First thoughts on Obama’s cyber security speech

So, what should we make of Obama’s long-awaited speech on cyber security? I think it was quite well-balanced and not as hysterical as it could be given the recent coverage of cyber security in New York Times (more on the military developments in a separate post). In fact, I think that while Obama promised to elevate cyber security to the top of his national security agenda, his action plan quite explicitly shows that he’s not going to be swayed by the pervasive cyberwarfare paranoia.

Here are my first impressions of his speech – more will follow soon:

– Good to see him put emphasis on the need for public education about cyber security. Ultimately, this is the only way to ensure we are secure in the long-run. This is also a great way to demilitarize the whole debate. I think a good first move would be to set up training programs for journalists who cover cyber security; one of the reasons why the cybersecurity debate has recently turned to hysterical is precisely the lack of good understanding of the real threats faced by the government by the media. I am curious if/how the government could go about it; otherwise, no education campaigns would be able to compete with the negative effects of the CNN-induced paranoia over "cyber-terror" and "digital Pearl Harbors".

– The split of the cyber security tsar portfolio between the National Security Council and the National Economic Council is a good thing. This is a brilliant move (not as brilliant as taking it out of the NSC altogether but that would probably be impossible given how excited the military is about cyber security these days). Bringing it under the NEC umbrella will ensure that the private sector won’t have to suffer under the burden of increased cyber security protective measures; Larry Summers would surely not allow any unnecessary restrictions on the private enterprise.
 
– It’s encouraging that the "tsar" is not going to be a real tsar (his authority seems to be quite limited). I think this is a good middle-ground position between those who wanted to see a mega-tsar and those (like Bruce Schneier, for example) who thought that having a cyber-tsar would only centralize authority and expertise under one person, which may not be the best way to fight the kind of decentralized threats occurring in cyberspace).

– Obama sounded knowledgeable when talking about botnets, malware, etc – I think there is a good chance that the Blackberry-addicted president actually gets it (the fact that he contextualized it by making references to his campaign made it even clearer).

All in all, it was a great speech – I am quite impressed, given how easy it was for him to use a lot of big words and make all of us feel extremely insecure about pressing that "on" button on our laptops…