White House plan for surveillance system draws fire

WASHINGTON, D.C. - The White House wants the U.S. to build a nationwide intrusion-detection system to monitor government and private-sector networks.

The idea is that the system would automate response to net security attacks, but the proposal is garnering heavy fire from political opponents, civil liberties groups and industry representatives who think such a system would raise too many privacy issues and would be too expensive to implement.

According to the "National Plan for Information Systems Protection," a draft document from the National Security Council (NSC), President Clinton wants the government to install an integrated intrusion-detection system - called the Federal Intrusion Detection Network (FIDNET) - by 2003 on all government networks.

"The protection of our nation's vital computer-based systems must become a central part of the mission of our corporations and our government agencies. This effort will not be easy," Clinton says in the draft.

The 150-page FIDNET draft was leaked by government officials to the Washington, D.C.-based civil liberties group Center for Democracy and Technology (CDT), which last week posted much of the plan's content at www. cdt.org.

The draft also calls for "key corporations" in telecom, banking and energy to use the same kind of monitoring and reporting system so critical U.S. information systems will be protected as well.

Like Ronald Reagan's "Star Wars" missile defense program, the Clinton administration's network defense initiative would require untold amounts of money and would be based on untried technologies. The draft calls for the U.S. to pick a "best-of-breed" intrusion-detection system and have it widely deployed in four years, with the FBI as its main administrator.

Because FIDNET would be monitoring network traffic, this Big Brother aspect has incited fierce critics.

"This really changes the dynamic of how the government goes after criminals," says Ari Schwartz, policy analyst at the CDT. "Instead of just tracking down criminals based on their behavior, it tracks everyone."

While U.S. privacy laws are complex, Schwartz noted that the government can pretty much do what it wants if it invokes the specter of national security.

House Majority Leader Dick Armey (R-Texas) said he does not like the idea of what he called "a new Washington bureaucracy to protect the private sector from hackers and computer terrorists."

"[The administration's] plan raises the Orwellian possibility that unscrupulous government bureaucrats could one day use such a system to read our personal e-mail," Armey stated. He said use of strong encryption offers a way to protect information assets. He urged the Clinton administration to fully disclose what the intrusion-detection system will do before building anything.

Americans for Computer Privacy (ACP), a group of about 100 companies and 40 trade associations that lobbies to lift encryption export rules, strongly condemned the FIDNET proposal.

"Like the third-party key-recovery plan advocated by the FBI, this Big Brother approach to dealing with the technological realities of the 21st century is an affront to the constitutional rights of law-abiding citizens," claims Ed Gillespie, ACP executive director.

Among others weighing in with an opinion were Sens. Conrad Burns (R-Mont.) and Ron Wyden (D-Ore.), who crossed party lines to condemn the White House draft plan. In a joint statement they said: "We are particularly concerned that this sweeping monitoring system could have access to all conceivable varieties of electronic communications, including e-mails, remote log-ins and computer programs."

In spite of the fact that the draft plan already has a "Message from the President" with a statement attributed to Bill Clinton on it, National Security Advisor Sandy Berger last week said it hasn't officially been sent to the president. But the NSC anticipates such a plan will be officially unveiled around September or October.