Planned Senate Cybersecurity Bill Would Be Aimed At Protecting Water And Power Systems

By Diane Bartz

WASHINGTON (Reuters) - Leading senators introduced a cybersecurity bill on Tuesday aimed at safeguarding the nation's water and power systems, which experts have warned often only have the most rudimentary protections against hackers.

Senators John Rockefeller and Dianne Feinstein, both Democrats; Susan Collins, a Republican, and Joseph Lieberman, an independent, drafted a comprehensive bill that would require the secretary of homeland security to designate certain infrastructure as critical and compel steps to safeguard against hackers.

"The prospect of mass casualty is what has propelled us to make cybersecurity a top priority for this year, to make it an issue that transcends political parties or ideology," Rockefeller told the Senate on Tuesday morning.

He noted hackers' success in breaking into sensitive government agencies and Fortune 500 companies, and warned that air traffic control, rail switching networks and chemical pipelines could be the next target.

Under the bill, some financial networks, or portions of networks, could be deemed critical if damage to them could result in catastrophic economic damage to the country.

The Department of Homeland Security would have the power to penalize companies that do not put in place appropriate safeguards. However, companies that have good security and are hacked anyway will not be liable for damages.

The legislation would also ease information-sharing between the federal government and the private sector to combat cyber crime and espionage, and would require the government to take steps to secure its own networks.

Last, it would update recruitment of cybersecurity experts into the federal workforce.

Senate Majority Leader Harry Reid last year called for the drafting of a comprehensive cybersecurity bill, and this 207-page bill is the product.

Defense contractors such as Lockheed Martin Corp have been among the high-profile victims of cyberattacks. Others include Google Inc, Citigroup and Nasdaq OMX.

Industry has fought back and succeeded in stopping previous cybersecurity bills, even though experts have warned for years that portions of the U.S. critical infrastructure - particularly water and electrical plants - sometimes have woefully inadequate defenses against hackers.

Industry opposes additional regulations as burdensome and argues it should focus on fighting hackers instead of complying with government rules.

Companies will likely try to weaken the measure in coming weeks and months, said James Lewis, a cybersecurity expert for the Center for Strategic and International Studies.

"The spin is that it's burdensome regulation and will hurt innovation. The counter to that is 'OK, we'll sacrifice national security,'" he said. "It would be really nice to have something (legal) in place but just because we need it doesn't mean we're going to get it."

The House of Representatives is considering legislation that overlaps with the Rockefeller bill on some points.

Republican Representative Mac Thornberry, who oversaw the writing of a report outlining Republican priorities, supports regulation to require better cyber defenses for critical companies.

A key difference would be that the companies' usual regulator, rather than the Department of Homeland Security, would oversee the new regulation.

(Reporting By Diane Bartz; Editing by Steve Orlofsky and Richard Chang)

Comments

[bobnky]

07:45 AM on 02/28/2012

Are we really sure the aim of this bill isn't to just ensconce some more bureaucrats in push, well paid circumstances - while only making the government yet a little larger and more intrusive?

[RecreationalPilot]

07:47 AM on 02/15/2012

Simple:

Keep your back-end systems disconnected from the internet or public networks!

Problem solved! Cost $0.

[skeeterandbucky]

08:45 AM on 02/15/2012

So true. But they won't do this. They love to play the fear card and then wait for the results of multimillion dollar studies. After which they can justify raising prices or taxes. It's so predictable. All talk, no action.

[Jeffersonian72]

05:35 AM on 02/15/2012

Has it completely escaped government's glance that the victims of hacking tend to be...how can I put this gently...d!cks?

The Joker isn't out there hacking...neither is Brainiac or Lex Luthor (although that might be their handles). They're not out to poison the water supply (they drink it too) or destroy the power plant systems (they need power to run their PC's). They're out to make a point, typically. And from my non-hacker viewpoint, it tends to be "If you're a d!ck, we'll hack you".

But then again, our government is kind of...well...d!cks.

[thecornerangel]

02:28 AM on 02/15/2012

Tech companies compete strenuously for government contracts Once they get the contract they're in for good. Look at the Committee members to see who got bought for how much.
The water and power plants should have been protected years ago from cyber attacks. But they are utilities and never spend their own money on anything. They just have to wait until someone in power has enough clout to give the contract to the most generous contractor. These contracts are usually called emergency, and don't even go out for bid.

