Cybersecurity: The next partisan issue?

A cybersecurity task force created by the Republican party has a set of recommendations for legislation addressing threats to the nation’s information infrastructure. Positoned as a response to President Barack Obama's legislative proposal in May, the recommendations could mark the transformation of cybersecurity from bipartisan concern to yet another partisan flashpoint, some industry and government observers fear.

"The House and Senate have taken a bipartisan approach to cybersecurity,” said Patricia Titus, chief information security officer at Unisys and former CISO at the Transportation Security Administration. But with the creation of the GOP task force, “I think it’s turning into something partisan."

Related coverage:

Under cybersecurity plan, agencies would answer to DHS

Cyber challenge: Securing private-sector IT with a minimum of regulation

The task force delivered its report to House Speaker John Boehner (R-Ohio) and Majority Leader Eric Cantor (R-Va.) on Oct. 3. It makes recommendations on cybersecurity authorities, information-sharing and public-private partnerships, critical infrastructure, and domestic legal frameworks.

In the report, the task force made clear its difference of opinion with the Obama approach.

“We are generally skeptical of large, comprehensive bills on complex topics, at least as the bills are being written,” the report reads. “We generally are skeptical of direct regulation and of government agencies grading the security of a private company, which is another form of regulation.”

There currently are at least 20 bills dealing with cybersecurity and information security pending in the Senate, and at least 13 more in the House. Many of the bills are perennial efforts that have been introduced in previous Congresses, and the numbers do not include the White House proposal, which has not been introduced as a bill.

The legislation Obama proposed in May would put the Homeland Security Department in charge of the security of federal IT systems but would give the department only limited authority to oversee the security of privately owned critical infrastructure. It would create a regulatory framework for nongovernment critical infrastructure, requiring owners and operators to develop security plans that would be evaluated by DHS, but the department would not be able to require specific measures or impose penalties for inadequate plans.

Administration officials called the proposal a work in progress that would be further developed in Congress and said the proposed regulatory framework is an acknowledgment that government does not have all of the answers and that cooperation is likely to be more effective than regulation.

The Republican task force recommendations are not in the form of proposed legislation, but an outline of goals and proposed steps. They include:

• Improve information sharing and develop an active defense capability by establishing a non-government clearinghouse for information and intelligence.
• Liability protection to provide an incentive to comply with “targeted and limited regulation.” The proposals would limit additional regulation to those industry sectors already regulated, and oversight for cybersecurity requirements would be done through existing regulatory agencies.
• Update the Computer Fraud and Abuse Act of 1986 to impose criminal penalties for attacks on critical infrastructure and to criminalize the creation and distribution of malware, and to make the Racketeer Influence and Corrupt Organization law apply specifically to online crime.

Titus said the administration proposal was a response to industry concerns about the lack of action on the legislative logjam in Congress. “Those of us in cybersecurity understand there have been competing priorities” for Congress to deal with, such as a devastated economy. “But we need to move forward or we will miss our opportunity before a catastrophic event,” she said.

With the probability that there eventually will be some cybersecurity law passed, “we are all kind of waiting with bated breath to see what will be facing us,” Titus said.

Just what will be passed, and when, remains uncertain, although representatives on both sides of the aisle agree that national cybersecurity legislation is needed to create a unified framework with clear lines of authority for protecting government and private-sector infrastructure.

“Congress must pass legislation giving the administration and private entities the tools they need to enhance our nation’s cybersecurity while protecting our privacy,” Rep. Jim Langevin (D-R.I.), co-founder of the Congressional Cybersecurity Caucus, said in June in testimony before the Senate Judiciary subcommittee on crime and terrorism.

Texas Rep. Mac Thornberry, head of the GOP task force, said upon its creation in June, “Cybersecurity needs to be a priority, and this task force will lay the foundation to make it one in the House.”

So why is it so hard to get anything passed?

“At the end of the day, it’s politics,” said Richard Moulds, vice president of strategy for Thales IT Security. Any form of regulation is controversial, and cybersecurity covers a lot of congressional turf.

The amount of turf being protected is illustrated by the task force roster, whose members are on nine House committees that claim some jurisdiction over cybersecurity:

• Mac Thornberry (Texas), Armed Services/Permanent Select Committee on Intelligence.
•  Robert Aderholt (Alabama) ,Appropriations.
• Jason Chaffetz (Utah), Oversight and Government Reform.
• Mike Coffman (Colorado), Armed Services.
• Bob Goodlatte (Virginia), Judiciary.
• Bob Latta (Ohio), Energy and Commerce.
• Dan Lungren (California), Homeland Security.
• Michael McCaul (Texas), Science, Space, and Technology.
• Tim Murphy (Pennsylvania), Energy and Commerce .
• Steve Stivers (Ohio), Financial Services.
• Lee Terry (Nebraska), Energy and Commerce.

On the government side of cybersecurity, one issue likely to be addressed is reform of the Federal Information Security Management Act of 2002. FISMA requirements have been updated over the years through the revision of standards by the National Institute of Standards and Technology and through compliance guidance from the Office of Management and Budget.

“It’s a type of reform,” Titus said. But she said OMB is hampered by the lack of a dedicated federal chief information security officer. She said government officials so far have not shown any interest in creating such an office. “I just don’t see that happening.”

Moulds said one of the most urgent legislative needs is a national data breach notification law to replace the current patchwork of 47 state laws organizations now must comply with. He is optimistic that some law will emerge from the four bills addressing the issue now pending in the House and Senate.

“I think we’re close to getting something,” he said. “The question is, what are we going to get?”

None of the currently proposed bills is perfect, he said, but the final product could be worse if there is too much compromise. The worst possible outcome would be a national bill that represents the lowest common denominators from the current state laws. “We would probably end up with something that is pretty watered down,” he said.