b'Chesney on Cybersecurity Law,\nPolicy, and Institutions\nv.3.1 (August 2021)\nProfessor Bobby Chesney\nThe University of Texas at Austin\n@bobbychesney\n\nAbout this book: This is an interdisciplinary \xe2\x80\x9ceCasebook,\xe2\x80\x9d designed from the ground up to reflect the\nintertwined nature of the legal and policy questions associated with cybersecurity. My aim is to help the\nreader understand the nature and functions of the various government and private-sector actors associated\nwith cybersecurity in the United States, the policy goals they pursue, the issues and challenges they face,\nand the legal environment in which all of this takes place. The first part of the book focuses on the \xe2\x80\x9cdefensive\xe2\x80\x9d\nperspective (meaning that we will assume an overarching policy goal of minimizing unauthorized access to\nor disruption of computer systems). The second part focuses on the \xe2\x80\x9coffensive\xe2\x80\x9d perspective (meaning that\nthere are contexts in which unauthorized access or disruption might actually be desirable as a matter of\npolicy). In short, the book is a guided tour of the broad cybersecurity landscape.\nWho should use it? The book is designed to be valuable not just to beginners but also those who may have\nexperience in one area but would like to see how their corner of the puzzle relates to the larger whole. At\nthe University of Texas, I use it as the main text in an interdisciplinary course that includes students from our\nschools of law, public affairs, computer science, engineering, information, communications, and business.\nMy aim is for it to work equally well, however, as a free-standing text for those who want to study these topics\nindependently.\nWhy did you write this book and why is it free? I wrote this book under the auspices of the interdisciplinary\ncybersecurity program at UT\xe2\x80\x99s Robert Strauss Center for International Security and Law, with generous support\nfrom the Hewlett Foundation\xe2\x80\x99s Cyber Initiative.1 We believe that progress in this area has been inhibited to\nan unnecessary degree by a lack of mutual understanding among lawyers, engineers, computer scientists,\ngovernment officials, and business leaders, and we have set out to develop courses that will help close that\ngap. Wanting to ensure the widest possible distribution and impact in light of this goal, and to have the\noption to quickly and easily update the text when needed, I opted to make the book freely available online\nrather than selling it through a publisher. I hope you\xe2\x80\x99ll find the end result appealing, even if it is much lessformal and polished than would have been the case otherwise. And, if you do, I hope you will further the\nmission by recommending the book to others.\nCopyright? I\xe2\x80\x99m providing access to this work under the terms of a Creative Commons Attribution 4.0\nInternational (CC BY 4.0) license: https://creativecommons.org/licenses/by/4.0/. You are free to use some or\nall of it as you wish (that\xe2\x80\x99s one reason why I\xe2\x80\x99ve posted a .doc version along with the .pdf), so long as you (1)\ncite the book as indicated below, (2) give appropriate indications of changes made by you, and (3) link to\nthe license. Here is the requested citation:\nROBERT M. CHESNEY, CHESNEY ON CYBERSECURITY LAW, POLICY, AND INSTITUTIONS (v.3.1) (2021), available at\nhttps://papers.ssrn.com/sol3/papers.cfm?abstract_id=3547103 (this work is licensed under a\nCreative Commons Attribution 4.0 International license\nhttps://creativecommons.org/licenses/by/4.0/).\nI make no copyright claim, of course, as to any public-domain works excerpts included in this work, such as\nquotations from cases or statutes. Nor is any claim made as to any other materials that I have included in\nthis work pursuant to a copyright exception or limitation such as fair use.\n\nI extend special thanks to Rachael Jensen for her outstanding research and teaching assistance, especially her key role\nin adapting earlier versions of these readings into the current format, and to Eli Sugarman of the Hewlett Foundation.\n1\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n2\n\nTable of Contents\nI. THE DEFENSIVE PERSPECTIVE ...................................................................................... 3\nA. Introduction ........................................................................................................... 3\n1. Holiday Bear and SolarWinds: A Case Study ................................................ 11\n2. Introduction to Key Terms and Concepts ..................................................... 11\nB. Imposing Costs on Attackers .............................................................................. 17\n3. The Crime Model: Key Institutions and the CFAA ........................................ 17\n4. CFAA Case Studies .......................................................................................... 22\n5. Other Criminal Statutes ................................................................................... 24\n6. Civil Liability under the CFAA .......................................................................... 30\n7. What if the Attacker is a Foreign Government? (I) ...................................... 43\n8. What if the Attacker is a Foreign Government? (II)...................................... 46\n9. What if the Attacker is a Foreign Government (III) ....................................... 57\n10. What if the Attacker is a Foreign Government? (IV) .................................. 63\nC. Encouraging Potential Victims to Defend Better ............................................ 66\n11. The Role of Regulators (I) .............................................................................. 67\n12. The Role of Regulators (II).............................................................................. 75\n13. Private Lawsuits (I) .......................................................................................... 84\n14. Private Lawsuits (II); Insurance & Contract Terms ..................................... 104\n15. Facilitating Better Defense through Information-Sharing (I) .................... 114\n16. Facilitating Better Defense through Information-Sharing (II) ................... 129\n17. How the Government Protects Itself (I)...................................................... 144\n18. How the Government Protects Itself (II) ..................................................... 158\n19. Improving Cybersecurity for the Nation\xe2\x80\x99s Critical infrastructure ............. 170\nD. Organizing to Mitigate Harm ........................................................................... 184\n20. Federal Coordination and Significant Cyber Incidents .......................... 