'Kill switch' debate takes another turn

If a foreign country launches a cyberattack on the United States, should the president be able to shut down parts of the Internet to protect the nation’s infrastructure and networks?

Sixty-one percent of people responding to a recent survey supported the idea. But a great majority of  the readers responding to William Jackson’s report on the survey disagree.

The question first arose when the phrase "kill swiitch" began to circulate in connection to the Protecting Cyberspace as a National Asset Act of 2010, S. 3480, However, while the belief is widespread in some quarters that the legislation would give the president a “kill switch” to shut down the Internet whenever he deems fit, it really doesn’t go that far.

Alan Paller, research director for the SANS Institute, writing in GCN after the bill was introduced, wrote that the bill “just authorizes standard filtering like that done by Internet service providers every day, but in a nationally coordinated fashion.”

Related stories:

The 7 people who can restart the Internet

President has had ‘kill switch’ for communications since 1934

In fact, Paller wrote, the president has had a “kill switch” since 1934, when the Telecommunications Act gave the Oval Office power to shut down or disrupt networks during a national security emergency.

But whether the power comes from the 1934 act or the current bill before the Senate, the question posed by Unisys’ Security Index survey was whether he should have that power.

“This is a terrible idea and, if passed, we are in big trouble,” wrote Gerry McGowan of Virginia. “I really disagree with having that capability created for any entity for two big reasons. First, if the capability can be created, it can (will) be compromised and used against us in an attack. The Internet is global. We (USA) do not own it and it is not segmented into nice functional areas (how would one isolate the financial segment?) Second and most importantly, if the capability is created it can and will be abused for control … there is no segment of our government (or any other) that I would trust with such power. Better that each entity has the capability itself (DOD already has the ability to isolate) and the government initiates a system that recommends actions to isolate individual entities in at-risk segments of the internet. The individual entities take on the risk of not complying.”

“I could see the President having the authority to shut down the government and the military from the Internet, but having the authority to shut down privately owned websites goes a little far since it is not always clear whether the website is U.S.-owned or foreign-owned,” wrote another reader. “This is a very slippery slope that must be avoided. If there is a rogue site then it behooves ISPs to manage their infrastructure and block these sites.”

“Are people insane?” asked a reader in Florida. “The level of sophistication necessary to achieve an immediate shutdown of the Internet could not be placed at the disposal of one individual without compromising the security and privacy of the rest of us. Just one more move toward depriving us of our individual freedoms. I wonder what the result of the survey would have been if it were conducted during the Bush presidency.”

“The answer is simple,” summed up db in Omaha, Neb.: “No such authority should ever be given to any one person or even an organization.”

Chip of Hollywood, Fla., pointed out the potential dangers of concentrating control in one place. “If  the ‘switch’ exists it becomes a critical fail point when compromised. Unless it is physically some giant switch that can be tripped like something you would see in Frankenstein’s lab, and therefore physically protected by someone, presumably with a gun, this is a bad idea.”

DionS of D.C. suggested that a kill-switch level of control would be hard to achieve. “It's nice to say that isolation of certain infrastructures would protect them, but after working in most of the critical industries I would say that the ability to isolate them from attack and keep them able to interoperate as necessary is technically infeasible today,” he wrote. “Companies tightly integrate their critical presence from the corporate public presence. The effort needed to isolate the critical part would require the isolation of the public part as well. … I support the requirements for companies to have defined contingencies that meet some federal standard and the president being able to order the invocation of contingency plans. I suspect this is what is meant by ‘kill switch’ after all, the president doesn't push a button and launch the missiles, he orders others to do it.”

“I don't understand why everyone is getting so excited about this,” wrote Jeffrey A. Williams. “The president has always had a ‘kill switch’ for public as well as government networks. Frankly, shutting down public networks totally would be a very difficult task to accomplish since about the early 1990s, as so many are interlinked so intricately and complexly as well as being not totally originated/located on the continent that to accomplish such a task would take some significant time to do cleanly.”

A few people did defend the idea, although with some qualifications.

“Perhaps we need an amendment to the Constitution [for] ‘the right to Internet access," Richard Ordowich of Princeton, N.J. “I think if we added up all the potential vulnerabilities to the Internet we would discover that a significant breach of data is inevitable. Our ability to respond to a breach may require time to develop and a solution such as the ‘kill switch,’ maybe the only recourse. I only hope that those ‘in the know’ consider this eventuality and are losing some sleep over it. It certainly worries me.”

Bill Smith of Norfolk, Va., questioned the accuracy of the survey sample, but acknowledged the importance of protecting systems. “A 1,000 person survey can not be considered representative of a population that is 310 million persons strong. This is basic statistics 101,” he wrote. “However, as an IT professional, I agree believe that the Department of Homeland Security should work with DOD to monitor and be able to defend national infrastructure and financial systems.”

At least one reader was straight-up in favor, writing: “I think that is an excellent idea. How do we vote for this!”

And another reader had an alternate, if tongue-in-cheek, solution: “I've got something more effective than a kill switch. I've got this cute video of dancing kittens that is sure to bring down the Internet when everyone starts downloading it. And I am prepared to use it if the call from the president comes.”