"Kill Switch" not the issue. "Liability of companies" is the issue.

[Cerridwen]

The "Kill Switch" is not the only issue with this bill. "Liability of companies" is another issue; as in, they won't be liable for damages depending on circumstances {See CBO report linked below} and they'll be required to share information {See 'shared information' section below}.

The Protecting Cyberspace as a National Asset Act (PCNAA) is not yet dead.

It has been "Ordered to be reported with an amendment in the nature of a substitute favorably." I found a description of what that phrase means:

<snip>

This substitute is actually drafted in the form of an amendment to the original that reads “strike all after the enacting clause and insert the following”, i.e. it’s an amendment that says start over with this.

<snip>

As for the term favorably , this means that a majority of the members of a committee support the bill beinig reported.

details at this link

In the interim, it was sent to the Congressional Budget Office. Link to .pdf of CBO report.

<snip>

The bill would, under certain circumstances, indemnify owners of critical infrastructure
who implement emergency-response plans required by the federal government.

<snip>


S. 3480 would impose intergovernmental and private-sector mandates, as defined in the
Unfunded Mandates Reform Act (UMRA), on owners and operators of information
systems designated as critical infrastructure by DHS. Owners and operators of such
systems would have to comply with new security standards and procedures. The bill also
would impose a mandate by limiting the damages that users of critical infrastructure can
seek from owners and operators of such systems for incidents related to cyber risks.

{much more at link}

A House version was introduced in June and there is a http://techinsider.nextgov.com/2010/11/house_dhs_cyber_bill_unveiled.php">November 17, 2010 report of legislation introduced by House Democrats to "expand the Homeland Security Department's cybersecurity powers".

Quotes from June article reporting on the Senate legislation:

<snip>

Any private company reliant on "the Internet, the telephone system, or any other component of the U.S. 'information infrastructure'" would be "subject to command" by the NCCC, and some would be required to engage in "information sharing" with the agency, says CBS4. {See definition of 'National Information Infrastructure below}

<snip>

{Joe} Lieberman recently defended the PCNAA, arguing that it was imperative the president had the ability to "say to an electric company or to say to Verizon, in the national interest, 'There's an attack about to come, and I hereby order you to put a patch on this, or put your network down on this part, or stop accepting any incoming from country A.'"

He added that the bill is necessary for it would reduce the liability of companies that may need to resort to extreme measures in an emergency situation. Companies might have to "do things in a normal business sense you'd be hesitant to do but national security requires you to do," Lieberman explained, adding "We protect them from that because the action the government is ordering them to take is in national security or economic interest." {emphasis added}

Another article from June notes:

<snip>

"It's been frustrating to read some of the misrepresentations of our bill in the cybersphere," {Senator Susan} Collins said, arguing the new bill actually circumscribes the president's existing authority and puts controls on its use. "I believe the substitute amendment we're offering strengthens those protections even more."

As we wrote here, the bill would also see the creation of a new agency within the Department of Homeland Security, the National Center for Cybersecurity and Communications (NCCC). Any private company reliant on "the Internet, the telephone system, or any other component of the U.S. 'information infrastructure'" would be "subject to command" by the NCCC, and some would be required to engage in "information sharing" with the agency, says CBS4.

NOTE: from text of bill:

NATIONAL INFORMATION INFRASTRUCTURE - The term `national information infrastructure' means information infrastructure--

(A)
.....(i) that is owned, operated, or controlled within or from the United States; or

.....(ii) if located outside the United States, the disruption of which could result in national or regional catastrophic damage in the United States; and

(B) that is not owned, operated, controlled, or licensed for use by a Federal agency.{Federal information infrastructure is defined elsewhere}

Additional definitions found in the text:

the term ‘information sharing and analysis center’ means a self-governed forum whose members work together within a specific sector of critical infrastructure to identify, analyze, and share with other members and the Federal Government critical information relating to threats, vulnerabilities, or incidents to the security and resiliency of the critical infrastructure that comprises the specific sector;

<snip>

‘(vii) any non-Federal entity, including, where appropriate, information sharing and analysis centers, identified by the Director, with the concurrence of the owner or operator of that entity and consistent with applicable law;
‘(D) work with the entities described in subparagraph (C) to establish policies and procedures that enable information sharing between and among the entities;

<snip to more at link>

Did you know that during various "Inquisitions" in the Middle Ages, the Catholic Church worked in concert with the secular government when putting accused witches to "The Question." Yes. It seems torture was a "sin" but sending accused witches to friendly-to-the-Church authorities so that they could "Put the Question," wasn't a sin.

The government might have to watch out for our civil liberties, but as we already seen, when businesses and corporations trounce all over them, hey, "It's just business" and the government has plausible deniability.

This will be one to watch.

[snagglepuss]

1. k & r nt

[Faryn Balyncd]

2. Big Brother wants to tighten his grip.... K and R.

[Cerridwen]

5. I think "Big Brother" is now trademarked and has a corporate logo.

:evilfrown:

[Unknown Liberal]

3. I hope we don't have to be groped to get on the net n/t

[Cerridwen]

6. I laughed and then grimaced when I read your post.

Fortunately, dark humor works. :(

[Cerridwen]

4. Morning kick and thanks for replies and recs and taking the time

to read.

