Bill S.773 – the Cybersecurity Act of 2009 – is on the table in Washington. The Electronic Freedom Foundation is concerned that “the bill would create a major shift of power away from users and companies to the federal government”.
I have taken a pass through the bill myself and, while I agree with the EFF that there is at least a need for clarification and modification of a few points I think it is overall an issue that must be addressed. The cyber risk to physical systems (transportation, power, manufacturing, and automated systems) and to the free flow of commerce and communications is very real. From a governmental standpoint it has been largely left to its own devices to date, and that may not be the best choice.
I suggest reading sections 14, 17 and 18 for all the non-geeks out there.
Purpose:
To ensure the continued free flow of commerce within the United States and with its global trading partners through secure cyber communications, to provide for the continued development and exploitation of the Internet and intranet communications for such purposes, to provide for the development of a cadre of information technology specialists to improve and maintain effective cyber security defenses against disruption, and for other purposes.
[UPDATE] Steven Bellovin has written a decent commentary on the bill.