Federal security program draws few responses
Industry executives say confidentiality a concern
From Mike Ahlers
CNN Washington Bureau
 | |
|
Story Tools
|
| RELATED |
 Interactive: Terror warning system
|
|
WASHINGTON (CNN) -- A new federal program to protect privately owned power plants, factories and other "critical infrastructure" from terrorists is getting little response from businesses.
So far, only two companies and two associations have responded with information to be used in the voluntary program, which was launched two months ago, according to the Department of Homeland Security.
Business leaders cite several reasons for the low participation rate, including a historic distrust between government and industry on some matters and concern as to whether the confidentiality of the information would withstand possible court challenges.
Bruce Don, a senior researcher at the RAND Corp., said being a good public citizen may not be enough to entice companies to voluntarily disclose information, especially in the absence of terrorist attacks.
"If it doesn't work out to be a useful two-way street, I don't think the good corporate citizen motive will be strong enough to hold much sway," he said.
The Protected Critical Infrastructure Information (PCII) program is an effort by the department to protect the estimated 85 percent of the nation's infrastructure that is privately held.
Under the program, businesses that voluntarily disclose information about their operating practices, security systems and vulnerabilities are given assurances by the government that the information will not be divulged to competitors or the public.
The Department of Homeland Security says it will use the information to evaluate security shortcomings, recommend improvements and develop industry "best practices."
The program operates with a $3.9 million budget, 12 employees and 20 contract personnel.
Program manager Fred Herr acknowledged the response is less than anticipated, but said he is not discouraged.
"It's way too early to be disappointed in the participation," Herr said. "We are getting interest. ... If nobody was showing any interest in the program, I'd be disappointed."
'A disincentive'
But some industry executives said the program's regulations may discourage companies from turning over information.
"I'm disgusted and disappointed" by the PCII regulation, said Laurence Brown of the Edison Electric Institute, a trade association for investor-owned electric utility companies. "I think [the low response] is a direct result of the way they've drafted the regulations."
The regulations "create nothing but a disincentive for the critical infrastructure companies to share sensitive information" by protecting only information that is given to the PCII program office, he said.
"What that does is it, in essence, completely closes off the prior lines of communication between the business and the department. And information that has already been provided is officially not protected, according to the department," Brown said.
He added, "To be fair, it will never be easy to convince industry that the government will keep their information confidential. That was always a hard sell. But the way the regulations are written, it is well nigh impossible."
Jack Lichtenstein of the American Society for Industrial Security said businesses recognize the need to share information with the government. But the program will require a sea change in attitudes.
"Security people and law enforcement people are, by their very nature, by the nature of their work, very protective, and in order for them to be forthcoming even with each other, it requires a great deal of trust," Lichtenstein said.
In the past, information has generally been shared on an individual, informal basis, such as between a corporate security officer and a trusted local police chief, he said.
"But that's no way to run an information exchange in the new era," Lichtenstein said. "Those relationships are good and we should continue to encourage that type of thing, but that shouldn't be the only protocol for exchanging information in the new era."
Legal challenges a concern
Another concern cited by business executives: Will sensitive information be disclosed in court proceedings?
Although the regulations prohibit disclosure in civil proceedings, that prohibition has not been put to a test, and the the department concedes it does not know if it would stand up against a court challenge.
Industry is also concerned the government will use security as a pretext for gathering information it will then use for other purposes, Lichtenstein said.
But, he added, "I think major corporations ... will come to accept the need for this type of information exchange once they see it is used for the reason intended."
Assistant Secretary for Infrastructure Bob Liscouski said the program is reaching out to the private sector to gain momentum. But the program is going "as we predicted," he said.
"I'd prefer to do it more slowly than quickly," Liscouski said. "We don't want to let the perfect be the enemy of the good, but we also understand that this program is so vital to us in terms of its integrity and our trust with the private sector that we can't afford to not get this right."
Because the PCII program is voluntary, there are no penalties for companies that do not submit information. And companies are free to determine how much detail they give.
Liscouski said companies that volunteer information now may largely be motivated by the desire to be good citizens, but the good business aspects of volunteering information will become apparent as the program expands.
"It's going to be one of those issues where the more [information] we get the better off we'll be. We'll be able to share much better information back with the private sector so they can protect themselves," he said.
