To date, the U.S is one of the most hacker-active countries in the world; North America has been the target of various Internet-based intrusions and cyber-attacks directed at critical infrastructures (e.g., Pentagon, White House, Capitol) from foreign threat actors including both Russian and Chinese groups. Most U.S. government agencies have been already the victim of cyber security threats; many are the breaches that made the news, including the hacking of the network used by President Obama’s staff in October 2014 and the breach of the unclassified e-mail system of the Department of State in the same year. Lately, there was the alleged November 2016 U.S. election-hacking affecting voting-related systems with suspects of Russia’s interference on the outcome; obviously, the Russian government and President Vladimir Putin deny the allegations of having planned the altering of actual ballot counts or results for Republican candidate Donald Trump.

State-sponsored cyberattacks are, in fact, a reality. Former U.S. President Barrack Obama and President Xi Jinping of China met to address norms, rules, principles and measures that were intended to help increase cooperation and transparency with the aim of reducing the risk of cyber disputes among states; the aim was a bilateral cyberspace agreement that could place restrictions on the use of cyber weapons. No treaty came out of those negotiations, however, only the reassurance on mutual efforts against these issues. Nevertheless, in the diplomatic arena, there is a push towards a multilateral ‘cyber arms’ treaty in hope to achieve cooperation between states and a code of conduct defining a new era in cybersecurity and also preventing at least cyber aggression that is state-sponsored.

As disruptive as the above-mentioned incidents were considered, there are a number of scenarios that could be considered that are even more unsettling: imagine, for example, hackers taking down the U.S. power grids, disrupting a critical piece of infrastructure or go as far as take over unsecured devices through the Internet, the so-called IoT, through large-scale distributed denial-of-service (DDoS) attacks or hacking.

Obama Administration’s Efforts

Reformations of the national information security regulations is currently underway to safeguard the nation against new threats in an aim to make America more secure, says the U.S. Department of Homeland Security (DHS). Conflict in cyberspace has grown, and threats against U.S. interests are increasing in severity and sophistication, as the “Worldwide Threat Assessment of the U.S. Intelligence Community” notes; this calls for a holistic plan to defend the security of America’s networked computers. The Obama administration has attempted to work towards it implementing a Cybersecurity National Action Plan (CNAP), which called for an increase in federal funding to more than $19 billion. The former president had set up a special non-partisan Commission on Cybersecurity after the many attacks on U.S. government Web sites (NASA, Department of State, Commerce…). He made it clear that cybersecurity is one of the most important challenges Americans face and he pushed for a “long-term strategy to enhance cybersecurity awareness and protections, protect privacy, maintain public safety as well as economic and national security, and empower Americans to take better control of their digital security,” as the White House CNAP fact sheet states.

Obama addressed cybersecurity also through the Launch of the Cybersecurity Framework in the last years in office and procedures like the Presidential Policy Directive/ PPD-41, United States CyberIncident Coordination that calls on government agencies to better protect their networks and their sharing of related intelligence during threat response efforts, in the belief that building threat awareness and information sharing can strengthen cyberdefense and the cyberdeterrence posture of the nation.

Bill S. 754, the Cybersecurity Information Sharing Act (CISA) of 2015, that was discussed and passed in the Senate, required the Director of National Intelligence and the Departments of Homeland Security (DHS), Defense, and Justice to develop procedures “to increase cyber-surveillance and help spread initial warnings of cyber-threats” in real time with all “private entities, nonfederal government agencies, state, tribal, and local governments, the public, and entities under threats”; this would allow taking prompt action to employ defensive measures.

Newly elected President Donald Trump, however, said the “Obama administration has failed” in cybersecurity and has committed to fixing America’s cyber capabilities or improving them. Even influential Republicans like “[Senator John] McCain ripped the Obama administration for leaving the national security apparatus as “bystanders and observers” for failing to draft a specific policy of deterrence and retaliation for cyber-attacks.” Obama’s presidency focused more on the initiatives to drive cybersecurity policy, planning, and implementation across the Federal Government. Though it was a step in the right direction, the takeover of the Trump administration seems to be charting a new path to cybersecurity.

