Previously, we reported that ACM created a committee to study issues related to statewide voter registration databases and that the Election Assistance Commission (EAC) recently released its draft guidance on this topic, seeking additional comments. ACM’s committee took the opportunity to provide expert comments to the EAC.

The Help America Vote Act requires that all states have statewide voter registration databases in place by January 1, 2006. Seeking to give the states guidance on this law, the EAC released draft guidelines on how to implement statewide registration databases. ACM’s committee felt that the guidance was a good start, but that it covers only a few issues and lacks much of the technical detail that states really need:

CONTENTS

[1] Newsletter Highlights
[2] Congress, Media, and Research Societies Bring National Attention to IT R&D Funding, USACM Weighs in
[3] ACM Voter Registration Database Study Calls for More Details in EAC Guidance
[4] USACM Provides Testimony to House Science Committee Hearing
[5] Congress Begins Work to Fund Research Agencies
[6] Congressmen Announce “Innovation Summit”
[7] Real ID Act Becomes Law
[8] House Passes Two Spyware Bills
[9] Cybersecurity Issues Move Forward in the House
[10] Administration Announces Leadership Changes in IT R&D Agencies
[11] Events to Watch In June
[12] About USACM
(more…)

With most eyes focused (understandably) on the Senate’s judicial filibuster fight, the House of Representatives yesterday passed two pieces of spyware legislation:

(more…)

Update 5/24/05: The Senate cut a deal last night paving the way for several judge confirmations, so looks like a ceasefire is in effect. The Washington Post has a good report on it.

Original Post 5/17/05: Today’s Washington Post reports that Republican and Democrat leaders have ended efforts to find a compromise over the confirmation of judges. (For background, the President has sent several judges to the Senate for confirmation; the Republicans seek an up or down majority vote on each one, while the Democrats are filibustering their nominations, meaning it takes 60 votes before a judge would face a simple majority vote.) This has been a leading issue in D.C. for well over a year now, but this week it is clear that something will happen. Senator Frist (R-TN) has said he will likely bring a confirmation up for debate, call for a special ruling to bypass the filibuster, and then force a simple majority vote on the ruling. (There is more nuance, but this is basic gist.) This scenario has been described in the media as the so-called “nuclear option.”
(more…)

Federal Trade Commissioner (FTC) Orson Swindle had some strong words recently for business leaders attending a meeting on cybercrime convened by the Business Software Alliance and the Center for Strategic and International Studies (as reported in National Journal’s Tech Daily [subscription req’d]):

However, as pointed out in a NY Times article today, many of the activities from which current privacy concerns arise aren’t theft at all:
(more…)

In a previous post (recommended reading for background to this post), we outlined House Homeland Security Chairman Cox’s (R-CA) efforts to add cybersecurity provisions to the Department of Homeland Security Authorization Act. The leading idea was to give cybersecurity more political clout within the department by moving it higher up on the bureaucratic food chain. Another idea was to add research provisions to the act. What was unclear was how this effort would proceed given four different committee’s claiming responsibility over cybersecurity – normally a recipe for gridlock. In what appears to be a win for the fledging Homeland Security Committee, The House of Representatives is poised to pass the Department of Homeland Security Authorization with a new “Cybersecurity Czar” and research and development provisions.

This is apparently homeland security week in the House of Representatives as it considers both the Homeland Security Appropriations Act and the Department of Homeland Security Authorization Act. This post covers only the cybersecurity provisions in the authorization bill. Peter at CRA has a great (and distressing) analysis of what happened in the appropriations bill. (For those of you new to authorizing versus appropriation, it is a complex topic, but the really rough summary is an authorization bill authorizes activities, while the appropriation bill actually funds them.)
(more…)

News.com has a rather troubling article today about how ID theft and phishing are converging to create a new very active threat to electronic commerce. Here is the key excerpt:

While we normally post policy-related stories and this one isn’t policy per se, it struck us as particularly troubling for couple of reasons. First, both identity theft and phishing seem to be growing threats to consumers. While Congress has held numerous hearings on the deluge of identity theft incidents since the start of the year (here is one we covered on ChoicePoint), it has yet to move any of various pieces of legislation to regulate data brokers or increase privacy protection. Further, little attention has been paid to phishing. We doubt that Congress is looking into how the issues may be converging. In fairness, Congress does move rather slowly, particularly on issues that overlap so many different committees such as this one.

