Articles by Jerry Brito

Jerry is a senior research fellow at the Mercatus Center at George Mason University, and director of its Technology Policy Program. He also serves as adjunct professor of law at GMU. His web site is jerrybrito.com.


Keeping the NSA out of civilian cybersecurity: there’s a reason

by on February 29, 2012 · 0 comments

Tomorrow Sen. John McCain, along with five other Republican senators, [plans to unveil a cybersecurity bill](http://techdailydose.nationaljournal.com/2012/02/gop-senators-to-unveil-rival-c.php) to rival the Lieberman-Collins bill that Majority Leader Harry Reid has said he plans to bring to the Senate floor without an official markup by committee.

At a hearing earlier this month, Sen. McCain criticized the Lieberman-Collins bill for not giving the NSA authority over civilian networks. And as we’ve heard this week, the NSA has been aggressively seeking this authority–so aggressively in fact that the White House [publicly rebuked Gen. Keith Alexander](http://jerrybrito.com/2012/02/27/the-white-house-strikes-back/) in the pages of the *Washington Post*. But as CDT’s Jim Dempsey explains in a [blog post today](https://www.cdt.org/blogs/jim-dempsey/2902will-nsa-power-grab-imperil-cybersec-consensus),

>The NSA’s claims are premised on the dual assumptions that the private sector is not actively defending its systems and that only the NSA has the skills and the technology to do effective cybersecurity. The first is demonstrably wrong. The Internet and telecommunications companies are already doing active defense (not to be confused with offensive measures). The Tier 1 providers have been doing active defense for years – stopping the threats before they do damage – and the companies have been steadily increasing the scope and intensity of their efforts.

>The second assumption (that only the NSA has the necessary skills and insight) is very hard for an outsider to assess. But given the centrality of the Internet to commerce, democratic participation, health care, education and multiple other activities, it does not seem that we should continue to invest a disproportionate percentage of our cybersecurity resources in a military agency. Instead, we should be seeking to improve the civilian government and private sector capabilities.

The military, and especially the NSA, has great experience and useful intelligence that should leveraged to protect civilian networks. But that assistance should be provided at arms-length and without allowing the military to conduct surveillance on the private Internet. Military involvement in civilian security is as inappropriate in cyberspace as it is in the physical world.

As Gene Healy [has explained](http://www.thefreemanonline.org/featured/blurring-the-civilian-military-line/), civilian law enforcement and security agencies “are trained to operate in an environment where constitutional rights apply and to use force only as a last resort”, while the military’s objectives are to defeat adversaries. The NSA’s warrantless wiretapping scandal speaks to this difference. “Accordingly, Americans going back at least to the Boston Massacre of 1770 have understood the importance of keeping the military out of domestic law enforcement.” The Senate Republicans would do well to leave NSA involvement in civilian networks out of a new cybersecurity bill.

And FYI: I will be presenting at a Cato Institute Capitol Hill briefing on cybersecurity on March 23rd along with Jim Harper and Ryan Radia. [Full details and RSVP are here](http://www.cato.org/event.php?eventid=9060).

**[Cross posted from JerryBrito.com](http://jerrybrito.com/2012/02/29/keeping-the-nsa-out-of-civilian-cybersecurity-theres-a-reason/)**

SHARE: 0 comments

Clay Johnson on information consumption

by on February 28, 2012

On the podcast this week, Clay Johnson, co-founder of Blue State Digital and former director of Sunlight Labs at the Sunlight Foundation, discusses his new book, The Information Diet. According to Johnson, America’s diet of mass-produced unhealthy food has resulted in an obesity epidemic and we may be seeing the same thing when it comes to our media diet. He believes the problem is not too much information, rather it is the quality of information that people choose to consume. Johnson encourages more responsibility in choosing information intake, similar to what is required to make healthy food choices. He ends by outlining a plan of action and offers tips on consuming “healthy” information.

Related Links

To keep the conversation around this episode in one place, we’d like to ask you to comment at the webpage for this episode on Surprisingly Free. Also, why not subscribe to the podcast on iTunes?

