Team Infidel
Forum Spin Doctor
Wall Street Journal
January 28, 2008
Pg. 8
Estimated Cost Could Be $6 Billion; Democrats Are Wary
By Siobhan Gorman
WASHINGTON -- President Bush has promised a frugal budget proposal next month, but one big-ticket item is stirring controversy: an estimated $6 billion to build a secretive system protecting U.S. communication networks from attacks by terrorists, spies and hackers.
Administration officials and lawmakers say that the prospect of cyberterrorists hacking into a nuclear-power plant or paralyzing Wall Street is becoming possible, and that the U.S. isn't prepared. This is "one area where we have significant work to do," Homeland Security Secretary Michael Chertoff said in a recent interview.
The White House's proposal has already dismayed lawmakers concerned about civil-liberties violations. Democratic lawmakers are also frustrated by what they see as the White House's refusal to provide details of the program, and say that could threaten the fate of the initiative.
Protecting private computer systems would likely require the government to install sensors on private, company networks, officials familiar with the initiative said. Amid divisiveness about other government-surveillance programs, having the government monitor Internet traffic, even in the name of national security, will be a hard sell to Congress and the public.
Cybersecurity specialists say the threat ranges from terrorists hacking into nuclear-power control systems, banks or subways, to foreign governments secretly implanting software to siphon off Pentagon secrets from the government and military contractors.
Last week, a Central Intelligence Agency analyst reported that cyberattacks have disrupted power equipment in unspecified regions outside the U.S. In at least one case, he said, the attack knocked out power in multiple cities. The outages were followed with extortion demands.
The U.S. government has been monitoring cyberattacks on U.S. systems under a program with the moniker Byzantine Hades. It has tracked, among other threats, continuing operations from China against U.S. computer systems, according to former intelligence officials. They say the program has discovered what appear to be efforts from China to collect information on specific types of U.S. military programs, such as "quiet drive" technology that helps submarines evade detection. Some U.S. officials believe such espionage is connected to the Chinese government.
Homeland Security counted 37,258 attacks on government and private networks last year, compared with 4,095 in 2005, the first year it started counting standardized data.
The administration's plan is to reduce points of access between the Internet and the government and to use sensors to detect intrusions displaying potentially nefarious patterns, said former top intelligence officials. The program would first be used on government networks and then adapted to private networks. Former officials said the final price tag is approaching an estimated $30 billion over seven years, including a 2009 infusion of around $6 billion, though those numbers could change significantly as the plan develops.
Access to private networks will be a major sticking point because intelligence agencies, including the National Security Agency, are to play prominent roles.
"We need to be very careful," Mr. Chertoff said. "There is a lot of thought being given to: How do you organize this in a way that protects an incredibly valuable asset in the United States but does it in a way that doesn't alarm reasonable people, and I underline reasonable people, in terms of civil liberties?"
House Homeland Security Committee Chairman Bennie G. Thompson, a Mississippi Democrat, wants the administration to put the program on hold until it can answer congressional concerns. "We don't want to unconstitutionally infringe on the rights of private business under the guise of this new program," Mr. Thompson said.
He said he was particularly irked to learn that Mr. Bush had signed a classified directive that outlines how the White House proposes to bolster security of government networks weeks ago but "has refused to share [the directive] with Congress."
White House spokesman Scott Stanzel said the White House is giving "careful consideration" to Mr. Thompson's request for the Jan. 8 directive, which he described as "a continuation of our efforts to secure government networks, protect against constant intrusion attempts, address vulnerabilities and anticipate future threats."
The structure of the initiative has also been under debate. Officials in Director of National Intelligence Mike McConnell's office argued for a centralized approach, according to a former senior government official. But they appear to have lost the fight in favor of a structure that would dole out responsibilities, and slices of the budget, to individual agencies, two former officials said.
The CIA and the Pentagon didn't want other agencies mucking about in their computer networks; other agencies sought to maintain exclusive relationships with certain industries. Some security experts warn a dispersed structure will invite bureaucratic turf wars. Mr. McConnell's office declined repeated requests for an interview.
Current and former officials said the effort could be scaled back to primarily protect government networks. They would then do what is possible to help the private sector improve its security. Mr. McConnell has said 95% of the problem lies with the private sector.
