U.S. Cybersecurity's Path from Legislative Debate to Executive Action

That some action is needed in the realm of cybersecurity is the one thing beyond debate. Over the last year, supporters of various versions of legislation have emphasized that the nation's critical infrastructure ' including electrical grids, water stations and telecommunications systems ' is a target for cyber-attacks. Indeed, in July, the head of the National Security Agency and the U.S. Cyber Command (www.defense.gov/home/features/2010/0410_cybersec) said that computer attacks on U.S. infrastructure had increased 17-fold between 2009 and 2011, and expressed the view that, on a scale of 1-10, U.S. preparedness for a large cyber-attack is around a three.

What action should be taken to address this threat, however, sparked sharp partisan disagreement. In the Senate, for example, supporters of the bill backed by the Obama Administration were unable to mollify its opponents' concerns: that the provision incentivizing companies to adopt voluntary cybersecurity standards was simply a guise for developing de facto mandatory standards; that the authority to aggregate cyber-attack information had been delegated to the wrong agency; and that the bill's provisions did not strike the right balance between national security, private innovation and self-governance, and civil liberties.