Summary
The Obama administration’s recent approval of the Bush-era ‘Einstein-3’ program is a telling example of where President Obama’s priorities lie in balancing civil liberties with the need to secure cyberspace.
Analysis
President Obama’s recent characterization of cyber attacks as, “one of the most serious economic and national security challenges” facing America isn’t that far from the truth. Countries like China have long planned to lean on cyberspace attacks as a way to re-dress the conventional military power imbalance between China and the United States. For the last decade, U.S. government networks made for easy targets, a fact made all too clear by the stunning success of the ‘Titan Rain’ attacks in 2003.
President Obama’s unveiling of the cyber security initiative endeavors to mark a departure from the ineptitude of the past. For now at least, it seems that Washington is starting to take the long ignored threat of cyber attack very seriously.
Squeezed between the plan’s calls for a cyber security military command and a cyber security coordinator is the far less popular extension of a Bush-era program called Einstein-3 – a program that monitors internet traffic in and out of government networks in search of hacker penetrations and backdoors. This program, like Pinwale and other NSA covert spying operations, has a very large potential for abuse and therefore constitutes a worrying trend- especially given the program’s survival under a President who claims to respect civil liberties.
Broadly speaking, Einstein-3 is disquieting because it represents a potential extension of U.S. government ‘protection’ over private networks. While the plan is currently limited to covering dot.gov sites, it’s not too difficult to imagine it one day being extending to ‘protect’ dot.com sites and beyond. In fact, James Lewis of the Center for Strategic and International Studies testified to Congress last March that the Comprehensive National Cybersecurity Initiative – the Bush-era initiative that birthed Einstein – singular focus on dot.gov sites was a “serious shortcoming.”
As it stands now, every private citizen surfing a dot.gov site or sending an e-mail to a government employee will be subject to Einstein-3 screening. The government claims that only e-mail attachments will be scanned for malignant code, but if the NSA Pinwale program has taught us anything, it’s that the potential for abuse more often than not leads to actual abuses taking place.
The Obama administration is keenly aware that when it comes to public perception, the NSA’s star is not shining so brightly these days. Warrantless domestic spying programs and e-mail surveillance has attached some serious negative connotations to any domestic NSA program. It thus makes sense that President Obama is stressing that Einstein-3 is being developed and overseen by the DHS, rather than the NHS. However, Secretary Napolitano has made it clear that the DHS intends to use the “[substantial] technical resources” that the NSA has to offer.
Whatever agency ends up sifting through the information, Einstein-3 has the potential for systematic abuse. The agency in charge will have the ability spy on individuals and departments within the government bureaucracy, opening the door for partisan bullying and intimidation.
Finally, there are questions as to whether programs like Einstein-3 are the most effective way to safeguard American cyber security. Einstein-3 is only able to screen for instances of malignant code that the NHS is already aware of. A coordinated attack using new code could hypothetically get through undetected.
