Pentagon opens classified cyber program to all defense contractors, ISPs

The Obama administration is expanding to all military contractors a computer security program that shares classified threat information, Defense Department officials announced Friday. After a year of trials with select vendors, the Defense Industrial Base, or DIB, cybersecurity pilot program will invite all military vendors and their Internet service providers to voluntarily join the two-way information-sharing initiative.

Most networks that control power, weapons system data and other critical services that support the military are privately owned. Under existing law, the government does not have the authority to regulate their security. Proponents say the program is a way for both sides to learn from reports of intrusions without compromising corporate reputations.

The National Security Agency, the Pentagon’s code-cracking branch, will disclose the “signatures,” or unique hallmarks, of identified malicious programs so that vendors can incorporate those red flags into antivirus software. In return, companies must report known breaches of defense information to the government within 72 hours after discovering an incident.

Companies are allowed, but not obligated, to disclose such incidents to the larger contracting community. Defense, however, can circulate intrusion reports stripped of identifying information among participants, other agencies and certain nondefense contractors. “The government may share nonattribution information that was provided by a DIB participant (or derived from information provided by a DIB participant) with other DIB participants in the [program], and may share such information throughout the government (including with government support contractors that are bound by appropriate confidentiality obligations) for cybersecurity and information assurance purposes,” states an April 30 preliminary rule also released Friday.

The administration is making this move during a heated debate over public-private computer security. Currently, the White House is at odds with the House and some Republican Senators over legislation modeled after the DIB cyber pilot that would allow other federal agencies and critical sectors to exchange similar intelligence. The administration argues the Cyber Intelligence Sharing and Protection Act, or CISPA, does not contain enough personal privacy protections and stops short of regulating certain security protocols for private industry. Republicans maintain that the government should not control a company’s security practices.

But both contingents agree valuable federal and business information has become all too susceptible to hacks. “The compromise of such information can significantly diminish return on DIB company and U.S. government research and development investment and represents a loss of intellectual property that compromises the security and technical advantages of DoD weapons systems,” the rule states.

One reason for changing the Defense program is to “address vigorous congressional and public interest in increasing cybersecurity and information assurance activities through government-industry cooperation,” the notice adds.

To join, military contractors must comply with certain security requirements for receiving the intelligence, according to Friday’s announcement. Internet service providers can participate by agreeing to offer their services to the contractors, after meeting certain federal stipulations, and are permitted to charge for the work. A new registration website states that Defense vendors also must obtain access to special secure phone lines and data networks to receive and submit intelligence.

Friday’s rule describes other new procedures and tools for communicating information through the program such as “a dedicated threat-sharing and collaboration system, and validated online application procedures in order to support participation by a large number of companies.”

For its part, the Defense Department pledges to protect the private information contractors disclose. “The DIB participants share this type of information with the government only on the condition that the government safeguards that information against any unauthorized use or release (both within the government and outside the government), which could cause substantial competitive harm to the DIB participant that reported that information,” the rule states. “The DoD analyzes the information reported by the DIB company regarding any such cyber incident, to glean information regarding cyber threats, vulnerabilities and the development of effective response measures.”

Almost from the beginning of the test run in 2011, contractors clamored to obtain advance notice of threats, security consultants said at the time. Interest was so great that it is expected the administration eventually could open eligibility to nondefense sectors that run transportation systems, water plants, electricity grids and other critical services.

The Homeland Security Department, which is the civilian agency responsible for facilitating the protection of private critical infrastructure, had been and “remains the government’s point of contact with the commercial service providers,” Defense spokeswoman Lt. Col. April Cunningham told Nextgov. “DHS and DoD are working closely together to provide cybersecurity support to the defense industrial base.”

For military contractors, a Defense chief information officer or other senior official and a corporate executive will need to sign off on a formal agreement before sharing intelligence.

The Pentagon stressed that the information the military reveals must be protected from accidental leaks and from the threats themselves. “A foundational element of this bilateral information sharing model is the recognition that the information being shared between the parties includes extremely sensitive nonpublic information,” the rule states. “The cyber threat information shared by the government must be protected against compromise by the cyber threat, which may already have a presence on the DIB participant's system; and thus the DIB participants must utilize security measures and limited sharing within the company, to ensure that the cyber threat information retains its operational value--for the benefit of all of the DIB participants.”

During follow-up investigations or damage assessments, both parties may have to share additional types of sensitive proprietary, personal and arms-related information. Defense officials stated the data “may include information regarding the types of DoD information or DIB company information that may have been compromised during the reported incident -- potentially including the most sensitive types of unclassified information (e.g., critical program information relating to DoD weapons systems, DIB company trade secrets related to DoD programs, personally identifiable information (PII) regarding individuals).”