185\nII. THE OFFENSIVE PERSPECTIVE ................................................................................. 199\n21. Lawful-But-Unauthorized-Access: Private Sector Hacking? .................... 200\n22. Government Hacking: Law Enforcement ................................................. 209\n23. The Insecurity Industry .................................................................................. 217\n24. Government Hacking: Espionage.............................................................. 231\n25. Government Hacking: Armed Conflict ..................................................... 247\n26. Government Hacking: Grey-Zone Competition ....................................... 259\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n3\n\nI. THE DEFENSIVE PERSPECTIVE\nFor the first part of this book, we will focus on the defensive perspective. That is, we will focus on\nthe overarching public-policy goals of (i) minimizing unauthorized access, disruption,\nmanipulation, and damage to computers and (ii) mitigating the harm when such malicious\nactivity nonetheless occurs.\nWhen it comes to the first of those two core goals, the main idea is simple: we want to increase\nthe undesirable consequences attackers believe they will risk should they attempt certain actions,\nwhile also making it more difficult for them to succeed. Part B below focuses of the former, and\nPart C below focuses on the latter. In both contexts, our goal is to understand the various\ninstitutions, policies, and legal frameworks that define the status quo on these matters; to grasp\nthe competing interests that are in play; and to wrestle with the question of how we might do\nbetter. Part D then takes up the second major goal noted above: managing the consequences\nof successful attacks. Before we dive into all that, however, we will launch into things in Part A with\ntwo introductory readings, to help build a common foundation for all that follows.\n\nA. Introduction\n1. Holiday Bear and SolarWinds: A Case Study\n\nSouthwest Parkway is a wide and winding road that leads away from Austin towards the Texas Hill\nCountry. Along its length are neighborhoods, schools, and long stretches of open landscape. It is\nnot where one might expect to find the epicenter of a major cybersecurity episode. But Southwest\nParkways also is where one can find the unassuming headquarters of SolarWinds, a name that\nburst into the headlines in December 2020.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n4\n\nSolarWinds specializes in network-management tools\xe2\x80\x94that is, software that large enterprises use\nto monitor and control conditions throughout their information technology environment. Its\nproducts are in widespread use around the world, including a wide array of prominent private\nsector entities and government agencies. Among its most successful products is a networkmonitoring system called Orion. Orion is an \xe2\x80\x9con premises\xe2\x80\x9d platform, meaning that it does not reside\nin the cloud (that is, on remote servers controlled by SolarWinds itself). Rather, customers upload\nOrion as a software package installed on their own networks and run from there. And this has\nconsequences for the process by which Orion periodically is updated. Like any software, Orion\nperiodically requires updates both for security purposes and to improve performance. Thus, Orion\ncustomers periodically receive and routinely install from SolarWinds software updates, much as all\nof us periodically accept vendor-provided updates for the operating system on our phones. In\nboth contexts, the provider \xe2\x80\x9cdigitally signs\xe2\x80\x9d the update in a way that can be verified technically,\nensuring that the update really is coming from the provider. Trusting that the provider took all\nnecessary safety precautions, and often lacking the means to conduct an independent security\ncheck in any event, most of us accept these verified updates as a matter of course. This is true for\nus as individuals with our phones, and it is true to some extent for many a large organization,\nincluding those using Orion.\nTherein lay an extraordinary opportunity for espionage. If a would-be spy could \xe2\x80\x9ctrojan\xe2\x80\x9d an Orion\nupdate\xe2\x80\x94that is, if one could find a way to embed malicious code somewhere within an\notherwise-legitimate update\xe2\x80\x94then customers by the thousands would open their virtual gates\nand let that code into their networks. And given the particular function of Orion\xe2\x80\x94spanning across\na user\xe2\x80\x99s IT infrastructure\xe2\x80\x94the resulting backdoors, if employed discretely enough, might then pave\nthe way for deployment of further malware directly into those now-compromised networks. The\nend result could be an intelligence bonanza.\nThe opportunity would have been tempting for any foreign intelligence service engaged in\ncollection against the U.S. government. And at least one such service did spot it: Russia\xe2\x80\x99s Foreign\nIntelligence Service, better known in English as SVR (Sluzbha Vneshney Razvedki).\nSVR has a well-deserved reputation for its ability to conduct espionage through cyber means.\nHackers associated with SVR sometimes are referred to as \xe2\x80\x9cAdvanced Persistent Threat 29\xe2\x80\x9d\n(APT29), under the anodyne labeling system frequently used in the information security industry as\na way to track government hackers without having to expressly attribute particular campaigns or\nentities to the actual government involved. Others have used the label \xe2\x80\x9cCozy Bear,\xe2\x80\x9d following\nthe more-entertaining naming system popularized by Dmitri Alperovich and the security firm\nCrowdStrike. With Crowdstrike\xe2\x80\x99s nomenclature, groups believed to be linked to the Russian\ngovernment are named some variation of \xe2\x80\x9cBear.\xe2\x80\x9d A group thought to be associated with Russia\xe2\x80\x99s\nmilitary intelligence agency (GRU), for example, are known in this system as \xe2\x80\x9cFancy Bear.\xe2\x80\x9d And\nso, when a possibly-new group of hackers linked to Russia emerges, a new name may follow. And\nin this case, when the SolarWinds story began to break in December 2020, the initial framing\noffered by Dmitri Alperovich was the seasonally-appropriate \xe2\x80\x9cHoliday Bear.\xe2\x80\x9d\nSince that time, attribution has focused firmly and reliably on SVR, but I will still refer periodically to\nHoliday Bear. This will remind us that analysts wrestling with attribution amidst unfolding attacks\noften are drawing on forensic and contextual clues that may be specific to specific groups within\nlarger organizations.