Was the FBI action on Microsoft exchange servers justified in your opinion?
In the decades I’ve spent in IT—and for a couple of those decades I was in security—I’ve never seen anything like this. It's a blend of public safety, public policy, IT, corporate and private property independence, and security issues. This action was precedent-setting, which means this path and some branches of it will occur in the future.
10-15 years ago the FBI and Secret Service had to do a tremendous amount of community building and outreach because people were concerned that following an incident the government would say, “We're in charge. We're taking your servers down.” And you could tell them, "Hold on, you're taking our core processing system down," but it wouldn’t matter. Maybe you shrug it off the first time, but the second time, the government says, "We did this before so we'll just patch all these things." You're patched and the reason given is that the bad component breaks so many aspects of their operating process. And now the logic is that it's for the good of the ecosystem. It's an insanely dangerous precedent.
Content you might like
Way more involved5%
Somewhat more involved47%
A bit more involved31%
Security’s current role is adequate10%
A bit less involved4%
Somewhat less involved1%
Way less involved1%
Business expansion12%
Changing business model47%
Compartmentalization due to localized regulatory requirements15%
Cultural changes within organization12%
Customer data privacy concerns3%
Data monetization3%
Emerging risks3%
Improving data governance maturity3%
Introducing new technology0%
Scaling data and analytics ecosystem0%
Not sure3%
We aren’t making changes0%
My security team has taken enforcement actions because the system owner wouldn't do it themselves. They either didn't care or didn't think it was important enough, so I looked at the FBI action through that same lens. I once took a factory offline and scrapped 50K units one time because some schmuck put a box susceptible to SQL Slammer back on the network. I disconnected the factory from the rest of the world because I was not going to live through that hell again. But the context was different, I was acting as an agent of the company.
It’s one thing for a private company to act on its own behalf. It's very different when somebody acts under the color of law. Imagine one of these companies saying, "We sustained a $50 million dollar loss because in the process of removing the vulnerable component you deleted a bunch of other stuff too." Who's on the hook for that? It's a business component.
If they did that and somebody sued, I would hope the government would have looked at that calculus and would therefore be willing to cover any damages resulting from their actions. That could take years to play out in court.