Today the White House hosted a Cybersecurity and Consumer Protection Summit at Stanford University.  The event was announced last month as part of the Administration’s rollout of cybersecurity initiatives in advance of the State of the Union address.  Discussions during the Summit touched on secure payments (part of the Administration’s BuySecure initiative), public-private collaboration, and improving cybersecurity practices.

The President spoke at the Summit and signed an Executive Order focused on cybersecurity information sharing for critical infrastructure.

In his remarks, the President covered several computing-related topics.  When discussing cyber threats, he identified four basic principles to emphasize when addressing those threats:

• Shared mission between the private sector and government.
• Focus on what each sector does best.
• Constantly evolve defenses.
• Protect privacy and civil liberties.

The Executive Order focuses on three major items to support increased cybersecurity information sharing related to critical infrastructure.

1. It encourages the development of Information Sharing and Analysis Organizations (ISAOs), groups organized around particular affinities (such as geographic area or field of activity) that would share cybersecurity threat information with their members and with the government.
2. The ISAOs would coordinate with the Deparmtent of Homeland Security’s (DHS) National Cybersecurity and Communications Integration Center, which is now a critical infrastructure protection program under the Executive Order.
3. DHS is now part of the National Industrial Security Program, which sets guidelines for the sharing of classified information with industry.  Participation will make it easier for the Department to have private sector personnel access national security information related to critical infrastructure protection.

All of the activities under this order must be conducted in consultation with senior agency personnel for privacy and civil liberties protection.

On February 6 USACM submitted a short comment to The Copyright Office in support of an exemption to the prohibitions against circumvention outlined in the Digital Millennium Copyright Act (DMCA).  Our comments were in support of an exemption for Software - Security Research (Class 25 of the twenty-seven classes open for comment).  This is part of a triennial rulemaking process that determines exemptions to the circumvention prohibitions for the following three years.

In this short comment, USACM argues in support of an exemption for this class, noting the value of examination and circumvention research for security research.

This first comment period closed on Friday, and was for commenters in support of, or neutral to, exemptions for the proposed classes.  The second round, closing on March 27, is for those opposed to the exemptions for the proposed classes.  There will then be a third round of comments closing on May 1.  This round is for supporters of exemptions for the proposed classes, or those neutral to them.  Comments in this round must be in reply to comments previously submitted to the record.

The President signed several cybersecurity bills toward the end of 2014.  Much of the legislation signed by President Obama affects various cybersecurity functions within the Department of Homeland Security (DHS):

Federal Information Security Modernization Act (S. 2521) – Updates the Federal Information Management Security Act of 2002.  The Office of Management and Budget would oversee implementation of agency information security policies and DHS would have the lead administrative role.  Compliance would

National Cybersecurity Protection Act (S.2519) – Formalizes in law the National Cybersecurity and Communications Integration Center at DHS.

Cybersecurity Workforce Assessment Act (H.R. 2952) – Requires DHS to produce a cybersecurity workforce assessment and strategy document on a regular basis, and to provide Congress with an assessment of costs and other requirements for a Cybersecurity Fellowship program.

Border Patrol Agent Pay Reform Act (S. 1691) – Part of this bill allows the DHS to exempt certain cybersecurity positions from some federal hiring rules.

Cybersecurity Enhancement Act (S.1353) – The bill formalizes in law the National Institute of Standards and Technology (NIST) process behind the Cybersecurity Framework.  It also supports the continuation of the Cyber Scholarship for Service program, National Science Foundation (NSF) research and development on cybersecurity and other computing security, as well as other research for both the NSF and NIST.

On October 17, comments closed on a Request for Information from the Networking and Information Technology Research and Development (NITRD) program.  Agencies in this program are working on a National Privacy Research Strategy, and sought input from the public.  Specifically, the request asked for input on the privacy objectives that would inform the strategy.  The strategy will emphasize “research directions for privacy-enhancing technologies, designs, and methods to enable privacy-preserving information systems.”

USACM submitted comments in response to the Request for Information.  In those comments, USACM outlined several scenarios that highlight privacy issues that would benefit from additional research.  The comments also recommended including more than one paradigm for evaluating privacy research results.  Focusing on one privacy paradigm (such as economic privacy) to the exclusion of others (like privacy as autonomy) would provide a limited view on the value of research questions and the results of privacy research.

USACM encouraged the use of multi-disciplinary approaches to privacy research questions.  To that end, it also recommended new training for computer science researchers, so that they can better understand how end users experience privacy.  Finally, in commenting on privacy architecture, USACM noted that it’s important to address both software architecture and enterprise architecture.