\nWhat follows is a detailed account of the complex sequence of operations SVR conducted as\npart of the Holiday Bear campaign. As we shall see, exploiting SolarWinds was a central part of\nthe campaign, but there is far more to the story than that (indeed, the intense media focus on\nSolarWinds has had the unfortunate effect of deflecting attention from the shortcomings of other\ncompanies and government agencies).\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n5\n\nStep one: accessing the SolarWinds \xe2\x80\x9cbuild environment\xe2\x80\x9d\nIt is one thing to recognize that SolarWinds customers might not detect a trojaned Orion update,\nbut quite another to compromise the update system in the first place. The task SVR first faced,\naccordingly, was to sort out how it could penetrate without detection the \xe2\x80\x9cbuild environment\xe2\x80\x9d\n(aka \xe2\x80\x9cdevelopment environment\xe2\x80\x9d) used by SolarWinds engineers to draft and tinker with Orion\xe2\x80\x99s\ncode. Then SVR would need to find a way to inject malicious code into an Orion \xe2\x80\x9cbuild\xe2\x80\x9d without\ndetection. These were tall orders.\nSVR managed both tasks, but we do not (yet) know precisely how. There are plenty of plausible\nexplanations, however. Perhaps it spearphished an employee\xe2\x80\x99s credentials (that is: tailoring a\nfake message for that particular employee and thereby tricking them into opening a malwarelaced file and thereby gaining access to the person\xe2\x80\x99s legitimate login credentials). Perhaps it\nsimply engaged in password \xe2\x80\x9cspraying\xe2\x80\x9d until it hit upon something that worked (famously, a\nsecurity researcher in 2019 had discovered the password for an unrelated SolarWinds server stored\nin a GitHub repository; the password was \xe2\x80\x9cpassword123\xe2\x80\x9d). Perhaps SVR hacked its way into the\nbuild environment, taking advantage of vulnerabilities or configuration errors in the software used\nby SolarWinds engineers to perform their development work. All of these are common routes to\ninitial exploitation, and any could have been the culprit here. At any rate, SVR managed it. No\nlater than early September 2019 (and possibly as early as January 2019), SVR established access\nto the build environment.\nStep two: injecting malware into an Orion update\nSVR\xe2\x80\x99s next step was to test drive its access by inserting some innocuous code into the build\nenvironment, to see if this could be done without detection. In fall 2019, SVR dipped its toes into\nthe water, inserting a modest batch of innocuous code. It worked; the addition was not detected.\nExhibiting remarkable patience, SVR continued with similar experiments for months before at last\ntaking advantage of this access to inject actual malware into an Orion build. It took that step in\nFebruary 2020.\nTo accomplish this, SVR used malware now known to us as \xe2\x80\x9cSUNSPOT.\xe2\x80\x9d SUNSPOT was thoughtfully\ndesigned for its task. Once deployed into the build environment, it determined whether a\nparticular development tool (Microsoft Visual Studio) was in use by the SolarWinds engineers at\nthat time. If so, SUNSPOT then checked to see if that tool was being used for an Orion build in\nparticular. If so, SUNSPOT monitored to determine precisely when the developers used that tool\nto access a particular part of the Orion source code, and at that moment SUNSPOT injected a file\nwith the plausible-sounding name \xe2\x80\x9cSolarWinds.Orion.Core.BusinessLayer.dll\xe2\x80\x9d into the Orion build.\nThat .dll file was, in fact, a custom malware package known to us now as \xe2\x80\x9cSUNBURST.\xe2\x80\x9d\nIt might help at this point to draw out the analogy to the Trojan Horse. If the eventual distribution\nof a corrupted Orion update was the cyber equivalent to that giant wooden horse being brought\nwithin the walls of the city of Troy, then SUNBURST was the equivalent of the small squad of Greek\nwarriors hiding within the horse, prepared to sneak out and quietly open a side gate in those walls\nand thus allows their fellows to pour in undetected. From that perspective, SVR\xe2\x80\x99s success in\nloading SUNBURST into the Orion build was equivalent to loading that squad of Greek warriors into\nthe horse prior to presenting the horse at the city\xe2\x80\x99s gates; it remained to be seen if the Trojans\nwould take the horse within their walls or if the squad hidden within could manage to open a gate\nfrom the inside without getting caught.\nIn the event, it unfolded exactly as SVR hoped. SolarWinds did not detect the compromise of their\nlatest Orion update, and hence proceeded to digitally sign it and roll it out to customers though\nthe existing, trusted remote-update mechanism. That process began in March 2020 and\ncontinued for a few months. The horse was now within the walls for a vast array of customers. The\nspread might have gone further, in fact, but at that point SVR apparently concluded that it had\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n6\n\nachieved sufficient distribution. Rather than risk someone at SolarWinds detecting the compromise\nof its build environment and unspooling the entire campaign, SVR at that point did what it could\ndelete its access to the build environment, covering its tracks as well as it could.\nAt this point, some 18,000 customers had downloaded the trojaned Orion update. Among them\nwere several U.S. government agencies, including the Departments of Treasury, State, Commerce,\nEnergy, and Homeland Security.\nStep three: deciding where to take advantage of SUNBURST\nIn theory, SVR could have blindly exploited all infected systems to the maximum extent possible.\nBut doing so would have increased the opportunities for detection, with the potential to expose\nand thus put an end to the entire campaign. Rather than run such risks, SVR instead chose to\nproceed slowly and narrowly, with an emphasis on remaining undetected while carefully\nidentifying which of the infected customers best fit their specific collection priorities.\nIn every instance, SUNBURST took no action at all for approximately two weeks once installed on\nthe customer\xe2\x80\x99s premises. This put some distance between its eventual actions and the upload\nprocess. Then, when it did finally come alive, its first action was to perform a complex series of\nchecks designed to determine whether various security products were in operation on the system.\nWhere such products were detected, SUNBURST disabled them if possible, but otherwise simply\nshut itself down without taking further action. Only if and when it passed these safety checks\nwould SUNBURST go on to its next step: communicating with an external command-and-control\n(C2) server. In Trojan horse terms, the warriors in the horse had waited two full weeks, and after\nmaking sure no one was watching they moved at last moved to open up a side gate.