Monday, September 23, 2013
Westgate
President Kenyatta: I call on Kenyans to stand courageous and united. Let us not sacrifice our values and dignity to appease cowards.
Monday, April 29, 2013
CISPA - Recent Developments
On April 26, 2012, the House of Representatives passed CISPA.
On February 13, 2013, United States Representative Mike Rogers reintroduced the CISPA bill in the 113th Congress as H.R. 624.[6]
On April 18, 2013, the House of Representatives passed H.R. 624.
The Senate has reportedly refused to vote on the measure and is drafting competing legislation.
On February 13, 2013, United States Representative Mike Rogers reintroduced the CISPA bill in the 113th Congress as H.R. 624.[6]
On April 18, 2013, the House of Representatives passed H.R. 624.
The Senate has reportedly refused to vote on the measure and is drafting competing legislation.
Sunday, April 21, 2013
Cyber Intelligence Sharing and Protection Act - Deciphering its implications to you!
CISPA (Cyber Intelligence Sharing and Protection Act) will most likely pass through the House and the Senate in USA.
We all need to pay attention to this Bill because we are avid consumers of the American technology market (Facebook, Twitter etc.).
Another concern is this equation, try and solve it:
CISPA + Patriot Act = ?
The below article is from ZDnet
(http://www.zdnet.com/what-is-cispa-and-what-does-it-mean-for-you-faq-7000013965/)
Written by Zack Whittaker
April 13, 2013 -- 23:00 GMT (16:00 PDT)
What is CISPA?
CISPA, known officially as H.R. 624, is a cybersecurity Bill currently going through the motions in the lower house of Congress, the US House of Representatives. It is designed to help prevent and defend against cyberattacks on critical national infrastructure and against other internet attacks on private firms by obtaining and sharing "cyberthreat information".
Its sole purpose is to allow private sector firms to search personal and sensitive user data of ordinary US residents to identify this so-called "threat information", and to then share that information with each other and the US government — without the need for a warrant.
By citing "cybersecurity", it allows private firms to hand over private user data while circumventing existing privacy laws, such as the Wiretap Act and the Stored Communications Act. This means that CISPA can permit private firms to share your data, such as emails, text messages, and cloud-stored documents and files, with the US government.
It also gives these firms legal protection to hand over such data. There is no judicial oversight.
To make matters worse, because there is little transparency and individual accountability, those who have had their data handed to the US government may not even know about it or be given a chance to challenge it.
Wasn't CISPA put on the backburner after it failed in the Senate?
In April 2012, the US House passed CISPA by a large majority, voting 248 to 168. It passed at a time when the White House threatened to veto the Bill should it pass the desk of President Obama, citing privacy and civil liberty concerns. But once it was handed to the Senate, it failed to gain traction, likely in light of similar legislation being drafted in the upper house at the time.
How is this new CISPA version any different from the old Senate-stalled version?
The current version of CISPA, reintroduced into the House, has the same name and vastly the same content. CISPA was brought back to the House in its original format.
Since being debated and amended by the House Intelligence committee, it has gone through a mark-up process that would tighten up certain language and add definitions. This process was decided upon by members to be conducted in secret, despite the controversy surrounding this Bill. While CISPA does not force or require a private firm to share data with the US government, major telecoms providers have illegally shared data with the US intelligence agencies before.
During this recent mark-up process, less than half of the privacy re-enabling amendments that passed have "only chipped away at the edges of CISPA", according to the Electronic Frontier Foundation (EFF).
These amendments now include:
• Information for "national security" purposes: One amendment means the US government can only use data collected under CISPA for "cybersecurity purposes", and not used for "national security" purposes — a catch-all term that can and has been used to skirt Fourth Amendment rights. The second amendment imposes the same rule on private firms. However, "cybersecurity" is still loosely defined and could be misinterpreted or abused by private firms.
• Hacking back: Private firms are limited from acting beyond their own networks to gather "cyberthreat information", such as "hacking the hackers". But the EFF noted that a "huge loophole" exists, which allows a firm to "still use aggressive countermeasures outside of its own network as long as it believed the countermeasures were necessary for protection".
• Government-related privacy oversight: This amendment requires oversight on how CISPA affects civil liberties and privacy on government activity, but it does not apply to private firms. The EFF is concerned that there is "no assessment of whether companies over-collect or over-share sensitive information".
