NIST MOVE STILL RESISTED AS HOMELAND SECURITY ADVANCES
Senate Governmental Affairs Committee moved forward on homeland security under Presidential veto threat Thurs. while House took up its version (HR-5005) on floor. High-tech community continued to monitor issues of interest, including exception to Freedom of Information Act for voluntary disclosures of cybersecurity breaches and possible move of Computer Security Div. of National Institute of Standards & Technology (NIST) to new Dept. of Homeland Security. Veto threat, issued by White House spokesman Ari Fleischer, was related to Presidential authority on personnel moves unrelated to high-tech.
At our deadline Thurs. Senate bill (S-2452) still contained language to move NIST Computer Security Div. House Internet Caucus Co-Chmn. Goodlatte (R-Va.) and more than 30 other House members had language stripped from House bill and analysts we spoke with said it was 50/50 whether move would survive in bill reaching President Bush. Many in high-tech community fear that moving standards-setting division from its autonomous location under Commerce Dept. to law enforcement agency could be harmful for technology standards- setting. “CDT’s position is that it doesn’t make any sense to move it to Homeland Security,” said John Morris, dir.- Internet Standards, Technology and Policy for Center for Democracy and Technology (CDT). Standards-setting officials need “broader focus, higher level of technology neutrality,” he said. CDT, led by staff counsel Alan Davidson, has been active in resisting govt. efforts to insert law enforcement tools such as back doors in encryption standards.
Rep. Davis (R-Va.) said Thurs. he still favored extending to all govt. agencies “very limited exception” to FOIA for companies that voluntarily submitted cybersecurity breaches or vulnerabilities to federal govt. Davis had authored language that would apply FOIA to all federal agencies; House adopted more limited version of his approach and Senate Governmental Affairs Committee Wed. approved amendment by Sen. Bennett (R-Utah) that was even more limited. Davis made his comments at Security Standards Forum in Washington sponsored by Oracle. Major goal of new cabinet-level security post will be “to facilitate the exchange of information between the private sector, which owns 90% of the infrastructure, with the U.S. government,” he said: “Government is not sure what security technology is out there and the private sector is reluctant to share what it knows.”
If company shares information security technology with govt., others using FOIA will be able to gain information needed to foil it, Davis said. He cited examples of documents found in caves in Afghanistan, gained by terrorists using FOIA. Companies also fear disclosure of technical information to competitors or risk of litigation if disclosure to govt. reveals vulnerability that could have been addressed, he said. Davis said he expected final bill on President’s desk by “mid-late Sept.”
New department’s role in cybersecurity could lead “to a whole new area of federal regulation,” Preston Gates Ellis & Rouvelas Meeds said in report Thurs. It said “standards and benchmarks” would be released later this year for infrastructure protection. “If those standards, or regulations eventually adopted by the new Department, dictate specific technological solutions for cybersecurity, the competitiveness of the cybersecurity market and the number of products it produces could be diminished. The incentive to innovate could decline, harming the level of future cyber security.” Preston Gates also said new department, not FCC or Dept. of Commerce, “is designated the lead homeland security agency for the information and telecommunications sector of the economy.”
It was unclear Thurs. how much progress either House or Senate would make on homeland security before Aug. recess. House is expected to wrap up today (Fri.) or possibly Sat. before going out until after Labor Day. It was just beginning debate on HR-5005 Thurs. afternoon. Senate will be in next week but Senate Majority Leader Daschle (D-S.D.) said he wanted drug legislation passed first. Both houses aim to have legislation to President Bush by Sept. 11.