\nTo minimize the risk that its communications with a C2 server would not draw attention, SVR\nattempted to disguise this malicious traffic. This was made easier by the fact that on-premises\ninstances of Orion routinely had to communicate with SolarWinds as part of what SolarWinds calls\nthe \xe2\x80\x9cOrion Improvement Program\xe2\x80\x9d (much as an iPhone user might click yes when asked if it is ok\nfor our phone to share information with Apple about how we are using Siri, in order to help Apple\nimprove the product or better tailor it to our usage patterns). SVR accordingly designed\nSUNBURST\xe2\x80\x99s communications with C2 servers so as to appear, on casual inspection, to be part of\nthat legitimate traffic flow. The ruse appears to have been highly effective. Among other things,\nthis illustrates that victims typically were not limiting Orion\xe2\x80\x99s external communications in a way that\nwould limit them to specifically pre-approved (\xe2\x80\x9callow-listed\xe2\x80\x9d) domains, or that would at least flag\nfor attention any communications to a non-pre-approved domain.\nCritically, the initial communication did not automatically result in SVR dispatching additional\nmalware. The first task, instead, was to enable SVR to decide whether to exploit that particular\nvictim or, instead to cover its tracks by uninstalling SUNBURST from that location. Towards that end,\nSUNBURST dispatched location information that SVR in turn used to make a judgment about the\nidentity of the infected system. In most cases, it appears, the system in question proved not to be\nof interest, and SVR uninstalled SUNBURST frequently. But not in all cases. SVR had hit the jackpot\nin plenty of instances, and now it was time to move on to the active-exploitation stage.\nStep four: injecting the tools needed to act effectively within targeted systems\nNotably, SUNBURST did not itself contain the tools needed to engage in lateral movement within\nthe compromised networks, to conduct data exfiltration, and to engage in other aspects of active\nexploitation. It was a slim design, reflecting the premium SVR placed on detection-avoidance at\nthe initial stage. SUNBURST contained no more than was necessary to reach the point that it could\nopen a backdoor to a C2 server. Put simply: in order to actively exploit an infected system, SVR\nneeded to use SUNBURST to inject additional malware.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n7\n\nBut how to do so without that fresh injection of malware being detected at the victim\xe2\x80\x99s perimeter\nby their network\xe2\x80\x99s antivirus capability? This is a classic problem that hackers have long faced. Of\ncourse, one might try to overcome it by developing sophisticated, never-seen-elsewhere custom\nmalware that might not be detected by security software that scans for known indicators of\ncompromise. That\xe2\x80\x99s not a realistic option for many attackers, and even where it is, it remains\ntempting to instead make use of \xe2\x80\x9cretail\xe2\x80\x9d malware that already exists and has a long track record\nof reliability and effectiveness. If such commonplace tools can be injected without detection,\neven sophisticated entities like SVR will make use of them.\nThese considerations over time have led to the development of a category of malware tools\nknown as \xe2\x80\x9cdroppers\xe2\x80\x9d and \xe2\x80\x9cloaders.\xe2\x80\x9d These are programs that hide within themselves some\notherwise-detectable malware payload. The idea with a dropper is that the attacker might be\nable to install the dropper on a targeted system without detection, at which the dropper will\nunpack and install the core malware payload. Loaders are similar, but rather than containing the\nmalware payload within themselves all along, they provide a (more secure) means to download\nthe payload surreptitiously from an external server. Both have the effect, at any rate, of reducing\ndetection risk at the stage when a malware payload must transit a system\xe2\x80\x99s perimeter, thus making\nit more attractive to rely on retail malware.\nThat\xe2\x80\x99s the route SVR took with the SUNBURST-infected systems that it targeted for active\nexploitation. Specifically, SVR developed what is now called TEARDROP. TEARDROP was a novel\ndropper that SVR could load into compromised systems via SUNBURST, with little risk of detection\nat victims\xe2\x80\x99 network perimeter. SVR also deployed a novel loader, RAINDROP, for the same\npurpose.\nIn this way, SVR successfully injected the toolkit it needed for active exploitation of its priority\ntargets, despite the fact that the toolkit it chose to use was, very much, a well-known one: Cobalt\nStrike.\nCobalt Strike is a commercial product sold by the Minnesota company HelpSystems as a tool for\nuse in attack simulations and penetration testing. That is to say, it is meant to be a pro-security\nproduct, emulating what a real attacker might do. The Cobalt Strike BEACON capability, for\nexample, provides a range of capabilities comparable to what a sophisticated, genuine attacker\nmight employ. All of which is quite useful from the defense-improvement perspective, when\nactually used for testing purposes. But real attackers also find these tools useful. As the firm Intel471\nrecently wrote, \xe2\x80\x9ccriminals love\xe2\x80\x9d Cobalt Strike, and it has \xe2\x80\x9cbecome a very common second-stage\npayload for many malware campaigns\xe2\x80\xa6.\xe2\x80\x9d\nSVR apparently loves it too, for rather than using TEARDROP and RAINDROP to inject bespoke (SVRmade) tools at this stage in the operation (as they had done at every prior stage), they instead\nwent with what amounted to a somewhat-customized version of Cobalt Strike BEACON.\nSome have suggested that this was a significant mistake on SVR\xe2\x80\x99s part, since there are techniques\navailable to detect the presence of BEACON on a network. Yet it does not appear that any of\nthe targeted entities actually detected BEACON in use before otherwise learning of the\nSolarWinds campaign. SVR did take steps to hide what was occurring, after all. To execute a file,\nfor example, it would temporarily replace a legitimate file with a malicious one, execute that file\n(at times doing so by temporarily modifying a legitimate scheduled task so that it would issue the\ncommand to execute the file), and then restore the original. And, in any event, SVR may have\nhad the notion that using such common tools might actually make it more difficult for investigators\nto attribute the operation to it, and by extension make it less likely that the larger campaign would\nbe undone by exposure of any one instance (relatedly, SVR ensured that each deployed instance\nof BEACON varied from the others in terms of file names and other otherwise-matchable details,\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n8\n\nthus reducing the chance that detection by one victim would result in the sharing of indicatorsof-compromise that could be used effectively by other victims).