Declan McCullagh, senior writer for CNET News, discusses the historical decline of U.S. government involvement with the physical Internet, Jay Rockefeller’s Senate bill that gives the president broad powers during an ill-defined ‘cybersecurity emergency,’ the continuing struggle between government surveillance and private anonymity and how the private sector is much more capable of responding to cyber attacks than the Pentagon.
Podcast: Play in new window | Download
For Antiwar.com, I'm Scott Horton.
This is Antiwar Radio.
Alright, now our guest on the show today is Declan McCullough, and he is a journalist for CBSNews.com, and writes the column, Taking Liberties at CNET.
And I'll have to click the right tab, so I tell you the right address, news.cnet.com.
Welcome back to the show, Declan.
How are you doing?
Why, thank you.
I'm quite well, and you?
I'm great, and I'm very happy to have you back on the show here.
Yeah, it's a pleasure.
So, listen, this whole internet thing is greatly dependent, I guess, on, you tell me, how many major switches at major American telecoms that were built with the National Security Agency from the ground up, and they really have the ability, the state does, to control the entire internet, and you're talking about now they're trying to legalize the authority of the president to shut down the private internet, if he wishes.
Is that right?
Well, let's take a step back and look at the history here.
Back in the 1960s when the ARPANET was being created, and universities like Stanford and Carnegie Mellon and MIT were being linked up, the government was creating what became the internet.
It was funding it, at least, but then you had some renegade computer scientists, many, not all, libertarians, did something that was much more magical than the government ever envisioned, and if the government, in fact, knew what the internet was going to become and how disruptive it would be, they'd probably never have funded it in the first place.
But back then the government really was the funder and did run the infrastructure through, either directly or through the universities that funded.
But, I mean, this is not the case now.
Circa 1992, NSF allowed commercial traffic on the internet backbone, and the rest is history now.
The internet is owned by the private sector, run by the private sector.
The protocols that make this thing work on a day-to-day basis are created by the private sector through groups like the Internet Engineering Task Force, and the government really has not much to do with it nowadays, and I think that the government would like to change that, and this brings us to the bill that we're talking about.
Well, let me stop you there for a second.
Go ahead.
I'll ask you to please forgive my ignorance about the technical matters here, because it's really not my forte at all, but I guess I thought that there were these few major switches and routers where really the internet is very bottlenecked at whatever, a few dozen places in the world, or something like that, at AT&T headquarters or whatever.
No?
Well, I mean, it depends on what you mean by a bottleneck.
I'm not trying to be clever here, but the internet is now a very, very difficult thing about this, because it's so large.
There are bottlenecks, it's true, and not so much nationally.
I mean, the days of what geeks called May East and May West, which were metropolitan area exchanges, one in the Bay Area, the other I visited in the 1990s before they really locked down the security outside of Washington, D.C. and Virginia, back then I would think things really were centralized domestically.
Now things are much more distributed domestically, but internationally there's a limited number of fiber connections coming into the U.S. and leaving the U.S., and those tend to be called landings.
A lot of them tend to be in Southern California.
A lot of them tend to be in the New York, New Jersey area, although they're scattered around the rest of the coast as well.
And so in terms of bottlenecks, not so much domestically, but internationally, absolutely.
There are only so many cables going in and out of the country, and if you're the government, these would be useful places to, say, tap.
I see.
So when James Bamford talks about the splitters at AT&T in San Francisco and how they're able, and I think another that he talks about is in Missouri, these major switches and how they're able to basically, the state is able to download the entire Internet that way.
It's not that if they turn that switch off, the rest of the Internet relies on it.
It's just that, I don't know what the hell.
It's in there somewhere, but if you cut it off, the traffic would still just go around it, basically.
Is that right?
That's a reasonable way to think about it.
Actually, I'm sitting here at CBS Interactive headquarters on 2nd Street in San Francisco, as I'm talking right now, and we're about half a block away.
If I went over to the window, I could see it.
The AT&T switching station at 611 Folsom Street, the intersection of 2nd Street and Folsom Street, which is where a lot of the alleged wiretapping happened.
This is Crown Zero, about half a block from me right now, across the street from CBS, across the street from Courtyard Marriott Hotel.
It's not a terribly exotic building.
It's an AT&T building without many windows, really none beyond the ground floor.
That's where Mark Klein, who is a whistleblower who works for AT&T, he said this is what was going on there.
His evidence became introduced during an EFF lawsuit, the Electronic Frontier Foundation lawsuit, against AT&T.
He has a book that came out a few weeks ago.
I've just skimmed it.
I haven't read it yet, so I can't say whether it's good or bad, but it's called Wiring Up the Big Brother Machine by Mark Klein.
He sent me a copy, but I presume you can find it on Amazon.
It actually includes photos of some of the entrances to the secret room 641A at AT&T's office here in San Francisco.