SHARE:

David Weinberger on knowledge

by on February 21, 2012

On the podcast this week, David Weinberger, senior researcher at Harvard Law’s Berkman Center for the Internet & Society and Co-Director of the Harvard Library Innovation Lab at Harvard Law School, discusses his new book entitled, “Too Big to Know: Rethinking Knowledge Now That the Facts Aren’t the Facts, Experts Are Everywhere, and the Smartest Person in the Room Is the Room.” According to Weinberger, knowledge in the Western world is taking on properties of its new medium, the Internet. He discusses how he believes the transformation from paper medium to Internet medium changes the shape of knowledge. Weinberger goes on to discuss how gathering knowledge is different and more effective, using hyperlinks as an example of a speedy way to obtain more information on a topic. Weinberger then talks about how the web serves as the “room,” where knowledge seekers are plugged into a network of experts who disagree and critique one another. He also addresses how he believes the web has a way of filtering itself, steering one toward information that is valuable.

Related Links

To keep the conversation around this episode in one place, we’d like to ask you to comment at the webpage for this episode on Surprisingly Free. Also, why not subscribe to the podcast on iTunes?

SHARE:

Some (hopefully constructive) thoughts on cybersecurity

by on February 16, 2012 · 0 comments

Ahead of today’s cybersecurity hearing in the Senate, I wanted to jot down some thoughts on the issue. For over a year now, I’ve been questioning the need for federal intervention in cybersecurity and calling for a slower and more deliberate process. Perhaps I come across as a refusenik, but I hope that I’m at least lending some balance to the debate.

First, let me say that I fully recognize that the U.S. faces serious cyber threats. [Here is](http://selil.com/archives/2985) one of the best (and most honest) cases for being worried that I’ve seen. I get it.

That said, what I try to point out is that the existence of a threat [does not necessarily mean](http://techliberation.com/2012/02/16/too-big-to-face-incentives/) that regulation is necessary. In many cases, the threat [can be internalized](http://techliberation.com/2012/01/24/is-there-a-market-failure-in-cybersecurity-its-not-an-open-and-shut-case/) by affected private actors. Even if we determine that some private actors are not internalizing the costs, prescriptive regulation can sometimes do more harm than good. The best thing we can do is not try to prevent harm at all costs, but instead make sure that we are resilient so that no single threat can destroy us. And we [may be more anti-fragile](http://mercatus.org/publication/beyond-cyber-doom)–more resilient and more capable of adaptation–than we’re led to believe.

That brings me to the other thing I try to point out: that the rhetoric surrounding cybersecurity is often unnecessarily alarmist. Introducing the Cybersecurity Act of 2012, Sen. Rockefeller equated the cyber threat with the nuclear threat. I’m sorry, but I don’t think that’s right. It does scare people, however, and I’m afraid that we will be sold an expensive bill of goods based on fear.

So I’m happy to see that both the Senate and the House have begun to take more realistic approaches to cybersecurity. For example, the [Rockefeller-Snowe bill](http://www.opencongress.org/bill/111-s773/show) from last congress would have required the Department of Commerce to develop “a national licensing, certification, and periodic recertification program for cybersecurity professionals,” and would have made certification mandatory for anyone engaged in cybersecurity. I’m happy to see that’s gone in the new bill. I’m glad that there is no “[Internet kill switch](http://techliberation.com/2011/02/19/the-internet-kill-switch-debate/).” I’m also happy to see that the bill includes a way for private industry to appeal its inclusion in the regulatory regime.

Where do I think there may be a role for government? Information sharing certainly comes to mind. There is no doubt that there’s a lot that the public and private sectors can learn from each other. And to the extent that private actors are prevented by privacy laws to cooperate on cybersecurity, there should be a way to facilitate cooperation without endangering consumer protections. Additionally, requiring disclosure of security breaches is not a bad idea. It would allow insurance markets and other markets serve as an alternative to regulation, or as Cass Sunstein calls it, regulation through transparency.

