Congress mulls clearinghouse for sharing cyber threat info
- By William Jackson
- Dec 06, 2011
Draft legislation before the House would create a quasi-governmental National Information Sharing Organization that would serve as a clearinghouse for cybersecurity and threat information shared between government and the private sector.
Witnesses at a House Homeland Security subcommittee hearing Dec. 6
called it an ambitious but challenging goal that will have to overcome
the lack of trust between the two sectors.
“We believe that a ‘third-party, honest broker’ facilitator for the
disclosure and dissemination of cybersecurity intelligence creates a
superior and more productive environment where all participants, both
government and non-government, more readily share sensitive
information,” Gregory Shannon, chief scientist for the CERT Program at
the Software Engineering Institute at Carnegie Mellon University, told
the Cybersecurity, Infrastructure Protection and Security Technologies
Subcommittee.
Related coverage:
Cyber bill strong on info sharing, light on privacy protections
But he warned that establishing such an honest broker would take
time. “For information sharing, building the necessary trust
relationships cannot be rushed.”
Gregory Nojeim, director of the Project on Freedom, Security and
Technology at the Center for Democracy and Technology, worried that such
an organization could open a back door for government monitoring of
privately owned infrastructure.
“Government monitoring would most likely grow as an indirect result
of information sharing between the private and public sectors or as an
unintended by-product of programs put in place to monitor communications
to or from the government,” Nojeim said. He recommended a slow
approach, building first on the efforts of the United States Computer
Emergency Readiness Team and existing sector-specific Information
Sharing and Analysis Centers.
The draft legislation being considered joins at least 14 other such
bills that have been introduced during this Congress in the House and
another 20 now pending in the Senate. The White House also has proposed
cybersecurity legislation.
Like many of the other bills, the draft proposal would make the
Homeland Security Department the lead agency for cybersecurity in
government and for critical infrastructure owned and operated by the
private sector. This is a role the department now holds nominally, but
without specific statutory or budget authority.
The bill also would address the growing concern over the need for
better situational awareness in cyberspace through sharing of
information. Although the need for sharing and for public/private
cooperation in cyberspace has long been acknowledged, a complete
framework for the exchange of information between two parties who are
wary of each other has yet to be worked out.
“I have seen too many instances of the government releasing
information on cyber threats days, and sometimes weeks, after the threat
has been identified,” said Cheri McGuire, vice president of global
government affairs and cybersecurity policy at Symantec, who testified
on behalf of the Business Software Alliance. “In many of these cases, by
the time the government releases the information, it has little use
because the private sector has already identified and taken actions to
mitigate the threat.”
On the other side, the industry often is reluctant to share with
government because of competitive and legal concerns. Some information
sharing does occur through DHS’s US-CERT and through industry-specific
ISACs, but not on a scale that enables the real-time situational
awareness needed to combat increasingly sophisticated threats.
NISO would be “a national clearinghouse for the exchange of cyber
threat information so that the owners and operators of networks or
systems in the private sector; educational institutions; state, tribal
and local governments; entities operating critical infrastructure; and
the federal government have access to timely and actionable information
in order to protect their networks or systems as effectively as
possible.”
It would be a quasi-governmental body governed by a board of
directors appointed by the DHS secretary with members from the banking
and finance; communications; defense; electricity; oil and gas; health
care; and IT sectors, as well as the privacy and civil liberties
communities. The board would determine membership requirements, and
participation would be voluntary.
It would be member-funded, with no more than 15 percent of its budget coming from government.
NISO would encourage the sharing of classified government data and
the declassification of data. Information from industry would be
anonymized and protected from disclosure or use in legal actions.
About the Author
William Jackson is a Maryland-based freelance writer.