White House drafting standards to guard U.S. against cyberattack, officials say

The White House has drafted a preliminary executive order aimed at strengthening the nation’s computer systems against attack, an effort to begin to accomplish through fiat what could not be achieved through Congress.

The draft order, whose contours are being debated, would create voluntary standards to guide companies in guarding themselves against cyberattacks, according to administration officials. It would also establish a special council made up of key government agencies to identify threats that could compromise critical sectors.

Gallery

When hackers attack: These six companies have fallen victim to major cyber attacks in recent years.

More from PostPolitics

It's not just Republicans up in arms about Benghazi

Sean Sullivan

THE FIX | More than half of Americans say the Obama administration is trying to cover up the facts of the attack, according to a new Washington Post-ABC News poll.

IRS’s Lois Lerner to plead the Fifth

Aaron Blake

The IRS official who first disclosed the agency's improper targeting of conservative groups will invoke her right not to incriminate herself.

Has anyone been ‘fired’ because of the Benghazi attacks?

Glenn Kessler

FACT CHECKER | Sen. Rand Paul claims no one has been fired because of the Benghazi attacks. So what happened to those State Department officials who lost their jobs?

Coburn: Tornado aid must be offset

Rachel Weiner

Sen. Tom Coburn (R-Okla.) will insist that any federal aid to deal with the tornado in his home state must be offset by budget cuts.

Read more

White House spokeswoman Caitlin Hayden said the administration was not going to discuss details of internal deliberations, “but an Executive Order is among the things we’re considering to fulfill the president’s direction to us to do absolutely everything we can to better protect our nation against today’s cyberthreats.”

Compromise legislation to bolster the nation’s defenses against cyberattacks that could affect electric grids, communications networks and other critical infrastructure failed this summer in the face of strong opposition from the Chamber of Commerce and Republicans who decried even voluntary standards as a regulatory burden on business.

Last month, John O. Brennan, President Obama’s top adviser on homeland security and counterterrorism, said an executive order was a good vehicle to make sure “the nation is protected.”

“If the Congress is not going to act on something like this,” he said, “then the president wants to make sure that we’re doing everything possible.”

The four-page draft order, whose contents were described to The Washington Post by several officials this week, is in the early stages, and completion could take months, officials said.

Under the draft, an interagency Cybersecurity Council would be led by the Department of Homeland Security. It would have representatives from the Commerce, Defense, Treasury, Energy and Justice departments as well as from the Director of National Intelligence’s Office.

The council would take intelligence on cyberthreats and translate it into guidance that would be used to develop security standards. It might also prioritize the industry sectors that need the most attention, though no decision has been made on that issue.

The standards, along with best practices, would be written by the National Institute of Standards and Technology, an arm of the Commerce Department, in collaboration with the private sector. Companies would determine what technologies to use to improve cybersecurity.

The creation of clear standards — especially if there is widespread adoption — may help create a market for cybersecurity insurance, officials said. Before insurance underwriters issue a policy, they would have to ensure that firms had met the standards.

The voluntary approach is not a panacea, said one administration official, who spoke on the condition of anonymity to discuss internal deliberations. “We still think it should be mandated,” he said. But “it’s better than sitting around and waiting for legislation.”