January 28, 2008
Pg. 8
Estimated Cost Could Be $6 Billion; Democrats Are Wary
By Siobhan Gorman
WASHINGTON -- President Bush has promised a frugal budget proposal next month, but one big-ticket item is stirring controversy: an estimated $6 billion to build a secretive system protecting U.S. communication networks from attacks by terrorists, spies and hackers.
Administration officials and lawmakers say that the prospect of cyberterrorists hacking into a nuclear-power plant or paralyzing Wall Street is becoming possible, and that the U.S. isn't prepared. This is "one area where we have significant work to do," Homeland Security Secretary Michael Chertoff said in a recent interview.
The White House's proposal has already dismayed lawmakers concerned about civil-liberties violations. Democratic lawmakers are also frustrated by what they see as the White House's refusal to provide details of the program, and say that could threaten the fate of the initiative.
Protecting private computer systems would likely require the government to install sensors on private, company networks, officials familiar with the initiative said. Amid divisiveness about other government-surveillance programs, having the government monitor Internet traffic, even in the name of national security, will be a hard sell to Congress and the public.
Cybersecurity specialists say the threat ranges from terrorists hacking into nuclear-power control systems, banks or subways, to foreign governments secretly implanting software to siphon off Pentagon secrets from the government and military contractors.
Last week, a Central Intelligence Agency analyst reported that cyberattacks have disrupted power equipment in unspecified regions outside the U.S. In at least one case, he said, the attack knocked out power in multiple cities. The outages were followed with extortion demands.
The U.S. government has been monitoring cyberattacks on U.S. systems under a program with the moniker Byzantine Hades. It has tracked, among other threats, continuing operations from China against U.S. computer systems, according to former intelligence officials. They say the program has discovered what appear to be efforts from China to collect information on specific types of U.S. military programs, such as "quiet drive" technology that helps submarines evade detection. Some U.S. officials believe such espionage is connected to the Chinese government.
Homeland Security counted 37,258 attacks on government and private networks last year, compared with 4,095 in 2005, the first year it started counting standardized data.
The administration's plan is to reduce points of access between the Internet and the government and to use sensors to detect intrusions displaying potentially nefarious patterns, said former top intelligence officials. The program would first be used on government networks and then adapted to private networks. Former officials said the final price tag is approaching an estimated $30 billion over seven years, including a 2009 infusion of around $6 billion, though those numbers could change significantly as the plan develops.
Access to private networks will be a major sticking point because intelligence agencies, including the National Security Agency, are to play prominent roles.
"We need to be very careful," Mr. Chertoff said. "There is a lot of thought being given to: How do you organize this in a way that protects an incredibly valuable asset in the United States but does it in a way that doesn't alarm reasonable people, and I underline reasonable people, in terms of civil liberties?"
House Homeland Security Committee Chairman Bennie G. Thompson, a Mississippi Democrat, wants the administration to put the program on hold until it can answer congressional concerns. "We don't want to unconstitutionally infringe on the rights of private business under the guise of this new program," Mr. Thompson said.
He said he was particularly irked to learn that Mr. Bush had signed a classified directive that outlines how the White House proposes to bolster security of government networks weeks ago but "has refused to share [the directive] with Congress."
White House spokesman Scott Stanzel said the White House is giving "careful consideration" to Mr. Thompson's request for the Jan. 8 directive, which he described as "a continuation of our efforts to secure government networks, protect against constant intrusion attempts, address vulnerabilities and anticipate future threats."
The structure of the initiative has also been under debate. Officials in Director of National Intelligence Mike McConnell's office argued for a centralized approach, according to a former senior government official. But they appear to have lost the fight in favor of a structure that would dole out responsibilities, and slices of the budget, to individual agencies, two former officials said.
The CIA and the Pentagon didn't want other agencies mucking about in their computer networks; other agencies sought to maintain exclusive relationships with certain industries. Some security experts warn a dispersed structure will invite bureaucratic turf wars. Mr. McConnell's office declined repeated requests for an interview.
Current and former officials said the effort could be scaled back to primarily protect government networks. They would then do what is possible to help the private sector improve its security. Mr. McConnell has said 95% of the problem lies with the private sector.