US public-private link proposed for critical cyber data

Washington/Palo Alto: The US government will share classified information with the private sector operators of "critical infrastructure" under the terms of a proposed cyber-security bill in Congress that has bipartisan support.

The bill was unveiled by two senators amid heightened concern in Washington that the US is ill equipped to deal with the growing threat of cyber-crime and state-sponsored "intrusions" into US government and communications networks.

If passed, the legislation would enhance ties between US intelligence agencies and the private sector. First, it would require the White House to designate certain technology systems as critical if their disruption threatened strategic national interests. If intelligence officials received information about a forthcoming attack targeting a specific company or critical part of the US infrastructure, a top-level private sector official with security clearance would be provided with "enough" information to defend or mitigate the attack, a congressional aide said.

Debates

The threat to critical infrastructure has become a flashpoint in the broadening debate about overall cyber-security issues. More than 85 per cent of infrastructure that is deemed to be critical is owned or operated by the private sector.

Congressional witnesses have testified that the large segments of the US electrical power grid could be rendered inoperable through documented vulnerabilities in equipment that is increasingly connected to outside networks. As with the internet and telecommunications infrastructure, a stumbling block has been the private ownership of potential targets.

Though security experts have for years called for greater "public-private" partnerships to deal with potential cyberthreats, there has been little progress.

Richard Schaeffer, the National Security Agency's man for protecting private assets, indicated on Wednesday that some progress had been made. "I don't think there's anyone who would disagree that critical infrastructure is at risk," Schaeffer said at a Stanford University forum. The US government, especially intelligence agencies, had a responsibility to tell private owners of utilities what the threats were and set expectations for them to respond with increased security. The process to date was not moving fast enough, he suggested.

— Financial Times