Cybersecurity regulations face ‘uphill battle’ after Chevron ruling
-
The Biden administration has looked to regulation to strengthen cybersecurity rules, but a Supreme Court ruling threatens that effort.
President Joe Biden’s executive branch has distinguished itself on cybersecurity policy from previous administrations with its willingness to embrace regulations — often with a bit of creative lawyering involved.
But a landmark ruling by the Supreme Court last week that overturned the so-called Chevron doctrine — which holds that courts should defer to federal agencies when interpreting parts of federal law not specified by Congress — threatens to make it much more difficult for the Biden administration to put in place more stringent cybersecurity rules.
A series of damaging supply chain hacks, breaches and an epidemic of ransomware has spurred an effort in the White House to raise the cybersecurity bar across the public and private sector.
Much of that work has come in the form of new or expanded federal regulations, particularly within sectors of critical infrastructure where the government’s rulemaking authorities are often strongest.
The Supreme Court’s gutting of the Chevron doctrine threatens to compromise the legal foundation upon which that work is built.
Harley Geiger, an attorney at the law firm Venable and counsel at the Center for Cybersecurity Policy and Law, told CyberScoop that the Supreme Court’s ruling means that existing cybersecurity regulations may now be more vulnerable to court challenges, particularly ones that rely on reinterpretation of older statutes or ambiguous statutes used to write cybersecurity rules.
Because much of the foundation for the U.S. legal and regulatory system was passed into law decades ago — before the use of digital technologies were ubiquitous in society — agencies have often had to tap laws with more general purposes and argue that they can also address cybersecurity considerations.
“Congress has actually legislated relatively little when it comes to cybersecurity, including problems that are widely recognized, such as critical infrastructure cybersecurity,” Geiger said, “and this has understandably led the executive to revisit existing statutes to see where cybersecurity can fit into established missions for consumer protection, physical safety and sector oversight.”
Full article:
https://cyberscoop.com/cybersecurity-regulations-face-uphill-battle-after-chevron-ruling/