Administrations New Cyber Threat Center Replaces Old Cyber Threat CenterMark Jaycox Its not. We already have significant information sharing avenues, which makes the new center redundant. Companies can definitely look forward to more red tape when it comes to sharing computer security threats. And its not just a question of seemingly unnecessary bureaucracy. Were concerned that the whole point of the new center is to be IN the intelligence community, and thus all but eliminate any transparency and accountability. In a press release the Administration lauded the center, formally called the Cyber Threat Intelligence Integration Center, saying: No single government entity is responsible for producing coordinated cyber threat assessments, ensuring that information is shared rapidly among existing cyber centers and other [government] elements, and supporting the work of operators and policymakers with timely intelligence about the latest cyber threats and threat actors The description looks awfully familiar. It should; the Department of Homeland Security (DHS) has an entire department called the National Cybersecurity and Communications Integration Center (NCCIC) that seems to do pretty much everything the Administration thinks needs doing. NICCIC is a bridge between government, private sector, and international network defense communities. Its About page states that the NCCIC analyzes cybersecurity and communications information, shares timely and actionable information, and coordinates response, mitigation and recovery efforts. Digging deeper, NCCIC in turn houses US-CERT (United States Computer Emergency Readiness Team) and ICS-Cert (Industrial Control Systems Cyber Emergency Response Team). Both teams also handle computer security information sharing and threat analysis. Specifically, US-CERT leads efforts to improve the nations cybersecurity posture, coordinate cyber information sharing, and proactively manage cyber risks. The descriptions speak for themselves. Current Public Sharing More confusing is trying to reconcile what this new center will contribute to the current public and private information-sharing regime. In 2012 the President signed EO 13636, which created the Enhanced Cybersecurity System, or ECS. The ECS focuses on sharing computer security information from the government to critical infrastructure and other commercial service providers. At the time, it was hailed as a critical step to improving information sharing and coordinating cyberattacks since the private sector owns about 85% of the Americas critical infrastructure. Two years later, weve heard little about its implementation. The bottom line is that ECS, US-CERT, ICS-CERT, NCCIC, and other departments appear to be tasked with doing exactly what this new Cyber Threat Agency will be doing. And theres morethe DHS programs complement DOD programs like the DIBNET, or Defense Industrial Base Network, where defense contractors share computer security information between themselves and with the government. Current Private Sharing All of this is on top of private-sector hubs known as Information Sharing and Analysis Centers (ISACs). ISACs are often sector specific and facilitate information sharing; theyve been noted as working very well and are supplemented by public reports and private communications, like the recently launched ThreatExchange. Private sharing was further encouraged when the FTC and DOJ stated they would not prosecute companies under antitrust law for sharing computer security information. Combined, these private centers facilitate sharing and are core parts of the already current information-sharing regime. Whats New About the New Center? Given the apparent redundancy of the new center, its hard not to believe that its main reason for being is its location: inside the intelligence community and shrouded in near-impenetrable secrecy. Keep in mind that its long been settled that a civilian agency should lead the countrys computer securityso settled that even former NSA chief General Keith Alexander declared that civilian agencies should take the lead on government computer security. If the government wants more information sharing then it should expand the ECS or utilize the already current information sharing regimes in US-CERT and the private sectoror explain why it cant be done in DHS. And of course, as weve often said, its not at all clear that information sharing is where we should be putting our security dollars and attention. Many of the past years breaches were due to low-hanging fruit like encrypting personal information, making sure passwords arent sent in unencrypted emails, and that employees dont download malware. For instance, the New York Times reported the JP Morgan hack occurred due to an un-updated server. Devils are in the Details The exact details of the center will be released later this week, but as of now the new center seems redundant. If we want to improve computer security and the sharing of threat information we must encourage companies and the government to use the already existing information sharing regimes. Creating another new bureaucracy inside the intelligence community will probably hinder, not help, the computer security landscape. Please visit the Electronic Frontier Foundation, where this first appeared, for the latest news in digital privacy and civil liberties. 