Home -> Law Blog Directory -> Intellectual Property Law Blogs -> Threat Level

Intellectual Property Law

: Threat Level

DHS Cyber-Security Too Blase About Citizen Info, Panel Says

By Ryan Singel, Kevin Poulsen, Sarah Lai Stirland, Kim Zetter, and David Kravets

The government's latest cyber-security efforts are too wrapped in secrecy and its privacy assessments downplay citizens' interest in the privacy of their IP addresses, a government commission reported Monday.

At issue is a Homeland Security anti-hacking system known as EINSTEIN, software which monitors traffic into and out of government networks in order to detect abnormal use.

The intrusion detection system is considered a key part of the government's multi-billion dollar, highly secretive computer security program known as the Comprehensive National Cyber-Security Initiative.

EINSTEIN2, the newest iteration of the detection system, is intended to watch over the gateways to all of the government websites in real time, in order to spot intrusions or attacks quickly. But to do that, software controlled by DHS will need to peer into citizens online interactions with the government, including emails.

But sharing traffic data from government websites such as the IRS's with the Department of Homeland Security raises privacy concerns, according to the Information Security and Privacy Advisory Board, though DHS's own assessment dismisses them outright.

"Internet users have no expectation of privacy in the to/from address of their messages or the IP addresses of the sites they visit," the program's recent Privacy Impact Assessment(.pdf) concluded.

But the NIST group of advisors disagree and all but call that notion dangerous.

"Written this broadly, the statement is a change from previous government policy that has suggested that there is an expectation of privacy based on the use of Internet header information," the group told the Office of Management and Budget in a letter(.pdf) sent Monday but not yet posted to the NIST.gov website.

They note that the government has turned down government sunshine requests for web traffic logs on the grounds that citizens who visited a .gov website had a privacy interest in their IP address. Government regulators -- particularly in Europe -- are pushing search engines to forget IP addresses more quickly, since they can be used to reconstruct a person's search history.

The panel, comprisedof private sector techies and employees from agencies ranging from the National Security Agency to Housing And Urban Development, want Homeland Security to make it clear that citizens do have privacy rights in the information their browsers have to tell government sites.

"We urge OMB to recommend that DHS clarify [...] that any privacy interest in IP address and other header information is being adequately addressed by DHS through fair information practices, considering the significant law enforcement and national security interest in use of this information by EINSTEIN2," the group wrote.

While TO: and FROM: lines in messages and IP addresses need to be semi-public in order to let information travel across the net, IP addresses can easily be used by law enforcement and intelligence agencies as a starting point to reconstruct a person's internet usage.

Google, for one, has had its own issues with whether users have a privacy interest in the IP addresses it services store. They argued to the government that they were in order to keep from having to turn over user logs, but then told European regulators that IP addresses weren't really personal, when those officials were seeking limits on how long search engines could store data.

That argument whipsawed on the company in a Viacom lawsuit over YouTube, when a judge orderedGoogle to turn over all its YouTube user logs, citing Google's own arguments about IP addresses.

The group also suggested that the Bush Administration's fledgling Comprehensive National Cyber-Security Initiative needed to be forthcoming, since many of the privacy assessments created for the program aren't public.

That's not unsurprising since the Executive Order laying out guidelines for the project -- issued in January by President Bush -- remains a secret.

Cyber-security finally became a priority for the government last fall.

Homeland Secretary Michael Chertoff wants EINSTEIN to eventually have the capability to strike back at attackers, while NSA head Michael McConnell has said the NSA will need to sit on the public internet, monitoring searches and traffic, to keep the internet running.

Image: Wordle of NIST security paper via Purpleslog/Flickr See Also:

• U.S. Has Launched a Cyber Security 'Manhattan Project,' Homeland ...
• DHS Doesn't Want to Monitor Net, Chertoff Tells Bloggers
• Chertoff: I'm Listening to the Internet (Not in a Bad Way ...
• Chertoff: We're Closing that Boarding-Pass Loophole
• What's Up with the Secret Cybersecurity Plans, Senators Ask DHS ...

Full post as published by Threat Level on December 10, 2008 (boomark / email).