The Promise & Peril Of Trump’s Cyber Strategy

Is Donald Trump’s cybersecurity policy humming along at the 10-month mark of his administration, a rare space of continuity amid myriad shifts and realignments? Or is Trump blazing a new path that could set dangerous precedents in cyberspace and leave the internet more ungovernable in the future?

The answer, according to cyber analysts and former officials in Republican and Democratic administrations, might be both.

When it comes to basic management of the government’s cybersecurity responsibilities, they say, it might be difficult to distinguish Trump’s cybersecurity program from his predecessor’s.When it comes to shaping and enforcing international rules of the road in cyberspace, however, the Trump administration may be taking a step back from the US’s historic role, a move experts worry could cede ground to an anti-Democratic model for the Internet championed by US adversaries such as Russia and China.

Here’s the Good Part

The top officials leading Trump’s cyber policy, including Tom Bossert and Rob Joyce at the White House and Jeanette Manfra at the Homeland Security Department, are seasoned professionals with lengthy government resumes and are highly respected by their peers. Their policies, including a May executive order and a series of Homeland Security Department directives, are uncontroversial and largely in lockstep with government cybersecurity priorities that stretch back into the Obama administration or even earlier, former officials say.

In general, the administration has focused on shoring up federal agencies’ cybersecurity, creating consequences for digital lapses and improving the security of critical infrastructure, such as hospitals, banks and airports. The Trump team has even broken new ground on these fronts. It won praise from industry when Homeland Security banned Russian anti-virus software made by Kaspersky Lab from government systems. Transparency advocates cheered when it offered an updated policy for how the government decides whether to hoard or disclose newfound software bugs.  

The administration also could close policy loops that the Obama administration never did, such as developing a rigorous cyber deterrence policy that outlines clear consequences for criminals and adversary nations that commit cyber-crimes against the US, said Frank Cilluffo, director of George Washington University’s Center for Cyber and Homeland Security and a Bush administration cyber adviser.

These policies aren’t perfect, the experts say, but cybersecurity isn’t about perfection. It’s about marginal improvements and balancing risk. Compared with analysts’ fears about Trump’s bellicose language when he first took office, including a signal he might shift responsibility for domestic cybersecurity to the military, we’re in a pretty good place, they say.  
“If you think about executive orders and the like, there’s not that ‘holy crap, who wrote that?’ moment like with immigration,” said Peter Singer, a senior fellow who leads the cybersecurity program at the New America think tank. “Generally, I’m thinking: ‘This is reasonable; this is sensible.’”

The Divergence

When the focus shifts from the government’s day-to-day cyber protections to the US role in global cyberspace, however, the Trump administration’s record suggests a much greater divergence. To begin with, there’s the State Department cyber coordinator’s office, which former Secretary Hillary Clinton established in 2011. The office represents the US at bilateral and multilateral cyber negotiations and advocates cyber best practices to allies and developing nations belatedly entering the digital age.

Current Secretary of State Rex Tillerson shuttered that office in August as part of a larger budget and bureaucracy trimming exercise.

There’s also the United Nations’ Group of Governmental Experts in cybersecurity, a group of 20-some nations, including the US, China and Russia, that meets periodically to iron out how international law and other rules of the road, known colloquially as “norms,” apply in cyberspace. When that group’s most recent round of meetings ended without any meaningful progress earlier this year, Bossert, the White House Homeland Security Adviser, announced the US would shift to a more coalition of the willing model to pursue cyber norms.

Finally, there’s the elephant in the room: Trump’s continuing caginess about acknowledging Russia’s role in a hacking campaign and influence operation aimed at sowing chaos during the 2016 presidential election. Taken together, these shifts could undermine US leadership in cyberspace and fundamentally change what the digital world looks like a decade from now, former officials said.

A Brief History of Global Cyber Norms

The argument during the Obama administration went something like this:

Nations will use the internet to spy on each other and that can’t be stopped. But, nations should also agree that this meddling in the internet should not extend to undermining businesses, damaging critical infrastructure like nuclear and energy plants, or putting citizens and their information at risk.

When nations fail to honor these cyber norms, the US argued, other nations should ensure they suffer consequences. That could mean a retaliatory cyber strike, but more often means economic sanctions, legal indictments or military action.
Trump officials, including Bossert and Joyce, have embraced that broad argument, using phrases nearly identical to their Obama administration predecessors. But the structure itself is undermined by the administration’s actions, former officials say.
Without the State Department cyber coordinator’s office, for example, there’s no organization in government that’s solely responsible for advocating the US view of what cyberspace should look like.

That leadership void leaves emerging and non-aligned nations more vulnerable to Chinese and Russian notions of the internet. Those include strong government control over what internet content their citizens see and rules that bar foreign companies from providing some internet services or force them to disclose their source code.   

What’s more, when the State Department first launched the coordinator’s office it was the first of its kind in the world. Now, six years later, roughly 20 nations have launched similar offices in their foreign ministries following the US lead.

