The Supreme Court heard argument last week in two cases seeking to overturn the Chevron doctrine, which requires courts to defer to administrative agencies in interpreting the statutes that the agencies administer. The cases have nothing to do with cybersecurity, but Adam Hickey thinks they're almost certain to have a big impact on cybersecurity policy. That's because, based on the argument, Chevron is going to take a beating from the Court, if it survives at all. With Chevron weakened, it will be much tougher to repurpose existing law to deal with new regulatory problems. Given how little serious cybersecurity legislation has been passed in recent years, any new regulation is bound to require some stretching of existing law – and thus to be easier to challenge.
Case in point: Even without a new look at Chevron, the EPA was balked in court when it tried to stretch its authorities to justify cybersecurity rules for water companies. Now, Kurt Sanger tells us, EPA, FBI, and CISA have combined to release cybersecurity guidance for the water sector. The guidance may be all that can be done under current law, but it's pretty generic; and there's no reason to think that underfunded water companies will actually take it to heart. Given Iran's demonstrated interest in causing aggravation and maybe worse in that sector, Congress is almost certainly going to feel pressure to act on the problem.
CISA's emergency cybersecurity directives to federal agencies are coming fast and furious. That's a bad sign, since they are a library of flaws that are already being exploited. As Adam points out, they also reveal just how quickly patches are being turned into attacks and deployed. I wonder how sustainable the current patch system will prove to be. (In fact, it's already unsustainable; we just don't have anything to replace it.)
