The dangers of delaying heightened cybersecurity

Since Congress has not been able to find common ground on cybersecurity legislation, I appreciate the president’s stated intention to fortify the security of critical cybersystems through his executive powers. We know our adversaries are already stealing valuable intellectual property and exploiting our critical infrastructure to prepare for attack. Under the Homeland Security Act of 2002, the Department of Homeland Security has clear authority to conduct risk assessments of critical infrastructure, identify the systems or assets that are most vulnerable to cyberattack, and issue voluntary standards for them to maintain adequate cybersecurity.

Executive action is not the best way to protect the United States from cyberattacks. Without congressional action, the president cannot offer liability protections to industry to reward compliance with voluntary security guidelines. Nor can he require industry to report major cyber-intrusions. But the president can encourage owners of critical infrastructure to improve their cybersecurity by identifying systems and assets that pose the greatest risk and recommending measures necessary to protect them.

Our nation’s security interests should not be at the mercy of congressional inaction. An array of current and former homeland security secretaries, National Security Agency chiefs, CIA directors, national intelligence directors, Joint Chiefs of Staff and others who know the extent to which our most critical cybersystems have been infiltrated have called on Congress to act. We fail to listen at our peril.

In a letter to the Senate majority and minority leaders this summer, former homeland security and defense officials Michael Chertoff, Michael McConnell, Paul Wolfo­witz, Michael Hayden, Gen. James Cartwright and William J. Lynnwrote: “We carry the burden of knowing that 9/11 might have been averted with the intelligence that existed at the time. We do not want to be in the same position again when ‘cyber 9/11’ hits — it is not a question of whether this will happen; it is a question of when.”

We must act before another catastrophe occurs.

Read more from Opinions:

The Post’s View: Defenseless against cyberattacks

The Post’s View: What is America’s cyberwar policy?

Noah Shachtman: A crime wave in cyberspace