Deputy Secretary of State John Sullivan told the US House Foreign Affairs Committee in September that State ultimately plans to elevate its cyber mission despite closing the coordinator’s office, but he did not provide details or a timeline. State has not made any public moves on the cyber front since that hearing. Seemingly unconvinced by Sullivan, Foreign Affairs Committee Chairman Ed Royce introduced a bill that requires the cyber office to be re-installed with greater authority which has  passed the committee this month without a formal vote.

Bush administration cyber adviser Frank Cilluffo largely supports the Trump administration’s cyber efforts thus far and says he supports more aggressive bilateral cyber negotiations, though he doesn’t believe the administration should abandon multilateral efforts, such as the Group of Governmental Experts. He acknowledged, however, that the State Department has not communicated clearly enough about its cyber plans. “If the actual intent is simply to eliminate the cyber coordinator’s position and not build something as robust in its place, then I deeply oppose that,” Cilluffo said.  

The Cozy Bear in the Room

It’s Trump’s unwillingness to consistently acknowledge Russia’s culpability for meddling in the 2016 election, however, that does the most damage by far to American efforts to impose rules upon global cyberspace, former officials of both parties said.

Failing to consistently advocate for good behavior in cyberspace is one thing, they said. Failing to impose consequences for bad behavior is another.

Russia’s behavior, both during the 2016 election and since then, including meddling in European elections and breaching previously off-limits targets such as energy and nuclear plants, is the most egregious flouting of global cyber norms to date, they said. And, because there can’t be presidential buy-in, there have been, so far, few consequences.

Even Russian sanctions that Congress passed over the president’s disapproval have yet to be fully implemented.  
“We would like our allies and partners and as much of the international community as possible to see that responding to cyber threats is legitimate and, in order to make that case, you can’t fail to respond to what is clearly the number one cybersecurity challenge of the day,” said Jim Miller, a former undersecretary of defense for cyber policy during the Obama administration and president of the consultancy Adaptive Strategies.

The result of this is two-fold. In the short term, it signals to Russia that it can continue to play fast and loose with pro-democratic cyber norms that the US and other western nations have tried to establish. Second, it signals to other nations and non-state actors that similar cyber mischief will go unpunished.

Defense One

You Might Also Read: 

Trump Tells US Cyber Command To Get More Aggressive:

Trump's Top Cybersecurity Advisors Resign:

Loss Of Cyber Expertise Is A Problem For Trump:

 

« Australia To Challenge Facebook & Google Over Media Disruption
Russia Is Providing North Korea With Internet Connectivity »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

ISACA

ISACA

ISACA is a global professional association and learning organization for members who work in information security, governance, assurance, rissk and privacy.

Qualitest Group

Qualitest Group

Qualitest is the world’s largest pure play Quality Assurance and software testing company.

Illumio

Illumio

Illumio delivers adaptive security for every computing environment, protecting the 80% of data center and cloud traffic missed by the perimeter.

BPC Banking Technologies

BPC Banking Technologies

BPC’s advanced fraud prevention solution helps card issuers and acquirers combat the growing threat by monitoring 100% of transactions, online, in real-time across all channels.

UM Labs

UM Labs

UM Labs is a developer of security products for Voice over IP (VoIP), protecting SIP trunk connections, safeguarding mobile phone communications and enabling BYOD.

Upstream Security

Upstream Security

Upstream Security is the first cloud-based cyber-security solution that protects the technologies and applications of connected and autonomous vehicles.

Asoftnet

Asoftnet

Asoftnet are specialists in IT security, IT forensics, IT service, websites, applications and mobile solutions.

ThirdWatch

ThirdWatch

ThirdWatch is a Data Science company with real-time automated fraud prevention solutions.

NOW Insurance

NOW Insurance

NOW Insurance provides small business owners and other professional classes with a seamless purchasing experience for general liability, professional liability, and cybersecurity insurance coverage.

Nardello & Co

Nardello & Co

Nardello & Co. is a global investigations firm with experienced professionals handling a broad range of issues including Digital Investigations & Cybersecurity.

Digital Identification & Authentication Council of Canada (DIACC)

Digital Identification & Authentication Council of Canada (DIACC)

DIACC is a non-profit coalition of public and private sector leaders committed to developing a Canadian framework for digital identification and authentication.

NWN Corp

NWN Corp

NWN Corporation is a leading Cloud Communications Service Provider (CCSP) focused on transforming the customer and workspace experience for commercial, enterprise and public sector organizations.

Aura

Aura

Aura is a mission driven technology company dedicated to creating a safer internet for everyone. We’re making comprehensive digital security that's simple to understand and easy to use.

Federal Bureau of Investigation (FBI)

Federal Bureau of Investigation (FBI)

The mission of the FBI is to protect and defend against intelligence threats, uphold and enforce criminal laws, and provide criminal justice services.

American Technology Services (ATS)

American Technology Services (ATS)

American Technology Services provides unparalleled services in information technology to support small and mid-sized business. From top-level strategy, to managed services and infrastructure support.

Delta Partners

Delta Partners

Delta Partners is a venture capital firm investing in Ireland and the United Kingdom with a strong focus on early stage technology companies.