It's time for feds to share their ideas

Everyone knows how hard homeland security officials have tried to get industry executives to talk about their cyber vulnerabilities — and how uncooperative companies have been.

But what if the federal government gave industry officials some incentives to open up? In an increasingly dangerous cyberworld, it is the federal government that can no longer afford to keep cybersecurity secrets.

The incentive is clear. Government officials are concerned that the nation's critical infrastructure is vulnerable to a large-scale and potentially devastating cyberattack, but much of that infrastructure — banks and financial institutions, telecommunications networks, electrical power plants — is privately owned and operated.

Nevertheless, government officials are generally unwilling to risk compromising their sources and methods by declassifying threat information and sharing it with industry, said Mark Gembicki, national managing director for critical infrastructure protection at BearingPoint.

Likewise, industry officials are fearful of disclosing information that could become public and damage their business. "They go out on a couple of dates, but they can't seem to get to the altar," he said.

Gembicki thinks critical infrastructure companies should be privy to the federal government's cyberthreat information. He also thinks agencies should share countermeasures for dealing with cyberattacks.

Such an idea has some merit, if it doesn't compromise the government's own security efforts, said Amit Yoran, former director of the Homeland Security Department's National Cyber Security Division. "If we're reluctant or incapable of doing that as a government," he added, "how do we expect to entice our private-sector counterparts to share information with us?"