Earlier this month, the Obama administration proposed comprehensive cyber security legislation to Congress that would clarify the government’s role in protecting the nation’s critical infrastructure and favor public/private cooperation over regulation. Since his candidacy, President Obama has made cyber security a national priority.
His method of achieving these goals focuses on government collaboration with private entities instead of dictating mandates. Obama has made it clear that the government will not be mandating technology standards for the private sector—a reasonable approach, given the lag time between enacting legislation and the speed of technological advance.
The 5-page cyber security legislative proposal, summarized in a Whitehouse Fact Sheet, provides objectives such as protecting the American people online, protecting critical infrastructure, protecting federal government computers and networks, and providing a new framework to protect individuals’ privacy and civil liberties.
The plan would force critical infrastructure organizations, like electric companies and large financial firms, to present audited cyber security plans to the Department of Homeland Security (DHS) for approval. Companies with inadequate security could expect to be publicly named by the government.
In keeping with his former assurances regarding public and private collaboration, the President has indicated that private auditors, paid for by private companies, will determine the adequacy and compliancy of a company’s cyber security plan. All plans and audits must be publicly accessible to facilitate transparency.
Some have viewed this proposal with suspicion, saying that only an entity with no financial incentive should be able to perform such audits. Private companies and the auditors they hire should not be able to decide what constitutes a sufficient security framework.
But allowing industry to audit itself can allow companies to keep up with the latest in innovation and best practices, rather than trying to adhere to a static bureaucratic template of an acceptable cyber security framework. Emerging threats and can be responded to more quickly. The required level of transparency will provide a level of scrutiny from competing businesses that will help ensure a high standard for security plans. We know that attacks on our critical infrastructure would likely include both facilities in the economy and in the government. The elimination of our potential vulnerability requires a closely coordinated effort of both the public and the private sector. To succeed, we believe this partnership must be genuine, mutual, and cooperative.
Companies also will respond to pressure from the public to ensure cyber security systems are tight. Consumers are increasingly aware of safeguarding their private information, and at the same time, increasingly insecure about Internet security. A recent Unisys Security Index, based on a biannual survey of more than 1,000 people in the United States, indicated increasing public concern. Within Internet security, 48 percent of respondents said they were extremely or very concerned about viruses and spam, with only 17 percent saying they are not concerned – down sharply from 33 percent who said they were not concerned in the last survey. The private sector will be compliant with regulatory matters, but also will respond to marketplace pressure.
The White House proposal could provide a real push for privacy and cyber security laws, and the administration seem intent on avoiding regulatory overreach and government interference in business. Private business will need to show their motivation to collaborate with the government and provide a collective, meaningful focus on protecting consumer data and other cyber security issues.
