Will It Take a 'Cyber Pearl Harbor' To Break Congressional Deadlock?

Hugh Pickens writes "For years lawmakers had heard warnings about holes in corporate and government systems that imperil U.S. economic and national security. Now Ward Carroll writes that in the face of what most experts label as a potential 'Cyber Pearl Harbor' threat, Republicans have stalled the Cybersecurity Act of 2012 with a Senate vote of 51–47 against the legislation. This drew a quick response from the staff of Secretary of Defense Leon Panetta: 'The U.S. defense strategy calls for greater investments in cybersecurity measures, and we will continue to explore ways to defend the nation against cyber threats,' says DoD spokesman George Little. 'If the Congress neglects to address this security problem urgently, the consequences could be devastating.' Many Senate Republicans took their cues from the U.S. Chamber of Commerce and businesses that framed the debate not as a matter of national security, but rather as a battle between free enterprise and an overreaching government. They wanted to let companies determine whether it would be more cost effective — absent liability laws around cyber attacks — to invest in the hardware, software, and manpower required to effectively prevent cyber attacks, or to simply weather attacks and fix what breaks afterwards. 'Until someone can argue both the national security and the economic parts of it, you're going to have these dividing forces,' says Melissa Hathaway, a White House cyber official in the Bush and Obama administrations. 'Most likely, big industry is going to win because at the end of the day our economy is still in trouble.'"

Re:Deadlock?

[bill_mcgonigle]

It isn't deadlock every time a bill is voted down

sometimes it's seen to be desirable to have a crisis so that more power can be seized during the emotional response than would be possible at any other time.

This. I teach cybersecurity for DHS

[raymorris]

I'm involved with teaching cybersecurity for DHS. Our network, that we use to develop cybersecurity classes, is about as secure as the "lock" on a bathroom stall. But we sure are in compliance with a lot of regulations! A coworker and I were just discussing the fact that agency "security" regulations prevent us from making things secure. Example "anything hashed must be hashed with MD5". MD5 is broken, so we were going to use SHA-256, but regulations don't allow SHA-256. The other end refuses to use MD5 since it's broken, so we have to send the data in clear. With no"security" regulation it would be SHA-256 hashed. To comply with the "security" rules, we have to send it in the clear, out in the open. Such is government regulation.