August 2010

White House issues second-quarter report card for agency open-government plans

Despite a second chance to revise their open-government plans, 11 federal agencies are still falling short, according to White House Chief Technology Officer Aneesh Chopra.

According to the White House's assessment dashboard, the lowest-scoring agencies are the National Science Foundation and the State Department, which have met five of the 10 transparency criteria, and the Agriculture, Commerce and Labor departments, which have met six of the 10 criteria. Eighteen agencies' transparency plans have met all the requirements of the Obama administration's Open Government Directive, Chopra and Cass Sunstein, administrator of the Office of Information and Regulatory Affairs, wrote in the White House's "Open Government Blog" Aug. 12.

Critical Infrastructure Protection: Key Private and Public Cyber Expectations Need to Be Consistently Addressed

Pervasive and sustained computer-based attacks pose a potentially devastating impact to systems and operations and the critical infrastructures they support. Addressing these threats depends on effective partnerships between the government and private sector owners and operators of critical infrastructure.

Federal policy, including the Department of Homeland Security's (DHS) National Infrastructure Protection Plan, calls for a partnership model that includes public and private councils to coordinate policy and information sharing and analysis centers to gather and disseminate information on threats to physical and cyber-related infrastructure.

GAO was asked to determine (1) private sector stakeholders' expectations for cyber-related, public-private partnerships and to what extent these expectations are being met and (2) public sector stakeholders' expectations for cyber-related, public-private partnerships and to what extent these expectations are being met.

To do this, GAO conducted surveys and interviews of public and private sector officials and analyzed relevant policies and other documents. Private sector stakeholders reported that they expect their federal partners to provide usable, timely, and actionable cyber threat information and alerts; access to sensitive or classified information; a secure mechanism for sharing information; security clearances; and a single centralized government cybersecurity organization to coordinate government efforts. However, according to private sector stakeholders, federal partners are not consistently meeting these expectations. For example, less than one-third of private sector respondents reported that they were receiving actionable cyber threat information and alerts to a great or moderate extent.

Federal partners are taking steps that may address the key expectations of the private sector, including developing new information-sharing arrangements. However, while the ongoing efforts may address the public sector's ability to meet the private sector's expectations, much work remains to fully implement improved information sharing. Public sector stakeholders reported that they expect the private sector to provide a commitment to execute plans and recommendations, timely and actionable cyber threat information and alerts, and appropriate staff and resources.

Four of the five public sector councils that GAO held structured interviews with reported that their respective private sector partners are committed to executing plans and recommendations and providing timely and actionable information. However, public sector council officials stated that improvements could be made to the partnership, including improving private sector sharing of sensitive information. Some private sector stakeholders do not want to share their proprietary information with the federal government for fear of public disclosure and potential loss of market share, among other reasons.

Without improvements in meeting private and public sector expectations, the partnerships will remain less than optimal, and there is a risk that owners of critical infrastructure will not have the information necessary to thwart cyber attacks that could have catastrophic effects on our nation's cyber-reliant critical infrastructure.

GAO recommends that the national Cybersecurity Coordinator and DHS work with their federal and private sector partners to enhance information-sharing efforts.

(GAO-10-628, July 15)

RIM to Give India Messenger Service Access by Sept. 1

Research In Motion Ltd. will give India access to its BlackBerry messenger service beginning Sept. 1 to address the country's security concerns, two government officials said. The Canadian company will first give agencies access to messenger services on a manual basis, with information provided for individual phone numbers after government requests, said the officials who declined to be named because the discussions are private. RIM will provide a more automated solution to tracking BlackBerry smartphone messages by November, the officials said. Engineers from Waterloo, Ontario-based RIM will meet with technical staff from India's Department of Telecommunications August 17, the officials said. The company is also working on a solution to allow access to corporate e-mails, they said.

For Some Countries, Skype Too Open, BlackBerry Too Closed

Research in Motion isn't the only company facing government interference in the United Arab Emirates and other countries over its phone service. In its filing with the SEC to raise up to $100 million through an IPO last week, Internet phone provider Skype pointed out that "certain countries have made the use of one or more of our products illegal or are reported to have prohibited or blocked access to our website."

Among these is the UAE and Egypt. Access to Skype's site and products has reportedly been blocked since 2006 for undisclosed reasons. Numerous VoIP sites have been blocked in connection with a national ban on such applications, according to an August 2009 report by the OpenNet Initiative (ONI), a partnership that tracks the Internet filtering and surveillance practices of countries worldwide. Skype's IPO filing also states that in March the Egyptian National Telecommunication Regulatory Authority (NTRA) announced it was banning Skype on mobile devices under a law that international calls must pass through a long-distance calling gateway controlled by an Egyptian company. Skype said it believes its services can still be accessed through fixed broadband and Wi-Fi connections in Egypt. But unlike RIM's BlackBerry platform, which the UAE, Saudi Arabia and India have recently threatened to ban because it's too closed, issues with Skype likely stem from the very openness of its peer-to-peer technology. Its system relies on the existing Internet connections of its 124 million "connected" users rather than its own network infrastructure.

