IU cybersecurity expert says government hasn't done enough to protect data

“The government’s not nearly done what it should,” said Fred Cate, Indiana University professor of law and senior fellow with the IU Center for Applied Cybersecurity Research. “We have no obligation to protect data.”

Compare it to a car: There are safety measures that need to be in place, such as seat belts and air bags, tests that need to be done and other requirements met. But for cybersecurity, none of those safety rules and regulations exist, Cate said.

And attacks are becoming more sophisticated and strategic. Cate pointed to the recent security breach at Sony and how information was “rolled out” over a period of days, a kind of orchestrated event.

“When we think about the risk of attacks, what we are seeing a lot more of are organized attacks,” Cate said.

President Obama raised the issue in his State of the Union speech, calling for legislation to encourage information sharing between businesses and the government. Committees in both the U.S. Senate and House have met this week to discuss cybersecurity.