The Cybersecurity Enhancement Act is aimed to address IT security challenges in the years to come by creating programs to develop new ways to secure the nation's digital assets and provide a skilled IT security workforce. Hello, I'm Eric Chabro of Information Security Media Group, and I'm pleased to welcome my home state Senator Robert Menendez on New Jersey. Senator Menendez is the Senate's sponsor of the Cybersecurity Enhancement Act, recently introduced in both houses. Thanks, Senator, for taking time to chat.
Good to be with you, Eric. Before we get to the Cybersecurity Enhancement Act, first I'd like to ask you what your thoughts were when you heard last week that the Senate computers were hacked. Well, this is one of a series of challenges and attacks that have made it more pressing than at any other time to make sure that cybersecurity is being pursued rigorously and seriously, and that we treat this as any other national security risk, and certainly when the Senate computers are subject to that with all of its information, that flows not only in terms of constituency, but critical information that flows back and forth between the executive branch and the legislative branch, you know, just makes the case why we need to be vigorous in our enforcement. I would say that the Cybersecurity Enhancement Act and simply the bill calls for enhancing government IT security standards, fostering cyber security research and development, and creating scholarship programs to get more students to study IT security.
It also calls for the administration to conduct an assessment of the government's cyber security workforce needs. The Congressional Budget Office says you have to calculate the cost of this measure, but a similar bill that passed the House last year carried a price tag of about a billion dollars. At the time the government has reached its debt limit and huge spending cuts are being sought, how can the nation afford this bill? Well, I would simply answer how can the nation afford not to have what we are trying to accomplish under the Cybersecurity Enhancement Act.
When I look at financial institutions like Citibank, when I look at the World Bank, when I look at efforts against the Pentagon, when I think about any of those efforts of cyber hacking were to be fully realized, the potential risks when I think about our electric grid, when I think about refineries on the grid, I say to myself, just have them be successful once, and we will be howling about why the government did not prepare itself for such an eventuality, and then we will be dealing with the consequences far beyond the cost that is pertinent to trying to have a skilled federal workforce, making sure that we have the research and development that is necessary to provide for the ability to fight off any hacking opportunities, and also improving the transfer of cybersecurity technology to the marketplace, which means that we are going to both save money in the marketplace and ensure that we can commercialize this ability to protect ourselves from cyber attacks in a way that is incredibly important to the nation's economy. Whether it is your bill or other bills that are before Congress, it is going to take a lot of money to secure IT, not only in the government, but in the nation too. Should cyber security be seen differently than other type of spending? Should we see more like the way the government treats the defense where cuts are hard to do?
Well, look, I don't think anything today, even defense, we are looking at the significant reductions in defense that even Secretary Gates calls for based upon our new threats today versus the defense department that we have created over the years in terms of past defense of states. We are more against fighting stateless terrorists, and that is also the challenge for us in many respects in cyber security. The question is how do we do this in a way that both is cost efficient, and at the same time deals with the proactive view of how do we have the prevention that would avoid us spending a lot more in the long term. When I look at what our bill does and what other bills do, in my mind, we are focused on maximizing the potential with the least possible costs.
What do I say? Why do I say that? Because part of what we do is encourage coordination and prioritization of federal cyber security research and development, we improve the transfer of cyber security technologies to the marketplace, and we promote cyber security education and awareness for the public. Now, not all of that necessarily means money on the contrary.
When we create coordination and prioritization of R&D, when we improve the transfer of cyber security technologies to the marketplace, I think we can realize savings. Also, looking at the three main federal drivers, the National Science Foundation, the Department of Defense, and the Department of Homeland Security, to cooperate in developing a research and development plan that is anticipatory instead of reactive. I think that's also very important as well, as well as coordinating these agencies' actions so that we don't have duplication and waste. In those respects, we are actually pursuing both our national interests in terms of our cyber security, as well as doing it in a responsible way.
The bill that you're sponsoring very soon ago passed the House last year did not pass the Senate. In fact, the Senate has not passed any really significant cyber security legislation in several years. Is this Congress going to be any different? I think so.
Of course, this legislation passed the House 422-5, and that's about most of the most robust bipartisan vote you can ever get on any issue these days, especially business in general. When I see the efforts underway in the Senate, different than us, but nonetheless, Senators Lieberman, Collins, Rockefeller, and Sloan, Snow, that is a good bipartisan effort. When I see that Senator Reid, the majority leader, has made cyber security a priority, I believe that we have going to have a process that brings these legislations to the floor, and I will push for inclusion of these provisions in whatever moving legislation exists, and I think that those are likely to be done. I certainly hope in this session this year.
Any odds of that? I don't go through odds because I've seen so much happen that the unexpected comes along to have an earthquake or tsunami in Japan. You have Gaddafi bombing civilians, and all of a sudden that takes over the center stage of the nation of the Congress's attention, so I wouldn't give it off, but I think that considering the Homeland Security Committee, the Commerce Committee, with Senator Rockefeller, which are the two main committees of jurisdiction, are moving forward with legislation and the majority leader's own views, that, in fact, this is something that is of a national priority at all goals well for moving this year. Could you be recording into their bills?
Yes, it could be. That's likely right. It probably doesn't get enacted. My success, I'm using a moving vehicle, sole committee process, and whatnot, I think that our efforts, that pass overwhelmingly in the House, will be complimentary to any of the other efforts that will come to the floor for those who commit.
You're a member of the banking committee, and you've asked the Office of the Comptroller of the Currency to investigate the recent breach at C-Corp, pointing out that the bank failed to notify immediately hundreds of thousands of customers whose accounts were exposed. How tough should the government get to make sure banks or any businesses do a better job, not only protecting their customers' accounts and personal information, but to notify them when it retookers? I would hope that the financial institutions on their own initiative would both be protecting against cyber attacks, and certainly notifying their customers about breaches that take place that include financial and personal information, in this case of several hundred thousand bank hardholders. If public reports are true, that city group waited weeks before notifying customers of their breach, then that is unacceptable.
It seems to me that adding minimum regulators should insist that financial institutions in short order notify their customers of any breach so that they can take appropriate actions in protecting their own identity information that may very well create a risk to them. I am dismayed that it does not seem from not only this incident, but others at various times, for some reason, these institutions are reluctant to tell their customers in a timely fashion. I think that has to end. I'd love to see it as an industry initiative, but in the absence of that, we will push the regulators to make sure that there is a timely notification.
And also, what do the regulators know and when do they know it? Because obviously they should be very much aware of what is happening as well, and so those are all the types of questions we've asked the officer to control the currency. Is this something where you feel the regulators have the authority to make sure that this breach notification as well as other IT security standards are implemented by banks? I believe they do, but one of the questions that we pose is if you do not feel that you have the regulatory authority to both be notified in a timely basis and or to be made aware of the efforts of the standards in the industry as it relates to cybersecurity, then let us know because we may very well consider giving you that power if you believe you don't have it.
But I will wait to see what the regulators say. Thank you, Senator. All right. Thank you.
I've been speaking to Senator Robert Mendezam, New Jersey. Honor at Chabral of Information Security Media Group. Thanks for listening.