1 Federal Communications Commission Public Safety and Homeland Security Bureau NARUC Summer Committee Meetings Dallas, Texas July 13, 2014 Clete D. Johnson Chief Counsel for Cybersecurity Secure and Reliable Networks: The Role of the FCC in Public Safety and National Security

Public safety and national security: A fundamental FCC responsibility since the Commission’s beginning. Predecessor institution, the Federal Radio Commission, created in 1912 following Titanic disaster. To “promote safety of life and property” – first phrases of the Communications Act of Cannot abdicate these responsibilities just because the threats have begun to arrive via new technologies. SS7 Outage in 1991: New communications protocol, multiple carriers, multiple vendors … Major communications failure. How to avoid similar outcomes for public safety and national security imperatives in the era of IP-based communications? 2 The Role of the FCC in Communications Security and Reliability

“100 year” shifts underway: Copper wire to fiber optic cables. Switched telephony to IP-based networks. Fixed wireline to mobile wireless. What does this transition mean for crucial public safety and emergency functions? For core communications network infrastructure? 3 Historic Transition in Information- Communications Technology and Practices

Five year trajectory toward proactive private-public partnership: 2008: Comprehensive National Cybersecurity Initiative – military/intelligence-driven approach : Congressional consideration of mandatory regulatory requirements : President’s Executive Order and NIST Cybersecurity Framework for Critical Infrastructure. Now: FCC asks private sector communications companies to create “New Paradigm” of business-driven cyber risk management based on market innovation and accountability. Optimize security, privacy, innovation – create a mutually reinforcing virtuous cycle. 4 U.S. Policy Consensus: New Paradigm for Security, Privacy, Innovation

Chairman Wheeler’s New Paradigm Challenge the communications sector to create its own measurable, accountable, business-driven cybersecurity risk management processes as a substitute for traditional regulation:  Based on private sector innovation and the alignment of private interests with public interests.  More dynamic than compliance with rules but more effective than blindly trusting the market.  Businesses take responsibility for determining how to manage risk in a transparent and measurable way that promotes market accountability for cyber risk reduction.  Key distinction: Proactive business-driven risk management, not reactive compliance with government requirements.  Must be real and meaningful – measurably effective – not just “happy talk” about good ideas. 5

1.Improving cybersecurity standards, best practices, and cyber risk management. 2.Increasing cyber threat information sharing and situational awareness. 3.Early engagement in “security by design” for hardware and software development. 4.Helping advance U.S. cyber policy internationally. 5.Protecting privacy, civil liberties, and business confidentiality. 6.Improving FCC cybersecurity capabilities. 6 Areas of FCC Cybersecurity Focus

Measuring Success  Unlike for financial risk, for cyber risk there is not centuries’ worth of quantifiable data to draw on.  Measuring risk and effectiveness of risk management is the hardest and most important question stakeholders have to answer.  The FCC is working with federal partners and the private sector to gather input on how to measure, assess, and manage cyber risk.  Common factors emerging: companies identify the cyber risk universe, develop internal controls, assess implementation, and monitor effects – same as in other areas of enterprise risk management. 7