The Fear-Based Psychology of the 'Internet Kill Switch'

Security legend Paul Kocher talks about the attitudes shaping Congress's latest tech misstep.

If the Internet ever does something unfriendly to the national security interests of the United States, what if the president of said Union could pick up a cold war-era style phone - or maybe whip out an iPhone pre-loaded with a custom "kill the internet" app - and order that it be shut down?

That's what activists are saying is one potential outcome of the Protecting Cyberspace as a National Asset Act. The so-called "Internet Kill Switch" is not actually an outcome of that bill, by the way - some commentators have compared this meme to the "death panels" myth that almost derailed the healthcare bill.

But the fact remains that the president has broad power under the 1934 Telecommunications Act to restrict "wire communications" during a time of war - and that includes the Internet. So even under existing laws, an off switch for the United States' most important information conduit is, in theory at least, only one over-eager lawmaker in chief away from reality.

Paul Kocher, current CEO of Cryptography Research, is a legend in the field of security - one of the engineers behind SSL 3.0 and an innovator in a host of other areas. Recently I interviewed him on the subject; here's what he had to say about the so-called "Internet Kill Switch."

"It's a Rorschach blot."

"On one level it's absurd, and on others it's impractical and frightening. It's a Rorschach blot.

When you build something that will shut down a massively critical piece of infrastructure that people have tried to make reliable, that's a more frightening prospect than anything that could have inspired such a defense."

"It's a very blunt weapon."

"Networks like the Internet are critical for a lot of tasks - if you ever flipped a switch on that, you'd cause tremendous amounts of harm. It's unclear you'd get any particular benefit from doing that."

"Maybe I'm being cynical, but my read on the rationale [for the Internet Kill Switch] is that it's a fear of technology."

"The idea that people can kill the technology if they wish to makes people feel reassured that the technology won't go rogue in some way. If you had an army of robots walking around you'd like to have switch to turn them off - people still have that concept of the Internet."

"I can guarantee every teenage hacker will try to figure out how to trigger it."

[Ed. It goes without saying that Paul was once one of those teenage hackers, and knows whereof he speaks.]

"If I want my name in the paper, or to have an effect that's bad on the world, it's hard to think of something more perfectly designed for that kind of use."

Attemps to degrade the quality of civilian GPS signals shows that disabling communications networks hurts the good guys more than it hurts the bad guys.

"The whole GPS infrastructure is built with a mechanism where they can degrade the quality of location measurements. It's designed so they could have the military have more accurate GPS units than civilians.

But it turned out the military ended up using civilain GPS receivers because they're cheaper. They ended up disabling the degradation capability because the harm caused to the U.S. military exceeds the benefit to the folks they're fighting."

"Stopping a Denial of Service attack by shutting down the Internet is like trying to stop a small explosion by triggering a much larger one."

"You could conceivably come up with ways to bring down the entire Internet, by playing games with BGP protocol or bringing down the entire DNS archicecture. But you can't stop a pinpointed attack with this.... If you had a kill switch you'd either shut down entire internet or achieve nothing.

"The question this comes down to is, 'Is there some scenario where one would really want to bring the entire internet down?'"

"Everybody working from home: gone. Everybody's [VoIP] phone connection: gone. Everybody's website: gone. That's the only binary choice you can really achieve with this."

For technical as well as political reasons, no bill with anything resembling an "Internet Kill Switch" will ever be signed into law.

"If Congress decrees electrons have positive charge and gravity goes in the other direction, it doesn't mean it's possible to achieve those things.... But the reality is that if something like that came close to passing there would be a tremendous outcry.

"The government has had some misleading experience with this area, with telephone switches where there are requirements that there be backdoors so law enforcement can do wiretaps and eavesdrop on calls. But there's a lot more homogeneity in telephone infrastructure than within the packet-switched internet infrastructure.