Cyber Watch: Civil Authority

An American Civil Liberties Union official today urged lawmakers to codify civilian control over federal cybersecurity programs, a position that members of both parties on the House Homeland Security Committee seemed to embrace.

"Some are now arguing . . . that military agencies like the National Security Agency (NSA) should be empowered to collect more information about every-day American Internet users in order to respond to online threats," ACLU's Michelle Richardson said in prepared testimony to the committee. "Doing so would create a significant new threat to Americans' privacy, and must be avoided."

Richardson said it was "critical for civil liberties" that any expansion in the government's authority to collect and share cybersecurity information be run by civilian agencies like the Department of Homeland Security.

She told committee members that cybersecurity issues were "overwhelmingly" civilian in nature and are "not a defense issue." She added, "As we look at critical infrastructure, it absolutely has to be under civilian control," largely at the Department of Homeland Security. Any legislation that allows expanded information sharing between the federal government and the private sector must be civilian-run and should minimize the collection of personal data, she said.

Homeland Security Committee Chairman Michael McCaul (R-TX) said Richardson was raising "legitimate concerns" about the need for civilian control. McCaul told reporters after the hearing that NSA had a role to play in monitoring foreign intelligence sources, but he praised the formulation offered by Gen. Keith Alexander, head of U.S. Cyber Command, that DHS was the appropriate "interface" between the government and private sector.

McCaul said he was aiming to mark up legislation this spring that would codify DHS' role in securing critical infrastructure and other cybersecurity programs. That goal enjoys bipartisan support on the committee, but other elements likely to be included in McCaul's bill -- such as liability protection for companies that share cyber-threat information with the government -- are certain to provoke partisan debates.