The Promise & Peril Of Trump’s Cyber Strategy

Is Donald Trump’s cybersecurity policy humming along at the 10-month mark of his administration, a rare space of continuity amid myriad shifts and realignments? Or is Trump blazing a new path that could set dangerous precedents in cyberspace and leave the internet more ungovernable in the future?

The answer, according to cyber analysts and former officials in Republican and Democratic administrations, might be both.

When it comes to basic management of the government’s cybersecurity responsibilities, they say, it might be difficult to distinguish Trump’s cybersecurity program from his predecessor’s.When it comes to shaping and enforcing international rules of the road in cyberspace, however, the Trump administration may be taking a step back from the US’s historic role, a move experts worry could cede ground to an anti-Democratic model for the Internet championed by US adversaries such as Russia and China.

Here’s the Good Part

The top officials leading Trump’s cyber policy, including Tom Bossert and Rob Joyce at the White House and Jeanette Manfra at the Homeland Security Department, are seasoned professionals with lengthy government resumes and are highly respected by their peers. Their policies, including a May executive order and a series of Homeland Security Department directives, are uncontroversial and largely in lockstep with government cybersecurity priorities that stretch back into the Obama administration or even earlier, former officials say.

In general, the administration has focused on shoring up federal agencies’ cybersecurity, creating consequences for digital lapses and improving the security of critical infrastructure, such as hospitals, banks and airports. The Trump team has even broken new ground on these fronts. It won praise from industry when Homeland Security banned Russian anti-virus software made by Kaspersky Lab from government systems. Transparency advocates cheered when it offered an updated policy for how the government decides whether to hoard or disclose newfound software bugs.  

The administration also could close policy loops that the Obama administration never did, such as developing a rigorous cyber deterrence policy that outlines clear consequences for criminals and adversary nations that commit cyber-crimes against the US, said Frank Cilluffo, director of George Washington University’s Center for Cyber and Homeland Security and a Bush administration cyber adviser.

These policies aren’t perfect, the experts say, but cybersecurity isn’t about perfection. It’s about marginal improvements and balancing risk. Compared with analysts’ fears about Trump’s bellicose language when he first took office, including a signal he might shift responsibility for domestic cybersecurity to the military, we’re in a pretty good place, they say.  
“If you think about executive orders and the like, there’s not that ‘holy crap, who wrote that?’ moment like with immigration,” said Peter Singer, a senior fellow who leads the cybersecurity program at the New America think tank. “Generally, I’m thinking: ‘This is reasonable; this is sensible.’”

The Divergence

When the focus shifts from the government’s day-to-day cyber protections to the US role in global cyberspace, however, the Trump administration’s record suggests a much greater divergence. To begin with, there’s the State Department cyber coordinator’s office, which former Secretary Hillary Clinton established in 2011. The office represents the US at bilateral and multilateral cyber negotiations and advocates cyber best practices to allies and developing nations belatedly entering the digital age.

Current Secretary of State Rex Tillerson shuttered that office in August as part of a larger budget and bureaucracy trimming exercise.

There’s also the United Nations’ Group of Governmental Experts in cybersecurity, a group of 20-some nations, including the US, China and Russia, that meets periodically to iron out how international law and other rules of the road, known colloquially as “norms,” apply in cyberspace. When that group’s most recent round of meetings ended without any meaningful progress earlier this year, Bossert, the White House Homeland Security Adviser, announced the US would shift to a more coalition of the willing model to pursue cyber norms.

Finally, there’s the elephant in the room: Trump’s continuing caginess about acknowledging Russia’s role in a hacking campaign and influence operation aimed at sowing chaos during the 2016 presidential election. Taken together, these shifts could undermine US leadership in cyberspace and fundamentally change what the digital world looks like a decade from now, former officials said.

A Brief History of Global Cyber Norms

The argument during the Obama administration went something like this:

Nations will use the internet to spy on each other and that can’t be stopped. But, nations should also agree that this meddling in the internet should not extend to undermining businesses, damaging critical infrastructure like nuclear and energy plants, or putting citizens and their information at risk.

When nations fail to honor these cyber norms, the US argued, other nations should ensure they suffer consequences. That could mean a retaliatory cyber strike, but more often means economic sanctions, legal indictments or military action.
Trump officials, including Bossert and Joyce, have embraced that broad argument, using phrases nearly identical to their Obama administration predecessors. But the structure itself is undermined by the administration’s actions, former officials say.
Without the State Department cyber coordinator’s office, for example, there’s no organization in government that’s solely responsible for advocating the US view of what cyberspace should look like.

That leadership void leaves emerging and non-aligned nations more vulnerable to Chinese and Russian notions of the internet. Those include strong government control over what internet content their citizens see and rules that bar foreign companies from providing some internet services or force them to disclose their source code.   

What’s more, when the State Department first launched the coordinator’s office it was the first of its kind in the world. Now, six years later, roughly 20 nations have launched similar offices in their foreign ministries following the US lead.