SHARE: 0 comments

Too big to face incentives

by on February 16, 2012 · 1 comment

Here, in one sentence, is what’s wrong with [Stewart Baker’s testimony](http://www.skatingonstilts.com/skating-on-stilts/2012/02/testifying-about-cybersecurity-legislation.html) on cybersecurity before the Senate Homeland Security committee today:

>If an asset is not designated as “covered critical infrastructure,” then the owner has no obligation under the bill to guard against attack by hackers, criminals, or nation states, leaving those who depend on the asset unprotected.

The logic here is that if a private network is not forced by government to protect itself, then it will be left unprotected and wide open for attack. There is no private incentive to secure one’s investment, the argument seems to be. If you’d like an explanation of why this isn’t logical, see Eli Dourado’s [paper on cybersecurity market failure](http://mercatus.org/publication/there-cybersecurity-market-failure-0).

One more thing: according to Baker, present network insecurity “could easily cause the United States to lose its next serious military confrontation.” I understand asymmetric threats, but here is a l[isting of military spending by country](http://en.wikipedia.org/wiki/List_of_countries_by_military_expenditures). “Easily” doesn’t come to mind.

SHARE: 1 comment

It might be good to try a little harder on copyright

by on February 15, 2012 · 20 comments

Kevin Drum and Tim Lee have been having an [interesting](http://motherjones.com/kevin-drum/2012/02/should-idiots-be-allowed-regulate-internet) [exchange](http://arstechnica.com/tech-policy/news/2012/02/copyright-enforcement-and-the-internet-we-just-havent-tried-hard-enough.ars) about whether those of us who oppose granting copyright holders stronger enforcement powers feel this way because we are ideologically opposed to IP protection. Tim points out that copyright owners have, as a matter of fact, received greater and greater enforcement powers–almost on an annual basis. As a result, Tim says, “most of us are not anti-copyright; we just think enough is enough, and that the menu of enforcement tools Congress has already given to copyright holders is more than sufficient.”

Sufficient for what, though? Sufficient to significantly reduce piracy online? That’s certainly not the case. Piracy is rampant on the net. Some would say, though, that the only meaningful ways left to enforce copyright would (dare I say it?) break the Internet as we know it.

So I think that when Tim says that the powers copyright holders now have are “more than sufficient,” I think he means sufficient to provide an incentive to create. After all, the purpose of copyright is to “promote the progress of science,” not to protect some Lockean notion of property. It may be the case that while owners’ rights are no doubt being violated, a further reduction in piracy won’t affect the incentive to create.

This is why many, including [Julian Sanchez](http://www.cato.org/pub_display.php?pub_id=14028), [Tim O’Reilly](https://plus.google.com/107033731246200681024/posts/BEDukdz2B1r), [Mike Masnick](http://www.techdirt.com/blog/?tag=sky+is+rising) and [Jonathan Coulton](http://surprisinglyfree.com/2012/02/14/jonathan-coulton/), question whether piracy is really a problem at all. That is, they don’t believe it may be the case that the present level of piracy doesn’t hurt content owners’ bottom lines because it’s clear that not every infringement would have otherwise been a sale. If that’s the case, then the costs of new enforcement powers would outweigh any benefits. So, the argument goes, we should do nothing.

Continue reading →

SHARE: 20 comments

We’re not kidding about overheated cybersecurity rhetoric

by on February 14, 2012 · 1 comment

Tate Watkins and I have [an essay in Wired today](http://www.wired.com/threatlevel/2012/02/yellowcake-and-cyberwar/) looking at how the overheated rhetoric and unsupported claims around cybersecurity inflate the threat and may lead us to a new cyber-industrial complex. It’s the same theme we explore in our recent Harvard National Security Journal article and also in a feature in Reason a few months ago.


