Mastodawn

Jerry 🦙💝🦙Nov 22, 2022

I've been in contact with Jen Easterly, the head of US CISA, this morning and they'll be creating accounts here. There is an account, @cisacyber, that is legitimately owned by CISA, though they're early in the setup process, so please, don't report them for impersonation.

Jerry 🦙💝🦙

Since posting the message this is in reply to, I’ve had approximately 11,000,000 replies asking me why CISA or the US government doesn’t set up their own mastodon/fediverse instance. Or telling me that they should. I can’t reply to them all, so addressing it here.

Perhaps they will create one. Maybe they won’t. I’m not them. They didn’t create their own version of twitter.

I have to believe setting up a new service in the US government is a long and complicated and expensive process. Perhaps they want to jump in and see if the fediverse is useful enough to warrant the investment.

It’s been maybe 14 hours. Let’s give them a bit of grace, please.

DROP\ TABLE Hacker of Earthsea Nov 22, 2022

@jerry your so attentive lord jerry

@jerry While we're at it, why hasn't the government in XX set up their own instance yet?

I'll get me coat

James Hubbard Nov 22, 2022

@jerry not sure about the CISA requirements, but I'd imagine that they require someone to apply something like DoD STIGs to the host and software stack. It needs to be run in FIPS 140-2 compliance mode.
https://stigviewer.com/stigs

Complete STIG List

Security Technical Implementation Guides (STIGs) that provides a methodology for standardized secure installation and maintenance of DOD IA and IA-enabled devices and systems.

STIG Viewer | Unified Compliance Framework®

@jerry Oh Lort, I can just imagine the Oatmeal-Level screaming that you endured gracefully. Namaste 🙂 🕉️

Tindra Nov 22, 2022

@jerry recent Army policy involves needing metrics so they can make a data-driven decision before jumping on any new social media, and it needs to go through the CIO.

I expect other agencies have similar policies.

Andy Nov 22, 2022

@jerry I appreciate the optimism of people that think a large traditional enterprise could spin up a publicly facing service in days.

@jerry Labor-hours it takes to get approval to post on social media: Some, but kinda worth it.

Labor-hours it would take to just get FISMA authorization to operate an open source instance themselves: Oh lordy, I've got the vapors already

Gina Nov 22, 2022

@jerry it seems like in some ways, the US government moves amazingly quickly. In others, it's painfully slow. I imagine they will want to be sure whatever they set up is very secure, and can be properly recorded for the national archive as needed. That will probably take time.

Hal Pomeranz Nov 22, 2022

@jerry I’m not sure I can tolerate this level of mature, measured response on social media. More spicy hot takes please! (/sarcasm)

Jeff Hall - PCIGuru

@jerry Seriously!? The government set up their own Mastodon instance? I suppose stranger things have happened, but with their focus on everything else, I would guess that would be last on their To Do list.

Dave Swersky Nov 22, 2022

@jerry I've been a contractor for a government agency. The ethos there is about as diametrically opposed to the openness of the Fediverse as it's possible to get.

The government will have to see a need for their own instances that can't be fulfilled any other way, and that will only come after the lights go out at the birdsite.

Quing Em van Khaos Nov 22, 2022

@jerry no, ACAB

Daniel Micay Nov 23, 2022

@QuingKhaos @jerry CISA isn't a law enforcement agency.

Quing Em van Khaos Nov 23, 2022

@DanielMicay @jerry it's part of DHS

Daniel Micay Nov 23, 2022

@QuingKhaos @jerry

That doesn't make it a law enforcement agency. FEMA is part of DHS too. Would you feel the same way if FEMA made an account on a major instance to post announcements about natural disasters?

CISA is not a law enforcement agency and doesn't do offensive work. They work on securing US infrastructure overall and also help with securing the infrastructure of companies, etc. in the US to a lesser extent.

Having an account on the instance doesn't give them any special access, so what's the issue? If they wanted to do something nefarious it wouldn't be from an official account for publishing information...

@jerry Just to chime in, I for one support letting #CISA on here, because:

As far as I can tell CISA is one of the "good" ones. They have a positive impact on society and focus on protection.
Any of the "bad" ones -- overly aggressive gov. actors -- can make all sorts of accounts here and elsewhere without telling us. So what's gained by blocking CISA?
I'm for #inclusion and against #blocking unless there's documented bad behavior.
Getting important players involved in our conversation is good for infosec.exchange, the Fediverse, and our #community as a whole.

Thanks for taking a stand!

Dr. Lola Politicka Nov 22, 2022

Here is what govt struggles with:

1) Who has authority to create one? It's going to have to receive resources of some kind -- manpower, server costs, oh and security. Who has the authority to marshall those resources? What resources will be needed? (There will be committees).

2) Who has the knowledge/ expertise to develop such an instance? We'll need a moderation policy and some approval/oversight process for who gets an account and what they do with it. (Add committees).

ares Nov 22, 2022

you must realize that if cisa or us gov ever sets up fediverse instances, you'll need to block those instances approximately twelve minutes after people start posting there

@jerry Wouldn't that mean they could not enforce moderation policies as it would be a government run service subject to the 1st amendment w.r.t moderation? Hmm

wslack Nov 22, 2022

@decryptlyfe I think it likely those servers wouldn't host any non-USG accounts. The only accounts on the server would be official ones, so the domain would be its own form of verification. just spitballing though.

@jerry don’t you know that assuming bad intent makes this whole thing work? I mean, how else do we drive engagement and monetization? 🤯

@jerry oh that’s not your goal. Cool!

Jerry 🦙💝🦙Nov 22, 2022

@adamshostack 😂

Drew Mochak Nov 22, 2022

@jerry I doubt it's that expensive, it's probably more a matter of red tape and getting the appropriate clearances... plus, I mean, if they set up their own official instance sure that makes it easier to block, but I feel like that makes it MORE likely that they take the fediverse seriously, rather than less. Which strikes me as not the outcome these folks are looking for but 🤷‍♂️

Joseph Galbo Nov 22, 2022

@jerry very interesting development. Not surprised CISA is figuring this out first. Definitely following.

wslack Nov 22, 2022

@jerry If anyone has questions about that topic, I'm happy to take them. (this is not a promise to be able to answer them - and I wouldn't be speaking officially, just sharing information about how such an idea might play out using already public information)

Océane Dec 12, 2023

@jerry Exposing vulnerable people to government propaganda, to the benefit of white-collar workers who can sort out information, is libertarian.

Océane Dec 12, 2023

@jerry Call this “academic libertarianism” if you wish. But regardless of how well-meaning your contact is, they're still going to apply training and orders to casually mislead the people federating with your instance.

Your instance is going to share misinformation.