Commerce Department gets funds to combat cyber espionage

Funds appropriated for the Commerce Department last week include $10 million for an initiative to combat cyber espionage, including efforts by foreign criminals and enemy nations to hack into a computer system that tracks smuggling of weapons of mass destruction and other dangerous goods.

The 2010 Consolidated Appropriations Act, which President Obama signed into law Dec. 16, includes more than $100 million for Commerce's Bureau of Industry and Security, which regulates the export of sensitive goods and technologies, and enforces export control regulations. The bureau's budget includes $10 million for the Cyber Espionage Response Initiative, to fund an increase in cybersecurity personnel and security enhancements to computer systems that maintain sensitive data about international trade, including illegal export activities.

In a fiscal 2010 budget estimate submitted for the president's review, BIS officials said the agency "requires extraordinary IT security measures due to its international trade data with a high security impact, and confirmation as a target by international actors engaging in broad federal level cyber espionage. The former requires data security exceeding even the requirements of personal privacy information; the latter requires [computer infrastructure] security over and above that provided by commercially available products."

In the document, the bureau details an escalation in cyberattacks, including unauthorized access to its Investigation Management System. That system tracks cases of illicit trafficking and proliferation of weapons of mass destruction and missile delivery systems from the United States, as well as the diversion of potentially dangerous goods to enemy military and terrorism organizations. In a conference report released on Dec. 8 to accompany the consolidated spending bill, the House Appropriations Committee noted that advanced technologies such as biometric identification systems, military training simulators, and surveillance systems all could pose a danger if exported to adversaries.

In its budget submission, BIS noted, "If IMS becomes compromised to the point where externals impersonate BIS agents and access case information, which is a very real threat, the scenario could end with loss of life or vital commodities in the hands of countries or individuals who would put overseas U.S. troops and national security in jeopardy."

No loss of data from the system has yet been detected, the document noted.

The appropriations legislation did not specify what information security controls would be implemented to combat cyber espionage.

The Commerce Department could not be reached for comment in time for publication.