Information-sharing: A Tough Sell

FBI Director Robert Mueller makes the appeal

August 15, 2005 — CSO — Security executives know the information-sharing pitch so well, they can sense it coming like a public radio fundraising drive. Every so often, law enforcement leaders need to give a speech urging private sector players to share information about security breaches with the authorities. And so it was that FBI Director Robert S. Mueller III made the appeal in remarks to the InfraGard 2005 National Conference on Aug. 9.

To his credit, Mueller acknowledged that it’s a tough sell. Only 20 percent of companies that experienced computer intrusions in 2004 reported those incidents to law enforcement, Mueller said, citing a survey by the Computer Security Institute and the FBI. Respondents cited a fear of bad publicity and "a loss of competitive advantage" if they went public with their breaches. He said he knows it’s not a good idea to send agents in logo-laden raid jackets racing to every scene. And yet, there it was, that low participation rate.

Mueller’s citation sounded bad, but it may be rosy. A 2004 survey of 8,100 security and technology executives, said about 16 percent reported a negative security incident to either the CERT Coordination Center or law enforcement. (A writeup of the 2004 Global Information Security Survey by PricewaterhouseCoopers and CSO and CIO Magazines, can be found here.)  Another research project, the E-Crime Watch Survey by the Secret Service, CERT and CSO, sought to tease out the reasons why companies don’t report such breaches. The interesting tidbit here was that the 554 security executives responding cited reasons that showed they were at least weighing whether or not to report their electronic crime incidents: many (59 percent) said the damages didn’t warrant alerting the cops; half also said they didn’t have enough information about the incident to help prosecutors. (A bigger problem the survey showed, however, was that that too few companies, only about 48 percent, have a formal way to track information security breaches.)

Unfortunately the issue won’t go away. Mueller, as he did in his speech to InfraGard in Washington, must keep pointing out that terrorists and criminals can use computer networks to their advantage – just like businesses can. He must continue to appeal to the patriotism and economic interests of business people who, after all, control about 80 percent of the nation’s critical infrastructure. "Maintaining a code of silence will not benefit you or your company in the long run," Mueller sai

• Print