Contents: Introduction; Background on Cyber Threats and Calls for Executive Action; Comprehensive National Cybersecurity Initiative and Concerns Regarding Transparency and Effectiveness; Legal Authorities for Executive Branch Responses to Cyber Threats; Separation of Powers in National Security Matters; Congressional Constraints on Executive Action; Policy Considerations and Congressional Options; Conclusion.

Federal agencies report increasing cyber-intrusions into government computer networks, perpetrated by a range of known and unknown actors. In response, the President, legislators, experts, and others have characterized cybersecurity as a pressing national security issue. In January 2008, the Bush Administration established the Comprehensive National Cybersecurity Initiative (the CNCI) by a classified joint presidential directive. The CNCI establishes a multipronged approach the federal government is to take in identifying current and emerging cyber threats, shoring up current and future telecommunications and cyber vulnerabilities, and responding to or proactively addressing entities that wish to steal or manipulate protected data on secure federal systems. In response to the CNCI and other proposals, questions have emerged regarding: (1) the adequacy of existing legal authorities -- statutory or constitutional -- for responding to cyber threats; and (2) the appropriate roles for the executive and legislative branches in addressing cybersecurity. The new and emerging nature of cyber threats complicates these questions. Although existing statutory provisions might authorize some modest actions, inherent constitutional powers currently provide the most plausible legal basis for many potential executive responses to national security related cyber incidences. Given that cyber threats originate from various sources, it is difficult to determine whether actions to prevent cyber attacks fit within the traditional scope of executive power to conduct war and foreign affairs. Nonetheless, under the Supreme Court jurisprudence, it appears that the President is not prevented from taking action in the cybersecurity arena, at least until Congress takes further action. Regardless, Congress has a continuing oversight and appropriations role. In addition, potential government responses could be limited by individuals' constitutional rights or international laws of war. This report discusses the legal issues and addresses policy considerations related to the CNCI.

One might distinguish the term cyber from that of telecommunications with the former being the data or applications residing on the latter which is the electronic medium in which the activity occurs. [...] The CNCI "establishes the policy, strategy, and guidelines to secure federal systems."2 The CNCI also delineates "an approach that anticipates future cyber threats and technologies, and requires the federal government to integrate many of its technical and organizational capabilities to better address sophisticated threats and vulnerabilities."3 Subsequent to the issuance of the classified directi [...] Of paramount concern to the national and homeland security communities is the threat of a cyber related attack against the nation's critical government infrastructures - "systems and assets, physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national 6 Center for Strategic and International [...] Given the secretive nature of the CNCI, one of the common concerns voiced by many security experts is the extent to which non-federal entities should have a role in understanding the threat to the nation's telecommunications and cyber infrastructure and assist with providing advice, assistance, and coordination in preparation and response for ongoing and future intrusions and attacks.28 As telecom [...] Article I of the U. S. Constitution empowers Congress to "declare war," "raise and support armies," "provide and maintain a navy," and "make rules for the government and regulation of the land and naval forces."41 Article II states that the "President shall be Commander in Chief of the Army and Navy of the United States, and of the Militia of the several States."42 As a preliminary matter, invocat.

In response to the ongoing threats to federal systems and operations posed by cyber attacks, Pres. Bush established the Comprehensive National Cybersecurity Initiative (CNCI) in 2008. This initiative consists of a set of projects aimed at reducing vulnerabilities, protecting against intrusions, and anticipating future threats. This report determined: (1) what actions have been taken to develop interagency mechanisms to plan and coordinate CNCI activities; and (2) what challenges CNCI faces in achieving its objectives related to securing federal information systems. To do this, the report reviewed CNCI plans, policies, and other documentation and interviewed officials at OMB, DHS, and the ODNI, among other agencies. Charts and tables.

President Obama has identified cybersecurity as one of the most serious economic and national security challenges we face as a nation, but one that we as a government or as a country are not adequately prepared to counter. Shortly after taking office, the President therefore ordered a thorough review of federal efforts to defend the U.S. information and communications infrastructure and the development of a comprehensive approach to securing America's digital infrastructure.

Increasing focus on current cyber threats to fed. info. technology systems, nonfederal critical info. infrastructure, and other nonfederal systems has led to numerous legislative cybersecurity proposals and exec. branch initiatives. In May 2009, the Obama Admin. declared that U.S. info. networks would be treated as a strategic national asset. Contents of this report: (1) Intro.; (2) Difficulties in Addressing Cybersecurity Issues: Commission on Cybersecurity for the 44th Presidency; The Comprehensive Nat. Cybersecurity Initiative; Obama Admin. Cyberspace Policy Review; Common Themes of Recent Cybersecurity Initiatives; Representative Sampling of Preexisting Exec. Branch Programs and Initiatives; (3) Considerations and Options for Congress.

Increasing focus on current cyber threats to federal information technology systems, nonfederal critical information infrastructure, and other nonfederal systems has led to numerous legislative cybersecurity proposals and executive branch initiatives. The proposed National Defense Authorization Act for Fiscal Year 2010 and the Intelligence Authorization Act for Fiscal Year 2010 both contain provisions that would affect programs and funding for current and future cybersecurity-related programs. In May 2009, the Obama Administration issued its 60-day review of cybersecurity policy, declaring that U.S. information networks would be treated as a strategic national asset. There is no single congressional committee or executive agency with primary responsibility over all aspects of cybersecurity; each entity involved pursues cybersecurity from a limited vantage point dictated by committee jurisdiction. Many different initiatives exist, but because of fragmentation of missions and responsibilities, "stove-piping," and a lack of mutual awareness between stakeholders, it is difficult to ascertain where there may be programmatic overlap or gaps in cybersecurity policy. Drawing from common themes found in the Comprehensive National Cybersecurity Initiative (CNCI), a study by the Center for Strategic and International Studies (CSIS) Commission for the 44th Presidency, and the proposed near-term action plan from the President's recent Cyberspace Policy Review, this report identifies priority areas in cybersecurity for policy consideration. The report then lists and synopsizes current legislation that has been developed to address various aspects of the cybersecurity problem. It then lists the current status of the legislation and compares legislation with existing executive branch initiatives. Finally, analysis of information contained in executive branch initiatives and congressional legislation is used to offer cybersecurity-related considerations for Congress.