Cybersecurity Policy Report, Senate Report: Chamber of Commerce Out of Step with U.S Firms on Cyber Bill, (Feb 4, 2013)
The opposition of the U.S. Chamber of Commerce to legislation that would empower federal officials to oversee cybersecurity upgrades to critical infrastructure is not shared by many of the country's largest companies, according to a report issued this week by the office of Sen. John D. (Jay) Rockefeller IV (D., W.Va.).
"The Chamber of Commerce's vehement opposition to the legislation was not shared by many companies in the private sector," Sen. Rockefeller's office said in a Jan. 28 memo that summarized the results of a survey the lawmaker conducted last year.
Sen. Rockefeller, the chairman of the Commerce, Science, and Transportation Committee, had sent letters to the chief executives of the 500 largest U.S. companies to solicit their input on cybersecurity legislation (CPR, Sept. 24, 2012).
At the time, Sen. Rockefeller indicated he wanted to bypass "the filter of beltway lobbyists." He singled out the chamber for its intense lobbying against the Cybersecurity Act of 2012, which would have empowered the Department of Homeland Security to audit cybersecurity at critical infrastructure entities and supervise any needed upgrades.
Around 300 companies responded to Sen. Rockefeller's letter, according to the memo from his staff. "Very few companies stated in their responses that they were in outright opposition to the Cybersecurity Act of 2012, and only a subset of those explicitly characterized their positions as ‘in line with those of the Chamber of Commerce,’" the memo said.
"Many companies supported your proposal to create a voluntary federal cybersecurity program, where the federal government and the private sector work together to address the country's cyber vulnerabilities," it said.
"Companies' concerns related to the proposed voluntary program were primarily related to the potential development of an inflexible, ‘one-size-fits-all’ set of best practices, and companies in the financial and electric sectors in particular expressed concern that their existing regulatory relations would be disrupted," it added.
"The concerns with such a program were generally related to the manner in which it would be implemented, not with the fundamental notion of whether to create it," the memo said. "American companies recognize the importance of securing our most critical infrastructure from cyber attack and recognize the need for a government role."
The chamber, however, said it remained opposed to Sen. Rockefeller's approach. "Voluntary standards sound great in theory, but the devil is in the details," said Ann Beauchesne, the chamber's vice president of national security and emergency preparedness, in a statement issued this week.
"Whether a new cybersecurity program is labeled regulatory or ‘voluntary,’ the fact is government officials will have the final word on the standards and practices that industry must adopt, which the chamber opposes," she said.
Sen. Rockefeller and six other Senate Democrats have already introduced placeholder legislation in the 113th Congress that is expected to eventually look very similar to last year's bill (CPR, Jan. 28, 2013). But Sen. Rockefeller said he would consider the responses to his letter in developing that legislation.
"The companies' responses will be a great resource as we refine much-needed cybersecurity legislation to improve and deepen the collaboration between our government and private sector," he said.
"The responses I received were both thoughtful and constructive," he added. "Companies understand that the cyber threats we face are real, and they understand that the federal government must play an important role in the nation's cybersecurity."
News: Cybersecurity