Information security goes mainstream

New cybersecurity proposal

A legislative proposal announced by the White House in mid-January is designed to increase cybersecurity by promoting information sharing, ?strengthening law enforcement for cybercrime and requiring that data breaches be reported promptly.

Companies have been concerned about information sharing because of the risk of liability for violating individuals’ privacy. The bill addresses that issue by requiring compliance with privacy guidelines, including removal of unnecessary personal information. In addition, the Department of Homeland Security (DHS) would be required to develop guidelines for the federal government regarding the receipt, retention, use and disclosure of shared information.

Information originating in the private sector would be shared with the National Cybersecurity and Communications Integration Center (NCCIC) of the Department of Homeland Security. The NCCIC would then promptly pass the information to relevant federal agencies and information sharing and analysis organizations (ISAOs), organizations that are owned and operated by the private sector.

Law enforcement provisions would allow the courts to shut down botnets that are being used for distributed denial of service (DDOS) attacks and for the prosecution of their sale. The Racketeer Influenced and Corrupt Organizations Act (RICO) would be extended to apply to cybercrimes. The legislation would also clarify the provisions of the Computer Fraud and Abuse Act with respect to the access of information.

Finally, the legislation would simplify and standardize the requirements for reporting data breaches. Currently, the laws exist at the state level, but not all states have them, and those that exist are not consistent.

Similar legislation was proposed in 2011 but not passed by Congress, and an executive order was announced in 2013 that addressed some of the issues. Given the recent breaches, the ongoing concerns about cybersecurity and the support for the legislation by major industry groups such as the Financial Services Roundtable (FSR), its chances of passage may have improved.