:kick:

[PeaceNikki]

7. Read the bill

It's ridiculous how the perception of the bill has become so separated from the reality. The bill is here:

http://www.govtrack.us/congress/billtext.xpd?bill=s111-3480

First: there is no "kill switch". It's a complete fabrication. Of course the idea is a ridiculous one, but it's nowhere in the bill, whatever Joe Lieberman might think.

What the bill basically does is allow the President to declare a "national cyber emergency" (S. 249), which requires affected infrastructure-related networks implement a set of security procedures. This a step in the right direction, and it's not a kill switch.

The problem is, under present law it is unclear who is responsible for monitoring or maintaining the security of our infrastructure--NSA? FBI? DHS? The military?--and this bill takes some good first steps. It also repeatedly refers to privacy laws, and sets up the position of Privacy Officer who is a watchdog to make sure the Director stays on the right side of that line. Also a good thing.
Even though a coordinated cyberattack would be difficult to defend, the consequences would be serious, and I think it's the responsibility of the federal government to at least *try* to plan for such an attack. That's what this bill does.

Section 249 of the bill contains the material regarding powers during a "cyber emergency." Here's what the bill actually contains, according to the official summary:

Section 249: If the President determines there is a credible threat to exploit cyber vulnerabilities of the covered critical infrastructure, the President may declare a national cyber emergency, with notification to Congress and owners and operators of affected covered critical infrastructure. The notification must include the nature of the threat, the reason existing security measures are deficient, and the proposed emergency measures needed to address the threat. If the President exercises this authority, the Director of the NCCC will issue emergency measures necessary to preserve the reliable operation of covered critical infrastructure. Any emergency measures issued under this section will expire after 30 days unless the Director of the NCCC or the President affirms in writing that the threat still exists or the measures are still needed. Emergency measures imposed by the Director must be the least disruptive means feasible, and such emergency measures cannot be used to set aside the requirements of the Wiretap Act, the Electronic Communications Privacy Act, or the Foreign Intelligence Surveillance Act of 1978. This section does not authorize any new surveillance authorities or permit the government to "take over" private networks. While complying with the mandatory emergency measures, owners and operators of covered critical infrastructure will have the flexibility to propose alternative security measures that address the national cyber emergency and, once approved by the Director, implement those security measures in lieu of the original mandatory emergency measures. Owners and operators of covered critical infrastructure who comply with the requirements can in certain circumstances receive liability protections that range from limitations on some damages to immunity from suit.
The Director will also work with owner and operators of covered critical infrastructure outside the United States to inform them of cyber threats and vulnerabilities and appropriate security measures.

The language in the summary is consistent with the language in the bill itself (section 249 starts on page 76). It doesn't sound like a "kill switch." The bill would require the President to submit a report describing, among other things, "The actions necessary to preserve the reliable operation and mitigate the consequences of the potential disruption of covered critical infrastructure" (pg. 84 lines 1-4). That sounds like the opposite of a kill switch: this legislation describes a process by which the president is expected to take action to ensure access to "critical infrastructure" -including the Internet.

http://www.readwriteweb.com/enterprise/2010/06/no-kill-switch-in-lieberman-co.php

[Cerridwen]

8. I have. I also provided links and quotes to those pieces of the bill

which will allow and/or require private businesses to work in concert with the gov't to share information and to shut down portions of our communications infrastructure.

[PeaceNikki]

9. Right. In the interest of protecting the Internet.

This legislation describes a process by which the president is expected to take action to ensure access to "critical infrastructure" -including the Internet

[Cerridwen]

10. First, it's not "just the internet."

Second, it's not just "protection" in case of "national security" as there is also an economic component addressed in the text of the bill.

Third, Nikki, you and I are just not going to agree on this though I thank you for the opportunity to flesh out what is in the actual text of the bill rather than just what is written in the summary and a couple of articles.

eta: your first iteration said "just the internet" then you edited it. Noted.

[PeaceNikki]

11. I said "including", not "just". Yes, we disagree.

[Cerridwen]

12. Your pre-edited post said "just the internet." At least play fair. n/t

[PeaceNikki]

13. lol. "fair". It did not. All I edited was the capitalization of "Internet" in the title.

I copied that from my other NUMEROUS posts: http://www.democraticunderground.com/discuss/duboard.php?az=show_mesg&forum=389&topic_id=9757312&mesg_id=9758712

[Cerridwen]

14. It's a silly point to "fight." I concede that minor point of editing.

It's also a distraction.

This is a serious piece of legislation that could have chilling repercussions. With the republicans glombing onto the power they claim they've been given by the electorate, this does not bode well for US citizens.

[PeaceNikki]

15. And I continue to call it a total and complete misrepresentation of the bill.

But please, carry on with your irrational fear.

[Cerridwen]

16. Oy.