[aphidavis]

10:14 PM on 02/14/2012

NO MORE LAWS, NO MORE BILLS

ENFORCE the ones we have now and NOT SELECTIVELY.

[dknowles60]

12:25 AM on 02/15/2012

hear! hear!

[aphidavis]

10:18 PM on 02/16/2012

I know, I am asking for too much. Gotta just shut-up and pay my taxes.

[fuzzychickens]

01:36 AM on 02/15/2012

But the entrenched powers see the American people as "cattle" to be controlled. So we will see more bills, laws, and other actions remove what little control we have over those that are supposed to represent us.

[aphidavis]

10:16 PM on 02/16/2012

You are so right. I am practicing my mooing as I type. What would a sheep say?

[hman570]

09:07 PM on 02/14/2012

How much are the politicians going to make off this law?? I am sure they will make a big buck off this!!!

[rikster]

08:20 PM on 02/14/2012

the only thing Senators worry about is where the next check comes from..

[Rick Carufel]

08:20 PM on 02/14/2012

How will new laws improve the security of infrastructure? It won't, what will is upgrading the system with more protected internet connections and to keep major computer systems off the internet. Separate computers can be used for the internet and any data from that computer can be screened for malicious programs before it is introduced into the critical systems. No physical link to the critical systems and the internet, data introduced to critical systems with flash drives. Critical systems on a separate intranet isolated from the internet.
WE DON'T NEED MORE LAWS JUST COMPETENCE.

[rolse]

09:57 PM on 02/14/2012

Good post! Accurate in factual content and sound in thought process. as well as well written. Good luck in securing that last word, though.

[dknowles60]

12:27 AM on 02/15/2012

very well said. why does every thing have to be connected to the inter net.

[FOXYROSE]

07:59 PM on 02/14/2012

It's about time - if something happens to the grid, we will all go back to the dark ages. I hope they don't set up, yet, another big Gov department like Homeland Security - we can't afford it, they need to cut somewhere else like the military industrial complex.

[brandonissloan]

07:50 PM on 02/14/2012

I'll be mad if this doesn't pass.

[ur2nutty4me]

07:34 PM on 02/14/2012

They had ten years to do this and now they are in a hurry. Well my guess is the american people and businesses better not bend over because our rights, freedoms and private information is about to take another major shaf ting. The things they will try before the next election will be staggering. I suggest everyone read the final bill before it is approved

[dknowles60]

12:28 AM on 02/15/2012

well said, the problem is most dems cant read

[mhammer491]

07:17 PM on 02/14/2012

My Prayer: "God, please save us from these well meaning Senators who don't have the sense that You have given to a goose!"

[Rodger leMonde]

07:16 PM on 02/14/2012

Doomed at the start.
The legislation would also ease information-sharing between the federal government and the private sector to combat cyber crime and espionage, and would require the government to take steps to secure its own networks.
We have seen the loyalty of the private sector, sucking our jobs overseas. This is like tearing down the firewall. It is Christmas time for hackers in the bargain.

[bobohaze69]

07:16 PM on 02/14/2012

The Centers for Disease Control and Prevention (CDC, 1999, 2001) has now acknowledged that the mechanism of fluoride's benefits are mainly topical, not systemic. There is no need whatsoever, therefore, to swallow fluoride to protect teeth. The chemicals used to fluoridate water are not pharmaceutical grade. Instead, they largely come from the wet scrubbing systems of the phosphate fertilizer industry. These chemicals (90% of which are sodium fluorosilicate and fluorosilicic acid), are classified hazardous wastes contaminated with various impurities. NO ADDED FLUORIDE TO OUR WATER SUPPLY.

[NamVet 822]

07:14 PM on 02/14/2012

Whether we like it or not the war against terrorism demands cybersecuity as I feel certain the future will see terrorist hackers disrupting these very services. That is the price of connecting almost everything to the Internet.

[backinblack42]

07:38 PM on 02/14/2012

You are right, but the problem is we subcontract alot of our top secret security systems to the Chinese and they are possibly building in back doors to bring the systems down. They are not exactly our friends.

[rolse]

10:04 PM on 02/14/2012

Then don't connect it! Direct connection is not necessary for critical systems. They can be on closed intranet systems inaccessable from any internet terminal or connection. No more laws are needed. We have way too many now!

[dknowles60]

12:30 AM on 02/15/2012

very well said