International Law

UK Cyber Security Strategy - even more bureaucracy, but no financial budget, legislative power or democratic accountibility

Back in November 2007, Spy Blog commented: Countering terrorism with more quangos - more detail of Gordon Brown's security statement

The Labour Government has now published, without bothering to consult the general public, its first public UK Cyber Security Strategy, "coincidentally" in the same week as the US government re-launched their own military Cyberspace Command plans.

Cyber Security Strategy of the United Kingdom - safety, security and resilience in cyber space - June 2009 (.pdf 32 pages)

New Cyber Organisations

The Cyber Security Strategy sets out the Government's plans to establish two new organisations, both of which will be established in September 2009, and will be operational by the end of March 2010:

An Office of Cyber Security (OCS) to provide strategic leadership for and coherence across Government. The OCS will establish and oversee a cross-government programme to address priority areas in pursuit of the UK's strategic cyber security objectives.

A Cyber Security Operations Centre (CSOC) that will bring together existing functions: to actively monitor the health of cyber space and co-ordinate incident response; to enable better understanding of attacks against UK networks and users; and to provide better advice and information about the risks to business and the public.

[...]

3.22 Both new structures will be established in September 2009 and will be operational by the end of March 2010.

Some obvious Spy Blog questions:

Does either the Office of Cyber Security or the Cyber Security Operations Centre

• have an elected Cabinet Minister directly responsible for it, and democratically accountable for its failures (or, in theory, responsible for its successes) ?

• have even a junior elected Minister directly responsible for it, and democratically accountable for its failures (or, in theory, responsible for its successes) ?

• have even a senior Civil Servant of Permanent Secretary rank directly responsible for it, and professionally accountable for its failures (or, in theory, responsible for its successes) ?

• have any independent budget to spend on Cyber Security ? If so, then how much ?

• replace any of the other existing bureaucratic agencies, offices, departments, quangos, non-departmental government bodies etc, ?

• have any planned strong statutory legal enforcement powers i.e. criminal prosecutions with fines and or prison sentences ?

• have any planned weak statutory legal enforcement powers e.g. like the Information Commissioner ?

• have the power to cancel or amend Government IT projects and IT contracts if they are fail the Cyber Security standards ?

• have the power to cancel or amend Government IT projects and IT contracts if they fail the Privacy and Liberty Proportionality criteria ?

• be easily and securely contactable by the general public via secure SSL/ TLS encrypted web response forms, or PGP encrypted emails or by (freephone) telephone ?

• be easily and securely contactable by the people who look after Critical National Infrastructure systems via secure SSL/ TLS encrypted web response forms, or PGP encrypted emails or by (freephone) telephone ?

• be easily and securely contactable by the general public or by Critical National Infrastructure people, most of whom work in the private sector, 24hours a day, 7days a week, including holidays ?

If, as we suspect, the answers to most of these questions is "no", then this UK Cyber Security Strategy is worse than useless, and is just some more Must Be Seen To Be Doing Something political propaganda.

This "strategy" looks like something which the now defunct Office of the e-Envoy and the National Hi-Tech Crime Unit both failed to achieve.

Wading through the "engagement / stakeholder / addressing / combating" etc. spin doctor / management consultant nuspeak, some paragraphs do stand out:

Full post as published by Spy Blog on June 27, 2009 (boomark / email).