What makes this change interesting is that the national security aspect has always been there. This is nothing new and the groups responsible are pretty much the same as they have always been as well.  Before now many companies did not want it widely known that they are almost powerless to stop hackers from getting into their networks at will. It would have undermined their ability to get and maintain contracts with the US government. Now the issue is very different. They want to play on the thechnojoy that the current president has and also hope to gain favor by playing on his and others’ fears. In fact one of the paragraphs claims the following:

“Counterfeit software is a major vector for the distribution of dangerous malware that imposes substantial costs on the economy and decreases the security of IT systems and data. IDC estimated that globally “the direct costs to enterprises from dealing with malware from counterfeit software will hit 114 billion” in 2013 and “[t]he potential losses from data breaches could reach nearly $350 billion.”4 High rates of IP theft also increase the risks of cybercrime and other security threats, particularly with regard to counterfeit software use.”

They are claiming this despite the existence of technologies to isolate infected systems, to prevent the spread of malware, and also to mitigate intrusions into corporate networks. There are a ton of technologies out there to do this, the problem is that that companies do not want to spend the money on these technologies or properly trained people to maintain them. They would much rather spend money lobbying for greater control and try and claim that file sharing is the root of all evil today.

The continue to dive into the tangled fantasy world of how much it costs to protect US IP and forget that in many cases the money spent protecting IP goes to lobbing efforts and lawsuits against competitors instead of putting the money back into innovation. They attempt to claim that IP theft is the cause of a reduction in research and development when the reduction actually coincides with the increase in length of copyright and patent on different technologies. If you know you have the monopoly on a technology you are not going to dump the same amount of money into development, but you will dump money into protecting what you think is yours, just look at the amount of money Apple has dumped into their lawsuits around the globe. Still they need to find a way to make IP theft look dire and unstoppable unless drastic measures are taken.

By throwing these things in they (meaning the MPAA, RIAA and others in the Copyright lobby) hope to finally get their way and put file sharing, torrents, and others common protocols into the same basket as you would a breach from a sovereign state sponsored attack. This group seems to think that the only way to deal with this is to go after the people sharing the files. They would like to go so far as to attack their networks and “destroy” computer systems used to spread copyrighted works.  

“Raise the policy and enforcement priority of IP protection in the U.S. government. Designate the national security advisor as the principal policy coordinator for all actions regarding the protection of American intellectual property.”

You see now Copyright, Patent, Trademark and other forms of IP are going to be put under the umbrella of National Security. The thought that a song or a movie is not a matter of national security is ludicrous. Unless the movie depicts classified information there is nothing about either of these that merit them being controlled by the National Security Advisor. We are pretty sure that person has enough to deal with keeping real threats at bay and should not be dealing with file sharing sites. The copyright lobby simply wants to ensure their can keep their business model (one that is very outdated) alive. They have repeatedly asked to have copyright terms extended and keep getting them despite the fact that copyright was meant to give someone the rights to their work briefly allowing them to recoup the cost of creating the original work. There is no need to have a lifetime copyright or patent on anything. This limits innovation and culture more than almost anything else.

Sadly the report is written in such a way that it looks to grant broad powers of retribution against people that are alleged to have committed IP theft. They are looking to “identify and to recover or render inoperable intellectual property stolen through cyber means” and also want to “Reconcile necessary changes in the law with a changing technical environment.”

The report acknowledges that it is illegal for a company that is the target of an attack to strike back against their alleged attacker. They have options to identify them and turn everything over to the authorities who should then investigate to determine if that person is actually to blame. In this environment it makes sense because of the use of botnets, proxies and compromised systems to do the actual work while the real malicious people control and monitor everything from somewhere else. When you consider that most companies cannot remember to run updates, perform maintenance, change default passwords, or upgrade equipment it is not out of the realm of possibility that they would misidentify an attacker and damage the wrong network.

Remember these are the same people claiming they cannot block these attacks, but they want to be able to respond all on their own and with some rather aggressive actions:

“While not currently permitted under U.S. law, there are increasing calls for creating a more permissive environment for active network defense that allows companies not only to stabilize a situation but to take further steps, including actively retrieving stolen information, altering it within the intruder’s networks, or even destroying the information within an unauthorized network. Additional measures go further, including photographing the hacker using his own system’s camera, implanting malware in the hacker’s network, or even physically disabling or destroying the hacker’s own computer or network.”

What is even more interesting is that some of this is already happening; we have seen some companies release their own “pirated” versions of software, movies and music with tracking malware in them and worse. Sony was caught and got in a lot of trouble for installing a rootkit on users’ computers to identify software that was installed and to phone home. Microsoft also funded a project called PiratePay that was little more than a way to attack torrent swarms. We are pretty sure they would love to bring this back home. This report recommends making these types of practices legal and to change existing laws to allow this type of action while not clearly defining when this type of response is allowed.

The 100 page report is frightening in what they are recommending as well as the lengths they have gone to in order to claim IP “theft” as a national security concern. What makes it even more scary is that we can see members of Congress (who are now knowledgeable about this) drinking every drop of the Kool-Aid that this report contains. We can look forward to even more misguided laws, bills and executive orders in the coming years even though there are many more important things to deal with. If the industry gets its way the will set back innovation more than they can fully understand in an effort to cling to their old ways and that is a shame.

Tell us what you think in our Forum