The Senate Commerce Committee and Homeland Security and Governmental Affairs Committee held a joint hearing on March 7 to examine the development and implementation of the Executive Order issued by President Barack Obama and explore the need for comprehensive legislation to strengthen our nation’s cybersecurity.
Commerce Committee Chairman Jay Rockefeller said Congress has “wasted a lot of time, by turning an urgent national security issue into a partisan political fight. Back in 2010, we passed a cyber bill out of the Commerce Committee unanimously, without a vote. By the fall of 2012, we couldn’t even get enough votes to close debate on the Senate floor, even though our country’s top national security leaders were urging us to act. The Obama Administration got tired of waiting for us. I can’t blame them. This is a problem that is growing worse every day.”
"While I commend the President for issuing this very important Order,” said Homeland Security and Governmental Affairs Committee Chairman Tom Carper (D-DE), “there was only so much he could do using the authorities granted to him under existing law. Those authorities are simply not enough to get the job done. Now is the time to begin the process of gathering input from the Administration and a broad array of stakeholders in order to ascertain what Congress needs to do to build on the Executive Order that the President has promulgated.”
Department of Homeland Security Secretary Janet Napolitano and Patrick Gallagher of the National Institute of Standards and Technology testified. Sen Napolitano said a "suite" of legislation was needed that would 1) incorporate privacy and civil liberties; 2) create information sharing standards; 3) provide additional tools to fight cybercrime; 4) create a data breach reporting requirement; and 5) give DHS hiring authority equivalent to the National Security Agency.
Gallagher repeatedly emphasized that the voluntary cybersecurity framework created by the president's executive order was just that, and that he wanted industry to come up with that framework. Napolitano said that the government would use carrots rather than sticks for industry, including procurement and contract incentives for adopting standards. Gallagher said the goal is to set standards, and have industry decide how best to do that. Napolitano said that to the extent that this is a national security interest and the government is leaving it to industry, that is a first, and a "grand and bold experiment," rather than a top-down government process as is usually the case with national security. Gallagher suggested an added benefit of having the industry drive the framework is that the government sequester cuts would not have much effect on that process, as opposed to a government top-down process. Asked why there seemed to be a shift in the industry, Napolitano suggested it was because the president involved them in the creation of the executive order itself, and because the administration did not stop work when the Democrat-backed bill failed in the last Congress.