DHS drafts network protection plan, but Congress dithers
Connecting state and local government leaders
The National Infrastructure Protection Plan being developed by DHS is intended to help define and facilitate a voluntary alliance between government and private infrastructure owners.
The Homeland Security Department is the lead agency in the government’s effort to protect the nation’s privately owned critical infrastructure, but the department still is struggling to define its relationship with entities over which it has little or no authority. This is not all DHS’ fault; Congress and the National Security Agency have hampered DHS efforts and sown distrust of government in industry.
Essential to the job of protecting the privately owned networks and utilities vital to the nation’s security is information sharing. This always has been a touchy subject. Government is unwilling to share what it sees as sensitive information with the private sector without security clearances, and industry is leery of exposing confidential information to government. Reports that the NSA has been helping itself to information from private networks haven’t helped the situation. On top of that, inadequate funding and day-to-day budgeting make it difficult for DHS to develop and execute a coherent program.
Technical guidance for baseline cybersecurity in critical infrastructure networks is being developed by the National Institute of Standards and Technology, but NIST is not a regulatory agency and cannot create the necessary relationship between government and industry.
Congress, in its 2012 DHS appropriation, ordered the department’s National Protection and Programs Directorate to provide a report on efforts to streamline information sharing. But this was not addressed in the department’s annual report to Congress.
“The department has reorganized divisions, altered programmatic activities, and reviewed current and past NPPD Office of Infrastructure Protection outreach efforts to federal, state, and local governments and private-sector partners ... ,” DHS wrote by way of explanation in its reply to a Government Accountability Office assessment of the report.
DHS is in the middle of developing a new National Infrastructure Protection Plan (NIPP) under Presidential Policy Directive 21 on Critical Infrastructure Security and Resilience. This will replace the original NIPP created in 2006 and supply a framework for streamlining the sharing of information between government and industry.
“Additional progress will be made during calendar year 2014,” with the creation of a formal communications program, DHS said.
Let’s hope so. To date there has been too little coordinated effort between industry and DHS. Under the current structure, DHS can only offer its help to privately owned systems. While this help has sometimes been accepted, too often it has been after the fact, when an organization is responding to or recovering from a breach. The president can go only so far in correcting this situation. Executive Office policy can set out goals, but it cannot replace legislation.
There is nothing wrong with voluntary cooperation, as far as it goes. But if the networks supporting the nation’s power systems and other critical infrastructure are to be protected there needs to be a clear legal framework laying out the authorities, responsibilities and liabilities of both government and industry to enable − and require − cooperation and information sharing. This is something Congress has failed to provide.