Second, Congress just passed, and the President signed, the Real ID Act as part of the emergency supplemental appropriations bill. In USACM’s view, this act will significantly increase the risk of identity theft by linking each state’s drivers license databases to one another without any security mandates or clearly identifying who has access to what data.

Since Congress is generally a strong supporter of fostering electronic commerce, it would seem it should balk at things that can directly undermine this goal. This article would also seem to strengthen security expert Bruce Schneier’s arguments that new threats can undermine two-factor security strategies.

The House Science Committee held a hearing yesterday on computer science research. USACM and CRA, along with a number of other organizations concerned about the future of computing research, issued joint testimony for the hearing:

The full testimony is available (PDF, 1.6 MB) here.

CRA tracks computing research and funding issues very closely, and their Computing Research Policy Weblog has the most detailed coverage of the hearing.

Following the hearing, ACM President David Patterson made comments in an ACM press release:

The full release is available below (click here for a PDF of the release).
(more…)

At a Capitol Hill press conference yesterday, a group of House members announced plans to hold a national “Innovation Summit” later this year. The event was led by Rep. Frank Wolf (R-VA), along with his Congressional colleagues Rep. Vern Ehlers (R-MI), Rep. Sherwood Boehlert (R-NY), and Rep. Don Manzullo (R-IL). They were joined by former Michigan Governor John Engler from the National Association of Manufacturing; Deborah Wince-Smith from the Council on Competitiveness; John Castellani from the Business Roundtable; John Palafoutas from the American Electronics Association; and Dr. Alan Merten, President of George Mason University.

The group voiced concerns that the United States is losing its leadership in science and innovation. Rep. Wolf noted that the group’s “hope is that the conference will bring together the nation’s best and brightest to help develop a blueprint for the future of American science and innovation.”

Rep. Wolf’s press release regarding the summit is available here.

The event took place only minutes before the scheduled start of yesterday’s House Science Committee hearing on computer science research, to which we directed your attention the other day. Peter Harsha, CRA’s director of government affairs, has promised an update on how the hearing went and its likely fallout.

We will bring you more information about the Innovation Summit as it becomes available.

In an excellent op-ed for News.com, ACM’s President Dave Patterson argues that the federal government is abandoning its previous vision of investing in long-term IT research that has driven many amazing innovations and multibillion industries (i.e. the Internet).

He further explains how big of an issue this is as other agencies aren’t filling this gap:

He also discusses the implications of this shift in strategies:

The column and tomorrow’s (Thursday, May 12) the House Science Committee hearing do a great job of framing the issues that Congress and the Executive Branch really have to consider.

Update 5/10/05:The Senate passed the supplemental appropriations conference report tonight by a vote of 100-0.

Update 5/6/05: The House passed the supplemental appropriations conference report yesterday by a overwhelming margin 368-58-1.

Original Post 5/5/05:The House and Senate have reached agreement on the Real ID Act. We posted the final agreement here. It is largely the same bill that passed the House as part of the supplemental appropriations bill (see our previous coverage for more background).

The legislation prevents federal agencies from accepting state driver’s licenses for official purposes unless they meet certain minimum standards spelled out in the act. It also requires states to check citizenship against federal databases. Finally, it requires all states to share these databases with each other. (There are several more provisions, but those are the highlights.)

Last month USACM sent the Senate a letter outlining its concerns about the security aspects of the database provisions and its national ID implications. It’s safe to say the final bill still raises those same concerns.

The Real ID Act is part of the supplemental appropriations bill, which the House is scheduled to consider, and will likely pass, today. The Senate will take up the bill next week. The President has already indicated he will sign it.

This Thursday (May 12) at 10:00 a.m. EDT the House Science Committee will review the current landscape of the federal government’s commitment to IT R&D funding and its implications for the future.

