Gary Corn is director of the Technology, Law & Security Program at the American University Washington College of Law, and former staff judge advocate to U.S. Cyber Command.
Technology, especially in cyberspace, is rapidly shifting the center point of national security from the public to the private sector. For decades, the borderless, predominantly civilian-owned and civilian-operated environment of cyberspace has placed individuals and companies on the front lines of cybercrime and conflict, while the government has struggled to keep pace with the speed and scale of these threats.
Whether the Trump administration’s recent national security presidential memorandum on cybercrime is a step in the right direction or the opening of a Pandora’s box is uncertain. But it is at least recognition that the status quo is unsustainable.
Since the 1648 Treaty of Westphalia, the international order has operated on the basis of a core premise — that states hold a monopoly over the use of force or coercion in furtherance of public security. Both international and domestic law condemn private wars and vigilantism. But given the unparalleled scale and persistence of cyberthreats and the mostly civilian nature of their targets, that premise is beginning to fray.
The year-over-year increase in both criminal and nation-state cyberattacks exceeds the government’s capacity to prevent or even disrupt them. Instead, the private sector bears the brunt of the battle. Examples like Colonial Pipeline, the 2021 ransomware attack that temporarily paralyzed the fuel distributor’s operations and caused panic up and down the East Coast, and Volt Typhoon, China’s hacking of U.S. critical infrastructure, are just the tip of the iceberg. And artificial intelligence will inevitably increase the already record level of ransomware and other malicious operations.
The data critical to defending against cyberthreat actors resides principally on the networks of those with little to no authority to act beyond their networks, while the federal departments and agencies that have the authority often lack access to the data. And as evidenced by the recent roller-coaster ride of the on-again, off-again Cybersecurity Information Sharing Act of 2015, the means of sharing threat information are insufficient and ephemeral, which creates untenable holes in the intelligence picture.
Enlisting the private sector in combating cyberthreats is neither novel nor controversial. Across administrations and within industry, there has been a growing recognition that disrupting cyberthreats and criminal ecosystems requires more public-private collaboration. Such collaboration already happens in an ad hoc fashion and has produced some successes, albeit limited and sporadic. The administration’s new policy is a partial step toward making better use of private-sector capacity and routinizing collaboration.
Implementing the policy is not risk-free. How, to what degree and under what authority and oversight this collaboration should proceed are difficult and profoundly important questions. Unfortunately, the new policy raises at least as many questions as it answers.
The policy is relatively clear about what it does and does not authorize. It does not authorize the proverbial “hack back” authority — allowing independent cyber-counterattacks — that some in Congress and elsewhere advocate. It does not “unleash the private sector,” or permit private actors to engage in cyber-vigilantism. Nor should it. The government should not abdicate, through outsourcing or otherwise, its responsibility for providing national and individual security and for managing the risks that come with that responsibility.
The policy simply tasks the nascent National Coordination Center (NCC) with creating, managing and maintaining a program to authorize vetted and bonded companies to conduct surveillance and disruptive operations against a limited category of cyberthreat actors — Cyber-Enabled Transnational Criminal Organizations, or CE-TCOs — under, importantly, federal government control and oversight. The devilish details, however, lie in implementing this tasking.
Conducting the operations contemplated under the program will carry myriad practical and legal risks for both the participating companies and the nation. In theory, the government’s control and oversight of the operations will mitigate some of these risks — possibly by cloaking companies with the same immunity from criminal and civil liabilities that covers the law enforcement officials overseeing the operations, and by guarding against companies pursuing the wrong targets or causing unwanted collateral effects. However, this immunity protects only against domestic legal risks and cannot guard against cyber or physical retaliation aimed at company personnel or infrastructure, or other targets.
As for risk to the nation, the United States will bear full responsibility under international law for the companies’ operations, even if they deviate from approved plans. Given the exceptionally high ceiling the policy sets for prohibited “critical outcomes” — death, injury or armed attacks — this risk is significant. And notwithstanding the policy’s limited definition of CE-TCOs, it’s inevitable that some targets will overlap with non-law-enforcement government cyber-operations, creating mission risks that will require robust deconfliction and synchronization procedures.
All of which raises the question of whether the NCC will have the resources, infrastructure and expertise necessary to exercise effective control and oversight over the companies’ activities, as well as the related question of what the administration considers sufficient control and oversight within this framework to manage the risks lawfully and responsibly.
Some have described the memo as a significant policy shift in that “private companies will be authorized to conduct cyber-operations that were previously restricted to government entities.” This is an overstatement. The government has used contractors to augment cyber-operational capacity for years. What is potentially different here are the contemplated scale and perhaps shifting visions of what control and oversight mean.
As of yet, there is little meat on the bones of this new initiative. Managing the numerous, at times crosscutting, risks will be key to effective implementation.
There is no question that the government needs to adapt to the reality of the evolving civilianization of the security environment. It should do so boldly, quickly, but carefully.
The post Why empowering private companies to fight cybercrime had to happen appeared first on Washington Post.
