Politics and Law

Sensitive files like Secret Service safehouse locations, military rosters, and IRS tax returns can still be found on file-sharing networks, according to a report to a U.S. House of Representatives committee on Wednesday.

In many cases, that's because federal government employees or contractors installed peer-to-peer software on their computers without paying attention to which documents would be shared, Robert Boback, the chief executive of Tiversa, told the panel.

Boback said his company found the Secret Service's evacuation plans for the first lady and motorcade routes. (See an interview with Tiversa about Marine One documents found on a peer-to-peer network this spring.)

That led some politicians to announce that new federal laws were necessary to stop inadvertent file sharing.

"I'm planning to introduce a bill," said Rep. Edolphus Towns, a New York Democrat who heads a House oversight committee. He said his legislation would limit the use of peer-to-peer software on all computer networks operated by the federal government or its contractors.

In addition, the Federal Trade Commission should investigate whether P2P software developers are violating the law, and the Obama administration should "undertake a national campaign to educate consumers about the dangers of file sharing software," Towns said. (In April, Towns' committee informed the FTC it had reopened an investigation into inadvertent file sharing.)

Rep. Peter Welch, a Vermont Democrat, suggested a similar approach. He wanted to know "whether there's some legal action that should be taken to protect intellectual property, to protect kids from pornography, to protect classified medical information, national security information."

The two-and-a-half hour hearing singled out LimeWire, which is probably the highest-profile P2P client in use today. LimeWire is distributed by Manhattan-based Lime Wire LLC (which sells a more featureful version called LimeWire Pro) and it uses the BitTorrent and Gnutella networks.

Lime Group chairman Mark Gorton tried to defuse some of the criticism, saying "the current version of LimeWire does not share any documents by default," and many security improvements were added in version 5 of the software--released in December 2008--that were absent from version 4.

Gorton also tried to make a more subtle point: the Gnutella network is an amalgamation of scores of different P2P clients, many of which may have different default settings, and LimeWire shouldn't be held responsible for someone's decision to share files using a program written by a different company.

It didn't work. "It is chilling what the public now has available to it," Towns said. "The idea that you can look at the first lady's information, where she's going, how she's getting there. Tax records, things of that nature...we need to get to the bottom of this."

Not helping was the fact that Gorton testified at an earlier hearing in July 2007 on the same topic.

"Mr. Gorton, I find your testimony today stunning," said Rep. Paul Hodes, a New Hampshire Democrat. "You promised us two years ago you were going to fix LimeWire."

Replied Gorton: "LimeWire does not control the computers of people around the country."

He added later: "It's not unreasonable to expect that people who install file-sharing software want to share files."

Other suggestions were more extreme. Rep. Bill Foster, an Illinois Democrat who's more technically-inclined than most politicians (he has a doctorate in physics), said "the nuclear option is to block the Gnutella protocol" on a national basis.

But, Foster acknowledged, that wasn't likely to work. Another option, he said, would be to create a new version of the Gnutella protocol that allowed only limited clients--that curbed what folders or file types could be shared--to connect to it.

The tweet that shall live in infamy.

(Credit: Twitter)

You can't make this stuff up: Rep. Peter Hoekstra, a Republican from Michigan, set off a political-blog firestorm when he posted to his Twitter account on Wednesday that "Iranian twitter activity (is) similar to what we did in House last year when Republicans were shut down in the House."

Presumably he was talking about rallying in the face of adversity. But, um, really? The U.S. congressional elections might be rife with mildly nefarious characters on both sides of the party line, but the current upheaval in Iran deals with a totalitarian regime, media blackouts, and mass protests with casualties. Talk about a gaffe. Rep. Hoekstra has said he will not seek re-election and is reportedly considering a run for governor; I'm sure his potential opponents are taking note here.

Anyway, somebody brilliant (I learned this is, unsurprisingly, Ben Huh of I Can Has Cheezburger fame) seized the opportunity and created a hilarious blog called "Pete Hoekstra is a Meme," devoted to photo captions much like the perennial "lolcats" craze. "To Hoekstra is to whine using grandiose exaggerations and comparisons," the site explains. Each "Hoekstra is a Meme" caption illustrates a similar, though generally more offensive claim.

