From: GCN

By William Jackson

A Republican task force on Oct. 5 released a set of limited, near-term recommendations for cybersecurity legislation that emphasized voluntary standards rather than government regulation.

The recommendations take a piecemeal approach to reforming and upgrading the nation’s cybersecurity framework for the government and private sectors.

“We are generally skeptical of large, comprehensive bills on complex topics, at least as the bills are being written,” the Republican cybersecurity task force said in its report. “We generally are skeptical of direct regulation and of government agencies grading the security of a private company, which is another form of regulation.”

The recommendations said individual, targeted bills should be developed by and go through the appropriate House committees and members said they hope for a bipartisan effort to move needed legislation.

The recommendations contrast with a legislative proposal offered earlier this year by the president primarily in that they focus on “what we can agree on that we can pass this year,” rather than providing a comprehensive overhaul, said Rep. Mac Thornberry (R-Texas), who headed the task force.

“There are areas where we agree,” with the administration proposal, Thornberry said. These include the need to update criminal laws and government regulation such as the Federal Information Security Management Act, and emphasizing voluntary cooperation with the private sector.

“The White House proposal is more regulatory than we believe is wise,” he said. “But there is a lot of room to work together here.”

Initial industry response to the recommendations was positive, particularly proposals to improve information sharing and focus on voluntary standards. Liesyl Franz, vice president for cybersecurity and global public policy for TechAmerica, cited areas of agreement between the administration and GOP proposals, including data breach notification requirements, FISMA reform, liability protection for industry and enabling information sharing between the government and the private sector.

“These four policy areas provide momentum for much-needed legislation that should happen this year,” Franz said. “It is essential that every effort be made by our government to remove any existing barriers to information sharing and to provide industry with the flexibility to adapt and respond with the tools necessary to protect against rapidly evolving cyber threats.”

The 12-member task force was created in June in the wake of President Barack Obama’s legislative proposal, with a mandate to study legislative needs for legal authorities, information sharing, critical infrastructure protection and a domestic legal framework.

The recommendations are not in the form of proposed legislation, but an outline of goals and proposed steps.

One of the key proposals is to improve information sharing and develop an active defense capability by establishing a non-government clearinghouse for information and intelligence. This would work in cooperation with existing organizations such as the industry-specific information sharing and analysis centers, and would be based on the Defense Department’s Defense Industrial Base pilot program for information sharing. Participation would be voluntary, and companies that share information would receive some liability protection from lawsuits.

Liability protection also would be an incentive to for compliance with “targeted and limited regulation.” The proposals would limit additional regulation to those industry sectors already regulated, and oversight for cybersecurity requirements would be done through existing regulatory agencies.

Most of the effort in the private sector would be through voluntary standards, with the National Institute of Standards and Technology as the primary liaison with government. Voluntary compliance would be encouraged through incentives, many of them financial, such as tax breaks and grant funding.

The task force called FISMA “inefficient and unable to result in adequate cybersecurity protections,” and recommended that it be updated to focus on continuous, automated monitoring of systems, a shift that already is under way through revised NIST guidance and requirements from the Office of Management and Budget.

The recommendations also called for updating the Computer Fraud and Abuse Act of 1986 to impose criminal penalties for attacks on critical infrastructure and to criminalize the creation and distribution of malware, and to make the Racketeer Influence and Corrupt Organization law apply specifically to online crime.

Initial response from other lawmakers also has been positive. Rep. Jim Langevin (D-R.I.), a founder of the House cybersecurity caucus, said he welcomed the recommendations as an important step to changing an unacceptable status quo.

“I am pleased to see that the Republican Caucus is getting seriously engaged in advancing cybersecurity legislation,” he said. He pledged to work with Thornberry, but said that some additional regulation is needed. “It is clear that the current market is not achieving the security gains we need to address current vulnerabilities and future threats. This will require government involvement beyond incentives and voluntary minimum standards.”

Independent Sen. Joe Lieberman of Connecticut, chairman of the Homeland Security and Governmental Affairs Committee, called the proposals a positive step.

“We now have broad and bipartisan consensus on the nature of the threat, and on the steps we need to take to address it, both within the government and in the private sector,” he said.  “There is simply no reason we can’t pass bipartisan legislation this year to address this urgent and growing threat.”

Members of the task force said they anticipate that work on cybersecurity legislation will be bipartisan, despite the creation of the Republican task force.

“We recognize that the majority in the House can’t do this alone,” Thornberry said.