How does Obama's cybersecurity executive order differ from CISPA?
President Obama signed into law a cybersecurity executive order at the same time CISPA was reintroduced into the House.
Obama's cybersecurity executive order set up the foundations in which a "framework" can be constructed between the government and private sector industries, albeit without the vast majority of the privacy complications that CISPA has.
The "framework" will allow intelligence to be gathered from the aftermath of cyberattacks and cyberthreats to privately owned critical national infrastructure — such as the private defense sector, utility networks (like gas and electric companies), and the banking industry — so they can better protect themselves and the wider US population.
While the executive order does touch on intelligence sharing between the US government and private firms, it doesn't undo years of privacy law-making work that continues to protect the US population. The White House even garnered support from the American Civil Liberties Union (ACLU) on the order. The order opened a path for wider consultation and discussion that could, however, change in due time.
Who supports and opposes CISPA?
Because CISPA gives legal immunity to companies already collecting personal and sensitive user and customer data of ordinary US residents, many major web and technology companies are in favor of the Bill.
Tech companies such as Microsoft, Google, and IBM, and cellular giants AT&T and Verizon, as well as banks and financial firms like the American Bankers Association and the Chamber of Commerce, have all endorsed the current version of CISPA.
While Facebook, Twitter, and other social networks have not endorsed or openly supported the current version of CISPA, they backed previous iterations of the Bill. (Facebook and Microsoft reportedly backed away from CISPA after previously coming out in favor of it. However, Microsoft's membership to lobbying group TechNet suggests otherwise.)
As you might expect, a number of major civil liberties groups reject the principles surrounding CISPA. The EFF, the ACLU, and Reporters Without Borders have all expressed their opposition to the Bill. Firefox maker Mozilla has also criticized the Bill, and even Sir Tim Berners-Lee, the inventor of the World Wide Web, opposes CISPA.
More than 1.4 million people have signed online petitions for Facebook, Microsoft, IBM, and members of Congress to relinquish their support of the Bill — whether currently or in the past.
How does this differ from SOPA or PIPA?
There are two major differences: SOPA and PIPA acted against foreign alleged copyright infringers, while CISPA is a domestically focused cybersecurity Bill.
The House and the Senate introduced the Stop Online Piracy Act (SOPA) and the Protect IP Act (PIPA) respectively. Both primarily targeted non-US websites and networks, allowing the US attorney general to seek a court order that would see such allegedly copyright and intellectual property infringing sites shut down and seemingly disappear from the web.
However, CISPA focuses all but entirely on those within US borders — including US citizens and legal (and illegal) residents — rather than foreign citizens or non-US companies. While the US government cannot collect data from any private firm it likes — the firm must agree to it —
CISPA has a greater impact on those within US borders, rather than non-US residents.
Does CISPA affect non-US citizens, such as those who live in the EU?
Potentially, yes, although not directly. Many smaller companies do not have local EU-based datacenters. Microsoft, Google, and Facebook, for instance, do have non-US datacenters for local users, but many do not have the capacity of the funding to do so. This means that non-US resident data may be stored directly by a US company.
What can the US government do with user data acquired under CISPA by private firms?
Anything they like with it, so long as it's lawful and pertains to "cybersecurity purposes", rather than "national security" purposes. But because the language is so ill defined, it could be used for many more reasons than were initially considered.
The data will be handed to a central location within the US Department of Homeland Security (DHS) by the private firm, which can then be disseminated throughout government — including other US law enforcement and intelligence agencies.
Techdirt recently agencies that can acquire your data under CISPA, which amounts to around 600 departments.
Does CISPA allow the US government to spy on US residents?
Once it's in the hands of the DHS, it can be sent anywhere and be used against the person. CISPA amends the National Security Act to include provisions to further protect national or homeland security, as well as other "threats to the United States, its people, property, or interests".
According to the EFF, even though the data was passed to the government for "only cybersecurity purposes", it can then be used to investigate other crime, not limited to cybersecurity crime, such as the "criminal exploitation of minor, protecting individuals from death or serious physical injury, or protecting the national security of the United States".
What can I do if a private firm hands over my data to the US government?
Very little. But also, there's no way of knowing that your data has been handed to the US government by a private firm unless that firm informs you. Frankly, most will have no reason to.