What do we mean by overheated rhetoric that serves more to scare than to inform? Here are some statements from Sen. Jay Rockefeller introducing the comprehensive cybersecurity bill on the Senate floor today:

>”The experts are warning us that we are on the brink of something much worse. Something that could bring down our economy, rip open our national security, or even take lives. The prospect of mass casualty is what has propelled us to make cybersecurity a top priority for this year, to make it an issue that transcends political parties or ideology. …

>”Admiral Mike Mullen, former Joint Chiefs chairman, said that a cybersecurity threat is the only other threat that is on the same level as Russia’s stockpile of nuclear weapons. …

>”We are on the brink of what could be a calamity. A widespread cyber attack could potentially be as devastating to this country as the terror attacks that tore apart this country 10 years ago. …

>”Think about how many people could die if a cyber-terrorist attacked our air traffic control system, both now and when it’s made modern, and our planes slammed into one another. Or rails switching networks were hacked causing trains carrying people, and more than that perhaps hazzardous material, toxic materials, to derail or collide in the midst of our most populate urban areas like Chicago, New York, San Francisco, Washington, DC, etc.”

He also touch on pipeline explosions and electricity blackouts, of course, and said that we needed to act immediately. It seems that some GOP senators are [calling for a delay on the bill](http://thehill.com/blogs/hillicon-valley/technology/210671-gop-senators-call-for-delay-on-cybersecurity-bill). Stay tuned.

SHARE: 1 comment

Jonathan Coulton on music piracy

by on February 14, 2012

On the podcast this week, Jonathan Coulton, a musician, singer-songwriter, and geek icon, who releases his music under a Non-Commercial Creative Commons License, discusses his thoughts on piracy from an artist’s point of view. Coulton talks about quitting his day job so he could focus on his music. He bypassed the traditional route of becoming a musician, which usually means signing to a record label, and began releasing one song per week on his website. This lead to eventual success, according to Coulton, who now makes his living as a full-time musician by touring and selling his music on his website. The discussion then turns to piracy. Coulton explains why he thinks piracy cannot be stopped and describes what he considers “victimless piracy.” He goes on to discuss the difficulties of addressing piracy issues, especially when taking fairness and practicality into account.

Related Links

To keep the conversation around this episode in one place, we’d like to ask you to comment at the webpage for this episode on Surprisingly Free. Also, why not subscribe to the podcast on iTunes?

SHARE:

Will the UN take over Net governance?

by on February 13, 2012 · 3 comments

Over at TIME.com I write that we should keep a close eye on moves by Russia, China and other countries to move Internet governance to the UN:

>All this year, and culminating in December at the World Conference on International Telecommunications in Dubai, the nations of the world will be negotiating a treaty to govern international telecommunications services between countries. It is widely believed that some countries, including Russia and China, will take the opportunity to push for U.N. control of Internet governance. Such a turn of events would certainly be troubling. …

>It’s amazing to think about it, but no state governs the Internet today. Decisions about its architecture are made by consensus among engineers and other volunteers. And that, in fact, is what has kept it open and free.

>“Upending the fundamentals of the multi-stakeholder model is likely to Balkanize the Internet at best, and suffocate it at worst,” FCC Commissioner Robert McDowell said recently in a speech. “A top-down, centralized, international regulatory overlay is antithetical to the architecture of the Net, which is a global network of networks without borders. No government, let alone an intergovernmental body, can make decisions in lightning-fast Internet time.”

Read the whole thing at TIME.com.

SHARE: 3 comments

Feb. 24 Event: The Digital Inventor: How Entrepreneurs Compete on Platforms

by on February 9, 2012 · 0 comments

Folks, I wanted to bring your attention to this conference on Feb. 24 from the Information Economy Project at George Mason University. The pitch:

The assembly line of our knowledge-based economy begins with technology discovery and ends with the moving target of a consumer market. Connectivity is funded and rewarded through exchanges of time, money, and digital goods. The conversation in this conference will identify key priorities in technology policy for innovation, network investment, and content delivery models. Articles will be published in a special issue of the Journal of Law, Economics & Policy.

See the website for speakers, schedule, and RSVP info.

SHARE: 0 comments

← Previous Entries

Next Entries →