The Promise & Peril Of Trump’s Cyber Strategy

Is Donald Trump’s cybersecurity policy humming along at the 10-month mark of his administration, a rare space of continuity amid myriad shifts and realignments? Or is Trump blazing a new path that could set dangerous precedents in cyberspace and leave the internet more ungovernable in the future?

The answer, according to cyber analysts and former officials in Republican and Democratic administrations, might be both.

When it comes to basic management of the government’s cybersecurity responsibilities, they say, it might be difficult to distinguish Trump’s cybersecurity program from his predecessor’s.When it comes to shaping and enforcing international rules of the road in cyberspace, however, the Trump administration may be taking a step back from the US’s historic role, a move experts worry could cede ground to an anti-Democratic model for the Internet championed by US adversaries such as Russia and China.

Here’s the Good Part

The top officials leading Trump’s cyber policy, including Tom Bossert and Rob Joyce at the White House and Jeanette Manfra at the Homeland Security Department, are seasoned professionals with lengthy government resumes and are highly respected by their peers. Their policies, including a May executive order and a series of Homeland Security Department directives, are uncontroversial and largely in lockstep with government cybersecurity priorities that stretch back into the Obama administration or even earlier, former officials say.

In general, the administration has focused on shoring up federal agencies’ cybersecurity, creating consequences for digital lapses and improving the security of critical infrastructure, such as hospitals, banks and airports. The Trump team has even broken new ground on these fronts. It won praise from industry when Homeland Security banned Russian anti-virus software made by Kaspersky Lab from government systems. Transparency advocates cheered when it offered an updated policy for how the government decides whether to hoard or disclose newfound software bugs.  

The administration also could close policy loops that the Obama administration never did, such as developing a rigorous cyber deterrence policy that outlines clear consequences for criminals and adversary nations that commit cyber-crimes against the US, said Frank Cilluffo, director of George Washington University’s Center for Cyber and Homeland Security and a Bush administration cyber adviser.

These policies aren’t perfect, the experts say, but cybersecurity isn’t about perfection. It’s about marginal improvements and balancing risk. Compared with analysts’ fears about Trump’s bellicose language when he first took office, including a signal he might shift responsibility for domestic cybersecurity to the military, we’re in a pretty good place, they say.  
“If you think about executive orders and the like, there’s not that ‘holy crap, who wrote that?’ moment like with immigration,” said Peter Singer, a senior fellow who leads the cybersecurity program at the New America think tank. “Generally, I’m thinking: ‘This is reasonable; this is sensible.’”

The Divergence

When the focus shifts from the government’s day-to-day cyber protections to the US role in global cyberspace, however, the Trump administration’s record suggests a much greater divergence. To begin with, there’s the State Department cyber coordinator’s office, which former Secretary Hillary Clinton established in 2011. The office represents the US at bilateral and multilateral cyber negotiations and advocates cyber best practices to allies and developing nations belatedly entering the digital age.

Current Secretary of State Rex Tillerson shuttered that office in August as part of a larger budget and bureaucracy trimming exercise.

There’s also the United Nations’ Group of Governmental Experts in cybersecurity, a group of 20-some nations, including the US, China and Russia, that meets periodically to iron out how international law and other rules of the road, known colloquially as “norms,” apply in cyberspace. When that group’s most recent round of meetings ended without any meaningful progress earlier this year, Bossert, the White House Homeland Security Adviser, announced the US would shift to a more coalition of the willing model to pursue cyber norms.

Finally, there’s the elephant in the room: Trump’s continuing caginess about acknowledging Russia’s role in a hacking campaign and influence operation aimed at sowing chaos during the 2016 presidential election. Taken together, these shifts could undermine US leadership in cyberspace and fundamentally change what the digital world looks like a decade from now, former officials said.

A Brief History of Global Cyber Norms

The argument during the Obama administration went something like this:

Nations will use the internet to spy on each other and that can’t be stopped. But, nations should also agree that this meddling in the internet should not extend to undermining businesses, damaging critical infrastructure like nuclear and energy plants, or putting citizens and their information at risk.

When nations fail to honor these cyber norms, the US argued, other nations should ensure they suffer consequences. That could mean a retaliatory cyber strike, but more often means economic sanctions, legal indictments or military action.
Trump officials, including Bossert and Joyce, have embraced that broad argument, using phrases nearly identical to their Obama administration predecessors. But the structure itself is undermined by the administration’s actions, former officials say.
Without the State Department cyber coordinator’s office, for example, there’s no organization in government that’s solely responsible for advocating the US view of what cyberspace should look like.

That leadership void leaves emerging and non-aligned nations more vulnerable to Chinese and Russian notions of the internet. Those include strong government control over what internet content their citizens see and rules that bar foreign companies from providing some internet services or force them to disclose their source code.   

What’s more, when the State Department first launched the coordinator’s office it was the first of its kind in the world. Now, six years later, roughly 20 nations have launched similar offices in their foreign ministries following the US lead.