(Credit: hoekstraisameme.com)

It gets better. This is the same Rep. Peter Hoekstra who, you might recall, Twittered his secret trip to Iraq back in February. This guy is just comedy gold. I'm sure he's a fine public servant to the good people of Michigan (Is he? Michiganders, please weigh in!), but when it comes to Twitter, you'd almost think he had been planted by the writers for The Daily Show.

And while some might say Rep. Hoekstra's staffers ought to gently prevent him from Twittering, in the future, I say keep 'em coming. It's been a while: Politicians have been getting awfully digital-savvy for the past few years. Back in 2006, we were guaranteed loads of hilarity whenever Ted Stevens tried to explain the Internet, Robert Wexler wasn't aware that his Colbert Report joke about being a cocaine fiend would be mixed and remixed all over the Web, or George Allen mouthed off in the presence of YouTube-ready cameras.

These days, however, we're stuck with far too many Beltway types who are woefully adept at Twittering, like former Bush strategist Karl Rove.

And honestly, that's just no fun.

This post was updated at 11:33 p.m. PT.

Internet companies and privacy experts will appear before a Congressional subcommittee later on Thursday to discuss the privacy implications of behavioral advertising.

Representatives from Google, Yahoo, and Facebook will appear before two subcommittees of the U.S. House of Representatives' Committee on Energy and Commerce to discuss behavioral advertising, or the practice of tailoring Internet ads to a Web surfer's behavior on a particular Web site. In order to do that, Internet companies have to collect personal data, and members of Congress as well as privacy advocates are interested in hearing more about how that data is being handled.

Such ads have been contentious in the past, and it seems a new session of Congress wants to take a fresh look at the practice.

Yahoo and Google both plan to explain how their privacy policies work with respect to the data collected through behavioral advertising. Yahoo's Anne Toth said Wednesday she will emphasize that the company has introduced a plan (that it said won't be fully complete until 2010) to remove identifying links to personal data after 90 days and has taken steps such as linking one's decision to opt out of this type of ad serving to their Yahoo account, rather than a cookie.

Google will discuss similar measures, also pointing to the benefits of serving relevant ads--rather than random ads--to Web surfers, according to a copy of the prepared testimony submitted by Google's Nicole Wong, deputy general counsel.

But privacy activists such as Princeton University's Ed Felten, who is also the director of the Center for Information Technology Policy, will emphasize how many different parties have access to the data gathered through behavioral advertising, and the technical barriers that those parties can choose to erect around their data if they choose.

The hearing is supposed to begin at 7 a.m. PDT, and six speakers are expected to appear.

news analysis The U.S. House of Representatives has scheduled a hearing Tuesday to examine a bill that would force peer-to-peer applications to provide specific notice to consumers that their files might be shared.

The hearing before a House Energy subcommittee comes about a month after reports that specifications about the helicopter used as Marine One may have been leaked through a P2P network. Meanwhile, a second House committee is probing whether LimeWire or another P2P application was responsible.

Tuesday's hearing is expected to focus on a bill introduced in March by Rep. Mary Bono Mack, a California Republican. The catch: while it appears intended to target only P2P applications, the measure sweeps in Web browsers, FTP applications, instant messaging utilities, and other common programs too.

Bono's Informed P2P User Act says that it will be "unlawful" for P2P software to cause files to be made available unless two rules are followed. First, the utility's installation process must provide "clear and conspicuous notice" of its features and obtain the user's "informed consent." Second, the program must step through that notice-and-consent process every time it runs.

Her bill defines P2P applications as software that lets files be marked for transfer, transferred, and received. (The exact wording: "to designate files available for transmission to another computer; to transmit files directly to another computer; and to request the transmission of files from another computer.")

Every copy of Windows, GNU/Linux, and Mac OS X sold in recent memory includes a command-line FTP client fitting that definition but lacking the proposed warning. Does that mean that Microsoft, the Free Software Foundation, and Apple could be fined for "unlawful" activities? If the definition stretches to include the rsync utility and open-source software too, will volunteer maintainers and foreign citizens have to comply?

Another example: Web browsers could also be regulated and subject to Federal Trade Commission enforcement action unless "informed consent" is obtained each time the desktop icon is double-clicked. (Every Web browser allows the user to "designate" files to be uploaded--ever post a photo?--and request that files be downloaded.)