This Request for Information was the first part of the development of the National Privacy Research Strategy, a process likely to take a few months.  There may be additional opportunities to comment once NITRD has developed a draft or preliminary research strategy.

As part of its work on the Cybersecurity Framework (Framework), the National Institute of Standards and Technology (NIST) sought comments from stakeholders on their experiences with it.  USACM has followed the development of the Framework since the 2013 Executive Order that required it.  We submitted comments on a preliminary outline of the Framework back in April 2013.  Our latest comments re-emphasized a point of our April 2013 comments - the need to minimize the amount of information disclosed.

In our comments, USACM focused on the Roadmap that supports the Framework.  The Roadmap identifies areas for alignment, collaboration, and development that would assist parties in implementing the Framework.  USACM identified areas in the Framework that could inform each other, such as Technical Privacy Standards and Data Analytics.  Additionally, the comments identified autonomous devices (items like a smart meter that rely on networking to function) as an area that should be a priority.  As they can be used in sectors like energy and health care, they could qualify as critical infrastructure.

The comments NIST receives will inform the upcoming workshop it is hosting in Tampa on October 29-30.

The White House Office of Science and Technology Policy has asked a steering group in the Federal Networking and Information Technology Research and Development (NITRD) Program to lead development of a National Privacy Research Strategy.  As part of this effort, there is a Request for Information (RFI) seeking comment.  Submissions (of no more than 20 pages) must be sent in by October 17.

The call for such a research strategy is informed, per the RFI, from calls for additional research into privacy-enhancing technologies.  The resulting strategy will include research objectives and a framework for organizing ideas intended to address those objectives.  This framework is intended to encourage approaching privacy research questions from a multi-disciplinary perspective, including several disciplines in approaching privacy-enhancing technologies.

There are four main questions/topics in the RFI:

• Privacy Objectives
• Assessment Capabilities
• Mulit-disciplinary Approach
• Privacy Architectures

While most of these topics are described in general terms, the RFI mentions a ‘responsible use model’ when discussing Privacy Architectures.  This is linked to the Administration’s Big Data report, which was one of the reports cited in the RFI.

It’s worth noting that the RFI specifically states that while social and legal solutions can address concerns over privacy, those tools will not be a focus of the emerging National Strategy.  That will focus on “the research directions for privacy-enhancing technologies, designs, and methods to enable privacy-preserving information systems.”

On Thursday, October 2, the National Institute of Standards and Technology (NIST) has a webcast scheduled to present its draft (including a discussion deck) Privacy Engineering Objectives and Risk Model.  The development of these materials has been informed by two Privacy Engineering workshops that NIST co-hosted with the International Association of Privacy Professionals.

The current draft available online was prepared in advance of the second Privacy Engineering workshop, and whatever NIST releases on October 2 may reflect additional changes.  It’s focus is on protecting privacy in the course of unanticipated consequences of normal system behavior.  Malicious actors and attacks can be mitigated through security procedures.

Part of the motivation for this document is to address communications gaps around privacy and the development of tools to measure the effectiveness of privacy practices.  The objectives are not intended to describe a complete privacy risk management framework, as they are just one component of such a model.  NIST intends to add more components over time, but is focused on the objectives and the risk model for now.

Comments are being taken on the draft objectives and risk model until October 15.  They can be sent to privacyeng at nist.gov.

The Food and Drug Administration (FDA) has announced a workshop on medical device cybersecurity for October 21 and 22 in Arlington, Virginia.  Titled “Collaborative Approaches for Medical Device and Health Care Cybersecurity,” the event is intended for a broad audience of stakeholders engaged in health care and public health.  The workshop will be webcast, but if you are planning to attend in person, registration will close by 4 p.m. Eastern on October 14.

As part of the workshop announcement, the FDA issued this Federal Register notice seeking comment.  Whether or not you attend the workshop, the FDA is looking for comments on any aspect of the workshop by November 24.  But for a set of questions connected to the workshop themes, comments are needed by October 7.  Those questions are (HPH means Health Care and Public Health):

• Are stakeholders aware of the “Framework for Improving Critical Infrastructure Cybersecurity”? If so, how might we adapt/translate the Framework to meet the medical device cybersecurity needs of the HPH Sector?
• How can we establish partnerships within the HPH Sector to quickly identify, analyze, communicate, and mitigate cyber threats and medical device security vulnerabilities?
• How might the stakeholder community create incentives to encourage sharing information about medical device cyber threats and vulnerabilities?
• What lessons learned, case studies, and best practices (from within and external to the sector) might incentivize innovation in medical device cybersecurity for the HPH Sector? What are the cybersecurity gaps from each stakeholder’s perspective: Knowledge, leadership, process, technology, risk management, or others? and,
• How do HPH stakeholders strike the balance between the need to share health information and the need to restrict access to it?

