FBI Creates Alliance To Fight Cyber Crime

Washington Post 6jan01

Washington -- The FBI opened a national initiative yesterday to thwart computer crime by joining forces with corporations, universities and other organizations to share information about hackers and electronic intrusions.

The program, called "InfraGard," allows companies to share sensitive information about cyber attacks confidentially in a "sanitized" format via a secure e-mail system and Web site so that businesses can remain anonymous.

In addition, the FBI issues "intrusion alerts" that warn member firms about potential attacks through an encrypted e-mail system.

The public-private partnership began as a pilot program in Cleveland several years ago but already lists 518 firms, including IBM, as members. Organizations that want to participate must undergo a criminal background check by the FBI to minimize the potential for fraud.

Mike Vatis, head of the National Infrastructure Protection Center, acknowledged that the FBI's challenge remains persuading businesses of all kinds that involvement with the FBI is more beneficial than harmful. Many public corporations have formed their own private information-sharing networks with other firms, fearing that association with the FBI will make clients nervous or prompt the bureau to interfere with their operations after a cyber attack.

The nation's biggest banks, for example, have established their own security network that does not involve the FBI. Private security consultants sometimes advise companies to handle sensitive, cyber- security issues on their own or through private-sector arrangements, rather than team up with federal law enforcement officials.

Many corporate executives remain fearful of problems that could result from involvement with the FBI. But Vatis said executives who mistakenly fear their computers will be "surrounded with yellow tape" after a cyber attack do not understand how the FBI operates.

"We don't seize people's computers," Vatis said during a press briefing yesterday. "We don't victimize the victims by shutting down their companies."

Vatis added that "we are doing this to engender trust and increase the flow of information." But he said that the real test will not be whether companies sign up as members but their willingness to share sensitive information about technology and intrusions with others.