\nStep five: swimming upstream to the cloud\nAt this point, SVR was well-established within victims\xe2\x80\x99 own local (on premises) servers and systems.\nAnd if that was where to find the richest intelligence, the table would have been fully set for\nespionage success. But for a growing number of organizations\xe2\x80\x94including government entities\xe2\x80\x94\nthe on-prem environment is not where one will find most of the information an intelligence\ncollector would value. Increasingly, organizations rely on cloud services for email and documents.\nThis is true, for example, for organizations that rely on the Microsoft 365 (\xe2\x80\x9cM365\xe2\x80\x9d) product suite,\nwhich encompasses, among other things, the Microsoft Office software suite (Outlook for email,\nWord for documents, PowerPoint for slides, and Excel for spreadsheets), or that use Microsoft\xe2\x80\x99s\nAzure cloud services (just as the same would be true for an organization that instead used the\ncloud services of other providers, such as Amazon\xe2\x80\x99s AWS cloud services).\nNot surprisingly, this was true for many of the entities SVR had compromised via Orion, especially\nwith respect to using M365. In those case, accordingly, SVR had more work to do even after\ngetting BEACON into the on-prem environment. To get the intelligence it actually sought\xe2\x80\x94to\nrealize the purpose of the whole effort\xe2\x80\x94it next needed to swim upstream from its on-premises\nfoothold into the M365 cloud environment.\nThis brings us to an important and underappreciated aspect of the \xe2\x80\x9cSolarWinds\xe2\x80\x9d story: it is just as\nmuch a Microsoft story. The SolarWinds framing is understandable, of course, given the breadth\nof the compromises that resulted from the breach of that one company\xe2\x80\x99s own security. But from\nSVR\xe2\x80\x99s perspective, what ultimately mattered was accessing the M365 cloud environment. Orion\nwas one (very attractive and scalable) pathway to get to the doorstep, but it was not the only\nsuch pathway. Indeed, in a security advisory released on January 8, 2021, CISA revealed that it\nwas \xe2\x80\x9cinvestigating instances in which [SVR] may have obtained initial access\xe2\x80\x9d not via Orion but,\nrather, \xe2\x80\x9cby Password Guessing\xe2\x80\xa6, Password Spraying\xe2\x80\xa6, and/or exploiting inappropriately secured\nadministrative or service credentials\xe2\x80\xa6instead of utilizing the compromised SolarWinds Orion\nproducts.\xe2\x80\x9d Soon thereafter, the firm Malwarebytes revealed publicly that it too had been\n\xe2\x80\x9crecently targeted by the same threat actor,\xe2\x80\x9d and that it could \xe2\x80\x9cconfirm the existence of another\nintrusion vector that works by abusing applications [other than Orion] with privileged access to\nMicrosoft Office 365 and Azure environments.\xe2\x80\x9d\nHow did SVR make the leap to the cloud from within customer systems? It appears it used multiple\npathways, one of which is known as the \xe2\x80\x9cGolden SAML\xe2\x80\x9d approach. This method overcomes the\ncritical identity authentication process that normally precludes unauthorized users from accessing\ncloud-based accounts. More specifically, it is a method that works for systems that use \xe2\x80\x9cActive\nDirectory Federation Services,\xe2\x80\x9d or ADFS, to connect users with cloud-based services like M365. The\nbasic idea with ADFS is that when a user goes to log in to the cloud service, that service directs\nthe request to a particular server (the ADFS server) to validate the user\xe2\x80\x99s identity. If the ADFS server\napproves the credentials, it issues a token to the cloud service that confirms the user\xe2\x80\x99s legitimacy\nand enabling access. For obvious reasons, then, the security of the ADFS server itself is critical. In\nparticular, the private encryption key and signing certificate for that server are critical. Which\nbrings us to the heart of the Golden SAML approach: if the attacker gains access to the private\nkey, this in turn leads to the ability to issue tokens, and that then opens the door to accessing the\naccounts associated with that ADFS server.\nThat was one way that SVR began strolling through the 365 accounts of its victims. One of the\nother methods later identified by FireEye was similar: the creation within Azure Active Directory\n(Azure AD) of entirely new domains approved to function as a trusted third-party \xe2\x80\x9cidentity\nprovider\xe2\x80\x9d\xe2\x80\x94that is, as a provider of authentication services such as those described above.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n9\n\nWhichever particular pathway was taken, however, the fundamental approach was the same:\nleveraging the client\xe2\x80\x99s own credentials so as to circumvent cloud identity-authentication\nsafeguards from the inside. At this point, it was simply a question of whether anyone would notice\nunusual patterns of account access and other account activity. For a long time, no one did.\nStep six: don\xe2\x80\x99t get caught\nWhat changed? SVR\xe2\x80\x99s luck ran out. It was extracting material from a variety of private victims,\nnot just government agencies. One of these, as it happened, was the cybersecurity company\nFireEye, and at some point FireEye detected what was happening.\nOn December 8, 2020, Kevin Mandia published the jaw-dropping news that someone had\npenetrated FireEye\xe2\x80\x99s systems and gotten away with their pen-testing tools. The sophistication of\nthe attack suggested it was the work of a nation-state actor, in Mandia\xe2\x80\x99s opinion, as did the fact\nthat the attacker also apparently attempted to learn things about FireEye\xe2\x80\x99s government\ncustomers. Five days later, Mandia announced as a follow-up that FireEye had \xe2\x80\x9cidentified a\nglobal campaign that introduces a compromise into the networks of public and private\norganizations through the software supply chain.\xe2\x80\x9d In particular, Mandia explained, the campaign\nexploited the update mechanism for SolarWinds Orion.\xe2\x80\x9d It was a stunning turn of events, with\nholiday-wrecking implications for thousands-upon-thousands of SolarWinds customers.