U.S. Homeland Security department to share cyber threat data

WASHINGTON, D.C. — The United States Homeland Security Department on Thursday formally began sharing details of new digital threats with private business and other government agencies, a culmination of a longtime effort to improve cybersecurity.

“This is the ‘if you see something, say something’ of cybersecurity,” said Homeland Security Secretary Jeh Johnson (below left)at the agency’s Virginia-based data sharing hub, the National Cybersecurity and Communications Integration Center.

A U.S. law passed at the end of 2015 was intended to encourage corporations to share information about cyberthreats, making it harder for businesses to be targeted by threats used elsewhere.

The program is voluntary, and the number of companies that will participate or how effective the program will be remains unclear.

Companies have long been reluctant to acknowledge security failures. As of Thursday, about six organizations had signed up and others have expressed interest, Andy Ozment, the assistant cybersecurity secretary at Homeland Security, said. The names of companies participating are closely held, and records about their involvement are exempt from disclosure under the Freedom of Information Act.

“This is a big deal,” he said. “We’re not going to launch out the gates … and have thousands of companies sharing all sorts of information. We want to make sure we’re providing value and growing.”

Related — Ottawa pledges $36.4 million for security of ‘vital cyber systems’ operators

Under the new law, the Homeland Security Department programmed its systems to remove personally identifiable information that might be included that private companies might share.

“As companies come on board, we’ll learn more about what’s useful,” and learn to streamline other parts, said Suzanne Spaulding, a top Homeland Security cyber official.

Related — Credit card payment processors, national retail chains the most ‘hazardous’ cyber insurance clients

If information pertains to a specific threat of economic damage, death or serious injury or the effort to prosecute or prevent the exploitation of a minor, personal information may be passed on to other agencies.

Information sharing and analysis centres, which industry groups operate, will likely participate in the new program, DHS officials said. Johnson said he was telling such groups, ”We are open for business, on time and on schedule.”

Michael McCaul – a Republican representing the 10th District of Texas in the U.S. House of Representatives and chairman of the House Committee on Homeland Security – praised the new effort following recent hacks against Sony Pictures Entertainment Inc. and the Office of Personnel Management. More than 21 million Americans had their personal information stolen in the OPM hack, which the U.S. believes was a Chinese espionage operation.

Photo by Barry Bahler, U.S. Department of Homeland Security