Atlantic Council

In the wake of Congress’s inability to pass comprehensive cyber legislation last year, the White House is poised to release an executive order on cybersecurity and critical infrastructure. With this executive order, President Obama has the opportunity to hit the reset button and begin developing an effective national cybersecurity policy. It won’t change much on the ground but it could reenergize efforts to craft needed legal reforms. 

During his candidacy and the first months in office, Obama had unprecedented momentum regarding cybersecurity. He embraced the subject, unlike his predecessors, but that initial promise failed to produce new policy and even the anticipated executive order won’t fill the existing gap.

As the president has acknowledged, cybersecurity threats are pervasive and persistent. Attacks on vital networks threaten the loss of tens of billions of dollars annually, our intellectual property and our global competitiveness. We are under constant assault from hackers, organized criminals and nation states, to the extent that if the same kinds of attacks were occurring in the physical world we would be in a constant state of armed conflict. 

The first step is to make cybersecurity a top-level national security priority; Obama said he would do this by creating the office of the cybersecurity coordinator in the White House. The second and possibly the more important step, which no one has yet been able to accomplish, is to bring all of our collective assets to bear on the problem. 

The Internet and its underlying infrastructure are now integral to almost every aspect our lives. They are fundamental to providing health care, banking services, electricity, clean water and nearly all of life’s essentials. As such, securing these computers and networks must be ingrained in, and coordinated across, society. We can no longer view cybersecurity as a computer problem. It is a societal problem and it must be treated as such. All elements of national power must be coordinated to deal with it: social, military, diplomatic, intelligence, economic, legislative and law enforcement resources must all be used to secure the networks upon which our society is dependent. Falling short in any area is simply not acceptable. 

Since there are so many different elements of national power that must be brought to bear, leadership is crucial. Coordination on this scale can only come from the President. While Congress can and should pass legislation creating an environment where the private sector is encouraged to improve security for the sake of their investment, their customers and the greater good, only the President can ensure that the necessary manifestations of national power -- government agencies, private corporations, local and regional citizen organizations -- are all playing the same game, for the same team. The administration must provide them with the information they need to protect themselves and work with them to identify threats and determine the appropriate response. Ongoing efforts to pass cybersecurity legislation have created some bad blood between would be (should be) partners and, in truth, may actually have set us back. Only presidential leadership and sustained attention to the coordination of national resources, both public and private, will improve the situation.  

President Obama has the opportunity to appoint a proven leader to report directly to him -- not through the National Security Council and the Economic Security Council -- to coordinate all national resources on improving cybersecurity. This leader should speak with the President’s voice and be recognized and trusted within government and by the private sector. 

This trusted leader should initiate development of a national cybersecurity strategy. He or she should clearly articulate the risks to our national interests, critical infrastructure and intellectual property as well as expectations for protecting those assets. He or she needs to clarify the role of the private sector vis-à-vis the public sector: What does the Government expect of the private sector? What does the private sector expect of the Government? These questions can’t be answered without engaging the private sector in an authentic, constructive dialogue. What we don’t need is someone to give speeches and open meetings with private sector participants only to leave for another meeting. 

The White House must put in the effort and bring all the players to the table to craft real, workable solutions. For example, the Administration could determine what constitutes actionable information for owners and operators of critical infrastructure instead of relying on anecdotal evidence of what works and what doesn’t in information sharing. Conclusions drawn from this dialogue should guide the expenditure of public and private resources -- both capital and human -- into the foreseeable future.  

President Obama has the power to oversee meaningful improvements to our cybersecurity posture. He can provide the adult supervision that is badly needed, but only if his administration is willing to exercise real leadership. Finally, Obama and his advisers must remember that compromise is an important element of leadership. Without it, we will be doomed to bemoan our lack of progress even after a major incident shows us just how vital a national security issue cybersecurity is. 

Kevin Gronberg is a visiting fellow at the Atlantic Council. Until recently, he was the former senior counsel to the House Homeland Security Committee. This piece first appeared on Nextgov.