NYT Buries the Ineffective CyberSecurity Lede

/18 Comments/in /by

The NYT has a story today headlined,

Senate Rejects Measure to Strengthen Cybersecurity

In paragraph 12 of the story — after portraying the horse race details of Mitch McConnell and Richard Burr’s attempt to push through CISA yesterday and then reviewing how devastating the Office of Personnel Management hack is — NYT reports,
The bills before Congress would not directly address the attack on the Office of Personnel Management systems, which resulted from a series of missteps that included the use of outdated detection technology, a failure to employ basic authentication techniques most Americans use for online banking, having not acted on previous security recommendations, and a lack of encryption on the data.
The story then embraces a do something, do anything approach it says is backed by experts, plural, of which it only cites one, a contractor in information sharing:

However, the attack bore a similar signature as those on two insurance companies and underscored the overall need for Congress to advance new policies, experts said.

“It is as clear as a bell to me that this is case and point in favor of information sharing,” said Paul Kurtz, who worked on the issue under in the Clinton, Bush and Obama administrations, and is the chief executive of TruStar, which aids companies in information sharing. “It is really terribly unfortunate that this measure failed because of the politics on Capitol Hill.”

It’s all very nice for the NYT to “report” this as a matter of Congressional dysfunction — as an example of stupid politics getting in the way of protecting the country. But even the evidence the story itself presents suggests a different story: the solution being pursued by Congress would not actually fix our most urgent cybersecurity problems. The real story is about Congressional dysfunction, but of a different kind.

Indeed, the lede and headline of the story should be something like,

Congress Responds to Devastating Hack by Pushing Bill that Wouldn’t Help

Had the NYT reported that story, it might have found far more experts, who would explain in more detail why there are a long list of things we should do before facilitating information sharing with expansive immunity and obscurity.

But somehow, it didn’t report that story, even though that’s what the evidence it presents supports.

image_print
18 replies
  1. Trevanion says:

    I am old enough to recall the 1970s when Chicago Cub management cited the team difficulties in scoring runs as an argument for putting a more modern scoreboard into Wrigley.

    • What Constitution? says:

      The Cubbies have always had innovative solutions for that kind of “issue”. Then there was the phase when their scouts were instructed that they could not sign any player under 6’4″ tall for the reason that “we may suck but we’re going to look like athletes out there.” At least with the Cubbies, though, the carnage was limited in scope — unlike the Bush and Obama administrations, who seem to think more of what’s not working is the solution. “The beatings will continue until morale improves.”

  2. phred says:

    Great post EW. Of course, this is the NYT we’re talking about…
    .
    One can’t possibly expect an untoward display of journalistic competence on her delicate pages that can only support flimsy official narratives rather than substantive weighty reporting.

  3. bloopie2 says:

    Wait a minute. Whenever I tried to look closely at Cubs crap in the past (such as the aforementioned difficulty scoring runs), I was always directed to information on a group called White Sox, who looked decent, I thought. I was told “This is our other name”. Isn’t that the case? There aren’t two baseball teams in Chicago, are there?

  6. wallace says:

    CONGRESS RESPONDS TO DEVASTATING HACK BY PICKING THEIR NOSE SCRATCHING THEIR ASS AND FARTING WHILE PLAYING SCRABBLE ON SMARTPHONES.

    quote”Had the NYT reported that story, it might have found far more experts, who would explain in more detail why there are a long list of people in Congress who we should fire. “unquote

    There..fixed it. :)

  7. orionATL says:

    “the private sector has been “clamoring for the government to do something” reports the nytimes.

    just what in the hell is the government supposed to do about breeches at sony (utterly, indescribably trivial), target, home depot, anthem (blue cross/blue shield), banks, and oil companies ? invade china ? scold the chinaman when obama soon meets him ? reduce our subsidies to israel ? drive the russians and the chinese into each others arms.

    these organizations are responsible for their own data security.

    the gov is responsible for data at opm, dod, nih, dhs, etc.

    wait though, there is a possibility.

    since the nsa/fbi/dea collects and stores all communications in the u.s. and elsewhere, let’s insist congress pass a law that all american communications must first be collected, stored, and evaluated for data safety by these gov’t organizations BEFORE being forwarded to the intended recipient company.

    sure, this might cause some delays, but as a nation we are already well into the second decade of the mindset “security uber alles”. what’s a little time ? besides, the entire society runs too fast anyway.

  8. orionATL says:

    oh, and by the way, i still have not seen those details of the personnel data stolen from opm that would allow me to conclude that the theft was devastating. is it just that i was left off of that memo distribution list ?

    • bloopie2 says:

      Actually, you WERE on the memo distribution list. It’s just that I got to your copy of the memo before you did. Gone with the wind!

      • orionATL says:

        this just astonishes me, if true:

        from huffington post:

        “…Nearly all of the millions of security clearance holders, including CIA, National Security Agency and military special operations personnel, are potentially exposed in the security clearance breach, the officials said. More than 2.9 million people had been investigated for a security clearance as of October 2014, according to government records…”
        .
        .

        so our harsh, vindictive gov is going to hang edward snowden from a lamppost for telling the american people they were all being spied upon by their gov, but has failed to protect “critical” security clearance data of federal employees from foreign spying. in particular gov appears to have failed to protect the security records of nsa/cia employees (for example by physically storing and proccessing them seperately from that of ordinary government peons).
        .

        which demonstrates more executive incompetence ?
        .

        1) the introduction of the affordable care care or

        2) the failure to protect opm personnel data and, more generally, the failure to protect gov/gov contractor records from spying ?

        all the while,
        .
        the president, the national security bureaucracy that has mesmerized the president, and multiple demented, bungling congresses have spent their time ramping up the spying on the fucking entire american populace by the fbi, the dea, the hhs, the cia, the nsa, the postal service, and for all we know the u.s. printing office.

        • jerryy says:

          .
          The AP among others are reporting that as well…this is in addition to the earlier OPM hack that is supposed to have gotten SSNs, addresses, etc.
          .
          I guess Hollywood is going to have to remake their spy yarns again. Their usual fair is much too simplistic compared to these.
          .
          This is Jim Comey’s et-al, fault.

        • orionATL says:

          yeah.

          – who’s on first

          – inspector clousseau

          – the spying which went out from the white house

          – presented in thundering loud, 40 foot high SPYMAX cinema.

  9. earlofhuntingdon says:

    Enhancing privacy would seem to work against corporate supporters of members of Congress, which would make it a goal few would want to support. More room at the trough when the government leaks, more room to claim that security is “enhanced” when government asks the private sector to keep its information safe (albeit in a sense Dr. Zell might recognize) because the government is unable to do so.
    There’s no sense beefing up government security if it sets a higher standard than, say, Citicorp or Target wants to maintain. It doesn’t seem to matter which private sector hacker or foreign government wants to take a peek at whatever the government collects. And it fits with wished for “truth” that there’s no such thing as privacy anymore, unless, that is, one wants a peek at the “no fly” list or who lobbies whom and how much they pay for the privilege. Next thing you know, we’ll have a media mogul for president, good food, better soccer and trains that don’t run on time.

  10. jerryy says:

    I wonder how long it will take before there is widespread recognition that the current and future political leadership(s) have been compromised. [In ways they have not been before.] Keep in mind most of these folks rise up through being federal employees.

Comments are closed.