Select your localized edition:

Close ×

More Ways to Connect

Discover one of our 28 local entrepreneurial communities »

Be the first to know as we launch in new countries and markets around the globe.

Interested in bringing MIT Technology Review to your local market?

MIT Technology ReviewMIT Technology Review - logo


Unsupported browser: Your browser does not meet modern web standards. See how it scores »

{ action.text }

Over the past week, the White House has announced two big plans for improving Internet security. One is an international policy that seeks to promote Internet freedom while cracking down on the theft of intellectual property. The other is a domestic legislative proposal whose key features include tightening data-breach notification laws.

In recent years, dozens of cybersecurity bills have been introduced. One would have required the White House to generate detailed reports on the extent of cybercrime emanating from each nation. But the international strategy announced Monday took a broader tack, calling, among other things, for federal agencies, including the State and Defense departments, to work with counterparts abroad to forge partnerships in crime fighting. The plan recommends establishing Internet security standards and imposing some penalties on countries that don’t comply with them.

“This is a milestone in our national effort to ensure secure and reliable networks for Americans, businesses, and government; fundamentally, this proposal strikes a critical balance between maintaining the government’s role and providing industry with the capacity to innovatively tackle threats to national cybersecurity. Just as importantly, it does so while providing a robust framework to protect civil liberties and privacy,” Howard Schmidt, the top White House cybersecurity official, wrote in a blog post. Later, he told Bloomberg News: “We want nation states to be unified behind a vision like this so we can send a clear message to bad actors that there’s going to be no place for them to operate in the international sphere.”

The international plan also highlighted the importance of preventing theft of intellectual property. Two years ago, the White House, citing industry estimates, said the toll of such theft was $1 trillion in 2008. The same plan also calls for greater Internet freedoms worldwide, which is an effort to counteract some recent trends. Only last month, the Russian Federal Security Service announced that services like Gmail and Skype should be banned, though the Russian minister of communications reassured the world that the country does not plan to introduce “tight and total police control over the Internet.”

Last Friday, the White House also announced elements of a domestic legislative proposal. Its centerpiece was a proposed federal law harmonizing how companies must report data breaches that expose personal information.  Right now, this practice is governed by a patchwork of 47 state laws. The Obama administration also said it wants to toughen penalties for cyberattacks, including by expanding racketeering laws so that they would also cover online crime.

Responding to concerns that critical U.S. infrastructure—much of which is privately owned—was vulnerable to cyberattack, the domestic proposal calls for new requirements for financial institutions, power grid operators, and water companies, among others, to develop security plans that would have to be audited for their efficacy. It also would give the Department of Homeland Security a clear mandate to protect government computer networks.

For all their scope, the proposals would stop short in a key way: they wouldn’t enhance the government’s collection of data about cybersecurity, says Stefan Savage, a computer security researcher at the University of California, San Diego. The White House’s efforts would neither require detailed disclosures on the extent of financial losses caused by hacking and cybercrime at home, nor would they generate a detailed nation-by-nation accounting for the sources of cybercrime abroad. Without full data on the sources of the problem and the extent of the actual damage, it’s harder to prioritize the allocation of resources, notes Savage. “Cybersecurity generates lots of hyperbole, but absent data about the real costs, it’s pretty hard to know that the money you’re spending makes sense,” he says.

2 comments. Share your thoughts »

Credit: Getty Images

Tagged: Computing, security, cybersecurity, Internet Security, White House

Reprints and Permissions | Send feedback to the editor

From the Archives


Introducing MIT Technology Review Insider.

Already a Magazine subscriber?

You're automatically an Insider. It's easy to activate or upgrade your account.

Activate Your Account

Become an Insider

It's the new way to subscribe. Get even more of the tech news, research, and discoveries you crave.

Sign Up

Learn More

Find out why MIT Technology Review Insider is for you and explore your options.

Show Me