\nGiven the scale and potential impact of the operation, it was clear early on that the episode\nconstituted a \xe2\x80\x9csignificant cyber incident\xe2\x80\x9d\xe2\x80\x94that is, an incident of sufficiently-serious nature to\nwarrant formal federal government interagency coordination efforts\xe2\x80\x94under the U.S.\ngovernment\xe2\x80\x99s National Cyber Response Plan. In practical terms, this meant that the federal\ngovernment would form an interagency \xe2\x80\x9cCyber Unified Coordination Group\xe2\x80\x9d (UCG) as the focal\npoint for cooperation and deconfliction among FBI (as the lead agency for what the government\ncalls \xe2\x80\x9cthreat response\xe2\x80\x9d), CISA (as the lead agency for \xe2\x80\x9casset response\xe2\x80\x9d), and ODNI with NSA\nsupport (as the lead agency for \xe2\x80\x9cintelligence support and related activities\xe2\x80\x9d). By January 5, the\nUCG was ready to go on the record with a (very) limited degree of public attribution, declaring\ntheir collective belief that the attacker was \xe2\x80\x9clikely Russian in origin.\xe2\x80\x9d This was a far cry from blaming\nthe Russian government directly, but it was a beginning. Meanwhile, private sector experts were\nmore explicit about the attribution. Dmitri Alperovitch and David Cross used the label \xe2\x80\x9cHoliday\nBear\xe2\x80\x9d in an interview on Patrick Gray\xe2\x80\x99s Risky Business show (a weekly must-listen for everyone\ninterested in cybersecurity) as a way to capture their view that a Russian government actor was\nresponsible, even it if was not yet clear which precise actor it was.\nEventually, the US government would state in no uncertain terms that it was the SVR, specifically,\nthat conducted the operation: \xe2\x80\x9cToday the United States if formally naming the Russian Foreign\nIntelligence Service (SVR), also known as APT 29, Cozy Bear, and The Dukes, as the perpetrator of\nthe broad-scope cyber espionage campaign that exploited the SolarWinds Orion platform and\nother information technology infrastructures. The U.S. Intelligence Community has high confidence\nin its assessment of attribution to the SVR.\xe2\x80\x9d\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n10\n\nConsider the following questions and prepare to discuss them in class:\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\nWas it wrong, in some normative sense, for SVR to conduct this campaign?\nMust the answer to that question be yes to justify efforts to defeat such campaigns?\nMust the answer to the first question be yes to justify efforts to impose costs on Russia\nfor conducting the campaign?\nYou may have read about other recent high-profile cybersecurity challenges, such as\na ransomware episode targeting Colonial Pipeline which resulted in operational\ndisruptions with massive practical consequences, particularly on the East Coast.\nShould we view that sort of event the same as the Holiday Bear campaign?\nWhen analyzing actions by foreign actors in this space, do practices of US\ngovernment agencies matter? What about actions of individual US non-state actors?\nWho, if anyone, bears meaningful responsibility for failing to prevent or detect the\nHoliday Bear campaign?\nShould private companies be liable for damages when their products are exploited?\nBe prepared to discuss this with reference to SolarWinds, HelpSystems, and Microsoft.\nConsider the performance of the federal agencies at issue in this account. Later in the\nbook we will learn about how the federal government is organized to defend itself on\nsuch matters, but for now we must still ask: based on what is in the public record, are\nthese agencies partially at fault?\nIf you were president, what action if any would you take once you were confident of\nSVR\xe2\x80\x99s responsibility for this campaign?\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n11\n\n2. Introduction to Key Terms and Concepts\n\nOur aim in this reading is to build common ground regarding a variety of key concepts and terms\nassociated with cybersecurity.\nA. About those \xe2\x80\x9cattackers\xe2\x80\x9d\nIn this book we often will use the word \xe2\x80\x9cattacker\xe2\x80\x9d as a shorthand referring to a person or\norganization that seeks to access, disrupt, manipulate, or damage a system in an unauthorized\nway. Attackers come in many shapes and sizes. Some are sophisticated professionals, others are\nrank amateurs. Some are state-sponsored, some are part of non-state organizations (and some\nof these nonetheless sometimes work on behalf of states), and some are individuals. Some are\ncrooks. Some are spies. Some are just showing off skills. Some are in it for the laughs. Some do it\nto settle personal scores. Some are seeking competitive advantage. Some mean well, hoping to\nspur people to increase their defenses by exposing weaknesses in hopes that they\xe2\x80\x99ll be remedied.\nSome are malicious, hoping to cause harm (or to use your system to cause harm to others). The\npoint being, there are many potential attackers out there, with a wide variety of motives and\ncapacities, some awful and others laudable.\nB. Core Goals Associated with the Security of Information\nThere is a particular organizing principle often used to explain the core goals of information\nsecurity (\xe2\x80\x9cinfosec\xe2\x80\x9d): the \xe2\x80\x9cCIA Triad.\xe2\x80\x9d That\xe2\x80\x99s not a reference to the Central Intelligence Agency.\nRather, the acronym refers to three distinct defensive policy goals: preserving the confidentiality,\nintegrity, and availability of information.\nConfidentiality:\nYou may sometimes be happy to expose certain information to the world, but often you\xe2\x80\x99ll\nwant to control access to it. Ensuring the confidentiality of information means just that\xe2\x80\x93\xe2\x80\x93\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n12\n\nensuring that people can access it only in accordance with the terms the owner of the\ninformation sets. We can also refer to this as privacy, though \xe2\x80\x9cconfidentiality\xe2\x80\x9d fits a bit\nbetter and is more commonly used in this setting. Those who gain unauthorized access to\nan information system can cause harm, from this point of view, by violating\nconfidentiality\xe2\x80\x94either by just reading the information or exfiltrating a copy of it out of the\nsystem.\nIntegrity:\nIn addition to controlling the confidentiality of information, we also commonly wish to\nensure that information is not altered or destroyed in an unauthorized way. Those who\ngain unauthorized access to a system at a level permitting alteration of data are thus in a\nposition to cause harm to the integrity of the information.