(Edited September 4 to focus on NIST activities concerning the Cybersecurity Framework)

The National Institute of Standards and Technology (NIST) has posted a Request for Information on the Cybersecurity Framework, with a deadline for comments of October 10.   Developed and administered by the (NIST), the first version of the Framework was released in February of this year, along with a Roadmap.

NIST is particularly interested in understanding how companies and organizations in all critical infrastructure sectors are approaching the Framework.  The broad categories in the request are:

• Current Awareness of the Cybersecurity Framework
• Experiences With the Cybersecurity Framework
• Roadmap for the Future of the Cybersecurity Framework

NIST is hosting its 6th workshop on the Framework October 29-30 in Tampa.  An agenda is not yet available, but NIST indicates the target office is owners and operators of critical infrastructure and cybersecurity staff.  Registration is available online.

Yesterday USACM responded to a Request for Comment from the National Telecommunications and Information Administration (NTIA).  In response to a recommendation in the Administration’s Big Data report released in May, the NTIA solicited public comment on how the Consumer Privacy Bill of Rights could support big data.

In its comments, USACM notes that while big data adds to the complexity of limiting data collection, such limits should not be deemphasized.  It’s important to have controls on both the collection and use of data, and innovations, including privacy enhancing technologies, should make it easy for someone without a technical background to apply their data preferences when interacting with a data collector.

Among the USACM recommendations:

• Use a broadly construed risk-based approach to responsible use that accommodates multiple privacy risk models, and allows designers to accommodate variations in risk and exposure.
• Attach consumer guidance to data supplied by the consumer only once. Organizations should be responsible for applying the guidance wherever and whenever the data is communicated or used.
• Systems designers should build reasonably effective deletion capability into the system and document the capability and its limitations.
• Have sector-independent means of handling data of different levels of sensitivity could help address cost concerns and spur innovation in Big Data by simplifying the set of privacy rules.
• In addition to proper access and physical security controls, contract language is a practical tool available to organizations that want to discourage attacks against latent information about individuals.

The full set of recommendations is available online, as is our press release.

Guest blog post written by Mark Rasch, U.S. Public Policy Council member

The Supreme Court has always had to consider the impact of new technologies on both individuals’ expectations of privacy and ultimately on their rights to be free from “unreasonable” searches and seizures under the Fourth Amendment. When the telephone was invented, the court had to consider whether listening in on a phone call was a “search” and seizure — since nothing was “seized” the court initially concluded it was not, but later reversed itself. When airplanes were used to fly over people’s houses, or cameras to take pictures of them the court had to consider peoples privacy rights in their own backyards (they have none if the plane is at a “lawful altitude.”) The court has had to consider whether the use of canine technology (a dog sniff) violates privacy rights (airports, OK, traffic stops, OK, at your doorstep, not so much). The court also considered whether the cops can peer into your home with technology (NO for infrared sensors), or follow your movements when you drive (YES with a beeper, NO with GPS installed without a warrant on your bumper, MAYBE with a cell phone).

In the waning days of its term in June, the Court considered the circumstances under which the police can search the cell phone of a person arrested. Under the doctrine of “search incident to a lawful arrest” the cops wanted the authority to conduct as invasive and detailed a search of an arrestee’s cell phone as it could conduct for example of a briefcase in the arrestee’s possession. Just because a cell phone might carry more information, well, that’s your problem for carrying all that data with you.

The Supreme Court unanimously disagreed. While the Court addressed the purposes and scope of the “search incident” doctrine (to protect the cops, and ensure that evidence is not destroyed, and possibly because people arrested have lower privacy rights) the Court found that cell phones were no ordinary container. In fact, the Court said that it wasn’t accurate to call them cell phones — they were really hand-held computers. And not all the data to be “searched” incident to an arrest would be on the phone either — the phone can act as a portal to data stored elsewhere — on a Facebook or Twitter server, a cloud device, or anywhere else. This is much more invasive that just checking out someone’s wallet for a razor blade or betting slips.