Cybersecurity in the Age of Donald Trump

President Trump has addressed the need for a revamp in the cybersecurity efforts of government during his campaign. In the first few weeks after his inauguration, rumors about an executive order spread. This order would build on President Obama’s work to create a strong, holistic approach to cybersecurity. In fact, following on Obama’s call for cooperation between agencies, the executive order was supposed to call for a consolidation of all agencies’ IT security practices in favor of a uniform approach to cybersecurity. Differently than under the Obama’s administration, the responsibility for the safeguard of government IT infrastructure would fall under the Budget and Management Office of the Whitehouse and not the Department of Homeland Security, although it seems he actually proposed an allocation fiscal of $1.5 billion for Homeland Security to tackle cybersecurity and protect critical infrastructure in the 2018 budget. President Trump would also stress the importance that cybersecurity now has in each agency planning by making agency head accountable for any breaches.

In addition to accountability and the joint effort approach, the order would have called for a review by a CyberReview Team of cyber capabilities and vulnerabilities of government systems as well as those of the private companies the government contracts. It would have also focused on an issue President Obama had begun to address: the need for cybersecurity experts (to address a skills shortage in the field). The order intended not only for the Department of Defense (DoD) to be aware of what children learn about IT and security from an early age but also to make recommendations to the curriculum to ensure the proper shaping of the hundreds of thousands of specialists needed in the future.

It seems a couple of drafts of the executive order were actually prepared. The first one that focused on identifying vulnerabilities in the government security systems and civilian infrastructures, identifying cyberadversaries and reviewing the current capability of the U.S. in cybersecurity. A later version, instead, focused more on cybersecurity of federal networks; cybersecurity of critical (private) infrastructures (communications, electricity…); and cybersecurity for the nation. So far, the executive order has not left the draft stage, but it has already raised both praise and concerns. While some experts support the attention to security holes and vulnerabilities as well as the emphasis on training, others point out the lack of mention of some other important players in the cybersecurity arena, including CIA and FBI.

While the new draft order is obviously still a subject of debate in the executive branch, President Trump has moved his first step in the cybersecurity arena by extending one of President Obama’s orders, the E.O. 13694 of April 2015 that allows sanctions against all who engaged in significant cybercrimes against the U.S. As the President wrote in the executive order on cybersanctions: “Significant malicious cyber-enabled activities originating from, or directed by persons located, in whole or in substantial part, outside the United States, continue to pose an unusual and extraordinary threat to the national security, foreign policy, and economy of the United States […] Therefore, I have determined that it is necessary to continue the national emergency declared in Executive Order 13694 with respect to significant malicious cyber-enabled activities.”

This is obviously not enough, and now the Trump’s administration will have to raise the overall level of cyber strategy in the United States; President Trump’s objective of ‘Making America Safe Again’ will also mean measures that are bound to raise some eyebrows as they deal with the issue of privacy. The Trump administration wants laws allowing federal agencies to eavesdrop on digital communications to keep as a tool against terrorists. The president supports NSA’s surveillance activities and gives federal agents greater authority to go after cybercriminals even if that means to break into the consumers’ encrypted data.

Sensing that there might be finally increased attention and possibly action towards cybersecurity, experts are starting to send in proposals to the new administration. Specialists at MIT, for example, in a report that compiles findings for 12 months of workshops, have made a series of recommendations for the Trump administration for a “coherent cybersecurity plan that coordinates efforts across departments, encourages investment, and removes parts of key infrastructure like the electric grid from the internet.” The report was authored mainly by former Inspector General of the NSA and head of U.S. counterintelligence in the Office of the Director of National Intelligence, Joel Brenner, and was published by MIT’s Internet Policy Research Initiative (IPRI) at the Computer Science and Artificial Intelligence Laboratory (CSAIL), in conjunction with MIT’s Center for International Studies (CIS).

