Toward a Culture of Cybersecurity Research Aaron Burstein TRUST & ACCURATE Research Fellow Samuelson Clinic & BCLT, Boalt Hall UC Berkeley

Overview Why cybersecurity matters Why cybersecurity is a hard problem, and why research is crucial How communications privacy law inhibits research A better balance between privacy and cybersecurity

Why Cybersecurity Matters Attacks target infrastructure –Internet is the “nervous system” –Transportation, energy, water, banking connected by Internet –Example: Massive cyber attack against Estonia, May 2007 Potential for devastation is growing –Pervasive networked devices (think home thermostats and building materials)

Why Cybersecurity Is Hard Attacks are cheap and easily disguised. Attacker ISP 1 ISP 2 ISP 3 Victim (e.g., military system or small country) A “distributed denial of service” attack It’s hard to distinguish innocuous from malicious traffic until it’s too late due to lack of coordination. Defense involves many open research questions.

Tension Between Privacy and Research Electronic Communications Privacy Act (ECPA) regulates acquisition, disclosure Scenario: UC Berkeley researcher seeks network logs (IP addresses only) from commercial ISPs. –ISP voluntary disclosures regulated by ECPA –Addressing info and contents (e.g., bodies) protected under ECPA –Stored record disclosure vs. “real-time” interceptions –Disclosures to a “governmental entity” (UC Berkeley) more restricted –Consent is unworkable –No research exceptions  ECPA almost certainly bars disclosure

We need a cybersecurity research exception to the ECPA.

Properties of a Research Exception Tailored –For research only –Excludes law enforcement access Comprehensive –Applies to communications contents and real-time interception Protective –Prohibits further disclosures (voluntary or compelled) Controlled –Institutional review is integral

Would a Research Exception Work? Legislative action would give legitimacy to uses of data that are already analyzed, collected Exception would allow efficient data- sharing institutions to develop Exception’s institutional framework could extend to diverse data types (not just communications, e.g. passwords)

Conclusion Coordinated threats are potentially devastating. Urgent need for more coordinated defenses ECPA reform needed to make this happen