The United States Congress may sneak through Internet 'kill switch' in defense bill

By Daniel Tencer
The Raw Story
August 28th, 2010

A federal cybersecurity bill that critics say creates a presidential "kill
switch" for the Internet could be added on to a defense spending bill and
passed without much debate, technology news sources report.

Sen. Thomas Carper (D-DE), one of the sponsors of the Protecting Cyberspace as a National Asset Act, told GovInfoSecurity.com that the Senate is considering attaching the bill as a rider to a defense authorization bill likely to pass through Congress before the mid-term elections.

"It's hard to get a measure like cybersecurity legislation passed on its
own," Carper said.

Carper, along with Sen. Joe Lieberman (I-CT) and Sen. Susan Collins (R-ME), introduced the bill in June in an effort to combat cyber-crime and the threat of online warfare and terrorism. Critics say the bill would allow the president to disconnect Internet networks and force private websites to comply with broad cybersecurity measures. Future US presidents would have those powers renewed indefinitely.

The bill states that Internet service providers, search engines and other
Internet-related businesses "shall immediately comply with any emergency measure or action developed" by the Department of Homeland Security.

But many observers point out that that doesn't necessarily amount to a "kill switch" -- and, in fact, the president already has the power to shut off the Internet. As Time magazine points out, the Communications Act of 1934 grants the president the power to shut down wire communications during a time of war, and the Internet is now recognized as a wire communication medium.

Yet the proposed law authorizes the president to declare "cyber
emergencies" -- potentially expanding the president's power to shut down the Internet to times when the US is not technically at war.

And even some backers of the proposed legislation argue the bill is too
broad and vague, and the powers granted to the executive branch could be unpredictable as a result.

A summary of the bill issued by Sen. Lieberman's office describes the powers granted to the president:

"The Act will provide a responsible framework, developed in coordination with the private sector, for the President to authorize emergency measures, limited in both scope and duration, to protect the nation's most critical infrastructure if a cyber vulnerability is being exploited or is about to be exploited. The President must notify Congress in advance about the threat and the emergency measures that will be taken to mitigate it. Any emergency measures imposed must be the least disruptive necessary to respond to the threat. These emergency measures will expire after 30 days unless the President orders an extension. The bill does not authorize any new
surveillance authorities, or permit the government to "take over" private
networks."

The bill "authorizes the president to declare 'cyber emergencies,' without spelling out what would happen next," states an editorial at the Scranton Times-Tribune. "It is certain that the Internet will be a prime means of communication during an emergency. Given the history of the government over-stepping even constitutional constraints during such times, the bill's sponsors should retool it to be more specific."

Security expert and Cryptography Research CEO Paul Kocher describes the bill as a "Rorschach blot -- on one level it's absurd, and on others it's
impractical and frightening."

Kocher said, "When you build something that will shut down a massively
critical piece of infrastructure that people have tried to make reliable,
that's a more frightening prospect than anything that could have inspired
such a defense ... It's a very blunt weapon."

GovInfoSecurity notes that the House of Representatives passed a version of the defense authorization bill last spring that included cyber-security measures. If the Senate follows suit, a final version of the cyber-security legislation would be worked out in conference committee.

http://www.rawstory.com/rs/2010/0828/congress-internet-kill-switch-defense-bill/