> focusing on private-public info sharing deals that do nothing, instead of real defence

Can you elaborate? I haven't been exposed to any ideas that address this without compromising civil liberties.

That is, "real defence" sounds like the government monitoring internet connections to my company for malicious activity. I don't think that's good for business.

I might be thinking a little close-minded about it though. Please share what you mean.

It's been a couple of years since I read @War, but ISTR it described interactions between public officials and private industry that were explicitly more about politics and marketing than they were about security or risk management. E.g., NSA set up public-private dialogues with tiered access, then tantalized executives with off-the-record-but-in-a-meeting-also-attended-by-other-companies reports of server pwnage, to motivate them to sign up for the next, more stringent tier of cooperation. If the idea really were to improve security, the same information could have been distributed in truly private fashion. Also, NSA could acknowledge that private security firms are generally more helpful to companies than NSA is, and simply transfer their knowledge, when appropriate, directly to one or more NSA-vetted firms. The public actions of TLAs described in that book were far too entrepreneurial, in the sense that they didn't care what they did or what effect that had, so long as they were in the middle of everything to demonstrate their budgetary importance.

Thanks! It appears that the real problem is in the supremely suboptimal execution of a potentially acceptable vision.

I'm not sure how much explanatory power your summary has: couldn't that be a description of any government fuck-up? b^)