The MIT team calls for increased attention towards critical infrastructures that are privately-owned and hints to the need to incentivize investments in private companies in important fields like electricity, finance, communications and oil/natural gas for the protection of their systems even through relatively simple changes such as converting to a more secure Domain Name System (DNS). “Our recommendations complement their attention to federal systems,” Brenner says. “Our current cyber insecurity is a national disgrace, and we must defend the networks that the safety of our nation depends on.”

Conclusion

The Internet-connected world might become a new weapon for terrorists who could turn to cyberwarfare, as a cheaper, no-boundary, effective alternative to conventional weapons. Cyber-attacks are undeniably a big threat to U.S. national security and finding solutions to counteract cyber threats affecting information, and communications technologies (ICT) services are one of the greatest challenges of our time. President Trump promises to devise more aggressive policies and regulatory initiatives. The challenge will be placing greater emphasis on the digital security landscape and laying out parameters for norms of state behaviors in cyberspace to prevent and respond to attacks and establishing some sort of common ground for global cybersecurity governance.

A survey of RSA attendees by Tripwire found that cybersecurity professionals are not confident in the government’s current cybersecurity strategy as well as in its defense; in fact, only 17 percent of respondents said they are assured the U.S. government can adequately protect itself in the event of a cyber threat. According to David Meltzer, CTO at Tripwire, “people and organizations alike look to the government to set an example and lead the way on all sorts of issues, including cybersecurity. What the results of this survey show are that seasoned cybersecurity professionals are not confident in the government’s current cybersecurity strategy, and these worries can trickle down to the list of concerns for an enterprise.” That is why, today, the new president administration has made cybersecurity a top priority, and it is safe to assume that a stronger and more aggressive cybersecurity posture will be employed, but until legislation will be discussed, it is difficult to predict how efficient the measures will be. The important thing, however, is that it seems we are finally moving towards a more comprehensive plan that addresses multiple issues and forces cooperation in and out of the government.

References

Adhikari, R. (2008, December 8). Obama Faces New Calls for Cybersecurity Revamp. Retrieved from http://www.internetnews.com/government/article.php/3789661/Obama+Faces+New+Calls+for+Cybersecurity+Revamp.htm

Blumberg Capital. (n.d.). 2017 State of Cybersecurity. Retrieved from http://cybersecurity.blumbergcapital.com/

Bur, J. (2016, July 26). New White House Directive Amps Up Federal Cyber Response. Retrieved from https://www.meritalk.com/articles/new-white-house-directive-amps-up-federal-cyber-response/

Bur, J. (2016, October 3). Trump Calls Obama Cybersecurity Policy ‘Failed,’ Lays Out His Own Plan. Retrieved from https://www.meritalk.com/articles/trump-calls-obama-cybersecurity-policy-failed-lays-out-his-own-plan/

Conner-Simons, A. (2017, March 28). MIT experts urge Trump administration to take immediate action on cybersecurity. Retrieved from http://news.mit.edu/2017/mit-experts-urge-trump-administration-immediate-cybersecurity-action-0328

Corbin, K. (2016, May 26). State Department argues against ‘cyberarms’ treaty. Retrieved from http://www.cio.com/article/3075442/government/state-department-argues-against-cyber-arms-treaty.html

Dimov, D. (2015, August 5). The Most Hacker-Active Countries. Retrieved from https://resources.infosecinstitute.com/the-most-hacker-active-countries-part-i/

Elliott, P. (2009, February 9). Obama orders review of cybersecurity. Retrieved from http://www.nbcnews.com/id/29108453/ns/technology_and_science-security/t/obama-orders-review-cybersecurity/#.WOJI84VOKUl

Francis, R. (2016, December 19). What 2017 has in store for cybersecurity. Retrieved from http://www.csoonline.com/article/3150997/security/what-2017-has-in-store-for-cybersecurity.html

Gould, J. (2017, January 5). McCain: Russia Hack Should Spark National CyberPolicy. Retrieved from http://www.defensenews.com/articles/mccain-russia-hack-should-spark-national-cyber-policy

Gross, G. (2017, January 31). Trump stresses cybersecurity but postpones executive order. Retrieved from http://www.pcworld.com/article/3163516/security/trump-stresses-cybersecurity-but-postpones-executive-order.html

