Companies that run critical US industries such as power plants will get government incentives to make sure their systems are secure from computer-based attacks, the White House has said, detailing its broad proposal to strengthen US cybersecurity.
The approach is similar to congressional legislation already in the works, but some criticised it on Thursday as being too weak, while the business community said it preferred a voluntary program rather than government mandates.
Under its proposed legislation, the White House said it would give the Department of Homeland Security the authority to work with industries to come up with ways to secure computer systems and protect against cyber threats. If a company should fail to do so, or should come up with an inadequate plan, Homeland Security would be able develop its own security framework for that firm.
The proposal reflects the broad understanding that any more stringent regulatory system, such as the one that controls safety at nuclear power plants, would get little support, and business groups have been lobbying strongly for as much of a voluntary program as possible.
The government should encourage the private sector to adopt security standards voluntarily and "avoid a one-size-fits-all, mandated approach to cybersecurity," said Phil Bond, president of TechAmerica, which represents about 1,200 companies.
Other critics say the White House approach has little teeth.
"The administration's proposal shows no sense of urgency," said Stewart Baker, a former senior Homeland Security official. "It tells even critical industries on which our lives and society depend that they will have years before anyone from government begins to evaluate their security measures."
Under the administration's proposal, an independent group would evaluate the security plans. The DHS could use that evaluation as it makes purchasing decisions, thus potentially rewarding companies who take strong measures to secure their networks from intrusions.
The threat is diverse, ranging from computer hackers going after banking and financial accounts to terrorists or other nations breaching government networks to steal sensitive data or sabotage critical systems like the electricity grid, nuclear plants or Wall Street.
Federal computer networks are being scanned and attacked millions of times a day, and US officials warn that hackers have begun targeting power plants and other critical operations to either bring them down or take them over. A glaring example was the Stuxnet worm that targeted Iran's nuclear program last year, including the infection of laptops at Iran's Bushehr nuclear power plant.