Critiques of the DHS and FBI’s Grizzly Steppe Report
robertmlee.org
Critiques of the DHS and FBI’s Grizzly Steppe Report
1–10 of 114 posts
Re: Critiques of the DHS and FBI’s Grizzly Steppe Report
#2I agree with the assessment. While parts of this official communication were well written and intentioned, it feels like others weren't.
> at least in a vendor report you usually only get 1 page of marketing instead of 8
That was also my reaction when I scrolled down past page 4-5. It almost feels like they could have split this particular report into:
1)public-and-media-facing high level technical overview
2)actionable intelligence information for defenders
With 3) being the attribution and evidence coming at some point down the road.
Re: Critiques of the DHS and FBI’s Grizzly Steppe Report
#3The white house and the document itself never list attribution as the goal. Robert M Lee seems to think because it refers to the attackers as Russia, it is confusing readers. The summary at the beginning makes it clear to me that the document is presupposing the attacker is Russia as to be consistent with all future public reports.
I don't think this is the best written report, but his conjecture around completely leaving out attribution if it doesn't include evidence seems rooted in playing to the lowest common denominator (ie poor media coverage of what this report entails)
Re: Critiques of the DHS and FBI’s Grizzly Steppe Report
#4> But why is this so bad? Because it does not follow the intent laid out by the White House and confuses readers to think that this report is about attribution and not the intended purpose of helping network defenders.
Looking at the comments in yesterdays' thread[1], this is absolutely true - many, many people posted some variation of "What? There's no evidence proving Russian involvement in here at all!"
Re: Critiques of the DHS and FBI’s Grizzly Steppe Report
#5[deleted]
Re: Critiques of the DHS and FBI’s Grizzly Steppe Report
#6> But why is this so bad? Because it does not follow the intent laid out by the White House and confuses readers to think that this report is about attribution and not the intended purpose of helping network defenders. Looking at the comments in yesterdays' thread[1], this is absolutely true - many, many people posted some variation of "What? There's no evidence proving Russian involvement in here at all!" 1. https:/…
That's right, I was one of those confused people. I assumed this would be the WH presenting what evidence they have.
Sooo... still no public evidence that Russia leaked the DNC and Podesta's e-mails?
Re: Critiques of the DHS and FBI’s Grizzly Steppe Report
#7Has Scheiner written anything on this report?
I will say this; the Podesta emails revealed a lot about the internal politics of the DNC. Why are we not treating this type of leak with the same level of respect as the Ellsberg leaks? Or for that matter, the Snowden leaks? Who is really controlling the narrative here?
Re: Critiques of the DHS and FBI’s Grizzly Steppe Report
#8The white house and the document itself never list attribution as the goal. Robert M Lee seems to think because it refers to the attackers as Russia, it is confusing readers. The summary at the beginning makes it clear to me that the document is presupposing the attacker is Russia as to be consistent with all future public reports. I don't think this is the best written report, but his conjecture around completely le…
The timing of the release of this document, at the same time as the announcement of sanctions on Russia for the hacking, can't be overlooked.
It's quite reasonable to assume the release of this report was intended to create the impression of evidence for attribution, even if it actually contains no such thing. Otherwise why not release it on any other day to avoid confusion? It looks to me like the confusion was quite intentional.
Re: Critiques of the DHS and FBI’s Grizzly Steppe Report
#9Has Scheiner written anything on this report? I will say this; the Podesta emails revealed a lot about the internal politics of the DNC. Why are we not treating this type of leak with the same level of respect as the Ellsberg leaks? Or for that matter, the Snowden leaks? Who is really controlling the narrative here?
What was the public interest in his lobster recipe? Or creating a paranoid frenzy that got shots fired at a Pizza place?
Randomly dumping personal emails isn't the same as Ellsberg and Snowden working with reporters to blow the whistle on specific transgressions in war and mass surveillance.
Interesting article exploring this issue of exercising discretion and developing new ethics in the age of leaks: http://www.nytimes.com/2016/11/05/opinion/what-were-missing-...
Re: Critiques of the DHS and FBI’s Grizzly Steppe Report
#10This is theatre. Were Congress to expand tort law to mandate standards and consequences similar to products liability regulations for other products, then the attack surface available to state and non-state actors would meaningfully shrink.
If there is one thing the plaintiff's lawyers excel at, it is inflicting extensive expenses and pain on parties who negligently or fraudulently create, fund creation, or use products that injure property or person; thereby creating effective incentives to harden products.
You will know the USGOV is serious about INFOSEC when they stop issuing reports and start legislating, regulating and enforcing meaningful standards, as they already do for automobiles, drugs, machinery, etc.