CISPA explicitly prevents those under the scope of CISPA - typically US residents - to sue the US government for collecting or retaining data outside of legal parameters. Freedom of Information (FOI) requests do not apply under CISPA, because the data collected will be exempt from disclosure. CISPA also gives private firms legal protection to pass that data on the US government, so they can't be sued, either.
What are the key upcoming dates, and could CISPA be defeated?
Following a recent closed session which saw CISPA amended, it will go to a vote on the House floor as soon as next week, or late April.
Two things could happen: Either it will pass like it did last year, and will be handed over to the Senate for its consideration — where it could progress or stall as it did the last time; or CISPA could fail in the House at a coming vote
We all need to pay attention to this Bill because we are avid consumers of the American technology market (Facebook, Twitter etc.).
Another concern is this equation, try and solve it:
CISPA + Patriot Act = ?
The below article is from ZDnet
(http://www.zdnet.com/what-is-cispa-and-what-does-it-mean-for-you-faq-7000013965/)
Written by Zack Whittaker
April 13, 2013 -- 23:00 GMT (16:00 PDT)
What is CISPA?
CISPA, known officially as H.R. 624, is a cybersecurity Bill currently going through the motions in the lower house of Congress, the US House of Representatives. It is designed to help prevent and defend against cyberattacks on critical national infrastructure and against other internet attacks on private firms by obtaining and sharing "cyberthreat information".
Its sole purpose is to allow private sector firms to search personal and sensitive user data of ordinary US residents to identify this so-called "threat information", and to then share that information with each other and the US government — without the need for a warrant.
By citing "cybersecurity", it allows private firms to hand over private user data while circumventing existing privacy laws, such as the Wiretap Act and the Stored Communications Act. This means that CISPA can permit private firms to share your data, such as emails, text messages, and cloud-stored documents and files, with the US government.
It also gives these firms legal protection to hand over such data. There is no judicial oversight.
To make matters worse, because there is little transparency and individual accountability, those who have had their data handed to the US government may not even know about it or be given a chance to challenge it.
Wasn't CISPA put on the backburner after it failed in the Senate?
In April 2012, the US House passed CISPA by a large majority, voting 248 to 168. It passed at a time when the White House threatened to veto the Bill should it pass the desk of President Obama, citing privacy and civil liberty concerns. But once it was handed to the Senate, it failed to gain traction, likely in light of similar legislation being drafted in the upper house at the time.
How is this new CISPA version any different from the old Senate-stalled version?
The current version of CISPA, reintroduced into the House, has the same name and vastly the same content. CISPA was brought back to the House in its original format.
Since being debated and amended by the House Intelligence committee, it has gone through a mark-up process that would tighten up certain language and add definitions. This process was decided upon by members to be conducted in secret, despite the controversy surrounding this Bill. While CISPA does not force or require a private firm to share data with the US government, major telecoms providers have illegally shared data with the US intelligence agencies before.
During this recent mark-up process, less than half of the privacy re-enabling amendments that passed have "only chipped away at the edges of CISPA", according to the Electronic Frontier Foundation (EFF).
These amendments now include:
• Information for "national security" purposes: One amendment means the US government can only use data collected under CISPA for "cybersecurity purposes", and not used for "national security" purposes — a catch-all term that can and has been used to skirt Fourth Amendment rights. The second amendment imposes the same rule on private firms. However, "cybersecurity" is still loosely defined and could be misinterpreted or abused by private firms.
• Hacking back: Private firms are limited from acting beyond their own networks to gather "cyberthreat information", such as "hacking the hackers". But the EFF noted that a "huge loophole" exists, which allows a firm to "still use aggressive countermeasures outside of its own network as long as it believed the countermeasures were necessary for protection".
• Government-related privacy oversight: This amendment requires oversight on how CISPA affects civil liberties and privacy on government activity, but it does not apply to private firms. The EFF is concerned that there is "no assessment of whether companies over-collect or over-share sensitive information".
How does Obama's cybersecurity executive order differ from CISPA?
President Obama signed into law a cybersecurity executive order at the same time CISPA was reintroduced into the House.
Obama's cybersecurity executive order set up the foundations in which a "framework" can be constructed between the government and private sector industries, albeit without the vast majority of the privacy complications that CISPA has.
The "framework" will allow intelligence to be gathered from the aftermath of cyberattacks and cyberthreats to privately owned critical national infrastructure — such as the private defense sector, utility networks (like gas and electric companies), and the banking industry — so they can better protect themselves and the wider US population.