It's true that forcing compliance--at least for those programmers who are paying attention to legislative proclamations from the U.S. Congress--shouldn't be too difficult. A few warning messages and click-here-to-continue dialog boxes would suffice.

Still, the argument that a particular piece of proposed legislation could be worse is no argument at all. What the bill's drafters may not appreciate is that the Internet is, by definition, a peer-to-peer network. Restricting its P2Pishness, for lack of a better term, is difficult to do with restricting Internet access completely.

The point here is not that LimeWire and its rivals are without risk; misconfiguration probably would expose sensitive files to the public.

It's more that software is uniquely malleable, difficult to define, and better overseen by West Coast coders voluntarily adding warning messages than East Coast lawyers making it illegal not to do so.

The U.S. Supreme Court failed to reach a consensus about regulating obscenity a generation ago; do we really think that computer code today won't be equally slippery?

In the wake of recent reports describing the electric grid's vulnerabilities to hackers, two members of the U.S. Congress have introduced legislation giving federal regulators more authority to combat that possible threat.

The electric grid system that keeps the United States humming is worth more than $1 trillion and keeps the lights on for more than 300 million Americans. Federal regulators have complained they do not have enough authority over the electric grid networks, which recent reports have suggested may be vulnerable to infiltrations by Chinese and Russian spies--a new concern as utilities tie grid-monitoring control systems to open networks like the Internet.

Matching bills were introduced in the House and the Senate on Thursday to increase the authority of the Department of Homeland Security and the Federal Energy Regulatory Commission to secure the electric grid. The bills were introduced by Sen. Joe Lieberman (I-Conn.) and Rep. Bennie Thompson (D-Miss.), who chair the Homeland Security committees in their respective chambers.

"Our cybersystems are under constant attack," Lieberman said in a statement. "We rely on cyberspace for so much of what is at the heart of our way of life, and our systems are not protected. We are focusing on the electricity cyberstructure today because electricity is what so many critical sectors of the economy depend upon."

Utilities are already expected to comply with mandatory cybersecurity standards, but regulators have reported that utilities are likely downplaying the critical nature of their infrastructure to avoid compliance with the rules.

The legislation addresses that by giving FERC, DHS, and other national security agencies the authority to determine which physical or cyber assets should be deemed "critical electric infrastructure." The bill clarifies that "critical" infrastructure should refer to networks that are so vital to the United States that their incapacity would cause significant harm to the country's security, the economy, or public health at a national or regional level.

It also would enable FERC to issue rules or orders to protect critical electric infrastructure against threats--including emergency orders, which could be issued without prior notice if FERC determines an order is needed immediately to protect the grid from an imminent threat. Emergency orders would remain in place for 90 days, unless FERC opened them up to public comment.

In addition, the legislation calls for FERC and the DHS Secretary to establish within 120 days of its enactment interim measures to protect the electric grid.

The DHS would also be responsible for more oversight of grid protection programs. The legislation would require the department to conduct research to determine if the security of critical electric infrastructure has been compromised and to report its findings to Congress. The department would also have to produce regular reports with recommendations for creating a collective domestic response to a cyberattack by a terrorist, nation-state or person.

The legislation comes as the Obama administration is pushing through stimulus spending smart-grid development, which would connect the electric grid to more networks.

About 100 technology executives, including dozens of high-level officers and CEOs, met with White House officials and congressional leaders Wednesday to discuss ways the tech industry can help turn around the economy and the legislative agenda they say is needed to make that happen.

Cisco CEO John Chambers, Hewlett-Packard Executive Vice President Mike Holston, and Solazyme CEO Jonathan Wolfson were some of the executives brought together in Washington by TechNet, a bipartisan political network of CEOs from the "innovation" economy. The organization unveiled its 2009 policy agenda, which includes some proposals already under way such as support for green technologies and increased broadband infrastructure, as well as more controversial issues like immigration reform and patent reform.

The tech executives first met with a bipartisan group of congressmen, followed by a meeting with members of the Senate Democratic Steering Committee, including Senate Majority Leader Harry Reid (D-Nev.) and Senators John Kerry (D-Mass.), Maria Cantwell (D-Wash.), and Dick Durbin (D-Ill.). They also met with a group of Senate Republicans, as well as House Republicans led by Rep. Eric Cantor (R-Va.) There was also a meeting with House Speaker Nancy Pelosi (D-Calif.) and other House Democrats.

