The US Government has released a much-anticipated online security plan, outlining a national strategy to protect computer systems from possible cyber attacks.

When a nation, terrorist group, or other adversary attacks the United States through cyberspace, the US response need not be limited to criminal prosecution National Strategy to Secure Cyberspace plan

The 76-page plan urges internet users and private companies to practise "safe computing" and develop greater co-ordination with government agencies.

But unlike earlier drafts, which required the private sector to protect systems, the revised plan only states that the government should lead internet users by example.

Some experts have already criticised the new strategy as toothless, saying online security in the US will remain dismal unless businesses make it an absolute priority.

Right to strike back

The White House quietly posted the new plan on its web site on Friday, arguing that the low-key release was appropriate amid a heightened security alert in the country.

The National Strategy to Secure Cyberspace sets outs five key priorities for the government and private sector:

• Set up a security response system;

• Identify threats and vulnerabilities;

• Increase awareness and training;

• Secure the government's cyber space;

• Increase national and international security co-operation.

The plan places many government responsibilities with the newly-created Department of Homeland Security, which is now expected to respond to any cyber attacks.

The document also states that other US intelligence agencies should be encouraged to track down such attacks and even strike back.

"When a nation, terrorist group, or other adversary attacks the United States through cyberspace, the US response need not be limited to criminal prosecution," it says.

"The United States reserves the right to respond in an appropriate manner."

Encouragement

But the document places few new requirements on the private sector that controls up to 85% of the global computer network.

It limits the government's role to mere encouragement of businesses to keep their networks secure and promote greater use of anti-virus programmes and other security tools.

"In general, the private sector is best equipped and structured to respond to an evolving cyber threat," the document says.

"A federal role... is only justified when the benefits of intervention outweigh the associated costs".