After Target cyberattack, Congress votes to do precisely nothing
Connecting state and local government leaders
In response to the “very real and serious nature of the cyberthreat today,” the latest version of the National Cybersecurity and Critical Infrastructure Protection Act would ensure that nothing changes.
The latest cybersecurity bill to be introduced in Congress took a small step forward last week. After the legislation passed out of a House subcommittee, its co-sponsors released a statement saying that, “the recent Target incident in which 110 million Americans’ personal information was compromised only underscores the very real and serious nature of the cyberthreat today.”
In response to the unprecedented attack, the National Cybersecurity and Critical Infrastructure Protection Act of 2013 (H.R. 3696) does precisely nothing. It is not just that the bill fails to do anything. Its purpose is actually to avoid doing anything and to codify the status quo; a policymaking status that current events have repeatedly shown to be inadequate.
Recognizing that our national security inevitably is bound up with the security of the nation’s privately owned critical infrastructure, the Homeland Security Department has for some years been tasked with providing voluntary technical and operational assistance to the private sector. DHS supports these firms in cooperation with the agencies that have regulatory authority over specific financial sectors, such as financial services and energy.
But DHS never has had authority to go beyond just offering assistance and advice on best practices.
This is the situation that would be formalized under H.R. 3696. The bill, according to House Homeland Security Committee Chairman Rep. Michael McCaul (R-Texas), who introduced it in December, “prohibits new regulatory authority at DHS and is budget neutral.” That is, the department gets no power to do anything and gets no money to do it. Instead, it codifies existing efforts such as the National Cybersecurity and Communications Integration Center, the National Infrastructure Protection Plan and the National Cybersecurity Incident Response Plan.
There is nothing wrong with these programs, as far as they go; which is not far enough. But the nation’s critical infrastructure is increasingly networked and accessible through the Internet, which exposes it to the full range of threats across the globe.
The emergence of complex, multistage exploits that quietly penetrate critical targets by leveraging vulnerabilities several links away from the target mean that it is difficult to be sure any system is effectively isolated. Because of this level of complexity and interconnectivity, it almost is impossible to find a system that might not be rated critical.
Given Congress’ record on passing cybersecurity legislation, the specific provisions of H.R. 3696 probably aren’t important. But it is disappointing to see that so many in Congress still refuse to acknowledge that the nation needs a strong baseline of protections for the systems on which its security and economy depend.
The belief has been that the private sector will set up effective cybersecurity on its own because it is in its interest to do so. But it has been shown over and over that this is not adequate.
Effective security cannot be legislated, and the last thing this nation needs is a technology prescription from politicians. But regulations with teeth that define required outcomes and responsibilities could go a long way toward ensuring that industry does what is needed to protect its own systems – and gets the assistance it needs from government.