Gross, G. (2017, February 22). What to expect from the Trump administration on cybersecurity.
Retrieved from http://www.csoonline.com/article/3172933/security/what-to-expect-from-the-trump-administration-on-cybersecurity.html

Homeland Security News Wire. (2015, October 2). Cybersecurity: Strengthening U.S. cybersecurity capabilities by bolstering cyberdefense, deterrence. Retrieved from http://www.homelandsecuritynewswire.com/dr20151002-strengthening-u-s-cybersecurity-capabilities-by-bolstering-cyber-defense-deterrence?page=0,0

Lapena, R. (2017, March 6). Survey: 80% of IT Pros More Concerned About Digital Security in 2017 than in 2016. Retrieved from https://www.tripwire.com/state-of-security/risk-based-security-for-executives/connecting-security-to-the-business/survey-80-pros-concerned-digital-security-2017-2016/

Love, D. (2016, November 30). How to protect yourself on President Donald Trump’s internet. Retrieved from http://www.nbcnews.com/mach/technology/protecting-your-internet-presence-age-donald-trump-n689826

Lyle, A. (2017, January 5). Pentagon Officials Describe Ongoing Importance of CyberCapabilities. Retrieved from https://www.defense.gov/News/Article/Article/1043038/pentagon-officials-describe-ongoing-importance-of-cyber-capabilities

Paganini, P. (2014, October 30). Hackers infiltrated a White House unclassified computer network. Retrieved from http://securityaffairs.co/wordpress/29714/intelligence/hackers-white-house-network.html

Pagliery, J. (2017, January 31). Big changes in Trump’s cybersecurity executive order. Retrieved from http://money.cnn.com/2017/01/31/technology/trump-cybersecurity-executive-order/index.html

RT.com. (2015, August 19). DDoS defense: Pentagon eyes new security tools to counter cyber-attacks within seconds. Retrieved from https://www.rt.com/usa/312806-pentagon-ddos-attack-security/

Schneier, B. (2012, June 8). An International Cyberwar Treaty Is the Only Way to Stem the Threat. Retrieved from https://www.usnews.com/debate-club/should-there-be-an-international-treaty-on-cyberwarfare/an-international-cyberwar-treaty-is-the-only-way-to-stem-the-threat

Starks, T. & Bennett, C. (2017, February 7). Sources: Cyberorder could get Trump’s signature this week. Retrieved from http://www.politico.com/story/2017/02/cyber-security-trump-approve-timing-234746

The Wall Street Journal. (2009, March 31). Who Should Be in Charge of Cybersecurity? Retrieved from https://www.wsj.com/articles/SB123844579753370907

The White House. (2013, February 12). Executive Order — Improving Critical Infrastructure Cybersecurity. Retrieved from https://obamawhitehouse.archives.gov/the-press-office/2013/02/12/executive-order-improving-critical-infrastructure-cybersecurity

The White House. (2014, February 12). Launch of the Cybersecurity Framework. Retrieved from https://obamawhitehouse.archives.gov/the-press-office/2014/02/12/launch-cybersecurity-framework

The White House. (2016, July 26). Presidential Policy Directive — United States CyberIncident Coordination. Retrieved from https://obamawhitehouse.archives.gov/the-press-office/2016/07/26/presidential-policy-directive-united-states-cyber-incident

U.S. Department of Defense. (2016, March 2). Statement by Pentagon Press Secretary Peter Cook on DoD’s “Hack the Pentagon” Cybersecurity Initiative. Retrieved from https://www.defense.gov/News/News-Releases/News-Release-View/Article/684106/statement-by-pentagon-press-secretary-peter-cook-on-dods-hack-the-pentagon-cybe

U.S. Department of Defense. (n.d.). The Department of Defense CyberStrategy. Retrieved from https://www.defense.gov/News/Special-Reports/0415_Cyber-Strategy

Williams, M. (2017, March 29. x. Retrieved from http://www.pcworld.com/article/3186434/government/trump-extends-obama-executive-order-on-cyberattacks.html