Secrets and spies: Data in 2015, the year after everything changed

In Congress, limping attempts to restrict the kind and amount of data collected by U.S. intelligence collapsed before they reached the finish line. Sen. Pat Leahy, D-Vt., thought his PATRIOT Act reforms — packaged in the eerily acronymized USA FREEDOM Act — enjoyed enough bipartisan support to pass in November’s lame duck session. But de rigueur opposition from Republicans on the Hill and critiques from privacy advocates outside of Congress meant Leahy could only muster a simple majority, not enough for cloture in the “cooling saucer of democracy.”

That pushes the matter to the next Congress — and therein lies an interesting battle. For, while the zeal for intelligence reform might not seem strong among the new GOP majorities, if nothing is done, key intelligence-gathering provisions in the PATRIOT Act — most notably Sec. 215, used as part of the legal justification for the NSA’s sweeping collection of personal data (something confirmed by the Snowden leaks) — will expire in June. Will Republicans in leadership find common ground with the White House and overcome the objections of privacy advocates on the left and right? Will GOP attempts to renew PATRIOT provisions be so full of other surveillance-friendly provisions that it inspires Democratic opposition? And will this month’s fuss and fury over the Sony hack again swing the pendulum toward the spymasters?

The New Year’s hangover from the December cyber-excitement should be a big story in 2015. Hollywood is already using the Sony breach as a reason to reanimate the corpse of SOPA — the Stop Online Piracy Act — calling on government to exert more control over the Internet, even though Sony’s nightmare before Christmas likely started with an email.

“Companies are still staggeringly bad at protecting information,” said Lisa Lynch, associate professor of journalism at Concordia University and research fellow at Princeton’s Center for Information Technology Policy. “Sony was hit by malware, but their data breach was helped along by the fact that Sony kept thousands of sensitive passwords in a file marked ‘password.’”

The JPMC hack, Lynch said, could have been prevented with simple two-factor identification.

It remains to be seen how well the “Be less careless with data Act of 2015” will fare in Congress, but even before Sony, the attacks on Target and Home Depot reveled how messy the line is between government and corporate cybersecurity. Analyst Brian Krebs traced the origins of the malware used on the big box retailers to code developed by hackers opposed to U.S. intervention in Libya, Syria and Ukraine.

And the summer saw more than a few raised eyebrows when retired Gen. Keith Alexander used his long tenure as head of the NSA as justification for his seven-figure consulting fees. Though Alexander denied any impropriety, he traded on his deep connections inside the national security establishment, and his deep knowledge of malware variants of something called “Wiper,” which have financial institutions quite nervous. Wiper, it should be noted, is itself a variant of Stuxnet, the virus used to damage the Iranian nuclear program. It was developed by the National Security Agency and Israeli intelligence while Alexander was atop the NSA. (The U.S. has never officially acknowledged its involvement with Stuxnet.)

So, does all of this make the coming year a more dangerous time for the increasingly wired world?

“Certainly the average American probably feels that their data is a lot less safe from either government or criminal intrusion than it might have been a year ago,” Lynch said.

Whether or not that is actually true, Lynch believes the extra attention paid to the risks is a good thing. “It makes us more proactive about protecting data, and helps spur more research on privacy protection.”

But Lynch also worries that too much aversion to risk will paralyze innovation and growth — to say nothing of the casus belli it gives government to further spy on individuals and shackle the Internet.

The Snowden leaks have already shown many where that can lead — and there are still untold volumes of that information awaiting release in 2015.