The new authority will absorb most of the powers currently vested with the existing National Authority for Information Security that operates under the Israeli Security Agency (a.k.a Shabak) pursuant to the Regularization of Security in Public Bodies Law.
The proposed decision was submitted subsequent to government decision number 3611 of August 8, 2011 regarding “the advancement of national competence in cyberspace”. That decision instituted the National Cyber Headquarters, whose role is to establish an Israeli national defense doctrine on cyberspace.
The preamble to the proposed decision explains that cyberspace entails considerable threats to Israel’s national security, the proper functioning of the State and its organizations, public order and the economy. The proposed decision maintains that these threats are constantly elevating.
The proposed decision aims to provide up-to-date measures for “cyber defense” (a term defined as “the overall activities intended to prevent, neutralize, investigate and deal with cyber threats and cyber incidents, and to reduce their impact and resulting damage, before, during and after they materialize”). According to the proposed decision, the present measures are incomplete and insufficient. Hence, an overall, national effort for preparedness is required in order to elevate cyber defense and define the responsibilities for nationwide cyber defense.
The proposed decision would declare that protecting the proper and safe functioning of cyberspace is a “critical, national defense objective, and an interest critical to the State’s national security”. It also aims to adopt major parts of the national doctrine on cyber defense devised by the national cyber headquarters.
The proposal seeks to establish a national authority for cyber defense (the “Authority”), whose primary roles would be to –
- Manage, control, and carry out the overall, nationwide operational efforts to protect cyberspace, through a systemic approach that provides complete and continuous defensive solutions to cyber-attacks.
- Operate a national, economy-wide, Computer Emergency Response Team (CERT).
- Strengthen and reinforce the economy’s resilience, through preparatory measures and regularization.
- Design and implement a national cyber defense doctrine.
- Perform such duties as the Prime Minister may determine, consistent with the Authority’s designated mission.
According to the proposed decision, a National Cyber Establishment would comprise the Authority and the national cyber headquarters, as two independent units in the Prime Minister’s Office. The head of the Authority will assume full responsibility for achieving the Authority’s objectives and carrying out its mission, while the head of the national cyber headquarters will lead nationwide policy and strategy issues on cyber, competency, and reinforcement of Israel’s role as the global spearhead in the field of cyber. The new Authority is to be established over the next three years, until 2017. The Authority’s offices will be located in Israel’s center region and in Beer-Sheba.
The proposal seeks to have the national cyber headquarters establish nationwide technological infrastructures capable of detecting, identifying and deterring cyber-attacks launched against Israeli targets, and sharing information regarding such attacks. The Authority is to operate these infrastructures. In establishing the infrastructures, attention will be given to their impact on fundamental rights (regarding to the scope of data being collected, as well as its use, storage and further divulgence).
As for the Authority’s powers and its cooperation with other national security bodies, the proposal provides that such bodies will work with the Authority to promote cyber defense, through a “Cyber Defense Forum”, among other ways. The Forum’s role is to coordinate, regularize and govern joint activities of the Authority and other bodies.
The proposal would also have the national cyber headquarters prepare, with the next six months, a framework for transferring the powers regarding security of critical IT systems that are presently vested in the National Authority for Information Security pursuant to the Regularization of Security in Public Bodies Law. The proposal’s explanatory notes indicate that professionals hold the unanimous opinion that responsibilities regarding cyber defense ought to be centralized within a single organization.
The proposal would also have the national cyber headquarters prepare, with the next six months, a framework for transferring the powers regarding security of critical IT systems that are presently vested in the National Authority for Information Security pursuant to the Regularization of Security in Public Bodies Law. The proposal’s explanatory notes indicate that professionals hold the unanimous opinion that responsibilities regarding cyber defense ought to be centralized within a single organization.
The Israeli Ministry of Justice, together with the national cyber headquarters and the General Counsel of the Prime Minister’s Office, have been asked to prepare a draft bill for a Cyber Defense Law, and to evaluate the need for additional legislative amendments.