Getting serious about cyber-security

Russia and WikiLeaks are not the bill’s only targets. It also includes two provisions that would constrain any plans Trump might have to cozy up to the Russians. One would defund any scheme to partner with Russia on cybersecurity, which Trump has pledged to do. The second would impose a review of the risks of returning diplomatic compounds seized from Russia in December under the Obama administration, which was retaliating against Russia’s interference in the election. Russia has put heavy pressure on Trump to give the compounds back.

The intelligence authorization includes a range of other measures to fix known weak points. It establishes a task force that will identify risks to the government’s supply chain, such the widespread use of software produced by Russian anti-virus company Kaspersky. It establishes a working group to develop a national strategy to protect energy infrastructure, especially its industrial control systems. That effort comes in the wake of reports that Russian hackers were targeting engineers with access to the control systems of energy facilities, including nuclear power plants. And finally, the bill mandates a review of whether the intelligence community had the information it needed on the Russian threat and shared it effectively.

All told, the Intelligence Authorization mentions Russia 34 times, and includes a number of other provisions, such as the supply chain review and the energy infrastructure task force, that don’t name Russia but respond to U.S. vulnerabilities that Russia is suspected of exploiting. While neither the intelligence community nor the White House have weighed in on the bill yet, in its current form it represents a focused response to a threat to the U.S., and a concrete effort to improve America’s security generally.

That’s important for two reasons. First, it’s a tangible response to the Russian hack, and it comes as the president and House Intelligence Committee Chair Devin Nunes continue to undermine the investigations of four congressional committees and Robert Mueller’s special counsel team.

Just as importantly, the bill makes a number of common-sense changes—like higher salaries for top cybersecurity positions at NSA, congressional oversight over the vulnerability equities process, and a strategic plan to make the most of bounties paid to “white hat” hackers who find weaknesses in government systems—that will likely have a real impact on cybersecurity. These were all pitched back in 2015, when Congress focused instead on information-sharing between various intelligence agencies, an effort that still hasn’t shown great returns.

The Senate Intelligence Committee is by no means perfect. It rushed through the confirmation of CIA Director Mike Pompeo, who in April came up with the term “non-state hostile intelligence service” that Wyden now objects to. The Senate confirmed Pompeo even though he, like the president, cheered this non-state hostile intelligence service when it served his purposes. But the committee has at least shown where it stands on the issue of Russian interference in U.S. elections, which is more than we can say for Pompeo and Trump.