The hearing is titled “The Future of Computer Science Research in the U.S.,” and the witnesses are:

• Dr. John H. Marburger III, Director, Office of Science and Technology Policy, Executive Office of the President;
• Dr. Anthony J. Tether, Director, Defense Advanced Research Projects Agency;
• Dr. Wm. A. Wulf, President, National Academy of Engineering; and
• Dr. Tom Leighton, Chief Scientist and co-founder, Akamai Technologies, and member of the President’s Information Technology Advisory Committee

The committee webcasts all of its hearings (www.house.gov/science), and I recommend watching as this is the first hearing to delve into many of the issues the community and the media have discussed over the past few years.
(more…)

Infoworld has the following article on a recent legal setback for the entertainment industry:

Of course, that’s not the end of this saga. (more…)

Security expert Bruce Schneier has a sobering post on the Real ID Act today:

As you know, USACM has been active on Real ID, but it appears to be a done deal at this point. Indeed, we may see Senate action as early as this afternoon on the supplemental appropriations bill which includes the Real ID Act.

Peter Harsha at the Computing Research Association (CRA) has a good report on a recent op-ed in Science by former CRA Board members and current PITAC members Ed Lazowska and David Patterson (who also happens to be President of ACM and a member of USACM’s Executive Committee).

Quoting Peter, the article discusses “the impact of the changing federal landscape for support of computing research.”

We haven’t covered patent reform much in this blog, but it is an issue that Congress and the Administration are reviewing. As we previously reported, Congress is likely to look toward patent reform legislation while it waits for the Supreme Court to decide MGM v. Grokster.

Yesterday’s Washington Post had an article that gives a good overview of the issue and the current efforts:

It also concisely describes the differening positions and what may happen:

(more…)

The Computing Research Association (CRA) has a good post about Representative Frank Wolf’s (R-VA) call on President Bush to triple the federal government’s investment in basic research. He sent the President a letter (which is also on CRA’s website) outlining his concern about the levels of federal investment in basic research and its impact on the future of American competitiveness. It is especially important that it is Rep. Wolf saying this as he is Chairman of the Appropriations Subcommittee that has jurisdiction over much of the federal research budget.

Peter at CRA makes the key point in his post:

CONTENTS

[1] April Proves to be a Busy Month for ACM Policy Activities
[2] ACM Provides Testimony to EAC on Voter Databases
[3] USACM Questions Real ID Act’s Security Standards
[4] High-Performance Computing Legislation Passes House
[5] EAC Technical Committee Adopts Voting System Standards; EAC Commissioner Resigns
[6] Cyber Czar Legislation Takes First Step in Congress
[7] Legislation on the Move
[8] Events to Watch In May
[9] About USACM

[An archive of all previous editions of Washington Update is available here.]
(more…)

From the front page of today’s NY Times, an article on the Real ID Act’s progress:

This article confirms our earlier report that the Real ID Act is likely to remain a part of the supplemental appropriations legislation.

Recently, USACM sent Senator Lamar Alexander (R-TN), who has been working against the Real ID Act, a letter expressing our concerns about the bill.

Update 5/2/05: Last week, the Homeland Security Committee folded the “cyber czar” legislation (see below), pretty much as is, into the Department of Homeland Security Authorization Act of 2006. This massive bill reauthorizes and updates many different programs at the department.

The Committee did add two items to the cybersecurity provisions. The first is a new $3.7 million (over one year) professional development program for cybersecurity. The program would be run by the National Science Foundation but funded by the Department of Homeland Security. The second is language that assures that this position has no impact whatsoever on the existing cybersecurity guidelines for federal agencies.

We have also worked up (at Spaf’s request) an organization chart that compares current law to proposed structure. The chart shows the bill’s intent to increase the political clout of the office. For example, come budget season it will only have to go through two levels of bureaucratic tradeoffs instead of three – a likely worthy goal.

Lastly, we posted a Congressional Research Service report on cybersecurity. This report has been floating around the Internet for a while, but it is worth reading if you haven’t yet. It is a long report that outlines the many challenges with this complex issue.
(more…)