\nAvailability:\nAnother goal for the security of information systems is to ensure systems work as intended\xe2\x80\x94\nthat is, that the information remains available for its intended use. An attacker who cannot\npierce the confidentiality of information or harm its integrity might nonetheless be able to\ndisrupt access to it, causing harm to the availability of the information. And notice, too,\nthat measures one might take to protect against harms to the confidentiality and integrity\nof a might impose undue costs along the availability dimension.\nIn short, the overarching goal of cybersecurity from the defensive perspective is to prevent (or, at\nleast, minimize) unauthorized, harmful actions along any of these dimensions.\nC. More Key Terms\nVulnerability:\nIn any system, there are latent weaknesses. Those weaknesses present opportunities that\nmight be exploited purposefully (or even just accidentally) to cause the system to perform\nin a way its owner does not intend. This is endemic to software. The code that comprises\nsoftware tends to be complex, sometimes mind-bogglingly so. Vulnerabilities\xe2\x80\x94also known\nas \xe2\x80\x9cbugs\xe2\x80\x9d or \xe2\x80\x9cvulns\xe2\x80\x9d\xe2\x80\x94are bound to be there. Some are easily spotted, and some require\nsheer genius or blind luck to discover. Some are easily remedied (that is, \xe2\x80\x9cpatched\xe2\x80\x9d by a\nchange to the code in question), but some cannot readily be fixed without disrupting the\nfunctionality of the code.\nNote: Just because a vuln has been identified does not mean the creator/supplier of the\nsoftware at issue will develop a patch. And even if a patch is developed, it does not follow\nthat everyone using that software will apply the patch. Many vulns remain useful to\nattackers long, long after their existence is discovered and a patch developed.\nExploit:\nJust knowing that vuln exists is not enough to provide someone with unauthorized access\nto a system\xe2\x80\x93\xe2\x80\x93some further step is required to take advantage of the vuln. An \xe2\x80\x9cexploit\xe2\x80\x9d is a\nprogram or technique that takes advantage of a vuln in order to achieve some\nunauthorized effect within the system.\nNote: An attacker may not immediately have access to all parts of the system at issue.\n\xe2\x80\x9cPrivilege escalation\xe2\x80\x9d refers to additional steps that extend the attacker\'s unauthorized\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n13\n\naccess. An \xe2\x80\x9cexploit chain\xe2\x80\x9d refers to the combination of programs and techniques that an\nattacker assembles to gain access to a system, escalate privileges within it, and then\nperhaps to take further actions.\nDisclosure:\nA person who discovers a vulnerability (or, for that matter, who identifies an exploit\ntargeting a vulnerability) might choose to disclose the information to some responsible\nparty, such as the creator of the software that suffers from the vulnerability or to a public\ndatabase of known vulns. Some companies actually pay bounties for such information\nthrough \xe2\x80\x9cbug bounty programs,\xe2\x80\x9d but then again, some companies have unfortunately\nsuspicious (or worse) reactions to receiving such information out of the blue\xe2\x80\x93\xe2\x80\x93especially if\nthey perceive the situation as an extortion attempt. Meanwhile, not everyone who\ndiscovers a vuln is inclined to disclose it. Some would prefer to sell the information on the\nblack market, or even keep it for their own eventual use.\nA \xe2\x80\x9czero-day vulnerability\xe2\x80\x9d is a vulnerability that has not been disclosed. The name reflects\nthe fact that is has been zero days since disclosure, and thus there is not yet a patch for\nthe vuln (let alone distribution of a patch). Many assume that this makes zero-day vulns\nthe most valuable bugs. But, in fact, the value of a vuln depends on many factors,\nespecially the nature of the access that follows when the vuln is exploited successfully.\nThere are many, many, many more n-day vulns (i.e., vulns that were disclosed n days ago,\nwith n simply being a variable reflecting the number of days in a particular, actual\ninstance), and some have considerable continuing value. Conversely, some zero-days\nare not particularly valuable.\nNote: The fact that a company receives notification of a bug does not mean the\ncompany will necessarily work to develop a patch for it. Most companies have a primary\nmission (selling products or services) where they would prefer to spend their resources.\nInvesting the time, money, and labor in increasing cybersecurity diverts resources away\nfrom profit-seeking projects. And so, when a company is alerted to a vulnerability in its\nsystem, it will undoubtedly weigh the costs and benefits associated with patching it.\nSocial Engineering:\nAlas, the greatest and most persistent vulnerability is, well, us. \xe2\x80\x9cSocial engineering\xe2\x80\x9d means\ntricking people into revealing information or otherwise taking an action that make it\npossible for someone to gain unauthorized access to a system. This can be as simple as\ntricking someone into sharing a password, or as complicated as developing a highly\ncustomized email designed to get the target to open an attachment that contains\nmalware.\n\xe2\x80\x9cPhishing\xe2\x80\x9d is the generic term for tricking someone into opening an attachment or clicking\na link that opens the door for malware to access a system. \xe2\x80\x9cSpear phishing\xe2\x80\x9d is when the\ninducement is tailored to the target\xe2\x80\x93\xe2\x80\x93for example, an email that appears to be from a\ncoworker asking you to review an attached document.\nAnother category of human vulnerability involves \xe2\x80\x9cinsider threats\xe2\x80\x9d\xe2\x80\x94that is, people within\nan organization who properly have access to a system but then use that access in an\nunauthorized way or cooperate with someone else to enable them to do so. Some insider\nthreats are themselves malicious, such as an employee stealing trade secrets from his\nemployer. Others are induced by an outside actor working through an insider\xe2\x80\x93\xe2\x80\x93whether\nthe insider knows it or not. For example, an employee who forwards an email that contains\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n14\n\nlinks or attachments laced with malware is an insider who poses a threat to his\norganization, even though he is unaware. And don\xe2\x80\x99t disregard witting forms of\ncollaboration resulting from bribery, blackmail, coercion, etc.\n\nSpend some time thinking about the various reasons why someone might want to gain\nunauthorized access to a system, and what types of individuals and organizations might act on\nthose reasons. Be prepared to offer your thoughts during class, as we work collectively to map\nout the constellation of motives and actors.