The NSA should be performing signal and human intelligence operations around the world to ensure the US can track global events. While the Internet is a key tool for this, it doesn't make them the "internet cops" of the US.
The FBI should be doing this, not the NSA, considering the FBI is actually the "US Police".
"It's really stupid to expect every station owner to solve a physical security problem themselves."
Human intelligence operations have never been part of their mandate.
It was established in 1952 by a presidential directive from Harry S. Truman in which he specified its mission as
to provide an effective, unified organization and control of the communications intelligence activities of the United States conducted against foreign governments, to provide for integrated operational policies and procedures pertaining thereto.
The FBI is an investigative agency. They aren't beat cops. They aren't soldiers. They do have a counter-intelligence role.
From a threat POV, consider how dependent on gasoline and diesel the US economy is, and what the impact of disruption would be. If an attacker could disrupt fuel supplies in key areas or highway corridors, they would cause all sorts of chaos and economic damage.
As Americans, we've been very lucky to have two oceans protect us from the shift in warfare from the battlefield to total war, with the exception of the US Civil War. Our global connectivity changed the threat landscape. That's not a police matter.
I was wrong, it should be the NSA who does this stuff.
http://www.dhs.gov/homeland-security-presidential-directive-...
In the NSAs charter, the term "National security information" refers to classified information and "sensitive but unclassified" information, and the scope includes those systems. The scope does not include protecting all systems that might have national security implications, the NSA has no regulatory authority or requirement to do this.
what he proposed is more like defense. "cyber" defense. so perhaps better as a different agency or under DOD
This should be an agreement between you and the rest of society (read: laws or standards). Government agencies responsible for the security of the nation should probably be looking into these types of things, and if they come across your RS232->Ethernet-dongle-that-explodes-Tampa they should a) notify you, b) offer assistance if required (for a price) and c) fine and/or arrest you if you are a serial offender.
Serial offender? I can't believe I just typed that...
"But they are vlanned off!"
"Why would anyone know to attack it, we keep that info confidential?"
"They wouldn't target us, we're a small company"
"The probability of this is too small to worry about, the cost/benefit is just not realistic"
"Can this really be used to do anything bad, the attacker wouldn't even know what to do"
We'd be much better off as a country if we split the NSA into half with one side basically being a sort of USDA/EPA/FEMA with the only goal of improving baseline security standards and a healthy budget for things like aggressively auditing widely used code and services.