Cybersecurity: Making the Code Unbreakable

While this newspaper has certainly been critical of Republican U.S. Rep. Michael McCaul of Austin during his four years in office, we'll give him credit for one thing: He knows the Internet is not "a series of tubes," as now-disgraced Alaska Sen. Ted Stevens famously put it.

Appropriate to Austin's status as a high tech center, McCaul is co-chair and a co-founder of the Congressional High Tech Caucus and the ranking member on the Home­land Security Subcommittee on Emerging Threats, Cybersecurity, and Science and Techno­lo­gy. From that vantage point, he has become concerned that America's security is gravely at risk – and from a threat that "duck and cover" won't suffice.

"If on any given day, foreign nationals pulled moving vans up to the loading docks of government agency buildings, filled them with computers and drove away with sensitive information, Americans would be outraged," McCaul and Democrat Jim Langevin of Rhode Island wrote in a December editorial. (A request for an interview with McCaul went unanswered. During the 2008 campaign, we were told McCaul's staff advised him against talking to the Chronicle.) "The fact is it is happening, but with no trucks and no finger prints. The United States is under attack in cyberspace. Today's hackers are no longer thrill-seeking teenagers; they are organized crime syndicates and national militaries that commit espionage."

In an attempt to sound an alarm, McCaul and Langevin, working with the Center for Strategic & International Studies think tank, co-chaired a commission of 38 cybersecurity experts that last year produced "Securing Cyberspace for the 44th Presidency," a 78-page report of recommendations for the post-Bush administration. McCaul now waits to see if new President Barack Obama – who during the campaign pledged to make cybersecurity a top priority – will act on its recommendations.

The report compares today's struggle to that between Enigma and Ultra in World War II – the former a German military encryption machine, the latter Great Britain's code-cracking program. The cybersecurity war is, the report says, "like Ultra and Enigma, a battle fought mainly in the shadows. It is a battle we are losing." Among the report's major recommendations:

• Create a comprehensive national security strategy for cyberspace, coordinated through a new National Office for Cyberspace.

• Increase regulation of cyberspace security requirements and better authentication of digital identities.

• Update laws pertaining to cyberspace.

• Use government acquisitions to push private-sector security improvements.

• Build on previous federal cybersecurity efforts, rather than starting over from scratch.

The report has another Austin connection: Julie Fergerson, vice president of Emerging Technologies with the Debix corporation, an identity protection firm, provided expert testimony to the commission. Fergerson characterizes the report as a good starting point but far from what is ultimately needed to make America secure from virtual attacks. "I'm continuing to have an enormous concern that these reports [including previous reports under the Bush administration] are too narrowly focused," Fergerson says. "Any system that fundamentally makes the world work – electric companies, water districts, any of those things are connected to the Internet, which are connected to government systems. If any one of those things goes down – imagine no water for a couple of weeks because it's been hacked and attacked. They touch lightly on that – in fact, I think there's a statement in the report that says, 'We recommend that things be protected beyond just ".gov,"' which is what the previous [2003] report basically said, which is that everything government needs to be secured. But if I were looking at how to attack the U.S., I wouldn't be looking at the government systems; I'd be looking at the critical infrastructure systems that make our country work – credit-card processing systems, banking networks for debit transactions, water, electricity."

Ultimately, Fergerson says, the Internet can't be completely secured – the only way to truly make a computer unhackable is to completely disconnect it from the Internet. The real emphasis needs to come with things she says the report doesn't address: "More contingency planning and backup systems need to be in place for these things when they are hacked and you assume they go down." She also says the report's suggestions of a new level of verifying identification online needs to be more fully fleshed out, because currently, traditional government IDs such as Social Security numbers are being used by the private sector in ways that were never intended.

"I'm not in disagreement with any of their recommendations," Fergerson says, "it's just very narrowly focused, and if this is all we're going to do for the next four years, we're at big risk."