Experts Warn of a Weak Link in the Security of Web Sites

Computer security researchers are raising alarms about vulnerabilities in some of the Web's most secure corners: the banking, e-commerce and other sites that use encryption to communicate with their users.

Those sites, which are typically identified by a closed lock displayed somewhere in the Web browser, rely on a third-party organization to issue a certificate that guarantees to a user's Web browser that the sites are authentic. But as the number of such third-party "certificate authorities" has proliferated into hundreds spread across the world, it has become increasingly difficult to trust that those who issue the certificates are not misusing them to eavesdrop on the activities of Internet users, the security experts say. "It is becoming one of the weaker links that we have to worry about," said Peter Eckersley, a senior staff technologist at the Electronic Frontier Foundation, an online civil liberties group. The power to appoint certificate authorities has been delegated by browser makers like Microsoft, Mozilla, Google and Apple to various companies, including Verizon. Those entities, in turn, have certified others, creating a proliferation of trusted "certificate authorities," according to Internet security researchers. According to the Electronic Frontier Foundation, more than 650 organizations can issue certificates that will be accepted by Microsoft's Internet Explorer and Mozilla's Firefox, the two most popular Web browsers. Some of these organizations are in countries like Russia and China, which are suspected of engaging in widespread surveillance of their citizens.

Feds Strengthen Cybersecurity Workforce Plans

Federal agencies are making some progress on developing and executing strategies for building a stronger cybersecurity workforce, but much remains to be done, government officials and industry representatives said.

Coordinated efforts to spark improvements in the federal cybersecurity workforce, formerly part of the Comprehensive National Cybersecurity Initiative (CNCI), have been folded into a larger effort, the National Initiative for Cybersecurity Education (NICE), a broader national agenda, announced in April, which includes K-12 education and awareness campaigns as well as federal workforce efforts. In terms of government, NICE includes two tracks of work focused explicitly on improving the federal cybersecurity workforce -- one on workforce structure, and the other on training and professional development. Some of the work under these buckets had already begun when NICE began, but it's beginning to accelerate.

Cyber Command still struggling to define cyber war

Cyberspace has been accepted as a domain of military operations, alongside the four traditional domains of land, sea, air and space in which the military operates. But cyberspace is not analogous to real space. It is not defined by location, boundaries and terrain, and traditional U.S. military doctrine that served the nation well through the Cold War does not translate into this new place.

Computers driving the hospital of the future

All over Michigan, hospitals and doctor networks are investing millions in technology, a push also being made by the federal government.
Patients at some of the state's largest health systems over the next few years, for example, will have hospital rooms wired into a computer system that lets them see their vital signs, medicines and the name and photograph of the hospital staffer who enters their room. The systems spot medication errors, alert staffers to patients with drug allergies and send out alerts about the federal drug safety and recall alerts. The federal government will use $2.73 billion in bonuses to entice more health providers to install and upgrade electronic medical record systems -- or face reductions in their Medicare or Medicaid reimbursements by 2015.

Agencies advance use of health IT

When a Native American military veteran who lives in Virginia goes to the doctor, it might be tricky to track down his medical records. This hypothetical patient probably has received care from both the Veterans Affairs Department and the Indian Health Service. He has beneficiary data on file with the Social Security Administration, and also has a medical history with MedVirginia, a network of private health care providers. To get this diverse group of entities to share data and en sure that the patient gets the best care is a difficult task, full of paperwork and phone calls.

The Obama administration is trying to change all that with the Nationwide Health Information Network (NHIN), an ambitious project that aims to get federal agencies to use common standards to record and store health records electronically. What's more, the administration is investing billions to encourage private providers to do the same. NHIN "is able to take a process that manually might take several days and reduce that to several seconds," said Melissa Chapman, former chief information officer at the Health and Human Services Department and vice president of health solutions for the information technology firm Agilex Technologies.

Innovate, Yes, but Make It Practical

Business is a field not of theory but of practice. The central intellectual inquiry of the science of management is simply this: What works? That, it seems, is the best way to examine the steady rise in the practice of innovation management. A search of the database of the professional networking site LinkedIn found that more than 700 people listed their current job title as "chief innovation officer" and that nearly 25,000 had the word "innovation" in their job title. Many others may not have the word in their titles, but their job is to pursue opportunities that result in new products, services and more efficient ways of doing things. So what does work in the innovation game? No single formula, to be sure. But some recent interviews with executives, consultants and academics can be distilled into three recommendations: think broadly, borrow from the entrepreneurial Silicon Valley model, and pay close attention to customers and to emerging user needs. Here, then, are three innovation works in progress that include those ingredients, whether or not the efforts will ultimately prove to be winners.

Benton

Search