Home > Security

Computerworld - The NSA's Perfect Citizen program reminds me of several huge chunks of wood that used to be suspended 30 feet above my street by heavy cables strung between utility poles. When I moved in, I needed a lot of extra phone lines, and it seemed like it was taking

forever to get the new service to go live. When I finally asked an installer why, he pointed to the chunks of wood.

Know what those are? he asked. No idea, I said.

They used to be telephone poles, he told me. These phone lines are so old that the poles rotted out underneath them. But instead of restringing the lines, the phone company just put up new poles, attached cables to the old poles where the phone lines connected to them and sliced the poles off just above and below that point.

Congratulations, he said. By ordering five new lines, you forced them to replace that old copper.

What does that have to do with Perfect Citizen? Unfortunately, a lot.

The program's official purpose is to develop the ability to monitor the U.S. critical-infrastructure grid, so cyberattacks against it can be spotted early and defended against effectively. Think of it as packet inspection and network traffic analysis, except on a huge scale and really fast.

Some people worry that the NSA might listen in on Internet conversations. Look, it can already do that. The big issue is why the NSA would have to pay special attention to the networks that run critical infrastructure.

The reason for that is painfully simple: Those networks are old. They were designed as private networks, with no need for much security because hacking into them would require making a physical connection. But when they were hooked up to the Internet, they weren't rebuilt from the ground up, or even heavily reworked to make them more secure. That would have been expensive -- and utilities are notorious for avoiding any costs that can't be recouped by raising rates.

And as IT people know all too well, no money means no project.

Instead, the utilities did the equivalent of stringing cables, whacking the old poles off above and below, and then going about their business, hoping no one would worry about big chunks of aging network hanging out in full view.

The NSA shouldn't be babysitting these rotting chunks of network, or even just figuring out better ways to monitor them. Instead, the NSA should be developing the most bulletproof designs possible for these critical-infrastructure networks, based on the best crypto and security that the NSA is willing to release to the private sector.

And then those networks shouldn't be retrofitted with the new design -- they should be ripped out and replaced properly.

That's what should happen.

But that may not be politically possible. Even with shiny new high-security designs, replacing those networks is still expensive.

Who's going to pay? Getting approvals for rate increases from dozens of state utility commissions is politically impossible, as is the prospect of the federal government just tossing money to the utilities to do the upgrades, or taking over the networks in the name of security.

And in the end, that's why the NSA is doing this. It's a bad idea, and a long way from perfect. It's not the job the NSA should be doing.

But in a very imperfect situation, Perfect Citizen may be the best we can do.

Frank Hayeshas been covering the intersection of business and IT for three decades. Contact him at cw@frankhayes.com.

Read more about Security in Computerworld's Security Topic Center.