Proposed law gives US authorities sweeping powers over internet infrastructure

Out-Law News | 14 Jun 2010 | 4:19 pm | 2 min. read

A proposed US law would give the US President control over large parts of the internet's infrastructure if the US government decided a situation was an emergency.

The Protecting Cyberspace as a National Asset Act (PCNAA) has been proposed in the US Senate by Joe Lieberman, chairman of the Senate's Homeland Security Committee.

The bill seeks to establish a new government body to oversee the safety of the infrastructure on which the internet relies, the Office of Cyberspace Policy. The Director of Cyberspace Policy and the US President would have sweeping powers under the law.

"The owner or operator of covered critical infrastructure shall immediately comply with any emergency measure or action developed by the Director under this section during the pendency of any declaration by the President," said the proposed law.

It said that 'critical infrastructure' in this bill is the same as in the USA Patriot Act. This defines critical infrastructure as "systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters".

The bill proposes that any President-declared emergency could not last longer than 30 days unless the Director of Cyberspace Policy or the President gave written order that it be extended.

The proposed measure has not been welcomed by the IT industry.

Trade body TechAmerica says that it is the US IT industry's largest lobby group. It said that it welcomed the bill's realisation that the private sector had a security role to play but said that the measure was otherwise dangerous.

"America’s technology companies are concerned about the unintended consequences that would result from the legislation’s regulatory approach," said TechAmerica chief executive Phil Bond. "We are continuing to evaluate the emergency powers in the bill to make sure they provide for coordination with industry at every step and to mitigate the potential for absolute power.”

"While industry recognizes that the Senators intended to focus narrowly on the most critical infrastructure, the fundamental interconnected nature of the systems and networks that make up the information infrastructure makes that virtually impossible," he said. “If the bill passes in its current form, it will turn the Department of Homeland Security (DHS) into a significant regulatory agency. Regulations like these could seriously undermine the very innovation we need to stay ahead of the bad actors and prosper as a nation."

Lieberman said that the law was necessary because of industry and government's total dependence on the internet.

"For all of its ‘user-friendly’ allure, the Internet can also be a dangerous place with electronic pipelines that run directly into everything from our personal bank accounts to key infrastructure to government and industrial secrets," he said. "Our economic security, national security and public safety are now all at risk from new kinds of enemies – cyber-warriors, cyber-spies, cyber-terrorists and cyber-criminals. The need for this legislation is obvious and urgent.”

The bill would require the operators of 'critical infrastructure' to report security breaches to the newly-established Office of Cyberspace Policy so that the US Government could maintain a picture of security threats.

A statement from Lieberman's office said that while the bill created significant new powers for the President it also placed some limits on them.

"The President must notify Congress in advance before exercising these emergency powers," it said. "Any emergency measures imposed must be the least disruptive necessary to respond to the threat and will expire after 30 days unless the President extends them. The bill authorizes no new surveillance authorities and does not authorize the government to 'take over' private networks."