Cybercrime
,
Fraud Management & Cybercrime
,
Government
Bold Plan Raises Hard Questions About Execution, Liability and Oversight
The Trump administration’s new national cybersecurity strategy calls for a stronger partnership between the federal government and private companies, heralding a shift in the ways private enterprise could participate in offensive operations against nation-state adversaries, ransomware gangs and cybercriminals.
See Also: New Attacks. Skyrocketing Costs. The True Cost of a Security Breach.
The strategy outlines six pillars of action, and executive orders are expected to follow that outline the specifics of each, but the strategy is sparse and many details remain unclear. Pillar 1 – “Shape Adversary Behavior” – states that the government will “unleash the private sector by creating incentives to identify and disrupt adversary networks and scale our national capabilities.”
Many companies already play a role in identifying and analyzing cyberthreats, but the emphasis on offensive capabilities marks a shift in how the administration intends to focus resources and it raises questions about liability and responsibility.
“There’s nothing that a company could legally do that they couldn’t legally do yesterday, as a result of the strategy coming out,” said Michael Daniel, president and CEO of the Cyber Threat Alliance and former White House Cybersecurity Coordinator. “What’s changed is that this solidifies what the administration has been signaling for several months, which is that they want to take a more aggressive stance in cyberspace and they want the private sector to be part of that.”
The strategy overall doesn’t offer much new policy but it does bring a new emphasis to the administration’s more aggressive posture, said Ari Schwartz, managing director of cybersecurity services at Venable LLP and a former White House senior director for cybersecurity.
“But if you’re talking about what they’re emphasizing and the words they’re using and the order they put it in, that is all very different,” he said. “They’ve taken what’s usually the quiet part of the strategy and said the quiet part out loud, put it right at the front of the document.”
Where the Private Sector Adds Value
Cybersecurity and network providers already control much of the infrastructure that enable cyber defense, and many are monitoring threats in real time.
“Between pure cyber companies, cloud service providers and major telcos, they collectively own and operate what we would call 90% to 95% of the gray space,” said Daniel Kroese, vice president of public policy and government affairs at Palo Alto Networks and a former CISA official. This infrastructure gives the private sector visibility into adversary behavior that could enable takedowns and other deterrence activities without the private sector needing to go on the offensive, he said.
Artificial intelligence-powered security operations centers are another untapped resource, Kroese said. “In 70% of our incident response cases, logging exists that should have tipped off the defender that something anomalous was happening,” he said. “But they couldn’t find it in time. So, you had invested in the thing to give you the log to tell you that something might be wrong, but you didn’t actually see that thing in time.” AI could provide a “huge step function improvement” in defense, he said.
The private sector also has a wealth of threat data that’s continually being updated. “We’ve got a very strong repository of threat data over 30 years that’s constantly being updated,” said Tom Gann, chief public policy officer at cybersecurity firm Trellix. “That library of threat data coupled with incoming data that we organize and collate – that’s the kind of data that we can feed in real time to organizations that are taking action.”
And companies often detect cyberattacks before governments do because of the vast numbers of endpoints and networks they monitor across industries. “The sooner the good guys – the government and the private sector – know about how a threat actor is acting and what methods and tactics they’re using,” Gann said, “the faster the government can take some action.”
The Legal Obstacle Course
While the administration may want a more aggressive role for the private sector in fighting cybercriminals, the strategy could create dangerous ambiguity about what is and isn’t authorized with potentially serious consequences.
Statutes including the Computer Fraud and Abuse Act and many state and international laws criminalize accessing systems without authorization. And actions taken on behalf of a government could open companies up to a host of liability concerns – including being considered an “agent” of the U.S. government in an act of war.
“If we go down the hack-back route, you end up in this situation where another country might consider an action to be sanctioned by the government, and there’s also the false flag type situation, so then everyone ends up sort of hacking each other based on who they think is hacking them,” Schwartz said.
Daniel said that another complicating factor is the way adversaries often route their operations through hijacked infrastructure, like hospitals and universities, and a company acting without full knowledge of how adversaries are working “could have some serious unintended consequences,” he said.
It also blurs the lines between civilian and combatant. “If you engage in that activity, do you become a combatant? Are you now no longer a civilian because you’ve carried out, by any definition, an attack? Does that remove your civilian protections under the laws of war, which make you a legitimate target for somebody else to retaliate against?” Daniel said.
Schwartz echoed these concerns that companies acting on behalf of the government could open themselves up to compliance obligations. “They’re concerned about being an agent of the government,” Schwartz said. “If they take the action at the behest of the government, then do they have to follow every law that the government also has to follow, and every procedure that the government has to follow? It needs to be clear that it’s the government that’s taking the action.”
Gann was unequivocal on his company’s position. “Trellix is not involved in the business of doing offensive cybersecurity operations, and we don’t envision ourselves doing that,” he said. “The government has far greater deterrent capabilities to legally deploy than the private sector does.”
“There are lots of these kinds of questions that you would need to think through,” Daniel said. “And I think that’s why the number of companies that would actually seriously do that sort of thing is really small.”
What Incentives Could Work
While the strategy doesn’t outline any incentives, experts outlined several that could move the needle and spur private sector involvement.
Reauthorizing the Cybersecurity Information Sharing Act of 2015, currently operating on a short-term extension, would help. The law provides liability protections for companies that share cyberthreat intelligence with the government and with each other.
Kroese, who helped draft the original legislation, said a decade-long reauthorization would send a powerful signal to the industry. “We shouldn’t be sharing information just for the sake of sharing information,” Kroese said. “The public and private sector should come together to share information not just to pat each other on the back, but so we can actually drive risk reduction.”
Daniel said that giving internet service providers and telecom companies liability protections when they disrupt malicious traffic on their networks would also act as an incentive.
“Right now our ISPs and telecommunications companies could disrupt more malicious traffic that they know is transiting their networks, but they really have no incentive to do that because it’s all downside and no upside for them,” he said. “If they get something wrong, they get sued. If they get something right, they get nothing.”
Tax credits for cybersecurity research and development, sharing classified threat data with cleared private-sector partners and streamlining information-sharing processes could all be meaningful. “You could see incentives for companies to receive tax breaks for doing more R&D on cybersecurity capabilities,” Gann said, particularly technologies that improve automated detection and response to cyberattacks.
While many ambiguities linger, Gann’s said bringing both sides together will ultimately improve the government’s ability to protect against cyberattacks.
“This is the start of the race,” Gann said. “It’s going to take two to three years to really get implemented.”