US cyber chief issues corporate hacking warning

To boost security against terrorist attacks, US intelligence agencies and some legislators want the government to have more access to personal information collected by companies.

The top US intelligence official charged with protecting critical infrastructure such as power stations and financial markets from cyber attacks, says business leaders should assume hackers are penetrating their networks and advised not to simply delegate defense strategies to subordinated technical experts.

Mike Rogers, commander of US Cyber Command and National Security Agency (NSA) director, said cyber security should be a major priority for company boards and chief executives.

In the wake of North Korea's damaging cyber attack on Sony Pictures and the growing threat of state-sponsored hacking by Russia and China against private firms and governments, Mr Rogers said leaders must set the cultural ethos for taking on responsibility for cyber protection.

"The idea that you can have no knowledge of any of this and … this is what my CIO [chief information officer] or CTO [chief technology officer] does, those days are long past us now," Mr Rogers said in an address to business leaders in New York.

"We must increasingly assume that despite our best efforts, they're going to get in," he added.

"So how do you drive them out and how do you do it in a way that you don't shut down the network?"

Wall Street firms could face 'cyber 9/11' attack 

Mr Rogers was the keynote speaker on Tuesday night at the New York Global Leaders Dialogue set up by Australian Phil Scanlan and attended by international business and government luminaries including ambassador to the US, Kim Beazley.

In the financial sector, a New York regulator last week warned Wall Street firms could face a "cyber 9/11" attack that caused significant disruption in the financial system. Ben Lawsky, head of New York's Department of Financial Services, said an Armageddon-type cyber event could "spill over into the broader economy".

JP Morgan and Target have admitted personal customer data were stolen by hackers last year.

The Pyongyang-sponsored attacks on Sony last December forced it to cancel screening The Interview, a satirical political movie featuring journalists ordered to assassinate North Korean leader Kim Jong-un after a scheduled interview. The financial costs are estimated to have exceeded $US100 million, after North Korea launched the action via a web of servers in Asia, Europe and North America.

Alluding to the crippling assault, Mr Rogers said that cyber scams were difficult for governments and businesses to counter, because cyber did "not recognize geographic boundaries.

"I think it is a challenge to expect the private sector to take on the efforts of a nation state to attempt to penetrate it," Mr Rogers said, calling for international co-operation so governments and business could effectively share information.

More access to collected personal information

To boost security against terrorist attacks, US intelligence agencies and some legislators want the government to have more access to personal information collected by companies, particularly Silicon Valley technology giants.

The NSA has advocated for the building of so-called "backdoors" to allow the US and other governments to spy on selected users, a proposal that has upset the likes of Google and Facebook.

Civil libertarians and privacy advocates are worried the government may overreach.

Mr Rogers said a strong legal framework was required to get the balance right, noting the analogue-era laws did not reflect the rapid developments in digital technology.

The US Patriot Act governing wiretaps, searches of business records and surveillance of possible terrorists expires on May 31. Congress will consider extending and broadening its reach.

Under beefed-up security measures proposed in Australia, the government is pushing laws to require internet service providers to retain metadata for two years so authorities can trace who was accessing an IP address via their phones or computer.