While the executive order does touch on intelligence sharing between the US government and private firms, it doesn't undo years of privacy law-making work that continues to protect the US population. The White House even garnered support from the American Civil Liberties Union (ACLU) on the order. The order opened a path for wider consultation and discussion that could, however, change in due time.
Who supports and opposes CISPA?
Because CISPA gives legal immunity to companies already collecting personal and sensitive user and customer data of ordinary US residents, many major web and technology companies are in favor of the Bill.
Tech companies such as Microsoft, Google, and IBM, and cellular giants AT&T and Verizon, as well as banks and financial firms like the American Bankers Association and the Chamber of Commerce, have all endorsed the current version of CISPA.
While Facebook, Twitter, and other social networks have not endorsed or openly supported the current version of CISPA, they backed previous iterations of the Bill. (Facebook and Microsoft reportedly backed away from CISPA after previously coming out in favor of it. However, Microsoft's membership to lobbying group TechNet suggests otherwise.)
As you might expect, a number of major civil liberties groups reject the principles surrounding CISPA. The EFF, the ACLU, and Reporters Without Borders have all expressed their opposition to the Bill. Firefox maker Mozilla has also criticized the Bill, and even Sir Tim Berners-Lee, the inventor of the World Wide Web, opposes CISPA.
More than 1.4 million people have signed online petitions for Facebook, Microsoft, IBM, and members of Congress to relinquish their support of the Bill — whether currently or in the past.
How does this differ from SOPA or PIPA?
There are two major differences: SOPA and PIPA acted against foreign alleged copyright infringers, while CISPA is a domestically focused cybersecurity Bill.
The House and the Senate introduced the Stop Online Piracy Act (SOPA) and the Protect IP Act (PIPA) respectively. Both primarily targeted non-US websites and networks, allowing the US attorney general to seek a court order that would see such allegedly copyright and intellectual property infringing sites shut down and seemingly disappear from the web.
However, CISPA focuses all but entirely on those within US borders — including US citizens and legal (and illegal) residents — rather than foreign citizens or non-US companies. While the US government cannot collect data from any private firm it likes — the firm must agree to it —
CISPA has a greater impact on those within US borders, rather than non-US residents.
Does CISPA affect non-US citizens, such as those who live in the EU?
Potentially, yes, although not directly. Many smaller companies do not have local EU-based datacenters. Microsoft, Google, and Facebook, for instance, do have non-US datacenters for local users, but many do not have the capacity of the funding to do so. This means that non-US resident data may be stored directly by a US company.
What can the US government do with user data acquired under CISPA by private firms?
Anything they like with it, so long as it's lawful and pertains to "cybersecurity purposes", rather than "national security" purposes. But because the language is so ill defined, it could be used for many more reasons than were initially considered.
The data will be handed to a central location within the US Department of Homeland Security (DHS) by the private firm, which can then be disseminated throughout government — including other US law enforcement and intelligence agencies.
Techdirt recently agencies that can acquire your data under CISPA, which amounts to around 600 departments.
Does CISPA allow the US government to spy on US residents?
Once it's in the hands of the DHS, it can be sent anywhere and be used against the person. CISPA amends the National Security Act to include provisions to further protect national or homeland security, as well as other "threats to the United States, its people, property, or interests".
According to the EFF, even though the data was passed to the government for "only cybersecurity purposes", it can then be used to investigate other crime, not limited to cybersecurity crime, such as the "criminal exploitation of minor, protecting individuals from death or serious physical injury, or protecting the national security of the United States".
What can I do if a private firm hands over my data to the US government?
Very little. But also, there's no way of knowing that your data has been handed to the US government by a private firm unless that firm informs you. Frankly, most will have no reason to.
CISPA explicitly prevents those under the scope of CISPA - typically US residents - to sue the US government for collecting or retaining data outside of legal parameters. Freedom of Information (FOI) requests do not apply under CISPA, because the data collected will be exempt from disclosure. CISPA also gives private firms legal protection to pass that data on the US government, so they can't be sued, either.
What are the key upcoming dates, and could CISPA be defeated?
Following a recent closed session which saw CISPA amended, it will go to a vote on the House floor as soon as next week, or late April.
