Would you ever be comfortable with the government taking a direct action to address vulnerabilities in your networks?
If my fridge at home is compromised through hacking, can the Feds walk in and take it from my house? They shouldn't be able to. That seems like it would be a violation regardless of some broad subpoena. I try to translate what this would look like physically and it doesn't make sense to me.
If you believe the context that they attempted some reach out, then there was some potential attempt at a lockdown. I think the question becomes if somebody responded, but didn't respond timely or said no thanks.
In the case of the colonial pipeline incident, I wouldn't mind the government taking action on the pipeline owner because of the tremendous impact on the broader population. When thinking about this FBI action, we can't use examples where the impact is benign. I think it's reasonable to expect the government to say, “We expect this level of security and investment. We're holding the board of this pipeline responsible.”
These are privatized services and companies. If this were a nationally-owned pipeline it would be dramatically different, but Colonial Pipeline isn’t even publicly traded. If the government doesn't want to be so dependent the option is to nationalize these things. And we don't want nationalized critical services.
Being able to opt in would have been great, but companies didn't even have a way to opt out. If somebody finds malicious intellectual property, or some errant, illegal files on any of those servers then it's easy to say, "Well, I'm not the only one who had access to this." The government could have had access to it. I think it should have been an opt in because you can't even opt out.
If an opt-in is the right way to do it, does it make sense that if you are causing harm or have a high potential to cause harm for others, you either opt in to the government taking you offline, or you're liable for the harm that you might create? And if you do create harm you're billed for it. You could argue that there could be an opt-in to just be on the Internet.
Content you might like
Yes39%
Yes, but third & Nth parties are still a concern39%
Mostly16%
No4%
Don't know1%
Most of the time the legals and or DPO don't have the technical acumen to understand when data is floating to third party services.
Lets ...read more
API security is our top priority8%
Very high48%
High34%
Medium9%
Low1%
API security is not at all a priority for us1%
organized a virtual escape room via https://www.puzzlebreak.us/ - even though his team lost it was a fun subtitue for just a "virtual happy hour"
Another scenario occurred that did take Intel offline, and it was done by a private company. Going into earnings release one quarter, we're offline to upload certain things to the NASDAQ system. NASDAQ had basically blacklisted the Intel domain it was coming from. They took action to prevent us from doing what we needed to do. Once we sorted it out I was pretty irritated with NASDAQ, but I understood their reasons because they’d received a trigger of potential maliciousness and needed to protect the NASDAQ system. In essence, they disabled my ability to execute a business process to protect Intel.