I'm happy to concede your specific point while reiterating that you haven't addressed the core issue.

(I've done network security stuff for DoD and for some agencies, but you may have more experience on the classified side than I do, and what relevant experience I have I'm not going to give up to Hacker News and the Google index.)

And again: the NSA has done absolutely nothing to ensure that adversaries can't shut the power down in major cities, disrupt the GSM infrastructure, or cause billions of dollars in economic damages by messing with electronic markets.

And again: we have no specific knowledge that any branch of the military or intelligence has that capability to inflict on an adversary today.

Is there substantial overlap here with NSA? I'm 100% sure there is. But NSA is managed very differently than DoD.

What is the real life risk to lack of GSM coverage? Is it really just millions of nerds without iphone (cell) access?

Is any of the electric grid even publicly accessible over the internet? Surely there isn't a big "off" button for the power grid, as its quite a distrubted system... Furthermore I really doubt the infrastructure for these is publicly accessible over the internet. Even so, it seems like physical security would go a much longer way than network in the case of utilities.

As for markets, well there is a tiny agency called the SEC.

Either way this security is a cost to be borne by industry...Not ran by state military agencies.

Let's just call this for what it is, a power grab for defense/infosec contractors, and career officers. :)

To that end I'm not surprised to see it so vehemently defended by infosec professionals.

No. The real-life risk to lack of GSM coverage is that people can't use the phones during emergencies, and that a huge variety of industrial and municipal control networks that piggyback on commercial GSM networks will be rendered inoperable.

As for the markets, what does the SEC do when they get shut down by an electronic attack, other than hold a press conference?

And yes. I'm pretty sure you should just take my word for it on the utilities stuff.

From what I remember, during 9/11 the cell networks in NY were unusable due to capacity, should the DoD be implementing capacity guidlines as well, should we budget trillions so the DoD can buy more spectrum for cell carriers? Do CB radios suddenly stop working?

As for the power companies, I'm sure thats why they hire security professionals like yourself :).

The SEC provides regulations.

Billions don't need to be sunk by defense agencies on what is essentially a regulation issue.

A lot of these doomsday scenarios are bullshit. The world ran fine without cell phones and the internet, it'll run just as fine without it for a little while. Aside from a medical case here and there, noone is going to die and no country will dissolve as a result of being hacked on the internet or even being without power for a little while.

All I can say is that you have strong opinions about telephony, the markets, and the utilities for someone who has clearly never spent time working with the backend systems of phone companies, exchanges, and power companies.

But yes, regulations would be nice. That way, after a foreign power we've pissed off by parking aircraft carriers in their shipping lanes decides to inflict tens of billions of dollars of damage on us with a a few hours keyboarding, we can at least try to sue someone.

You touch on it with the carrier point; so let me get to the real core of my argument.

Electronic or financial damage is nothing compared to the ability to level entire nations physically. Any financial/electronic threat has a suitable recourse physically.

Not sure what's with all the downvotes. I'm honestly not trolling. If there is a large problem with the argument I presented please respond so I can form better opinions.

I don't really associate with any political party, but I believe the libertarian view is for smaller military. Often from what I've read they would like to see no standing army, leaving a navy, and militias for defense. However I have not read that much, so I could be reading for an inaccurate source.

Reply on news.ycombinator.com