Congress mulls clearinghouse for sharing cyber threat info

• By William Jackson
• Dec 06, 2011

Draft legislation before the House would create a quasi-governmental National Information Sharing Organization that would serve as a clearinghouse for cybersecurity and threat information shared between government and the private sector.

Witnesses at a House Homeland Security subcommittee hearing Dec. 6 called it an ambitious but challenging goal that will have to overcome the lack of trust between the two sectors.

“We believe that a ‘third-party, honest broker’ facilitator for the disclosure and dissemination of cybersecurity intelligence creates a superior and more productive environment where all participants, both government and non-government, more readily share sensitive information,” Gregory Shannon, chief scientist for the CERT Program at the Software Engineering Institute at Carnegie Mellon University, told the Cybersecurity, Infrastructure Protection and Security Technologies Subcommittee.

Related coverage:

Cyber bill strong on info sharing, light on privacy protections

But he warned that establishing such an honest broker would take time. “For information sharing, building the necessary trust relationships cannot be rushed.”

Gregory Nojeim, director of the Project on Freedom, Security and Technology at the Center for Democracy and Technology, worried that such an organization could open a back door for government monitoring of privately owned infrastructure.

“Government monitoring would most likely grow as an indirect result of information sharing between the private and public sectors or as an unintended by-product of programs put in place to monitor communications to or from the government,” Nojeim said. He recommended a slow approach, building first on the efforts of the United States Computer Emergency Readiness Team and existing sector-specific Information Sharing and Analysis Centers.

The draft legislation being considered joins at least 14 other such bills that have been introduced during this Congress in the House and another 20 now pending in the Senate. The White House also has proposed cybersecurity legislation.

Like many of the other bills, the draft proposal would make the Homeland Security Department the lead agency for cybersecurity in government and for critical infrastructure owned and operated by the private sector. This is a role the department now holds nominally, but without specific statutory or budget authority.

The bill also would address the growing concern over the need for better situational awareness in cyberspace through sharing of information. Although the need for sharing and for public/private cooperation in cyberspace has long been acknowledged, a complete framework for the exchange of information between two parties who are wary of each other has yet to be worked out.

“I have seen too many instances of the government releasing information on cyber threats days, and sometimes weeks, after the threat has been identified,” said Cheri McGuire, vice president of global government affairs and cybersecurity policy at Symantec, who testified on behalf of the Business Software Alliance. “In many of these cases, by the time the government releases the information, it has little use because the private sector has already identified and taken actions to mitigate the threat.”

On the other side, the industry often is reluctant to share with government because of competitive and legal concerns. Some information sharing does occur through DHS’s US-CERT and through industry-specific ISACs, but not on a scale that enables the real-time situational awareness needed to combat increasingly sophisticated threats.

NISO would be “a national clearinghouse for the exchange of cyber threat information so that the owners and operators of networks or systems in the private sector; educational institutions; state, tribal and local governments; entities operating critical infrastructure; and the federal government have access to timely and actionable information in order to protect their networks or systems as effectively as possible.”

It would be a quasi-governmental body governed by a board of directors appointed by the DHS secretary with members from the banking and finance; communications; defense; electricity; oil and gas; health care; and IT sectors, as well as the privacy and civil liberties communities. The board would determine membership requirements, and participation would be voluntary.

It would be member-funded, with no more than 15 percent of its budget coming from government.

NISO would encourage the sharing of classified government data and the declassification of data. Information from industry would be anonymized and protected from disclosure or use in legal actions.