Deputy Secretary of State John Sullivan told the US House Foreign Affairs Committee in September that State ultimately plans to elevate its cyber mission despite closing the coordinator’s office, but he did not provide details or a timeline. State has not made any public moves on the cyber front since that hearing. Seemingly unconvinced by Sullivan, Foreign Affairs Committee Chairman Ed Royce introduced a bill that requires the cyber office to be re-installed with greater authority which has  passed the committee this month without a formal vote.

Bush administration cyber adviser Frank Cilluffo largely supports the Trump administration’s cyber efforts thus far and says he supports more aggressive bilateral cyber negotiations, though he doesn’t believe the administration should abandon multilateral efforts, such as the Group of Governmental Experts. He acknowledged, however, that the State Department has not communicated clearly enough about its cyber plans. “If the actual intent is simply to eliminate the cyber coordinator’s position and not build something as robust in its place, then I deeply oppose that,” Cilluffo said.  

The Cozy Bear in the Room

It’s Trump’s unwillingness to consistently acknowledge Russia’s culpability for meddling in the 2016 election, however, that does the most damage by far to American efforts to impose rules upon global cyberspace, former officials of both parties said.

Failing to consistently advocate for good behavior in cyberspace is one thing, they said. Failing to impose consequences for bad behavior is another.

Russia’s behavior, both during the 2016 election and since then, including meddling in European elections and breaching previously off-limits targets such as energy and nuclear plants, is the most egregious flouting of global cyber norms to date, they said. And, because there can’t be presidential buy-in, there have been, so far, few consequences.

Even Russian sanctions that Congress passed over the president’s disapproval have yet to be fully implemented.  
“We would like our allies and partners and as much of the international community as possible to see that responding to cyber threats is legitimate and, in order to make that case, you can’t fail to respond to what is clearly the number one cybersecurity challenge of the day,” said Jim Miller, a former undersecretary of defense for cyber policy during the Obama administration and president of the consultancy Adaptive Strategies.

The result of this is two-fold. In the short term, it signals to Russia that it can continue to play fast and loose with pro-democratic cyber norms that the US and other western nations have tried to establish. Second, it signals to other nations and non-state actors that similar cyber mischief will go unpunished.

Defense One

You Might Also Read: 

Trump Tells US Cyber Command To Get More Aggressive:

Trump's Top Cybersecurity Advisors Resign:

Loss Of Cyber Expertise Is A Problem For Trump:

 

« Australia To Challenge Facebook & Google Over Media Disruption
Russia Is Providing North Korea With Internet Connectivity »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Code42

Code42

Code42 CrashPlan, is an enterprise SaaS solution that backs up all distributed end-user data on a single, secure platform.

OneLogin

OneLogin

OneLogin simplifies identity management with secure, one-click access,for employees, customers and partners, through all device types, to all enterprise cloud and on-premise applications.

Cybercrowd

Cybercrowd

Cybercrowd is a cyber security specialist offering technical services, cyber security assessments, guidance and security thought leadership.

Oxford BioChronometrics

Oxford BioChronometrics

By building profiles based on electronically Defined Natural Attributes, or e-DNA, Oxford BioChronometrics protects digital networks, communities, individuals and other online assets from fraud.

HYPR

HYPR

HYPR Decentralized Authentication minimizes the risk of enterprise data breaches while providing an enhanced user experience for your customers and employees.

Romanian Association for Electronic Industry & Software (ARIES)

Romanian Association for Electronic Industry & Software (ARIES)

ARIES is the Romanian Association for Electronic Industry and Software, the biggest and most influental organization created for the IT&C industry in Romania.

HumanFirewall

HumanFirewall

HumanFirewall makes it possible for every individual to take part in securing their organisation. With HumanFirewall, achieving security has never been easier.

WebOrion

WebOrion

WebOrion is an All-in-One Web Security & Performance Suite. Fortify, accelerate and monitor your website today.

Ribbon Communications

Ribbon Communications

Ribbon Communications delivers global communications software and network solutions to service providers, enterprises, and critical infrastructure sectors.

National Cyber Coordination & Command Centre (NC4) - Malaysia

National Cyber Coordination & Command Centre (NC4) - Malaysia

NC4 is established as a center for dealing with cyber threats and crisis at the national level in Malaysia.

World Cyber Security Summit

World Cyber Security Summit

World Cyber Security Summit, by Trescon, is a thought-leadership driven platform for CISOs who are looking to explore new-age threats and the technologies/strategies that can help mitigate them.

Global Cybersecurity Association (GCA)

Global Cybersecurity Association (GCA)

GCA’s Symposium and conferences featuring global thought leaders and CISOs provide a global best practice perspective on cybersecurity.

Centroid

Centroid

Centroid is a cloud services and technology company that provides Oracle enterprise workload consulting and managed services across Oracle, Azure, Amazon, Google, and private cloud.

CSIR Information & Cybersecurity Research Centre

CSIR Information & Cybersecurity Research Centre

The CSIR Information & Cybersecurity Research Centre focuses on research, development, and innovation of home-grown cyber and information security.

Cyera

Cyera

Cyera is the data security company that gives businesses context and control over their most valuable asset: data.

DHCO IT

DHCO IT

The DHCO IT team are experts in IT support, cyber security, cloud support and disaster recovery, and are Microsoft 365 partners.