Cybersecurity Act of 2009 Seeks Internet Shut-off Switch for President

U.S. Senate Bill 773, the Cybersecurity Act of 2009, offers several sensible responses to the real risks we face from foreign powers or terrorists who might attack us with hackers rather than nukes. Standards for cybersecurity professionals, regional cybersecurity centers to help small businesses (do I smell bacon for DSU?)... mostly sensible stuff. Mostly.

You can read the offical version of the bill at the U.S. Congress, but I recommend the OpenCongress.org version, where you can read and submit comments on specific portions of the bill with your fellow citizens. That capacity for interactivity and alternative voices is exactly why I don't like Section 18, Clause 2 of S. 773, which gives the President the following power:

...may declare a cybersecurity emergency and order the limitation or shutdown of Internet traffic to and from any compromised Federal Government or United States critical infrastructure information system or network.

When planes hit the World Trade Center and the Pentagon, the President grounded all U.S. air travel. I can imagine a similar emergency where the best way to stop a cyber attack from doing more damage would be to shut down big chunks of the Internet, if not the whole thing. But would a massive shutdown of the Internet be the right response to a serious cyber attack? Shutting down Internet access would be much more immediately damaging to the U.S. economy than shutting down air travel, and that's exactly the kind of damage cyberattackers likely want to inflict.

What makes me more uneasy is the lack of definition of "cybersecurity emergency" and the breadth of the definition of "critical infrastructure." Basically, the President would have broad discretion to declare any situation an emergency and shut down any "state, local, and nongovernmental information systems and networks." This vagueness and breadth gives the President the power to shut down the most effective communications medium available to the alternative press and dissenters who might seek to challenge the government's version of the facts about an emergency or even organize (via blog, Facebook, etc.) rallies, tea parties, or other reponses to improper government action.

Even with a President I trust, I want clearer language in the bill to protect civil liberties. The bill has some civil liberties language (here, too), but the emergency powers are still too Big Brother for my taste. Perhaps Senator Thune or Senator Johnson can do us the favor or introducing an appropriate amendment (at least a definition, if not a move to strike) to protect online alternative press and dissent, even in times of crisis.