U.S. cybersecurity — or the lack of it — was big news this week, as President Barack Obama’s recent issuance of cybersecurity-related executive orders coincided with reports that China has systematically made cyberattacks against American interests.
Since 2006, a Chinese military unit within the People’s Liberation Army has been using cyber-espionage to steal “confidential data from at least 141 organizations across multiple industries,” according to a report from Alexandria, Va.-based security firm Mandiant Corp. Mandiant’s findings, first reported in the New York Times, allege the Chinese hackers targeted wide-ranging sectors — many with operations in the United States — including information technology, military contractors, aerospace, chemical plants, telecommunications and scientific research. The Chinese government denies the reports.
The China hacking allegations came shortly after President Obama issued an executive order titled “Improving Critical Infrastructure Cybersecurity.” The cybersecurity executive order stated that “repeated cyber intrusions” requires operators of critical U.S. infrastructure to improve cybersecurity information sharing and the implementation of risk-based standards. Following the Chinese hacking allegations, the Obama administration also announced new efforts to protect against U.S. intellectual property theft.
But is the executive order enough to protect U.S. interests? Part of the reason the order was necessary is due to several failed attempts in recent years to pass a sweeping piece of cybersecurity legislation. Past U.S. cybersecurity bills have been thwarted by privacy groups and those representing businesses — including the very vocal U.S. Chamber of Commerce that argued the bills would put undue costs and regulations on industry.
Both the privacy and bottom line-related arguments could be perilous in the face of the Chinese hacking allegations, as well as other recent high-profile hacks of Apple, Facebook and the New York Times itself. It’s just common sense that hackers are usually seeking trade secrets, business information and personally identifiable information. This is all information that would ultimately degrade online privacy and business interests for those organizations and individuals that are being hacked.
If businesses and privacy groups don’t realize the need for U.S. cybersecurity after recent attacks against the country’s interests, the entire nation will continue to face these threats. As hackers and their targets get more sophisticated, a comprehensive, cooperative approach to the nation’s cybersecurity will be necessary. Of course, privacy and costs will have to be considered when developing the rules. But until at least some cybersecurity rules are outlined, online security for all Americans remains vulnerable.