Soviet‐Style Cybersecurity Regulation
Reading over the cybersecurity legislative package recently introduced in the Senate is like reading a Soviet planning document. One of its fundamental flaws, if passed, would be its centralizing and deadening effect on society's responses to the many and varied problems that are poorly captured by the word "cybersecurity."
But I'm most struck by how, at every turn, this bill strains to release cybersecurity regulators---and their regulated entities---from the bonds of law. The Department of Homeland Security could commandeer private infrastructure into its regulatory regime simply by naming it "covered critical infrastructure." DHS and a panel of courtesan institutes and councils would develop the regulatory regime outside of ordinary administrative processes. And---worst, perhaps---regulated entities would be insulated from ordinary legal liability if they were in compliance with government dictates. Regulatory compliance could start to usurp protection of the public as a corporate priority.
The bill retains privacy-threatening information-sharing language that I critiqued in no uncertain terms last week (Title VII), though the language has changed. (I have yet to analyze what effect those changes have.)
The news for Kremlin Beltway-watchers, of course, is that the Department of Homeland Security has won the upper-hand in the turf battle. (That's the upshot of Title III of the bill.) It's been a clever gambit of Washington's to make the debate which agency should handle cybersecurity, rather than asking what the government's role is and what it can actually contribute. Is it a small consolation that it's a civilian security agency that gets to oversee Internet security for us, and not the military? None-of-the-above would have been the best choice of all.
Ah, but the government has access to secret information that nobody else does, doesn't it? Don't be so sure. Secrecy is a claim to authority that I reject. Many swoon to secrecy, assuming the government has 1) special information that is 2) actually helpful. I interpret secrecy as a failure to put facts into evidence. My assumption is the one consistent with accountable government and constitutional liberty. But we're doing Soviet-style cybersecurity here, so let's proceed.
Title I is the part of the bill that Sovietizes cybersecurity. It brings a welter of government agencies, boards, and institutes together with private-sector owners of government-deemed "critical infrastructure" to do sector-by-sector "cyber risk assessments" and to produce "cybersecurity performance requirements." Companies would be penalized if they failed to certify to the government annually that they have "developed and effectively implemented security measures sufficient to satisfy the risk-based security performance requirements." Twenty-first century paperwork violations. But in exchange, critical infrastructure owners would be insulated from liability (sec. 105(e))---a neat corporatist trade-off.
How poorly tuned these security-by-committee processes are. In just 90 days, the bill requires a "top-level assessment" of "cybersecurity threats, vulnerabilities, risks, and probability of a catastrophic incident across all critical infrastructure sectors" in order to guide the allocation of resources. That's going to produce risk assessment with all the quality of a student term paper written overnight.
Though central planning is not the way to do cybersecurity at all, a serious risk assessment would take at least a year and it would be treated explicitly in the bill as a "final agency action" for purposes of judicial review under the Administrative Procedure Act. The likelihood of court review and reversal is the only thing that might cause this risk assessment to actually use a sound methodology. As it is, watch for it to be a political document that rehashes tired cyberslogans and anecdotes.
The same administrative rigor should be applied to other regulatory actions created by the bill, such as designations of "covered critical infrastructure," for example. Amazingly, the bill requires no administrative law regularity (i.e., notice-and-comment rulemaking, agency methodology and decisions subject to court review) when the government designates private businesses as "covered critical infrastructure" (sec. 103), but if an owner of private infrastructure wants to contest those decisions, it does require administrative niceties (sec. 103(c)). In other words, the government can commandeer private businesses at whim. Getting your business out of the government's maw will require leaden processes.
Hopefully, our courts will recognize that a "final agency action" has occurred at least when the Department of Homeland Security subjects privately owned infrastructure to special regulation, if not when it devises whatever plan or methodology to do so.
The same administrative defects exist in the section establishing "risk-based cybersecurity performance requirements." The bill calls for the DHS and its courtesans to come up with these regulations without reference to administrative process (sec. 104). That's what they are, though: regulations. Calling them "performance requirements" doesn't make a damn bit of difference. When it came time to applying these regulatory requirements to regulated entities (sec. 105), then the DHS would "promulgate regulations."
I can't know what the authors of the bill are trying to achieve by bifurcating the content of the regulations with the application of the regulations to the private sector, but it seems intended to insulate the regulations from administrative procedures. It's like the government saying that the menu is going to be made up outside of law---just the force-feeding is subject to administrative procedure. Hopefully, that won't wash in the courts either.
This matters not only because the rule of law is an important abstraction. Methodical risk analsysis and methodical application of the law will tend to limit what things are deemed "covered critical infrastructure" and what the regulations on that infrastrtucture are. It will limit the number of things that fall within the privacy-threatening information sharing portion of the bill, too.
Outside of regular order, cybersecurity will tend to be flailing, spasmodic, political, and threatening to privacy and liberty. We should not want a system of Soviet-style regulatory dictates for that reason---and because it is unlikley to produce better cybersecurity.
The better systems for discovering and responding to cybersecurity risks are already in place. One is the system of profit and loss that companies enjoy or suffer when they succeed or fail to secure their assets. Another is common law liability, where failure to prevent harms to others produces legal liability and damage awards.
The resistance to regular legal processes in this bill is part and parcel of the stampede to regulate in the name of cybersecurity. It's a move toward centralized regulatory command-and-control over large swaths of the economy through "cybersecurity."
