Both the FSF and CNet's sources are making the same complaint about the proposed bill: that it allows DHS to designate private networks as "critical national infrastructure", and that the terminology in the bill is so broad that it would allow (say) eBay to be declared critical infrastructure.

The reality is, while the bill sucks and the language is fuzzy, the intent is clear: critical private national infrastructure means air traffic control and the power grid. Maybe, under the broadest interpretation, they might call the NASDAQ ECNs part of the "nation's information infrastructure".†

The bill makes no mention of proprietary software or hardware. The FSF is apparently reacting to the notion of DHS having any authority over the operation of networks; the notional concern is, "if they can dictate operational terms, they can dictate Cisco and Microsoft". They could just as well dictate Linux or Apache.

It is a fair critique of this bill that DHS has virtually no expertise in this area (despite repeated appeals to US-CERT, which, respectishly, doesn't have the requisite expertise either).

Personally, while virtually everyone else on HN is going to disagree with me, I think it's less fair to criticize the notion of FedGov nationalizing the security of private networks in an emergency. I have several reasons for arguing this:

* * * It is simply the truth that vast amounts of our critical infrastructure are privately owned and operated, and while reasonable and mostly hands-off regulation may enable utility operators to serve the public good using their own best judgement, that same regulation does nothing to deal with malicious adversaries.

* * * The government already has the "shadow" authority to accomplish these goals. Does anyone seriously believe the President lacks the ability to nationalize power grid security in the event that an attack makes the midwest go dark? Of course he can. It's better to be explicit about that authority now, when we're not panicking over an actual technological attack, than it will be for us to create de facto new rules in a crisis.

* * * There is a real risk that companies managing critical infrastructure might not realize that their networks are critical infrastructure, or, worse, might not care. We have decades worth of track record for companies not disclosing horrible incidents for fear of economic consequences. It's one thing when a retail chain delays disclosure of credit card leaks; it's another when a grid operator gets owned up.

† Systems can be designated if "the destruction or the disruption of the reliable operation of the system or asset would cause a national or regional catastrophe"; specific factors that must be considered include whether an attack would cause "a mass casualty event with an extraordinary number of fatalities", "severe economic consequences", "mass evacuations with a prolonged absence", or "severe degradation of national security capabilities, including intelligence and defense functions".