I’m still trying to digest what the total meaning of the recent Senate bill that would allow the President to shutdown the Internet during a declared emergency.
The bill’s draft states that “the president may order a cybersecurity emergency and order the limitation or shutdown of Internet traffic” and would give the government ongoing access to “all relevant data concerning (critical infrastructure) networks without regard to any provision of law, regulation, rule, or policy restricting such access.”
To be clear, this is a draft bill introduced by Jay Rockefeller (D-WV) and Olympia Snow (R-MA). It has not been endorsed by the White House, although apparently they did have some sort of hand in constructing the language.
It’s not clear to me that everyone involved understands the scope of what they are proposing. In this day and age, shutting down the Internet basically shuts down business and infrastructure. Everything from traffic lights to hospitals, from stores to utility plants, including the government itself, may be brought to its knees by such a shutdown. This is far more than the inconvenience of not being able to update your Facebook status for a few hours.
Now one of the reasons that it’s reasonably safe to have our society so dependent on this network is that there is no central control point for the Internet. There’s no kill switch. There’s no one thing, or even 50 things that if you control them, you will control the network. Any prudent network manager has already designed into their company’s or organization’s network a way to disconnect their little piece of the network rapidly from the outside world. But allowing centralized control over shutting down the Internet would mean that there would need to be some centralized way to fire all those thousands of tiny kill switches all at once. The existence of such a control point, would likely be more of a security risk than the cybersecurity threat the bill was hoping to mitigate.
I haven’t seen the final wording, but what has been published seems enormously generalized. What constitutes “all relevant data”? That could be anything on the network. What are “critical infrastructure networks”? And for that matter, what is the threshold for a “cybersecurity emergency”?
While I recognize that cybersecurity is a significant vulnerability to America, I think we need to be very careful not to kill the patient with the vaccine. This is a highly technical area, and one I shudder to think that our Luddite legislation will take on. We may need some new policies and laws, but please, leave this to a panel of experts to create.