Updated Friday, July 9, 2010 at 9:58 a.m. EST
The U.S. Department of Defense (DoD) has launched a pilot program to detect and respond to cyberattacks against public and private entities, such as energy companies and nuclear power plants, that operate the nation's critical infrastructure.
The program, codenamed “Perfect Citizen,” is focused on monitoring network activity, as well as identifying and responding to attacks against government and critical infrastructure networks. The planned initiative first was reported this week in the Wall Street Journal.
As part of Perfect Citizen, a set of sensors would be deployed on participating critical infrastructure networks to detect anomalous activity, James Lewis, director of technology and public policy at the Center for Strategic International Studies, told SCMagazineUS.com on Thursday. When a cyberattack is detected, the technology would be able to quarantine traffic or take a number of other actions depending on the threat.
However, some of those familiar with Perfect Citizen worry that such a program is too privacy-intrusive, according to the Journal report.
“It's a departure from everything we have done in the past, and that's going to attract criticism,” Lewis said.
But the technology would not monitor systems for content, and participation in the Perfect Citizen program is voluntary, he said.
“I am for this,” Lewis added. “For an advanced opponent [such as] a foreign military source, private defenses won't work. We need to face up to the fact that just like with any other military problem, you've got to give the DoD a role.”
The program, still in development, grew out of concern among members of the federal government about vulnerabilities in private sector critical infrastructure networks that could be exploited by cybercriminals, Lewis said. The DoD is concerned about the issue because it depends on products and services provided by the private sector to function.“You could affect the DoD's ability to operate by turning off power,” Lewis said. “They [the DoD] have been thinking about how to protect the utilities they buy services from.”
DoD Deputy Secretary William Lynn directed the agency to develop the plan, which will be carried out by the National Security Agency (NSA), Lewis said.
A DoD spokeswoman directed calls about the program to the NSA. Judith Emmel, an NSA spokeswoman, told SCMagazineUS.com in an email Thursday that the Journal report was an “inaccurate portrayal” of the NSA's work.
Perfect Citizen is purely a "vulnerability assessment and capabilities-development contract," Emmel said. The NSA denied that Perfect Citizen involves the monitoring of communications or the placement of sensors on utility company systems.
“This is a research and engineering effort,” she said. “There is no monitoring activity involved, and no sensors are employed in this endeavor.”
The Perfect Citizen contract provides a set of technical solutions that help the NSA better understand the threats to national security networks — a critical part of NSA's mission to protect the nation, Emmel said.
“Any suggestions that there are illegal or invasive domestic activities associated with this contracted effort are simply not true,” she said. “We strictly adhere to both the spirit and the letter of U.S. laws and regulations.”
Perfect Citizen relies, in part, on technology supplied to the government by defense contractor Raytheon, Lewis said.
Raytheon has won a classified contract valued at up to $100 million for the initial surveillance phase, according to the Wall Street Journal report. A Raytheon spokesman declined to comment about the program when contacted by SCMagazineUS.com.
[An earlier version of this story was corrected Friday, July 9, 2010 at 12:18 p.m. EST. The earlier story reported that a TechAmerica memo obtained by SCMagazineUS.com referenced Perfect Citizen. The TechAmerica document was actually a meeting notice that referenced a similar but unrelated DoD program called Defense Industrial Base Cybersecurity/Information Assurance (DIB CS/IA), according to a TechAmerica spokeswoman.]
