Private Industry Should Be Required to Protect Itself from Cyberattack

Homeland Defense

Infosec Mandates Are an Option, Says House Cybersecurity Chairman

A top Republican congressman with jurisdiction over cybersecurity says it may be time to require private industry to protect its slice of cyberspace from attack.

While both President Bush and the Clinton administration before him have urged voluntary private-sector cooperation on this issue, Rep. Mac Thornberry (R-Texas), chairman of the House Subcommittee on Cybersecurity, Science, Research and Development, says he’s investigating whether urging CIOs and CISOs to improve security is enough. “You don’t want to be too quick on the draw with new mandates,” says Thornberry. “But you can’t be too hesitant to pull the trigger when there are concerns.” The congressman offered no further detail about his criteria for imposing regulations or what they would be.

Whether he gets the chance to weigh in, however, depends on if he is able to assert any influence amid the handful of other committees, including the House Subcommittee on Technology, Information Policy, Intergovernmental Relations and the Census, that have already staked a claim to the cybersecurity issue. Ari Schwartz, an associate director for the proconsumer Center for Democracy and Technology, thinks it’s unlikely that Thornberry’s subcommittee will blaze new trails in cybersecurity legislation. Ty R. Sagalow, COO for insurance company AIG eBusiness Risk Solutions, says Thornberry could use the committee’s “bully pulpit” to encourage the private sector to improve information security.

In fact, Thornberry’s favored approach is to encourage security best practices without regulation—an approach endorsed by the White House—and to create incentives for private industry to protect the Internet. One such incentive might be tax breaks for companies that focus on cybersecurity.

There aren’t any specific legislative proposals on the table yet, adds Thornberry, who was appointed in March. Among his top priorities is to keep a close eye on the cybersecurity readiness of the Department of Homeland Security, Thornberry says, because other federal agencies will be looking to DHS as a beacon of best practices.

Thornberry, a rancher and lawyer before joining the House in 1995, is a member of the House Armed Services Committee. Though he is new to cybersecurity, his long-range focus on national security issues has prepared him for the subcommittee chairmanship, he says.

-Grant Gross