Two things could happen: Either it will pass like it did last year, and will be handed over to the Senate for its consideration — where it could progress or stall as it did the last time; or CISPA could fail in the House at a coming vote
Thursday, March 14, 2013
SYSTEM FLOP A REFLECTION OF POOR IT GOVERNANCE
Below is a brilliant article written by Moses Otieno (Business Daily, 14 March 2013)
The system failures witnessed during the recent General Election are an indication of failure in Information Technology (IT) governance.
The responsibility for IT governance lies squarely with the Independent Boundaries and Electoral Commission (IEBC) officials. It is unfortunate that recent debate has been deflected to a hypothesis that Kenya’s IT professionals are incapable of managing complex system projects.
IT governance, simply defined, is the way in which an organisation aligns its IT strategy to its core mandate. It is owned and driven by the board of directors, in this case the commissioners.
The national consensus was that an automated process was a key ingredient to successful, free and fair elections. The commissioners had a responsibility to ensure that proper project management and systems development procedures were observed.
It was thus most embarrassing to listen to the chairman casually explaining that their live system was “multiplying spoilt votes by a factor of eight”.
This indicates that the chairman did not appreciate the magnitude of the responsibility he had to ensure smooth systems implementation, and chose to point the blame towards the employees in the IT department.
Scrutiny
There are several instances where the commissioners abdicated their IT governance role, resulting in delays and substandard products that could not guarantee the realisation of a transparent electoral process.
For example, procurement of the biometric electronic voter registration kits (BVR) was unnecessarily protracted and only concluded in November 2012, four months to the elections and at a massive cost of Sh7.2 billion.
Due to these delays, the voter registration exercise was done within a month, disenfranchising millions of Kenyans. The rush by IEBC meant that the electronic voter identification kits (EVI) were also not tested.
When you consider the Results Transmission System, which famously crashed at Bomas, the Request for Proposals was put out on 21st December 2012. This for an election scheduled for March 4th 2013.
It is important that the IEBC commissioners are put under scrutiny and if found guilty of abdicating their corporate governance role they should be subjected to Section 30 of the IEBC Act.
Secondly, considering the growing importance of IT to business and government, it may be the right time to ask whether those in board positions have the competency to provide the required level of vigilance and leadership as far as IT governance is concerned.
Lastly, the failures of the systems at IEBC should not be an indictment of the state of professionalism in the country’s IT sector.
The writer is an IT professional
The system failures witnessed during the recent General Election are an indication of failure in Information Technology (IT) governance.
The responsibility for IT governance lies squarely with the Independent Boundaries and Electoral Commission (IEBC) officials. It is unfortunate that recent debate has been deflected to a hypothesis that Kenya’s IT professionals are incapable of managing complex system projects.
IT governance, simply defined, is the way in which an organisation aligns its IT strategy to its core mandate. It is owned and driven by the board of directors, in this case the commissioners.
The national consensus was that an automated process was a key ingredient to successful, free and fair elections. The commissioners had a responsibility to ensure that proper project management and systems development procedures were observed.
It was thus most embarrassing to listen to the chairman casually explaining that their live system was “multiplying spoilt votes by a factor of eight”.
This indicates that the chairman did not appreciate the magnitude of the responsibility he had to ensure smooth systems implementation, and chose to point the blame towards the employees in the IT department.
Scrutiny
There are several instances where the commissioners abdicated their IT governance role, resulting in delays and substandard products that could not guarantee the realisation of a transparent electoral process.
For example, procurement of the biometric electronic voter registration kits (BVR) was unnecessarily protracted and only concluded in November 2012, four months to the elections and at a massive cost of Sh7.2 billion.
Due to these delays, the voter registration exercise was done within a month, disenfranchising millions of Kenyans. The rush by IEBC meant that the electronic voter identification kits (EVI) were also not tested.
When you consider the Results Transmission System, which famously crashed at Bomas, the Request for Proposals was put out on 21st December 2012. This for an election scheduled for March 4th 2013.
It is important that the IEBC commissioners are put under scrutiny and if found guilty of abdicating their corporate governance role they should be subjected to Section 30 of the IEBC Act.
Secondly, considering the growing importance of IT to business and government, it may be the right time to ask whether those in board positions have the competency to provide the required level of vigilance and leadership as far as IT governance is concerned.
Lastly, the failures of the systems at IEBC should not be an indictment of the state of professionalism in the country’s IT sector.
The writer is an IT professional
Subscribe to:
Posts (Atom)