Uncle Sam Wants You to Protect Cyberspace

WASHINGTON--A new national strategy for safeguarding computer networks will call on individuals and businesses, as well as the government--and might improve products as well.

Unlike most government initiatives, the National Strategy to Secure Cyberspace is a working document created by public and private sector groups throughout the country, according to Richard Clarke, special advisor to the president for cyberspace security. Clarke spoke at the Networked Economy Summit hosted by George Mason University in Reston, Virginia, on Monday.

The administration has gathered comments and ideas from town meetings, and is planning more events across the country to craft the document, Clarke said. "We're going to develop a national strategy ... by people all over the country," he said.

Secure Your Own Net

Its first edition will be a road map of what the government, industry, and individuals must do to secure networks. That should be ready by mid-September, and will be continuously updated, Clarke said.

The strategy is twofold. One involves everyone, not just the government, in securing their own portions of cyberspace, Clarke said. The second involves a shift in product priorities.

"Threats to cyberspace can't be handled exclusively by our military or law enforcement," Clarke said. Universities, different sectors of the economy, and owners of critical infrastructures such as electricity grids and water systems must each secure their own networks.

In the second idea, the nation must move away from its current "threat paradigm" to a "vulnerability paradigm," Clarke said. Before last September's terrorist attacks, the country relied on the government to warn of encroaching threats and tell people how to protect themselves. "That kind of dependency on the government to be prescient ... is not going to be successful," he said.

Instead, businesses must assess the vulnerability of their own systems. Individuals play a part too, Clarke said. For example, home PC users should install firewalls if they have broadband connections. Broadband services such as cable modems and digital subscriber line links are particularly susceptible to intrusion because PCs that employ them are constantly connected to the Internet.

Prodding for Action

The government's role in securing networks should not be to regulate or dictate, because agencies move too slowly to keep up with cyberthreats, Clarke said. Instead, the government should "stimulate the marketplace by raising the awareness of people and businesses," he said.

For example, members of the administration have questioned why tech customers buy products that have security flaws, Clarke said. The administration is also asking insurance companies to write cybersecurity policies, and urging the financial industry to share best practices related to security.

"The government's most important role may be as a nudge," he said.

The government is also responsible for promoting and funding training in cybersecurity, and making sure that related research and development overlooked by the private sector gets funded.

Clarke's speech didn't address Bush's announcement last week of plans to create a Department of Homeland Security that would coordinate a number of agencies' antiterrorism efforts. However, an audience member asked if the advisor thinks this department will facilitate information-sharing among government agencies.

The idea that there is tension between government agencies regarding sharing sensitive data is "largely myth," Clarke said, "There has been great cooperation for the last three years in the area of cyberspace." Putting together intelligence officials from organizations such as the CIA and the U.S. Immigration and Naturalization Service under this new department "will help minimize what little (tension) exists," he said.