What kind of national cyber-security officer could really make a difference? Do we really want to have an Internet under that kind of thumb?
During his campaign, President Obama promised
that he would "make cyber-security the top priority that it should be
in the 21st century. I'll declare our cyber-infrastructure a strategic
asset, and appoint a national cyber-adviser, who will report directly
About a month ago Obama appointed Melissa Hathaway, who served as
the cyber-security coordinator executive under Mike McConnell, former
President Bush's Director of National Intelligence, to be a senior
director at the National Security Council. She is currently performing a 60-day review of security of federal systems.
She is also a leading candidate to be the "national cyber-adviser" to
which Obama referred in the campaign, assuming he goes through with
such an appointment. Currently she is several steps away from reporting
directly to the president.
Many years after creating a Director of National Intelligence
(the new one is Dennis C. Blair), specifically in order to coordinate
all the various sources of intelligence and make sense of them, it
seems we're not very good at that, according to a report examined by the Wall Street Journal.
"Cultural, organizational and technical obstacles have slowed efforts
to move information across agency boundaries," according to the
article. Expect cyber-security to be a similar problem, and remember
that it is one of those components that needs to be coordinated by the
I actually assume that the DNI really did try to do a better job,
and it seems the report says they did accomplish some things, just that
they have a long way to go. But it's a really hard job, and
coordinating cyber-security for the nation is really hard, too. It
could be that it's a job doomed to failure; could we actually make
Absolutely we could. It's worth asking at the outset what we're
talking about defending; is it just federal government systems, in
which case the czar is really just the federal CSO? This is not only
unobjectionable, it's a pretty good idea. I'm sure most large federal
agencies have a CSO or someone with such responsibilities (correct me
below if I'm wrong) but it's fair to have a coordinator directing a
common security policy above them, one who can also help them to get
their jobs done by providing political weight. This position really
needs to report directly to the president? That I don't understand.
Already we've seen that political decisions are central to how this effort will be made. Just the other day the
most recent person in charge of federal cyber-security, Rod Beckstrom,
head of the U.S. National Cyber Security Center, resigned,
complaining that all the authority was being taken from the Department
of Homeland Security and put in the National Security Agency. That and
the fact that his group was only sparsely funded. Even if this is just
a job about federal systems, should it be run out of the NSA?
And if we're talking about someone who's in charge of security for
the whole of U.S. Internet infrastructure, the idea is pretentious and
dangerous. Today an appointed czar would have no real authority over
badly administered Web servers, ISPs that have insufficient controls,
networks with no DNSSec or IPv6 support. And there is no U.S. border to
defend on the Internet; many significant U.S. Internet assets are tied
closely with assets owned by the same organizations abroad.
If the government is supposed to have real authority in this regard
it would take new and highly intrusive legislation to do so, and none
of us would take it sitting down. If they won't have the authority,
then nothing has really changed, which is maybe the best way to go
What would you do if you really wanted to shape up the nation's
networks? You'd need someone in charge with real authority, like a real
CTO or network admin at a real enterprise. Imagine it: someone with the
authority to quarantine infected systems; the authority to disconnect
networks that are poorly, perhaps even maliciously, managed; the
authority to ban old and insecure products and, conversely the
authority to mandate new and secure ones, like DNSSec and IPv6; the
authority to tell people "no, you can't do that with your own computer."
There is no way we would ever put up with authority like that on the
Internet. There's no way service providers would put up with it either.
Security Center Editor Larry Seltzer has worked in and written about the computer industry since 1983.For insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzer's blog Cheap Hack.
Larry Seltzer has been writing software for and English about computers ever since,much to his own amazement,he graduated from the University of Pennsylvania in 1983.
He was one of the authors of NPL and NPL-R, fourth-generation languages for microcomputers by the now-defunct DeskTop Software Corporation. (Larry is sad to find absolutely no hits on any of these +products on Google.) His work at Desktop Software included programming the UCSD p-System, a virtual machine-based operating system with portable binaries that pre-dated Java by more than 10 years.
For several years, he wrote corporate software for Mathematica Policy Research (they're still in business!) and Chase Econometrics (not so lucky) before being forcibly thrown into the consulting market. He bummed around the Philadelphia consulting and contract-programming scenes for a year or two before taking a job at NSTL (National Software Testing Labs) developing product tests and managing contract testing for the computer industry, governments and publication.
In 1991 Larry moved to Massachusetts to become Technical Director of PC Week Labs (now eWeek Labs). He moved within Ziff Davis to New York in 1994 to run testing at Windows Sources. In 1995, he became Technical Director for Internet product testing at PC Magazine and stayed there till 1998.
Since then, he has been writing for numerous other publications, including Fortune Small Business, Windows 2000 Magazine (now Windows and .NET Magazine), ZDNet and Sam Whitmore's Media Survey.