President's Commission on Enhancing National Cybersecurity

President's Commission on Enhancing National Cybersecurity
Name	President's Commission on Enhancing National Cybersecurity
Formed	2016
Dissolved	2017
Type	Advisory body
Jurisdiction	United States
Chair	Tom Donilon
Vicechair	Ronald D. Sugar
Report	2016 Final Report

President's Commission on Enhancing National Cybersecurity was a presidential advisory commission convened by Barack Obama in 2016 to assess vulnerabilities and propose reforms to strengthen United States cyber resilience. The commission issued a comprehensive final report during the administration of Barack Obama that informed policy deliberations in the United States Department of Defense, United States Department of Homeland Security, and the National Security Agency. Its findings influenced subsequent initiatives under the Donald Trump and Joe Biden administrations involving public-private partnerships and regulatory proposals.

Background and Establishment

The commission was announced by Barack Obama in the aftermath of high-profile incidents such as the Office of Personnel Management data breach, the Sony Pictures Entertainment hack, and alleged intrusions linked to the 2016 United States presidential election. It was chartered to respond to threats highlighted by prior inquiries including the 2013 Data Breach at Target Corporation and reports from the 1st U.S. Cyberspace Policy Review and the Presidential Policy Directive 20. The commission drew on precedent from advisory bodies such as the Commission on the Intelligence Capabilities of the United States Regarding Weapons of Mass Destruction and the 9/11 Commission to produce actionable recommendations for agencies like the Federal Bureau of Investigation, the Department of Commerce, and the Federal Communications Commission.

Membership and Leadership

The commission was chaired by Tom Donilon, a former National Security Advisor, with vice chair Ronald D. Sugar, former Lockheed Martin chief executive, providing industry leadership. Members included executives and leaders from technology and finance such as Eric Schmidt of Alphabet Inc., Michael Chertoff of Chertoff Group, Aneesh Chopra formerly of the Office of the United States Chief Technology Officer, Mieke Eoyang of Third Way, and Katie Arrington from the private sector. The roster featured senior figures from Microsoft, Amazon, IBM, Intel, JPMorgan Chase, Bank of America, academic institutions including Massachusetts Institute of Technology, Stanford University, and think tanks like the Brookings Institution and the Heritage Foundation.

Mandate and Objectives

The commission's mandate directed it to evaluate critical United States infrastructure vulnerabilities, coordinate recommendations across agencies including the Cybersecurity and Infrastructure Security Agency, and propose incentives for technology adoption by private entities such as Energy companies and Financial Services Sector firms. Objectives encompassed advancing workforce development initiatives parallel to programs at National Institute of Standards and Technology and expanding research partnerships involving the Defense Advanced Research Projects Agency and the National Science Foundation. It also sought to frame policy options compatible with legislation like the Federal Information Security Modernization Act of 2014 and regulatory authorities of the Securities and Exchange Commission.

Key Findings and Recommendations

The commission's final report emphasized modernization of legacy systems in Department of Veterans Affairs and state agencies, universal adoption of strong authentication technologies exemplified by standards from the Internet Engineering Task Force, and accelerated deployment of secure cloud architectures promoted by National Institute of Standards and Technology. It recommended establishing incentives for cyber risk disclosure coordinated with the Securities and Exchange Commission and creating tax incentives similar to prior credits under the Internal Revenue Service to spur investment in cyber defenses. Other recommendations included expanding cyber workforce pipelines via partnerships with institutions such as Carnegie Mellon University and University of California, Berkeley, and bolstering international norms through engagement with bodies like the United Nations and NATO's Cooperative Cyber Defence Centre of Excellence.

Implementation and Impact

Several proposals informed policy actions: elements influenced the formation of the Cybersecurity National Action Plan's successor programs, contributed to updates in National Institute of Standards and Technology guidance, and shaped procurement reforms within Department of Defense acquisition pathways. Private-sector adoption of recommended best practices appeared in initiatives by Microsoft and Amazon Web Services offering stronger identity management and encryption services, while financial institutions including JPMorgan Chase and Goldman Sachs increased cyber investment and disclosure. The commission's emphasis on public-private collaboration echoed in partnerships with InfraGard and the Financial Services Information Sharing and Analysis Center.

Criticism and Controversies

Critics from Electronic Frontier Foundation and privacy advocates referenced potential conflicts of interest due to industry representation from companies such as Lockheed Martin and Alphabet Inc., arguing that recommendations favored private-sector priorities over consumer protections enforced by the Federal Trade Commission. Civil liberties organizations including American Civil Liberties Union raised concerns that proposals regarding information sharing and expanded authorities for the Federal Bureau of Investigation might erode privacy safeguards enshrined in legislation like the Privacy Act of 1974. Journalists at outlets such as The New York Times and The Washington Post scrutinized the commission's composition and the implementability of its tax-incentive proposals in the context of congressional budget constraints, notably during deliberations in the 114th United States Congress.

Category:United States national security commissions