At the White House, the executives met with officials including White House Senior Adviser Valerie Jarrett, National Economic Council Director Larry Summers, Assistant to the President for Energy and Climate Change Carol Browner, and Tom Kalil, the associate policy director for the White House Office of Science and Technology Policy.

The American Reinvestment and Recovery Act has enabled the Obama administration and Congress to address some issues relevant to the tech community, like health information technology and energy efficiency, but there needs to be "continued follow-through both from our side and their side," said Chris Hankin, senior director of federal government affairs for Sun Microsystems.

The executives also appealed to the politicians to resist protectionist policies spurred by concern over U.S. job growth. President Obama's budget proposal, for instance, would limit multinational corporations' ability to defer U.S. taxes on profits earned abroad until the profits are brought back to the United States. The administration estimates it can raise $210 billion over 10 years by collecting those taxes.

"There's concern that would put us at a competitive disadvantage," since other countries have the same tax deferral policy, said Betsy Mullins, TechNet's vice president of government and political affairs.

With over 70 percent of the industry's sales overseas, "what does that do to your sales, your ability to grow, and to create new jobs?" she asked.

It's easy to criticize government failures. But as the U.S. Congress is learning in the case of the executive branch's cybersecurity efforts, fixing problems and crafting improvements is a little more difficult.

The U.S. Department of Homeland Security's cybersecurity arm has been under fire practically since its inception, flunking tests by outside auditors and receiving letter grades of "F" from congressional overseers. That invited speculation last year about whether the National Security Agency or the White House should take over responsibility for cybersecurity tasks.

Both ideas met with a lukewarm reception during a congressional hearing on Tuesday. "The mission should not reside in NSA," said Microsoft Vice President Scott Charney, a onetime Justice Department computer crime chief. Charney said if you want the public to trust its government, "it's really important to empower DHS to take the necessary operational role."

Subcommittee Chairman Yvette Clark (D-NY) says the Bush administration failed on cybersecurity because it "stopped short of mandating security changes."

The chairman of the full House Homeland Security Committee, Bennie Thompson (D-MS), felt the same way. "I don't think the answer to our problems in cyberspace comes from giving control of the entire federal cybersecurity mission to NSA," he told the House Subcommittee on Emerging Threats, Cybersecurity, and Science and Technology.

There are "pockets within DHS showing signs of improvement," Thompson added.

And the idea of a White House takeover wasn't wildly popular. "I want to respectfully disagree with those of you who think the White House is a place to put this," said Rep. Paul Broun, a Georgia Republican. He added: "I think this committee, not the White House, should be setting policy."

Making the hearing more lively than usual was last week's resignation of Rod Beckstrom, director of Homeland Security's National Cybersecurity Center. In his farewell letter, Beckstrom blasted what he said was an NSA power grab, saying the secretive military agency "effectively controls DHS cyber efforts through detailees, technology insertions." (The week before, Director of National Intelligence Admiral Dennis Blair suggested to a House committee that the NSA was ready for the job, saying "there are some wizards out there at Fort Meade.")

"It's pretty clear (DHS) have not lived up to those responsibilities," said Dave Powner, a director at the Government Accountability Office, who testified at the hearing. "The question is: do we want to keep working with them...or do we just designate them an operational role and put someone else in charge of coordinating with the private sector and the intelligence community?"

Part of official Washington's dissatisfaction with DHS involves disagreements with not just who should handle cybersecurity topics, but what should be done. Security hawks would like the government to have the authority to order around the private sector. Defense hawks would like more focus on offensive "cyberattacks." Privacy advocates worry about Homeland Security's expansive mission, and remember how the NSA and FBI fought for many years to restrict domestic use of encryption.

"I don't think DHS can effectively lead offensive capabilities we need in cyber," said Amit Yoran, the CEO of monitoring firm NetWitness and a former DHS cybersecurity official. DHS's "key role" should be to protect government networks, he said.

Any significant legislative effort to rethink federal cybersecurity efforts is likely to wait until a two-month review ordered by the Obama administration in February is complete. Rep. Yvette Clark (D-NY), chairman of the cybersecurity subcommittee, said that review is crucial because the Bush administration's "strategy stopped short of mandating security changes. Without teeth, the strategy was never implemented."

