The U.S. Cyber Policy Blitz

Over the past week, the White House has announced two big plans for improving Internet security. One is an international policy that seeks to promote Internet freedom while cracking down on the theft of intellectual property. The other is a domestic legislative proposal whose key features include tightening data-breach notification laws.

In recent years, dozens of cybersecurity bills have been introduced. One would have required the White House to generate detailed reports on the extent of cybercrime emanating from each nation. But the international strategy announced Monday took a broader tack, calling, among other things, for federal agencies, including the State and Defense departments, to work with counterparts abroad to forge partnerships in crime fighting. The plan recommends establishing Internet security standards and imposing some penalties on countries that don’t comply with them.

“This is a milestone in our national effort to ensure secure and reliable networks for Americans, businesses, and government; fundamentally, this proposal strikes a critical balance between maintaining the government’s role and providing industry with the capacity to innovatively tackle threats to national cybersecurity. Just as importantly, it does so while providing a robust framework to protect civil liberties and privacy,” Howard Schmidt, the top White House cybersecurity official, wrote in a blog post. Later, he told Bloomberg News: “We want nation states to be unified behind a vision like this so we can send a clear message to bad actors that there’s going to be no place for them to operate in the international sphere.”

The international plan also highlighted the importance of preventing theft of intellectual property. Two years ago, the White House, citing industry estimates, said the toll of such theft was $1 trillion in 2008. The same plan also calls for greater Internet freedoms worldwide, which is an effort to counteract some recent trends. Only last month, the Russian Federal Security Service announced that services like Gmail and Skype should be banned, though the Russian minister of communications reassured the world that the country does not plan to introduce “tight and total police control over the Internet.”

Last Friday, the White House also announced elements of a domestic legislative proposal. Its centerpiece was a proposed federal law harmonizing how companies must report data breaches that expose personal information.  Right now, this practice is governed by a patchwork of 47 state laws. The Obama administration also said it wants to toughen penalties for cyberattacks, including by expanding racketeering laws so that they would also cover online crime.

Responding to concerns that critical U.S. infrastructure—much of which is privately owned—was vulnerable to cyberattack, the domestic proposal calls for new requirements for financial institutions, power grid operators, and water companies, among others, to develop security plans that would have to be audited for their efficacy. It also would give the Department of Homeland Security a clear mandate to protect government computer networks.

For all their scope, the proposals would stop short in a key way: they wouldn’t enhance the government’s collection of data about cybersecurity, says Stefan Savage, a computer security researcher at the University of California, San Diego. The White House’s efforts would neither require detailed disclosures on the extent of financial losses caused by hacking and cybercrime at home, nor would they generate a detailed nation-by-nation accounting for the sources of cybercrime abroad. Without full data on the sources of the problem and the extent of the actual damage, it’s harder to prioritize the allocation of resources, notes Savage. “Cybersecurity generates lots of hyperbole, but absent data about the real costs, it’s pretty hard to know that the money you’re spending makes sense,” he says.