Biden directs spy agencies to share more intelligence with private sector on threats from China and Russia

President Biden is directing U.S. spy agencies to more proactively share information with private companies that manage critical American infrastructure, to protect themselves against risks from foreign adversaries like China and Russia, or criminal groups. and hackers.

The new guidance is part of a national security memo on Critical Infrastructure Security and Resilience that Biden issued on Tuesday. The memo serves to update guidance first introduced in 2013 during the Obama administration, identifying new security procedures for 16 critical infrastructure sectors to protect against natural disasters and man-made threats.

“The policy is particularly relevant today given the continued disruptive ransomware attacks, the cyberattacks on U.S. water systems by our adversaries, and their frequent and repeated testimony from the FBI director and other senior administration officials who have sounded alarm about how our critical infrastructure is being targeted by our adversaries,” Caitlin Durkovich, Biden’s deputy Homeland Security advisor for Resilience and Response, said on a call with reporters in anticipation of the memo.

The Biden administration, drawing on lessons from its warning about Russia’s large-scale invasion of Ukraine, said it is tasking intelligence agencies to focus on declassifying information to share with the private sector, or sharing information with companies. with appropriate authorization, to better protect against security threats.

“I know that the IC [intelligence community] is looking to ensure that if information can be safely declassified, then it will be,” said Jen Easterly, Director of the Cybersecurity and Infrastructure Security Agency.

Easterly said the IC declassified potential retaliatory attacks by the Russian government to share with owners and operators of critical infrastructure that led to Russia’s full-scale invasion of Ukraine in February 2022.

She said the work was becoming more urgent with “serious” threats from the People’s Republic of China. The Biden administration warned in February that Chinese cyber actors are pre-positioning themselves on critical US infrastructure to launch potential cyber attacks, in an operation called Volt Typhoon.

“We have conducted extensive briefings at various classification levels with authorized industry personnel to ensure that they are aware, that we are aware – in 2022 of the Russian threat – and we are aware now of the serious Chinese threats to our critical infrastructure,” Easter said.

“Specifically pre-positioning to disrupt or destroy critical infrastructure in the event of a major crisis.”

The memo also gives the Department of Homeland Security overarching responsibility for coordination among different federal agencies, directing DHS to submit to the president a biennial “national risk management plan” summarizing work to mitigate risks to critical infrastructure. from the country.

Additionally, the memorandum seeks to codify and mandate minimum security and resilience requirements for critical infrastructure entities that were previously only voluntary.

“Voluntary approaches to improving the security and resilience of critical infrastructure have significantly mitigated risks over the past decade, but more must be done to ensure the nation’s critical infrastructure is secure and resilient against all threats and hazards,” it says. the memo.

“The Federal Government must focus on increasing the adoption of requirements that address sectoral, national and cross-sectoral risks for critical infrastructure.”

The memorandum also reaffirms the 16 critical infrastructure sectors, identifying which government agencies should liaise with which sectors.

“This is part of what we call our all-hazards approach to the nation’s resilience,” Durkovich said.