This is all background.
This is background to say that if you're the National Security Agency and you want to conduct wiretaps of the Internet that seem to be illegal under the law in place at the time, then you want to cut deals with individual telecommunications companies.
Some, like Quest, seem resistant.
This is a Colorado-based Quest.
Some, like AT&T, as far as we can tell, seem much more open to the prospect.
Maybe it's because they have very large government contracts.
Maybe there's some quid pro quo there.
We just don't know.
But we do know that last year, or was it over a year ago now, the Senate and House passed legislation that immunized these companies who cooperated with the NSA and opened their networks to the NSA in violation of the law in place at the time, which would have made them felons.
Yeah, indeed.
And, of course, they went after the guy from Quest, the CEO of Quest, who wouldn't go along.
They literally persecuted him, Soviet police state style, on a bunch of trumped-up charges because he wouldn't go along with their illegal program.
And that's one of the most important parts of the story to me.
That's some real lawlessness there.
Yeah, I didn't cover the other charges against him, and so I don't know whether there was correlation, causation, but it certainly did seem to happen after he refused to go along with the NSA.
Yeah, I guess I'm doing some assuming there, but I'm also thinking it's a pretty safe assumption to make.
But, no, you're right.
As far as I know, there hasn't been any journalism about the direct causation of a lawyer being assigned to that case for that reason.
Anyway, okay, so now tell us about this new bill that has been proposed by John D. Rockefeller IV, a senator from West Virginia, to give the president what kind of authority over the Internet, Declan?
Well, the term the bill uses is emergency authority, and so it's a little unclear what that means.
The background here is that Senator J. Rockefeller is, of course, a West Virginia Democrat, and he came out with a bill early this year, this spring, that gave the White House the power to disconnect private sector computers from the Internet.
Now, when you're talking about basically pulling the plug on private sector computers during a so-called Internet emergency, people tend to get a little concerned if you're one of those companies running the Internet.
And so they complained about it, civil liberties groups complained, libertarians complained, and then Rockefeller backed down a little.
And so instead of being a very specific bill that said we can disconnect private sector computers from the Internet, the new version that I got my hands on and posted an excerpt of on cbsnews.com is more vague.
It's not as specific as the first one that said we can disconnect.
Now it says we can, quote, declare a cybersecurity emergency, that is, the president can declare a cybersecurity emergency relating to, quote, non-governmental computer networks and do what's necessary to respond to that threat.
What does this mean?
I don't know.
Other people I talk to don't know either.
I talked to the president of the Internet Security Alliance, which is not a bunch of raging libertarians or liberals.
This counts representatives of Verizon, Verisign, Nortel, Carnegie Mellon, the board of directors.
And the Internet Security Alliance said, you know, we just don't understand what this means.
This bill is too vague.
We just can't even analyze it, let alone support it, until some of these problems are fixed.
Well, and just because that one statement, that one deliberately vague statement, do whatever is necessary, is that what it says?
That's my summary.
The exact phrase is declare a cybersecurity emergency, and then do what's necessary to respond to the threat.
Yeah, what's necessary.
That's the open-ended statement in question right there, right?
Yeah.
The Section 201 of the bill, and you can check out CBSNews.com and search for cybersecurity, and you'll find the piece.
It orders the president to, quote, direct the national response to the cyber threat, if necessary, for the national defense and security.
Also, the White House is supposed to engage in periodic mapping of private networks deemed to be critical, and the companies that run those networks, quote, shall share requested information with the federal government.
And prior to the emergency.
This is so that they can be prepared for an eventual one.
Yes, on an ongoing basis.
Yeah.
Well, and so, being the kind of expert that you are about this kind of thing, I mean, isn't there a threat that the Chinese could launch an electronic Pearl Harbor and shut down all of America's networks, and that we would need the central authority of the Pentagon and the NSA and the president to take over and defend our cyberspace from them?
It's a compelling analogy, at least at face value.
But the Pentagon is very good when you have physical enemies coming in with tanks or coming in with missiles or coming in with landing craft, for instance, on assaults on the United States.
But the private sector runs these networks.
They know the way these networks operate.
They know the flaws.
They know how to fix them.
And they basically manage these things on a day-to-day basis.
And so I'm not sure what a bunch of bureaucrats, well, meaning I'm inclined to assume and perhaps very smart, but I'm not sure why a bunch of bureaucrats in Washington or the Pentagon would be better suited to respond to cyber threats than the companies that actually run this on a day-to-day basis.
This is sort of the conceit of bureaucracy, in a way, that you have a bunch of smart people, 5, 10, 30 smart people in Washington, and they can do a better job than the 3,000 or 5,000 smart people who are actually running this on a day-to-day basis in private sector networks like Verizon, Comcast, AT&T, and so on.