Deputy Secretary of State John Sullivan told the US House Foreign Affairs Committee in September that State ultimately plans to elevate its cyber mission despite closing the coordinator’s office, but he did not provide details or a timeline. State has not made any public moves on the cyber front since that hearing. Seemingly unconvinced by Sullivan, Foreign Affairs Committee Chairman Ed Royce introduced a bill that requires the cyber office to be re-installed with greater authority which has  passed the committee this month without a formal vote.

Bush administration cyber adviser Frank Cilluffo largely supports the Trump administration’s cyber efforts thus far and says he supports more aggressive bilateral cyber negotiations, though he doesn’t believe the administration should abandon multilateral efforts, such as the Group of Governmental Experts. He acknowledged, however, that the State Department has not communicated clearly enough about its cyber plans. “If the actual intent is simply to eliminate the cyber coordinator’s position and not build something as robust in its place, then I deeply oppose that,” Cilluffo said.  

The Cozy Bear in the Room

It’s Trump’s unwillingness to consistently acknowledge Russia’s culpability for meddling in the 2016 election, however, that does the most damage by far to American efforts to impose rules upon global cyberspace, former officials of both parties said.

Failing to consistently advocate for good behavior in cyberspace is one thing, they said. Failing to impose consequences for bad behavior is another.

Russia’s behavior, both during the 2016 election and since then, including meddling in European elections and breaching previously off-limits targets such as energy and nuclear plants, is the most egregious flouting of global cyber norms to date, they said. And, because there can’t be presidential buy-in, there have been, so far, few consequences.

Even Russian sanctions that Congress passed over the president’s disapproval have yet to be fully implemented.  
“We would like our allies and partners and as much of the international community as possible to see that responding to cyber threats is legitimate and, in order to make that case, you can’t fail to respond to what is clearly the number one cybersecurity challenge of the day,” said Jim Miller, a former undersecretary of defense for cyber policy during the Obama administration and president of the consultancy Adaptive Strategies.

The result of this is two-fold. In the short term, it signals to Russia that it can continue to play fast and loose with pro-democratic cyber norms that the US and other western nations have tried to establish. Second, it signals to other nations and non-state actors that similar cyber mischief will go unpunished.

Defense One

You Might Also Read: 

Trump Tells US Cyber Command To Get More Aggressive:

Trump's Top Cybersecurity Advisors Resign:

Loss Of Cyber Expertise Is A Problem For Trump:

 

« Australia To Challenge Facebook & Google Over Media Disruption
Russia Is Providing North Korea With Internet Connectivity »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

EIT Digital

EIT Digital

EIT Digital is a leading digital innovation and entrepreneurial education organisation driving Europe’s digital transformation. Areas of focus include digital infrastructure and cyber security.

Certus Software

Certus Software

Our Secure Data Erasure solutions protect customer data confidentiality by completely erasing it from data storage devices.

Compass Security

Compass Security

Compass Security is a specialist IT Security consultancy firm based in Switzerland. Services include pentesting, security assessments, digital forensics and security training.

Core Security

Core Security

Core Security provides threat-aware identity, access, authentication and vulnerability management solutions.

Nextcloud

Nextcloud

Nextcloud offers offers solutions to the combined need of security and ubiquitous access to data and collaboration technology.

Asvin

Asvin

Asvin provides secure update management and delivery for Internet of Things - IoT Edge devices.

Global Cyber Security Capacity Centre (GCSCC) - Oxford University

Global Cyber Security Capacity Centre (GCSCC) - Oxford University

GCSCC's work is focused on developing a framework for understanding what works, what doesn’t work and why – across all areas of cybersecurity capacity.

Splone

Splone

Splone is a Berlin-based IT security research team and consultancy. We help improve IT-security by offering red team assements, penetration tests, audits and customized consulting.

GRSi

GRSi

GRSi deliver next-generation systems engineering, cybersecurity, technology insertion and best practices-based Enterprise Operations (EOps) management.

Verichains

Verichains

Verichains Lab is a pioneer and leading APAC blockchain security firm with extensive expertise in the areas of security, cryptography and core blockchain technology.

Cybecs Security Solutions

Cybecs Security Solutions

Cybecs was founded to address rapid technological advancement, changing business models, global privacy regulations, and increasing cyber threats for global organizations.

Leaf IT

Leaf IT

Leaf IT are a pioneering cloud-first MSP, dedicated to helping businesses in the UK and Ireland. We focus on delivering tangible results for our clients through IT transformation.

Secure Halo

Secure Halo

Secure Halo has been protecting the intellectual assets and sensitive information of the federal government and private sector for 20+ years, through our proactive approach to risk and cybersecurity.

Dedagroup (Deda)

Dedagroup (Deda)

Dedagroup provide application solutions and IT services to bring innovation at the core of business processes.

CoGuard

CoGuard

CoGuard is a patented solution that uses AI driven automation to provide fast, cost effective white-box penetration testing, infrastructure audits and infrastructure design services.

Apexanalytix

Apexanalytix

Apexanalytix is a leading provider of supplier onboarding, risk management and recovery solutions.