K.S. Rajan (28
Feb 2012)
"NSA Chief Seeks
Bigger Cybersecurity Role"
"The National Security Agency director and
other intelligence officials have been making the case within
the Obama administration that the NSA should play a bigger role
in protecting computer networks in the U.S., according to
current and former U.S. officials."
From Today's WSJ, FYI,
David
FEBRUARY 26, 2012, 8:33 P.M. ET
NSA Chief Seeks Bigger Cybersecurity Role
By SIOBHAN GORMAN
The National Security Agency director and other intelligence
officials have been making the case within the Obama
administration that the NSA should play a bigger role in
protecting computer networks in the U.S., according to current
and former U.S. officials.
The proposals from Army Gen. Keith Alexander and others would
expand the NSA's authority to allow it to block or pre-empt
cyberattacks targeting entities within the U.S. and to scan for
cyber threats but not monitor the content of communications,
these officials said.
Gen. Alexander and other intelligence officials have raised
these proposals with top military and intelligence officials, as
well as the White House, current and former U.S. officials said.
Gen. Alexander also commands the U.S. Cyber Command.
NSACYBER
Agence France-Presse / Getty Images
NSA director Keith Alexander wants to expand the agency's
authority to block cyberattacks in the U.S.
Who's in Charge?
NSA officials want a bigger role in fighting cyber threats, but
a bill being considered in the Senate would make the Department
of Homeland Security the central agency for domestic
cybersecurity:
Homeland Security would work with private
companies to set new cybersecurity standards and decide which
companies would be required to meet them.
Those companies would have to certify they
were meeting the new standards and report significant cyber
incidents to the government.
Companies that substantially comply with the
standards would receive liability protection.
NSA's role would be limited to providing
intelligence and technical assistance to Homeland Security on
request.
--Source: The Wall Street Journal
The proposals are controversial because they would expand NSA's
power to monitor networks domestically, potentially raising
concerns about protecting civil liberties. The warrantless
surveillance program established by the NSA under President
George W. Bush eventually was put under court supervision. In
addition, pre-empting a cyberattack raises questions about
whether that could be considered an act of war in cyberspace.
The NSA is the U.S. government's primary eavesdropping agency
focused on overseas targets. It can't intercept domestic
communications without a warrant. Established in 1952, the
agency originally was charged with code breaking and code
making. In recent years, its code-making capabilities
increasingly have been sought to bolster cybersecurity. In 2009,
the Secretary of Defense established a unified subcommand, Cyber
Command, to defend U.S. military networks and placed the NSA
director at the helm.
Gen. Alexander is "making the case that to be effective, you
have to do it at network speed—tracking domestically,
monitoring, following malware or a botnet or some kind of
penetration technique," a former U.S. defense official said,
referring to cyber weapons.
"Gen. Alexander has repeatedly stated that our role is to
inform, not make, cyber policy," said NSA spokeswoman Judith
Emmel.
The White House declined to comment on internal discussions. But
Deputy National Security Adviser John Brennan said the
administration is working to promote cybersecurity and protect
privacy. He said the administration seeks to "strike a balance
between addressing the operational requirements of our military,
intelligence and homeland security professionals, while
safeguarding the values of freedom, openness, and innovation."
The debate over these proposals underscores a central dilemma
for the Obama administration and lawmakers: how to balance
security and privacy when a spy agency is their best weapon
against the rapidly evolving threat of cyberattacks.
U.S. national-security officials, meanwhile, have stepped up
warnings about hackers who steal prized intellectual property
and might try to take down the networks running key
infrastructure such as electric, subway and air-traffic-control
systems. The director of the Federal Bureau of Investigation has
said the threat posed by cyberattacks will someday surpass the
threat the U.S. faces from terrorism.
Proposals to expand NSA's domestic role have been debated at
White House policy meetings, U.S. officials said. So far, the
White House hasn't supported these proposals, at least in part
because it would upset civil libertarians, a former U.S. defense
official said.
Most of the leading cybersecurity bills under consideration on
Capitol Hill make the Department of Homeland Security the
primary agency responsible for the threat domestically.
But advocates of a greater role for NSA say it is the only
organization with the capability and monitoring infrastructure
to protect U.S. computer networks, and that NSA's current
support role to Homeland Security won't get the job done.
NSA technology currently used to defend military networks would
allow it to scan large volumes of Internet traffic and block
incoming cyberattacks. Some of that technology grew out of a
program launched years ago, called Tutelage, which detects
incoming cyberattacks and allows NSA to block the threat or
manipulate the attack code, according to people familiar with
the program.
U.S. officials say that NSA isn't seeking a role that would pry
into the daily lives of Americans. "I don't think NSA is trying
to run wild," another U.S. official said. "Privacy and civil
liberties are important. Some of this is putting ideas on the
table to see what the art of the possible is."
Gen. Alexander is seen by many in the administration as the
leading advocate for using NSA's powerful monitoring tools to
identify and block cyberattacks in the U.S., current and former
U.S. officials said.
Even so, these proposals would face long odds on Capitol Hill,
where three years of legislative haggling have produced a series
of proposals that tackle domestic cyberdefense by establishing a
new regime in which the Department of Homeland Security takes
the lead role. Under those proposals, the department would work
with companies running critical infrastructure to bolster their
defenses against cyberattacks.
At a cybersecurity forum last week at George Washington
University, former Director of National Intelligence Michael
McConnell said current U.S. cyberdefenses are weak and the bills
on Capitol Hill are insufficient. "There isn't a corporation in
the nation that can successfully defend itself. Not one," Mr.
McConnell said.
One way to address the problem, he said, would be to have NSA
scan domestic networks for cyberattack code but make it illegal
for NSA to read the content of communications.
Responding to that suggestion, Tommy Ross, a top
national-security aide to the Senate majority leader said that
lawmakers have weighed how to use NSA's capabilities. The
leading cybersecurity bill in the Senate placed Homeland
Security in the central role for domestic cyberdefense but would
let private organizations work with NSA through Homeland
Security on a voluntary basis, he said.
Write to Siobhan Gorman at siobhan.gorman@wsj.com