Well, I was just thinking about the guys that host the servers for antiwar.com.
Believe me, they've got to put up with some attacks.
I'd like to think that the best that they could do would be call 911 and say, please stop them from attacking our server instead of doing it themselves.
Well, I think you're right.
I mean, the Internet is under attack every moment, every day.
And so in a way, these are actually good.
I hate to say that because it's not entirely true, but all of these different viruses and worms and malware and denial-of-service attacks and other threats against the Internet, they make the Internet stronger.
They cost us incredible amounts of money.
They're very disruptive to companies that are targeted.
But the one good thing about them is that it makes it more resilient because the Internet is always under threat.
And so could the Chinese, could an adversary come up with something, a new attack that would yank some portions of the Internet offline?
I mean, perhaps, but it would be solved very, very quickly and responded to very, very quickly, much like the way we respond to threats when a new denial-of-service attack happens or when a new virus or piece of malware comes out.
Remember the giant Northeast power outage a few years back?
I guess many years back now, late 90s or something, when there was the giant power outage in the Northeast?
And I remember somebody commenting because there was a guy, one of the talking heads on TV was explaining, well, you see, the electricity power grid is a lot like the Internet.
And that was his metaphor for explaining.
And then someone on a blog called him out and said, really, then how come the Internet didn't go out when the power grid went out?
The power grid is centralized and operated by states and is not at all like the structure of the Internet.
And that's why the Internet was just fine, except for the people who couldn't turn their computer on.
That is true.
It's much more resilient because it's running on different types of operating systems.
It's run by different companies.
And so if one of them is down, the other may stay up and may be able to tell the company that went down what they did.
I mean, this is a model to emulate, not this sort of top-down government-controlled model of regulation we have for the electric grid, I'll say.
Well, so talk to me about the dark police state future we're heading into here.
Obviously, there's no law that can bind the power of the executive branch of our government anymore.
And so at the same time that that's happened, we're at the point of our technology where any gadget that can be invented will be invented and will be implemented as long as it's affordable.
We've got cameras everywhere.
Before long, we'll have drones everywhere.
We've got to whatever degree this law is going to allow the government to take over the Internet more than before or expand their influence there.
Are we headed toward a situation where there will be no more antiwar.com and no more CNET?
What's going to happen here?
I'm going to have a two-way TV and I'm not going to be allowed to turn it off like in 1984?
Yeah, or even throw a towel over it so you don't have to watch it anymore.
I mean, in a way, it depends on so many different moving parts.
We can think of sites like antiwar.com as canaries in a coal mine.
If you go down, then the rest of us have to worry.
But if you're up and publishing and unmolested, then we still have the kinds of First Amendment freedoms that we like.
More broadly, I go between optimism and pessimism.
If you look at the ways we have of hiding our online conversations and identities from surveillance, those are improving.
But then again, so are the tools for government surveillance.
We have encryption.
Very few people use it nowadays.
We have services like Tor, which allow you to browse anonymously.
It goes hand-in-hand with encryption.
If you want to conceal what you're doing online, there are lots of legitimate reasons to use this.
And so we have advances in defensive arts online, but you also have advances in offensive arts.
And we saw this reach its peak perhaps in the Bush administration in wholesale surveillance of Internet traffic.
I'm actually a little more concerned with the physical world.
At least online, we can use encryption and anonymous cloaking mechanisms.
But we're driving down the street, and we're required to have license plates on our cars.
And we have some jurisdictions that are recording all license plates, and this might even be allowed under a current Supreme Court precedent.
Some federal appeals courts have said it's perfectly okay for police to stick GPS trackers on a suspect's car, even in the absence of a court order.
And so it's more like when we're out in public and we're interacting in public, then we can be monitored and tracked.
And who we talk with can be monitored and tracked and all put in a nice handy government database.
I'm not saying this is happening now.
It's not, but we're starting to see little pieces.
We saw part of it with face recognition cameras.
We have to go out in public unless we wear a mask, then we can be monitored and tracked.
And the video camera footage that's recorded today can be, assuming we actually get face recognition technology working, evaluated five years, ten years from now.
And then the archived video can be turned into records of who moved where, when, who talked to whom, when.
So I'm actually more concerned about physical movement and what this does to feelings of privacy and autonomy and all these values that we hold dear.
Well, you know, I was talking with a friend and she was saying that there was an old Isaac Asimov article, if I'm saying that right.
I never read his stuff, but I saw a couple of the movies they made out of him.
And she was saying in this one that this guy invented time machines.
And then they got mass produced, basically, where everybody had a time machine.
And so everybody could go back.
I don't know if it was the kind of thing where they couldn't interfere.
They could just watch, like, The Ghost of Christmas Past or what.
I don't know.
They could go back and see everything that happened ever.
So, you know, they go back and see history, whatever.