What is significant about the decision is not just that the Court recognized that technological advances can impact privacy rights, but also that quantitative changes can create a qualitative impact. There is a huge difference between being able to read a message of mine, or a Facebook posting of mine, and being able to see everything I have ever done. There’s a difference between being able to follow me in a car and know where I am going, and being able to track every place everyone has ever been — and where they are now. Privacy rights are collective, temporal, proximate, and combined. And so is erosion of them. When the Atlanta father was arrested for leaving his child in a car seat on a hot day to die, and the police indicated that his browser history indicated that he had researched leaving a child in a hot car, my question was “when?” A browser history search for a few weeks or months ago is reasonable and relevant. But data may be kept (at least by someone) for decades. The fact that the father may have looked up something of interest to the police years or decades ago is no longer relevant. In fact, after the Atlanta case, I also looked up kids in hot cars (well, actually cases in which people had been convicted or acquitted for kids in hot cars). God forbid this search history becomes relevant later on.

The Court has a long way to go. It will be forced to consider issues like privacy right with respect to drones and micro-drones, cell phone location services, third party doctrine, crowdsourcing, cloud, data aggregation, big data, and how the Internet acts and does not act as a “public space.” But the Founding Fathers never considered a pay phone either. The fact that a unanimous court accepted the fact that a phone is not just a container is heartening. The fact that they had to, not so much.

Mark Rasch is a member of the ACM U.S. Public Policy Council. He is an attorney and author, working in the areas of corporate and government cybersecurity, privacy, and incident response. He is the former Vice President, Deputy General Counsel, and Chief Privacy and Data Security Officer for SAIC.

The U.S. Supreme Court recently unanimously ruled that law enforcement need to obtain a warrant to search a cellphone seized incident to an arrest. The decision addressed two separate warrantless cellphone search cases before the Court – one involving a smartphone and one involving a flip-lid phone. In the new balancing of law enforcement needs and the rights of arrestees, the Court concluded, “Our answer to the question of what police must do before searching a cell phone seized incident to an arrest is accordingly simple — get a warrant.”

The Court was not clearly convinced that a warrantless search might be necessary to prevent potential evidence destruction of data on the cellphone by remote wiping, geofencing, or data encryption. Geofencing is when the contents of the phone are deleted upon crossing some geographic boundary; this is generally achieved through pre-programmed mechanisms that leverage the device’s GPS location information or the WiFi tower location. When discussing the techniques used to destroy or encrypt data, the Court cited the “Guidelines on Mobile Device Forensics,” published by the National Institute of Standards and Technology in May 2014. The guidelines identify three means to prevent data destruction and encryption, each with tradeoffs for forensics examination: (a) airplane mode, (b) turning off the device, and (c) placing the device in a shielded container, such as a Faraday bag.

Even though the Court asserts a clear rule with a simple answer, warrantless searches of cellphones could still be lawful in certain circumstances. For example, the Court spotlighted the continued applicability of the exigent circumstances exemption, which could allow law enforcement to search the phone immediately without a warrant if they believe an arrestee’s phone is in imminent threat of a data destruction attempt. Presumably, the imminent threat would not be mitigated by disconnecting the cellphone from the network through the “simple” and “reasonable” responses discussed earlier in the opinion. The Court also clarified that law enforcement can disable a phone’s auto-lock security feature to prevent the phone from locking and encrypting data for the purpose of preserving evidence while they obtain the warrant.

“The most significant part of the decision is not the fact that the Supreme Court has limited searches incident to an arrest,” said U.S. Public Policy Council member Mark Rasch. “It’s that it has recognized that data – and digital data in particular – is a different kettle of fish than physical objects and must be treated accordingly. And that’s a big deal. A very big deal.”

Riley v. California; United States. v. Wurie, U.S. Supreme Court Slip Opinion

In remarks at the American Enterprise Institute on June 12, Federal Communications Commission Chairman Tom Wheeler outlined how he sees the Commission addressing cybersecurity.  While perhaps not the first government entity that comes to mind when thinking about cybersecurity, the FCC is concerned with the operations of networks, and would certainly be interested in keeping them secure.

Wheeler’s remarks were consistent with the approach outlined by the Obama Administration in its cybersecurity policies, including the 2013 Executive Order and the Cybersecurity Framework released by the National Institute of Standards and Technology in response to that order.  While Wheeler did mention the new leadership and organization in the Commission responsible for cybersecurity, his remarks focused on the kind of collaborative, private-sector led approaches to cybersecurity encouraged by the Executive Order and the process that informed the Cybersecurity Framework.  He exhorted the commercial network ecosystem to assume new responsibility and accountability for managing cyber risks  He would like the Commission to encourage and support increased attention to network security, resorting to regulation only if increased private sector activity is not successful.  Wheeler considers the current activity insufficient to protect network cybsecurity but does not want to prescribe activity at the moment.

