Sen. Johnson Seeks Raised Awareness of Cybersecurity Threats

"In this town, in this government, we are not addressing" the threat of cyberattacks on infrastructure, Johnson said, citing a lack of government preparedness. "We have a lot of issues we have to deal with," he said. "What are we going to do to respond to these bad actors? These are serious issues we are going to have to discuss." Johnson said members of Congress have been seeking specific legislation to address cybersecurity issues since 2011, but public awareness of the issue wasn't enough to allow passage of a cybersecurity bill. "We just couldn't do it until the public was fully aware of the imperative for doing it," he said. Recent data breaches at companies and the government have increased public awareness of the threat of cyberattacks, Johnson said, saying the current speed of growth in the technology sector is outpacing the public's knowledge and contributes to a lack of information on the issue. "As technology moves forward, it's leaving the vast majority of the population behind in terms of how" it works, he said. "We really don't know, [and] it's incredibly complex."

Awareness of cybersecurity threats and defense measures need to be highlighted to generate a response from Congress, Johnson said. "We've got to make sure that the American public is fully aware of the threat and the risk so you put pressure on the political process to start responding, [and] to start passing some common-sense legislation that is sorely needed to address it." But Johnson said Congress must be well informed on the issue: "The concern I always have is, you end up with a rush to judgment. What we need to absolutely do is we've got to get that information so we really understand it before we rush to judgment and pass something that does more harm than good."

Johnson also cited industrial cyberespionage and the need to be kept up to date on what competitors and enemies are doing. "Probably the greatest transfer of wealth really is in that industrial espionage space, where Europe and the West is investing enormous amounts of money into research and development, and through cyberattacks, our adversaries … can just steal it," he said. "And they get the benefit of all of our R&D without having to invest in it." Without violating civil liberties, the U.S. should be "getting the intelligence gathering, getting the assets in place, getting the protections in place to stay as close to the people trying to do us real harm as we possibly can and recognizing that it's an enormous challenge," he said.

Other panelists spoke on cybersecurity, and touted the cross-border data flow protections enabled by the Trans-Pacific Partnership (TPP), and criticized FCC net neutrality rules. Roslyn Layton, AEI visiting fellow, said her recent research has found more harms than benefits to strict net neutrality rules. "What's interesting to find is that those countries that have soft net neutrality rules, specifically that use a multistakeholder model, actually have a better ecosystem for the edge providers," she said. "I actually find there is absolutely no relationship between bringing a kind of utility-style regulation like the FCC has proposed to increasing the investment in infrastructure. In countries that have had such hard [net neutrality] rules, the investment has either stayed the same or gone down, but it certainly hasn't increased."

On the TPP, Claude Barfield, AEI resident scholar, said the e-commerce section and the telecom section are a "triumph" for the U.S. and for Internet commerce freedom. "It is a nicely balanced set of trade rules," he said. Barfield predicted TPP will be a "highly important" precedent, but its e-commerce and telecom rules will "be very difficult to match" in trade negotiations with the EU.