But then everybody also goes back and checks up on, you know, every time they thought someone was cheating on them or every time a crime happened.
And basically to the point where everything was known to everyone all the time.
And the result was people started acting nice.
And they quit backstabbing each other and stealing from each other and doing all these terrible things.
And how this is kind of a metaphor for the situation we're coming into now where the old definitions of privacy don't really count.
But, hey, maybe it's a good thing.
And I was thinking, well, that's great, but the biggest problem with that is the state.
Because it's not just about, you know, equal opportunity privacy invasion.
It's their ability to spy on all of us.
And they're the same ones who can jail us and do what they want with us, send us off to the salt pit, you know.
It sounds a little like Asimov's The End of Eternity, which was a novel that dealt with time travel.
And I think someone who went back into time and then sent coded messages to the future saying, hey, I know these things are happening before they do.
Newspaper ads, magazine ads, that kind of thing.
But there's, I mean, David Brin talked about this in a book published about 10 years ago called The Transparent Society.
Now, Brin is a brilliant science fiction writer.
He wrote The Postman, which was turned into a movie.
He did Earth and a series about so-called uplifts.
But anyway, I digress.
His idea was to come up with, if everyone was monitored, then everyone would be polite.
It would have a safer society and everything that goes with it.
I'm summarizing a little.
It's a long book.
It's worth reading.
But the one thing that I never found satisfying about it is that, sure, everyone, so you're going to have the overseers who monitor people, but who's going to monitor the overseers?
Who's going to bell the cat?
I mean, do you think that the people who, in government, who make these decisions, the people who run the cameras in these police organizations want to have cameras looking at them as well?
Maybe if that were the case, this would be a good tradeoff.
But right now, we have the cameras run by other people, but no way of watching the people who are running the cameras.
Well, and they're liable to beat you over the head if you do film them or tase you right there on the street.
Exactly.
So we have this asymmetric idea of surveillance that the police are allowed to surveil you.
The police are allowed to tape record you.
In fact, they're allowed to lie to you during interrogations or interviews.
And if you try to record them, you're likely to get tased.
If you try to tape record them, it may be illegal in some states and so on.
And so one way of handling this is to try to restore some of the symmetry.
And if you have a lot of people with live video feeds walking around, I mean, I know this sounds like science fiction, but we've got iPhones now, we've got 3G wireless.
The components are coming into place.
And so walk around.
You see something going on.
You see a crime.
You press a button on your iPhone.
It records the video and instantly transmits it to a secure server, perhaps even in another country.
This is one way to combat some of these abuses of power.
Sure, someone can take your video camera from you, your iPhone or Android phone, whatever you're using.
But at least then the video that's been recorded of whatever abuse is going on will be out there archived and available for the viewing.
Well, you know what I kind of like about this conversation is we've sort of already just taken for granted that we're never going to take those cameras down, man.
It's never going away.
We're never going to really be able to undo this.
It's a battle now only really just like this radio show and just like your articles.
The question is, how do we use their weapon back against them as best as we can?
You know, I mean, hell, they invented these machines for keeping track of Holocaust victims and stuff.
This is, you know, our best use of their double edged sword.
And, you know, but the premise, the idea that we're going to live in a society where there are no more police cameras all over the road someday.
That's just over that.
That argument never even happened.
They just put them up and it's a fait accompli and it'll be like that until we run out of electricity.
Well, let's also differentiate between private companies with cameras and indeed cameras.
I mean, my wife and I are expecting our first kid next month and maybe eventually in the next few years we'll get a nanny.
And is a nanny cam reasonable or appropriate?
Maybe.
Maybe it's reasonable for a home security system.
If I had a small business, maybe I'll stick it in there.
They seem to me to be reasonable uses of video cameras, especially if they're disclosed.
And also private owners don't really want to keep the video forever.
The incentive structure is just different.
They just want to reduce crime or abuses.
And maybe video cameras can be useful in those contexts.
I mean, they're so cheap.
I think 50 bucks for a video camera, it's almost even if they might just barely be useful, 50 bucks is not that much to spend.
I'm more concerned when you either have law enforcement access to these private cameras or cameras set up by law enforcement.
The incentive structure is different.
The incentives can be to look at pretty women walking by in short skirts.
The incentives can be to target minorities for harassment.
The incentives can be just to record everything and keep this database on file forever.
Storage is cheap as well.
So the privacy advocates are almost fighting against Moore's Law and the other technological more or less laws that say things are becoming very cheap and will keep getting cheaper.
When the cameras fall from $50 to $5 and then $0.50, there are going to be cameras all over the place.
And what do we do?
All right, everybody.
That's Declan McCullough.
The article is Taking Liberties.
It's at cbsnews.com slash blogs and at news.cnet.com.
Thanks very much for your time today.
My pleasure.