CNET's Stephanie Condon contributed to this report.

Caption: To celebrate Pi Day 2008, the San Francisco Exploratorium made a Pi string with more than 4,000 colored beads on it, each color representing a digit from 0 to 9.

(Credit: Daniel Terdiman/CNET)

Washington politicians took time from bailouts and earmark-laden spending packages on Wednesday for what might seem like an unusual act: officially designating a National Pi Day.

That's Pi as in ratio-of-a-circle's-circumference-to-diameter, better known as the mathematical constant beginning with 3.14159.

The U.S. House of Representatives on Wednesday approved a resolution introduced two days earlier that designates March 14, 2009 (3/14, get it?) as National Pi Day. It urges schools to take the opportunity to teach their students about Pi and "engage them about the study of mathematics."

Backing the measure is a collection of technology and engineering groups, including the Association for Competitive Technology, the American Chemical Society, the Biotechnology Industry Organization, IEEE, TechAmerica, and TechNet.

They sent a letter after the vote to House Science Chairman Bart Gordon (D-Tenn.) thanking him for introducing the measure, which is also sponsored by Rep. Ralph Hall of Texas, the panel's senior Republican. "Thank you for recognizing the importance of math and science education to a knowledge-based economy," it says.

Jonathan Zuck, president of the Association for Competitive Technology, says he's been quietly celebrating Pi day for the last few years by delivering apple, peach, and blueberry pies to colleagues, congressional staffers, and professional contacts.

Zuck called them "lighthearted reminders about the importance of math and science education," adding "this year we decided to put together an effort to see if we could use this as a mechanism to increase awareness for math and science education."

The idea of improving math and science education is thoroughly bipartisan and backed by major tech companies including Microsoft and Intel. But how to achieve that goal has little consensus in Washington; many Republicans have advocated for school choice, which has helped to boost student scores in some areas, while teachers unions and most Democrats oppose it.

WASHINGTON--House Democrats rebuffed Republican attempts to include more loan guarantees for nuclear and clean coal technologies into the so-called stimulus package, along with Republican efforts to make the energy sections more market-oriented.

By a largely partisan vote of 34 to 17, the House Energy and Commerce Committee ultimately approved the energy portion of the American Recovery and Reinvestment Act, which spends about $25 billion on renewable energy, energy efficiency, and electricity transmission. (See our related story about the broadband portions of the bill.)

The legislation creates a loan guarantee program for renewable energy systems, and the committee on Thursday voted to extend the loan program to specifically apply to hydropower, as well as commercially viable "leading edge biofuel projects."

Rep. Jay Inslee (D-Wash.) had specific praise for the company Sapphire and its work producing algae-based gasoline, which he said will be commercially viable "any place with saltwater and sunshine."

However, the committee rejected an amendment to extend the loan guarantees further to apply to "zero emissions energy"--which would make nuclear and clean coal power eligible for the loans.

"This is a job stimulus bill, and there are literally 100,000 jobs that could be added if we increase our nuclear portfolio," argued Rep. Fred Upton (R-Mich.), who introduced the amendment.

The committee also rejected a Republican amendment to make carbon capture technologies eligible for loan guarantees.

Democrats insisted the amendments were inappropriate given that another portion of the stimulus package allocates $2.4 billion specifically for carbon capture and that using taxpayers' money for nuclear power would not create immediate economic stimulus.

"No amount of incentives will change the fact that no nuclear projects are ready," said Committee Chair Henry Waxman (D-Calif.).

Rep. Anna Eshoo (D-Calif.) also pointed out that $10 billion in loan guarantees were offered to the nuclear industry last year.

Republicans and Democrats were also divided over the proposal to decouple energy rates from usage. The purpose of decoupling, Democrats said, is to enable energy companies to promote energy efficiency without facing the threat of lower revenues.

Inslee called it "the single most effective thing for creating jobs in energy efficiency and giving people an opportunity to lower their (energy) costs in the long run."

California's energy efficiency improved remarkably, in comparison with the rest of the country's, after the state adopted decoupling 20 years ago, Inslee pointed out.

Republicans were unconvinced and unsuccessfully tried to change that portion of the bill.

"I think this is the most anti-consumer vote any of us could make," said Greg Walden (R-Ore.). "This is the reverse of an incentive system."