McCain slams slow pace of cyber policy

A day after President Donald Trump called out Sen. John McCain for his vote against a Republican health care bill at a Phoenix rally, the senior senator from Arizona took aim at the administration's cybersecurity policy.

In a speech at an Arizona State University cybersecurity conference, McCain complained that the U.S. was not moving fast enough to combat rising threats from state and nonstate actors.

"Our democracy itself has become a target. As we all know, last October, 17 U.S. government agencies concluded unanimously that the Russian government had directed the theft and publication of e-mails from American citizens and political organizations in order to interfere in our election," McCain said. "Months of congressional hearings, testimony, and investigative work have demonstrated that Russia’s deliberate cyberattacks and disinformation campaign were designed to undermine faith in our democracy and our values," he said.

The problem, McCain said, is that the executive branch isn't taking steps to shore up defenses and develop protocols to defend and deter attacks.

"Unfortunately, leadership from the executive branch on cybersecurity has been weak. As America’s enemies seized the initiative in cyberspace, the last administration offered no serious cyber deterrence policy and strategy. And while the current administration promised a cyber policy within 90 days of inauguration, we still have not seen a plan," McCain said.

He complained that the current government approach to cybersecurity is "overgrown with bureaucracy and choked by duplication." The responsibilities of the Department of Defense, the Department of Homeland Security and the FBI when it comes to cybersecurity, he said, "are often poorly defined, and each body lacks the full suite of legal authorities required to combat a dynamic threat that respects neither physical nor bureaucratic borders."

McCain touted his work on the National Defense Authorization Act to define what constitutes an "actionable attack" that merits a response.

"Actionable attacks would include any malicious cyber activities targeting U.S. interests with the intent to cause casualties, to significantly disrupt the normal functioning of our democracy, or to threaten the U.S. Armed Forces or the critical infrastructure they rely upon," he said.

McCain is a longtime critic of U.S. cybersecurity policy and the lack of a well-defined deterrent, going back to the Obama administration. But his remarks come at an interesting time politically for the senator.

At an Aug. 22 Phoenix rally, Trump complained that the Senate was "one vote away," from passing a health care bill. "Think of it, seven years the Republicans -- and again, you have some great senators, but we were one vote away from repealing it," Trump said, in a thinly veiled reference to McCain's vote against the bill. "But, you know, they all said, Mr. President, your speech was so good last night, please, please, Mr. President don't mention any names. So I won't. I won't.… Very presidential, isn't it?"