OSAC Item (Printer Friendly Version)

[an error occurred while processing this directive]

CurzTech News Network

OSAC Item (Printer Friendly Version)
from The Globe and Mail on Friday, January 10, 2003

So far, business has been pretty lucky as it moves into the technological age. As systems develop and hardware matures, the process of getting wired (and wireless) has been a reasonably easy ride. This has been especially true of network security, which has enjoyed an evolutionary growth. Corporations have had reasonable freedom to explore their desires and their vulnerabilities without being stampeded into creating elaborate systems to defend themselves.

Sure, the press has carried many reports of security break-ins and published shocking estimates of the damage done. But the bottom line is that the vast number of businesses survived whatever assaults they have experienced.

This all changed in the aftermath of the terrorist attacks of Sept. 11, 2001. The administration of President George W. Bush, basically rudderless in its first nine months in office, found its voice in those attacks, and that was the voice of fear. By beating the drum of vulnerability, the United States has even attempted to signal to the public how paranoid it should feel, using changing colour codes for the alerts issued by Attorney General John Ashcroft.

So far this hasn't meant very much on the Internet, and especially to business, for which little has changed beyond the effects of a sagging economy. But news leaking out of Washington these days should give Canadian enterprises cause for concern.

They should keep a sharp eye on the Bush administration's nascent cybersecurity policy, a second draft of which has just been circulated in Washington.

The earlier draft, released in September, spooked many corporations with its list of recommendations for private industry, most of which appeared coercive. But reports about the second draft, which has not been published, are contradictory. While an Associated Press story this week stated that the new draft drops most of the provisions for private industry, Tiffany Olson, deputy chief of staff for the President's Critical Infrastructure Protection Board, said that most of the changes since the first draft are to the format of the document. It's impossible to guess what that means, but it does suggest that most of its recommendations for private industry remain largely intact.

Without the text of the document, we are left to judge it by the way Washington is approaching the matter, and that is troubling. This becomes especially important for Canadians, not only because so much of our trade is with the United States, but also because so much of our industry is either owned by U.S. interests or has significant U.S. investment. Whatever Washington recommends for U.S. business will directly affect all Canadian business.

Though security has been largely evolutionary, reflecting the borderless nature of cyberspace, the document and all the people involved in it are nationalizing security, as though it were a purely political matter for the U.S. government and its interests.

The policy is called the National Plan to Secure Cyberspace; given that the United States is the base for so many transnational companies, this means that "national" will ultimately apply to many nations — although not necessarily to their specific security interests. Moreover, as the Associate Press reported, the plan is handing most of the responsibility for the Internet to the Department of Homeland Security, a U.S. government agency with a name intended to reverberate with nationalistic instincts. A yet-to-be-appointed privacy officer will have the responsibility of addressing privacy issues and concerns, such as reading e-mail and shutting down unfriendly on-line presences.

Globalists, continentalists and libertarians may reject Canadian concerns, saying they are just as nationalistic as the U.S. security efforts. That's true up to a point; but it's clear the Bush administration would dearly love to have as much control over cyberspace as it can possibly get: A good sign of this intent was its proposal, which fortunately didn't make the original draft, to license all computer security personnel at both government agencies and private companies. It was dropped only when corporate interests pointed out that it would "deputize" security workers and divide their allegiances between government and their co-workers' privacy concerns.

It's hard to imagine what would happen if such a proposal were ever to be accepted: Canadian IT security personnel working for Canadian branches of U.S. companies having to be licensed by Washington. But note that the proposal was dropped because corporate concerns over this proposal had to do with the division of allegiance, not over allegiance to which government.

Yes, this is an old Canadian lament played on a battered violin. But what makes it particularly relevant today is that U.S. efforts to increase security have to do with cyberspace, which has so far been substantially free of nationalistic hegemony.

The U.S. National Plan to Secure Cyberspace is still very much a work in progress, and so is subject to many changes, and it will contain only recommendations for business, not regulations. But how is the business community to be reassured by a policy with no teeth?

The ultimate purpose, we have to conclude, is that the plan is nothing more than a jingoistic claim on cyberspace.

E-mail Jack Kapica at jkapica@globeandmail.ca

[an error occurred while processing this directive]