The Cybersecurity Triad: Government, Private Sector Partners, and the Engaged Cybersecurity Citizen

In May 2009, the Obama administration released its, Cyberspace Policy Review: Assuring a Trusted and Resilient Information and Communications Infrastructure, which it expected would lay the groundwork for a new national cybersecurity strategy. Staking out separate policy development space, Congressional leaders began hearings and introduced legislation. The most significant - the Cybersecurity Act of 2009 - proposed major changes in current federal government approaches. The common starting point of all of these reform efforts is that current federal organization and current national cybersecurity policy is inadequate for the task of securing cyberspace.This article analyzes past federal reorganization efforts in response to the last technological revolution with serious national security implications - nuclear technology -- and the more recent response to homeland security. While much of the current cybersecurity debate leans toward radical reforming, we counsel an incremental approach to reorganization that builds on the hard work of the last decade combined with a genuine reconceptualization of the threat solution set. Borrowing from the language of the nuclear era, we call for cybersecurity to rest on a balanced triad of intergovernmental relations, private corporate involvement, and active cyber citizenship as a resilient model that can manage this new and challenging security environment. In particular, we introduce the third leg as a critical new concept that has been absent from standard policy debate. The road to cybersecurity is destined to be long, circuitous, and difficult. Extensive negotiations between federal, state, local, and private sector leaders loom. No truly significant federal policy reform can be achieved without considering the intergovernmental policy dimensions combined with the overall threat perception driving those reforms. Success will remain elusive if government to private business relations do not improve and much will be undermined if the general public remains inactive in contributing to national cybersecurity.