Commentary Addressing Risks and Opportunities Through the Lifecycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

There has been no shortage of cybersecurity bills introduced in Congress in 2011.&nbsp; The Obama Administration even issued a <a href="http://www.whitehouse.gov/the-press-office/2011/05/12/fact-sheet-cybersecurity-legislative-proposal">cybersecurity legislative proposal</a> in May 2011 that would require the Department of Homeland Security (DHS) &ldquo;to work with industry to identify the core critical-infrastructure operators and to prioritize the most important cyber threats and vulnerabilities for those operators.&rdquo; &nbsp;As we reported <a href="https://www.dataprivacymonitor.com/federal-legislation/senator-reid-seeks-to-break-cybersecurity-legislation-gridlock/">here</a>, Senator Harry Reid (D-Nev.) announced his intention to bring comprehensive cybersecurity legislation to the floor when Congress returns in January of 2012.
The <a href="http://homeland.house.gov/sites/homeland.house.gov/files/Cybersecurity.pdf">PRECISE Act</a> is the newest edition.&nbsp; Two members of the House Homeland Security Committee&mdash;Rep. Dan Lungren (R-CA) and Rep. Peter King (R-NY)&mdash;introduced the Promoting and Enhancing Cybersecurity and Information Sharing Effectiveness Act of 2011 on December 15.&nbsp; A section-by-section summary can be found <a href="http://homeland.house.gov/sites/homeland.house.gov/files/Cybersecurity_Sec_By_Sec.pdf">here</a>.&nbsp; The PRECISE Act would amend the Homeland Security Act of 2002 by tasking DHS with creating market-based incentives to entice &ldquo;critical infrastructure&rdquo; operators to adopt voluntary cybersecurity standards.&nbsp; The term &ldquo;critical infrastructure&rdquo; is broadly defined to include any infrastructure that if destroyed or disabled would result in a significant number of deaths, cause mass evacuations, major disruptions of the economy, or significant disruption to national security.&nbsp; The industries that fall under this category would include utilities, financial services, and telecommunications.&nbsp; The PRECISE Act would also authorize the creation of a National Information Sharing Organization to serve as a central source for sharing cyber threat data (classified as Sensitive Security Information) with government agencies and the operators of critical infrastructure.
There have been news reports regarding the &ldquo;undeclared global cyber war&rdquo; and corporate espionage attacks, including a recent attack against the <a href="http://online.wsj.com/article/SB10001424052970204058404577110541568535300.html">U.S. Chamber of Commerce</a>.&nbsp; However, aside from an erroneous report of a Russian attack on an <a href="http://www.homelandsecuritynewswire.com/dr20111128-dhs-hackers-did-not-cause-illinois-water-pump-to-fail">Illinois water pump</a>, there have been no publicly reported accounts of cyberattacks crippling U.S. infrastructure.&nbsp; Although based on <a href="http://www.wired.com/threatlevel/2011/07/how-digital-detectives-deciphered-stuxnet/all/1">reports</a> about the impact the Stuxnet worm had on Iranian SCADA systems (supervisory control and data acquisition management systems, used in large manufacturing and utility plants), the risk certainly exists.&nbsp; Moving into next year, there appears to be bipartisan consensus regarding the need for a federal cybersecurity law, and some of the similarities between the White House&rsquo;s legislative proposal and the pending bills create the possibility for cybersecurity legislation to be enacted in 2012.&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;

PRECISE Act Introduced in House to Boost Critical Infrastructure Cybersecurity