Today marks the start of the Cyber Grand Challenge, organized by the Defense Advanced Research Projects Agency (DARPA).  The New York Times has a lengthy article on the challenge, which involves over 35 teams deploying automated cybersecurity solutions.  There’s also an extensive commercial website devoted to the event.  The teams will receive a suite of programs with hidden flaws.  The challenge is to detect and address the security flaws while permitting the infected programs to do their intended jobs.

This is the qualifying round of the Challenge.  The top seven teams will receive money to prepare for a final round, planned for 2016 in Las Vegas and held concurrently to that year’s Def Con.  The winning team would receive $2 million, with $1 million going to the second place team and $500,000 to the third place team.

DARPA has had success with previous Grand Challenges, including their work on autonomous vehicles.  The agency expects that work on this challenge would prompt developments in the following:

• Expert-level software security analysis and remediation, at machine speeds on enterprise scales
• Establishment of a lasting competition community for automated cyber defense
• Identification of thought leaders for the future of cybersecurity
• Creation of a public, high-fidelity recording of real time competition between automatic systems

While the competition officially begins today, teams may register to participate through November 2 of this year.

In early May the White House and the President’s Council of Advisers on Science and Technology (PCAST) each issued reports on ‘big data’ as part of the Administration’s 90-day big data review.   John Holdren, co-chair of PCAST and the President’s science adviser, was involved with both reports.  USACM submitted comments to the Office of Science and Technology Policy in connection with the big data review, and the White House solicited public feedback via its website.  The responses expressed significant concerns with data collection and use practices associated with big data, and reflected a strong interest in having effective transparency and oversight in place for data practices.

The review, announced in January as part of the response to leaks and disclosures about how the government was collected and using data for national security reasons, was focused in particular on the effects of big data on how people live and work.  This includes how private and public sector entities collect and use this data.  As you might expect, the focus of the PCAST report was more narrow than that of the White House report.  The White House report acknowledges the benefits possible through big data, which can include saving lives and making organizations run more efficiently.  It also made recommendations for legislative changes and additional policy actions that should improve the security and privacy of how big data is collected and used.

Besides concerns over the privacy and security of collected big data, the White House report highlighted how big data can facilitate discriminatory outcomes, especially in areas where there are existing protections in place.  This is in addition to the chilling effect government data collection and use can have on free expression and association.  The ease by which information can be collected, merged and analyzed without human interaction or interpretation makes it easier for large groups to be targeted.

Read More »

In comments to both the Privacy and Civil Liberties Oversight Board and the Review Group on Intelligence and Communications Technologies, USACM recommended the use of an independent systems engineering analysis to review the design and operation of complex processes and systems.  Our members spent some time further considering what should go into such an analysis, outlined the elements for one and described how such an analysis could be performed in the context of national surveillance programs.  This description was submitted in a letter to the Director of National Intelligence earlier this month, and links such an analysis to several of the recommendations by the Review Group.

A systems engineering analysis will be focused on data flowing into, through and out of a system.  Analyses should be concerned with the following system attributes:

• Auditability (including provenance)—the ability to associate system actions and data with their sources
• Confidentiality—the extent to which the system ensures that data is only accessible for authorized purposes and to those who are authorized
• Integrity—the resistance of data to unauthorized modification
• Data quality (of both collected and derived data)—the fitness of data for its intended purpose, including its accuracy and currency
• Functional completeness—the extent to which the set of functions addresses all objectives
• Functional correctness—the extent to which the system produces correct results with the necessary degree of precision
• Functional appropriateness—the extent to which the functions achieve objectives

The letter goes into further detail about how each of those attributes can be analyzed.  By conducting such an analysis, USACM believes that relevant policy tradeoffs can be highlighted, hopefully before systems are deployed and problems arise.

Following on the announcement in January that the White House would be reviewing Big Data and its influence on privacy and the economy, the Office of Science and Technology Policy (OSTP) has been seeking input from the public and other stakeholders.  The office has already co-sponsored two conferences on big data.  The first was at MIT last week and the next is scheduled for March 17 at New York University.  Another event will take place at Berkeley later this year.

OSTP released a Request for Information (RIF) last week on how big data can influence privacy, the economy and other aspects of public policy.  Comments must be submitted by March 31, and must be fewer than 7,500 words.

The questions in the RFI are organized around a few broad themes:

• The public policy implications of the collection, storage, use and analysis of big data
• What areas of big data could benefit from additional government research or support?
• Technology trends that may influence big data
• How should government big data be treated differently from private sector big data?
• Cross-jurisdiction issues prompted by big data

OSTP considers big data to mean “datasets so large, diverse, and/or complex, that conventional technologies cannot adequately capture, store, or analyze them.”

Responses are due by March 31.  Consult the Federal Register notice for instructions on how to submit your comments.