House Overwhelmingly Passes Cybersecurity Bill

eldavojohn writes "The Caucus, a NY Times Blog, is reporting on the overwhelming majority vote (422 yeas) the House gave a new cybersecurity bill. The Cybersecurity Enhancement Act, H.R. 4061 has a number of interesting provisions. Representative Michael Arcuri, a Democrat of New York who sponsored the bill called cybersecurity the 'Manhattan Project of our generation' and estimated the US needs 500 to 1,000 more 'cyber warriors' every year in order to keep up with potential enemies. The new bill 'authorizes one single entity, the director of the National Institute of Standards and Technology, to represent the government in negotiations over international standards and orders the White House office of technology to convene a cybersecurity university-industry task force to guide the direction of future research.'"

What the heck is a Cyber Warrior?

[Qualin74]

Can someone tell me WTF a "Cyber-Warrior" is? Seriously. Like, what is it.. A bunch of script-kiddies running 1337 ha0r tools? Or someone who just knows how to pingflood? If they really want to be concerned about "Cyber Security", why don't they nuke all the computers running Bot nets? Why don't they go after the jerkoffs running the C&C servers? Why don't they set up Honeypots acting as spam traps and go after all those spammers clogging up the pipes? Why don't they go after the RBN equivalents out there? Nobody would dare to sue a military unit, would they? Am I missing something here?

Re:So now suddenly it's OK again?

[GovCheese]

The federal government hasn't done a particularly good job advertising their Scholarship for Service Federal Cyber Service program where promising cyber students are given scholarships in return for a promise to give the government 2 years of service as federal employees in a cyber security related position. Few in the IT field even know it exists. But it's an exceptional idea and most government agencies are lobbying for expanding it to bring in even more students. The federal government isn't entirely incompetent or bereft of good ideas or lacking the will to implement them. The SFS Cyber Service program is one of their success stories.

Re:I wonder

[Anonymous Coward]

You don't have to wonder. It has nothing to do with ACTA. Really. Read the bill. It's S&T driven: research, education, and having somebody there when standards setting bodies meet.

You're dreaming if you think that State Dept. listens to NIST. Or that this bill would pass the House without going before Foreign relations committee if it had that kind of reach.

Re:So now suddenly it's OK again?

[Anonymous Coward]

It gets better:

H.Amdt. 545:
An amendment numbered 1 printed in House Report 111-410 to address the lack of minority representation in the cybersecurity industry including women and African-Americans, Hispanics, and Native Americans. The amendment adds language in Sec. 107 to describe how successful programs are engaging said minorities and in Sec. 108 to include minority-serving institutions on the Cybersecurity University-Industry Task Force.

Yay, more quotas.

H.Amdt. 548:
An amendment numbered 4 printed in House Report 111-410 to require the National Science Foundation to study ways to improve detection, investigation, and prosecution of cyber crimes including piracy of intellectual property, crimes against children, and organized crime.

Won't someone think of the children? And "This bill brought to you by the MPAA/RIAA".

Re:I wonder

[Tekfactory]

NIST isn't a new entity, they are the US Government's standards body, they are part of the Dept of Commerce, and write all kinds of standards the government has to use.

So when the government directs their standards body to take part in standards negotiations on their behalf, there is no conspiracy there.

Take a look at some of what NIST does

http://www.nist.gov/index.html [nist.gov]
http://www.nist.gov/public_affairs/orgchart.htm [nist.gov]

Also note that like IEEE all of their Technology Special Publications go through public comment periods.

http://csrc.nist.gov/publications/PubsSPs.html [nist.gov]

One of my favorites is SCAP, its like an XML for Security products that helps to standardize vulnerability reports and security settings so you can check using an array of SCAP compatible tools if your thousands of machines are all patched and up to date as well as running your enterprise security config.

http://scap.nist.gov/ [nist.gov]

I'd be concerned if some new bill made someone ELSE without some of the worlds best test labs, scientists and engineers negotiate standards for the US.

Re:I wonder

[Vairon]

They are not a loophole. The supreme court has ruled that treaties do not supersede the constitution.

http://www.npr.org/templates/story/story.php?storyId=89100044 [npr.org]
http://www.sweetliberty.org/issues/staterights/treaties.htm [sweetliberty.org]
http://en.wikipedia.org/wiki/Treaty_Clause [wikipedia.org]
http://caselaw.lp.findlaw.com/scripts/getcase.pl?navby=CASE&court=US&vol=354&page=1 [findlaw.com]

Re:I wonder

[FatherDale]

The State Dept DOES listen to NIST, and was the first federal agency to adopt the NIST SP800 series as the primary guidance for information security issues. State also made up 100% of the panel that built the CAP certification, and built it mainly on SP 800-37.