SAN FRANCISCO — UPDATED:Richard Clarke, the former White House cyber security czar, urged the technology industry to adopt regulations or even benchmarks to improve security in their products — or face getting walloped with new regulations from Congress.
Clarke’s comments came today during a panel discussion here at the RSA Security Conference called “To Regulate or Not to Regulate: That is the Question.” The panel sought to “debate the issue of software liability against poorly built software and security products.” It also comes at a time when statistics are exploding with new vectors for virus attacks via botnets, spyware and phishing attacks meant to steal personal data.
“Regulation depends on the industry,” said Clarke, who is now the chairman of Good Harbor Consulting. “After we have a major incident, there will be much worse regulation than you could get now.”
Clarke, perhaps best known as the cyber security czar in the Clinton and (the first) George Bush administrations — and who later resigned from the current Bush administration — admitted that he too was opposed to some regulation efforts during his time in government.
But the patchwork of regulations we now have, such as the Gramm-Leach-Bliley Act of 1999 in the financial services industry, and HIPPA (Health Insurance Portability and Accountability Act of 1996), overlaps and even confuses how the information industry builds its software and products to help companies comply. Some basic benchmarks on security in the software industry itself would help diffuse the confusion, he added. “There are some things we might want to regulate. I think cyber security has a problem.”
“Many think this year will be a watershed year in privacy and regulation in Congress,” said Scott Schnell, an RSA Security official who also moderated the panel discussion. “Others say if we simply held software companies accountable for fraud, we wouldn’t have these problems.”
Technology companies already hold themselves accountable, such as with Service Level Agreements, countered Harris Miller, president of the Information Technology Association of America, an industry trade association. “If you start regulating security, you will stifle innovation. You’ll end up with a “lawyer-driven world” in which you get sued for every flaw in a software product.
Rick White, the president and CEO of TechNet, an industry trade group made up of CEOs, said there may be some areas where the industry can improve security without any oversight from the government. “But I think you have to be careful” about too much regulation, he added. “The government isn’t well suited to handle that.”
Panelists cited the example of seat belts in the auto industry: they only arrived after they were mandated — but also after the U.S. auto industry saw that Japanese makers were selling more cars with seatbelts included.
The mix of market and regulation efforts eventually forced the automakers to add more security features, they said. Why not use a similar approach in the information technology industry — especially the software industry?
Bruce Schneier, founder and CTO of Counterpane Internet Security, argued capitalism has its own ways of forcing the same effects as regulation.
“I tend to like regulation that says ‘here are the results.’ I prefer regulation that just assigns responsibility,” he said. “I don’t care how they solve the problem. I want to make it in their best financial interest to do so.”
Although he agreed with the argument that regulation would stifle innovation, Schneier also said the problem in the industry is that the people who write the software don’t bear the losses for their mistakes. “That fundamental disconnect has to be rectified.”
Market forces are one way to force this, added Schneier, the author of best-selling books on security such as Applied Cryptography. The growth of “Linux has done more for Microsoft’s security then anything out there,” he asserted.
He also cited the example of ChoicePoint, the Georgia-based credit-check company that recently disclosedto about 35,000 California residents that their information may have been accessed by criminals posing as legitimate companies in order to gain access to information about consumers. “If those [35,000] residents can sue ChoicePoint, then the company has more than just a PR problem,” he added. “You need a mix of liabilities that work. If a CEO believes without a shadow of a doubt that he’s going to hell if he doesn’t ship secure products, he has an incentive.”
“Public humiliation would help,” quipped Clarke. “We do have to do something about the quality of software in the industry.”
Updates to include statement from ChoicePoint
