International Cyber Terrorism

A June 2013 Congressional report found there were over 50 statutes relevant to
cybersecurity compliance. The Federal Information Security Management Act of
2002 (FISMA) is one of the key statutes governing federal cybersecurity regulations.
Federal Government
United States
There are few federal cybersecurity regulations, and the ones that exist focus on
specific industries. The three main cybersecurity regulations are the 1996 Health
Insurance Portability and Accountability Act (HIPAA), the 1999 Gramm-Leach-Bliley Act,
and the 2002 Homeland Security Act, which included the Federal Information Security
Management Act (FISMA). The three regulations mandate that healthcare
organizations, financial institutions and federal agencies should protect their systems
and information. For example, FISMA, which applies to every government agency,
"requires the development and implementation of mandatory policies, principles,
standards, and guidelines on information security." However, the regulations do not
address numerous computer related industries, such as Internet Service
Providers (ISPs) and software companies. Furthermore, the regulations do not specify
what cybersecurity measures must be implemented and require only a "reasonable"
level of security. The vague language of these regulations leaves much room for
interpretation. Bruce Schneier, the founder of Cupertino's Counterpane Internet
Security, argues that companies will not make sufficient investments in cybersecurity
unless government forces them to do so. He also states that successful cyberattacks on
government systems still occur despite government efforts.
It has been suggested that the Data Quality Act already provides the Office of
Management and Budget the statutory authority to implement critical infrastructure
protection regulations by the Administrative Procedure Act rulemaking process. The
idea has not been fully vetted and would require additional legal analysis before
a rulemaking could begin.
State Governments
State governments have attempted to improve cybersecurity by increasing public
visibility of firms with weak security. In 2003, California passed the Notice of Security
Breach Act, which requires that any company that maintains personal information of
California citizens and has a security breach must disclose the details of the event.
Personal information includes name, social security number, driver's license
number, credit card number or financial information. Several other states have followed
California's example and passed similar security breach notification regulations. Such
security breach notification regulations punish firms for their cybersecurity failures while
giving them the freedom to choose how to secure their systems. Also, the regulation
creates an incentive for companies to voluntarily invest in cybersecurity to avoid the
potential loss of reputation and the resulting economic loss that can come from a
successful cyber attack.
Page 82 of 174