recommended reading

DHS Secretary OKs Bill to Monitor Federal Networks

Homeland Security Secretary Jeh Johnson speaks in Washington, Monday, March 16, 2015, during a ceremony to sign a preclearance agreement as part of the Beyond the Border Initiative. (AP Photo/ Evan Vucci)

Homeland Security Secretary Jeh Johnson speaks in Washington, Monday, March 16, 2015, during a ceremony to sign a preclearance agreement as part of the Beyond the Border Initiative. (AP Photo/ Evan Vucci)

An Obama administration top official has endorsed bipartisan legislation that would allow the Department of Homeland Security to surveil public Internet traffic on government networks.

The Senate Homeland Security and Governmental Affairs Committee approved the measure Wednesday, on the heels of devastating agency hacks. It now heads to the full floor for a vote.

"I urge the Senate to move quickly and pass this bill," DHS Secretary Jeh Johnson said in a statement Thursday night. The legislation would tighten security "by ensuring agencies understand they are legally permitted to disclose network traffic to DHS for narrowly tailored purposes."

The Federal Cybersecurity Enhancement Act of 2015 was conceived to stifle intrusions before hackers compromise agency operations or valuable information. The Office of Personnel Management lacked an intrusion detection system, as well as other agency-level real-time controls and login locks, which could have caught attackers before they ran off with 21.5 million people's information. The panel's proposal would mandate all those missing safeguards. 

"This bill will strengthen our cyber defenses by requiring all federal agencies to implement stronger protections and state-of-the-art technologies to defend against cyberattacks," Johnson continued. 

Within a year, DHS would have to roll out the intruder-blocking technology, dubbed EINSTEIN, per the legislation.

The measure "would accelerate deployment of a federal intrusion detection and prevention system across the federal government, increasing our visibility as a government into adversary activity," he said. 

EINSTEIN scans bulk traffic for the tell-tale signs of specific attacks -- sometimes called "signatures" or "indicators." Because it also collects innocuous data, such as personal correspondences and Web-surfing habits, the tool has raised questions about the possibility of government surveillance.

The Senate committee's bill requires multiple privacy protections to address such concerns, including reports on instances where personal information unrelated to a threat is captured.

In April, before the OPM attacks were made public, DHS Cybersecurity and Communications Assistant Secretary Andy Ozment told congressional purse-string holders that agencies have resisted EINSTEIN scans in the past. 

"Some agencies, in some cases, have questioned how deployment of EINSTEIN under DHS authority interplays with their existing statutory restrictions on the use and disclosure of agency data,” he said. “As a result of this uncertainty, DHS has not been able to achieve 100 percent commitment from agencies to enter into authorizing the deployment of EINSTEIN capabilities to protect their systems." 

Johnson said the legislation's civil liberties protections align with the department's existing privacy controls. 

The House already green-lighted similar legislation tucked inside the Cybersecurity Information Sharing Act, CISA, a lightning rod of a bill that would share threat indicators -- including, sometimes, personal data – between government and industry. Senate aides have said the committee's new bill could reach the floor as an add-on to the Senate version of CISA. 

Rep. Mike McCaul, R-Texas, chairman of the homeland security committee, on Wednesday introduced separate legislation, the 2015 Cyber Defense of Federal Networks Act, which also is comparable to the Senate committee's bill.

Threatwatch Alert

Thousands of cyber attacks occur each day

See the latest threats

JOIN THE DISCUSSION

Close [ x ] More from Nextgov
 
 

Thank you for subscribing to newsletters from Nextgov.com.
We think these reports might interest you:

  • It’s Time for the Federal Government to Embrace Wireless and Mobility

    The United States has turned a corner on the adoption of mobile phones, tablets and other smart devices, outpacing traditional desktop and laptop sales by a wide margin. This issue brief discusses the state of wireless and mobility in federal government and outlines why now is the time to embrace these technologies in government.

    Download
  • Featured Content from RSA Conference: Dissed by NIST

    Learn more about the latest draft of the U.S. National Institute of Standards and Technology guidance document on authentication and lifecycle management.

    Download
  • A New Security Architecture for Federal Networks

    Federal government networks are under constant attack, and the number of those attacks is increasing. This issue brief discusses today's threats and a new model for the future.

    Download
  • Going Agile:Revolutionizing Federal Digital Services Delivery

    Here’s one indication that times have changed: Harriet Tubman is going to be the next face of the twenty dollar bill. Another sign of change? The way in which the federal government arrived at that decision.

    Download
  • Software-Defined Networking

    So many demands are being placed on federal information technology networks, which must handle vast amounts of data, accommodate voice and video, and cope with a multitude of highly connected devices while keeping government information secure from cyber threats. This issue brief discusses the state of SDN in the federal government and the path forward.

    Download
  • The New IP: Moving Government Agencies Toward the Network of The Future

    Federal IT managers are looking to modernize legacy network infrastructures that are taxed by growing demands from mobile devices, video, vast amounts of data, and more. This issue brief discusses the federal government network landscape, as well as market, financial force drivers for network modernization.

    Download

When you download a report, your information may be shared with the underwriters of that document.