Could Uber be deemed critical infrastructure?

The president's cybersecurity commission is weighing changes to the way the U.S. government defines which industries are vital to the life of the nation — a move with potentially enormous legal and financial impact on the business sectors involved.

The president’s cybersecurity commission is weighing changes to the way the U.S. government defines which industries are vital to the life of the nation — a move with potentially enormous legal and financial impact on the business sectors involved.

“How we define critical infrastructure is going to have to evolve with technology, with innovation,” said Kiersten Todt, the executive director of the President’s Commission on Enhancing National Cybersecurity at the Billington Cybersecurity Summit in Washington.

She pointed to how “technologies that were developed as fun have now become part of our critical infrastructure,” citing Facebook and Uber as examples of companies that provided now-critical services.

The designation of 16 U.S. industrial sectors as critical infrastructure dates back to the Clinton administration. The 16 sectors range from banking and financial services, through transit, telecommunications and retail, to water and sewage. In most sectors they encompass a wide range of differently sized companies — from multi-national giants to tiny mom-and-pop operations.

“That was our best guess at what was critical infrastructure,” retired Coast Guard Commandant Adm. Thad Allen told the summit Tuesday about the existing taxonomy.

“It’s been around for several years and I think we have to revisit that because of the ubiquity of the internet and [its] interconnectedness,” he added. “We have to figure out a new way to approach it.”

In a recent interview with FedScoop, Todt called the definition of critical infrastructure “a very interesting question.”

In such an interconnected economy, “Where are those lines,” between critical infrastructure and other sectors? “You can’t have everything be critical infrastructure,” she noted.

Many critical sectors are regulated (think banking, telecoms and the power grid) and  — although few  specific regulatory provisions apply to critical infrastructure per se — the perception of business towards such a designation is generally not positive.

Todt joked that Uber and other technology companies had recoiled at the suggestion that they might be considered vital.

“They were telling us: ‘Please don’t label me as critical infrastructure,'” she said.

Nonetheless, the commission is looking at whether definitions needed to be updated, given the interconnected and inter-reliant character of the modern economy.

“It’s about the supply chain,” she said. “How you define critical infrastructure doesn’t have to do with size, doesn’t have to do with location, it’s really about what is the function and how does that feed into the services that are provided to a community,” she said.

“We don’t have an answer right now,” she said of the commission.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Election official says Tina Peters would be consultant, won’t have access to election systems