\n\nD. Meet the Black Market\nWhen a person or entity wants to gain unauthorized access to, or disrupt, a computer or network,\nit certainly helps if that person or entity already has the skill and resources needed to develop tools\nto suit that purpose. But not everyone does, and for the most part, they don\xe2\x80\x99t actually need to.\nWhy not? Because there is a thriving black market for the sale of both stolen information (credit\ncard numbers, etc.), and the tools needed to steal and disrupt.\nObviously, anonymity is important to participants in cybercrime black markets. Consider the\nfollowing excerpt from this January 2017 Wired article from Andy Greenberg, as an introduction\nto how these markets and their participants try to remain hidden:\nSITES ON THE so-called dark web, or darknet, typically operate under what seems like a\nprivacy paradox: While anyone who knows a dark web site\'s address can visit it, no one\ncan figure out who hosts that site, or where. It hides in plain sight. But changes coming to\nthe anonymity tools underlying the darknet promise to make a new kind of online privacy\npossible. Soon anyone will be able to create their own corner of the internet that\'s not\njust anonymous and untraceable, but entirely undiscoverable without an invite.\nOver the coming months, the non-profit Tor Project will upgrade the security and privacy\nof the so-called "onion services," or "hidden services," that enable the darknet\'s\nanonymity. \xe2\x80\xa6 That code is now getting a revamp, set to go live sometime later this year,\ndesigned to both strengthen its encryption and to let administrators easily create fully\nsecret darknet sites that can only be discovered by those who know a long string of\nunguessable characters. \xe2\x80\xa6\nMost darknet sites today make no secret of their existence, widely publicizing their\n".onion" web addresses on the regular web and social media for potential visitors. Any\nwhistleblower can visit WikiLeaks\' anonymous upload system, for instance, by pasting\nwlupld3ptjvsgwqw.onion into their Tor browser, and many thousands of drug customers\nand dealers knew that the notorious dark web drug market Silk Road could be found at\nsilkroadvb5piz3r.onion before the FBI took it offline.\nBut even without knowing a Tor hidden service\'s address, another trick has allowed\nsnoops, security firms, hackers, and law enforcement to discover them. Tor\'s network\ncomprises volunteers\' computers that serve as "nodes," bouncing traffic around the\nglobe. Anyone can position their computer as a particular sort of node---one of\nthousands of "hidden service directories" that route visitors to a certain hidden service.\nFor that routing system to work, all hidden services have to declare their existence to\nthose directories. A study released at the hacker conference Defcon last year showed\nthat more than a hundred of the 3,000 or so hidden service directories were secretly\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n15\n\ncrawling every site whose address they learned, in order to scan the dark web for\npreviously undiscovered sites.\n\xe2\x80\xa6 The next generation of hidden services will use a clever method to protect the secrecy\nof those addresses. Instead of declaring their .onion address to hidden service\ndirectories, they\'ll instead derive a unique cryptographic key from that address, and give\nthat key to Tor\'s hidden service directories. Any Tor user looking for a certain hidden\nservice can perform that same derivation to check the key and route themselves to the\ncorrect darknet site. But the hidden service directory can\'t derive the .onion address from\nthe key, preventing snoops from discovering any secret darknet address. "The Tor network\nisn\xe2\x80\x99t going to give you any way to learn about an onion address you don\xe2\x80\x99t already\nknow," says Mathewson.\n\xe2\x80\xa6 That potential to foil law enforcement raises the inevitable question: Will\nundiscoverable hidden services become a magnet for the worst parts of the darknet,\nincluding markets for stolen data, hacking tools, or child pornography?\n\nConsider the following questions and prepare to discuss them in class:\n\xe2\x80\xa2 What do the labels \xe2\x80\x9cdarknet\xe2\x80\x9d and \xe2\x80\x9cTOR\xe2\x80\x9d mean?\n\xe2\x80\xa2 Which policy arguments might favor allowing at least some such hidden services to\nexist? Which favor suppressing them?\n\xe2\x80\xa2 How should these interests be reconciled? Should the balance should be the same in\nall societies? Why might that be hard in practice?\n\nE. Ransomware\nA particularly-important aspect of hacking-related crime revolves around ransomware\xe2\x80\x94that is,\nschemes to extort money from a victim by encrypting their data and demanding a payment\n(typically bitcoin) in exchange for the key. The problem posed by ransomware has accelerated\nin recent years in part thanks to the emergence of a market for ransomware-as-a-service (RaaS),\nand convenient online portals enabling would-be-customers to purchase RaaS. Catalin Cimpanu\nprovided this overview for ZDNet (Nov. 16, 2020):\nRansomware-as-a-Service is a cyber-security term referring to criminal gangs that rent\nransomware to other groups, either via a dedicated portal or via threads on hacking\nforums.\nRaaS portals work by providing a ready-made ransomware code to other gangs. These\ngangs, often called RaaS clients or affiliates, rent the ransomware code, customize it using\noptions provided by the RaaS, and then deploy in real-world attacks via a method of their\nchoosing.\nThese methods vary between RaaS affiliate and can include email spear-phishing attacks,\nen-masse indisciriminate email spam campaigns, the use of compromised RDP credentials\nto gain access to corporate networks, or the use of vulnerabilities in networking devices to\ngain access to internal enterprise networks.\nPayments from these incidents, regardless of how the affiliates managed to infect a victim,\ngo to the RaaS gang, who keeps a small percentage and then forwards the rest to the\naffiliate.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n16\n\nRaaS offerings have been around since 2017, and they have been widely adopted as they\nallow non-technical criminal gangs to spread ransomware without needing to know how\nto code and deal with advanced cryptography concepts.\nAccording to a report published today by Intel 471, there are currently around 25 RaaS\nofferings being advertised on the underground hacking scene.\nWhile there are ransomware gangs who operate without renting their "product" to other\ngroups, the number of RaaS portals available today far exceeds what many security\nexperts thought could be available and shows the plethora of options that criminal gangs\nhave at their disposal if they ever choose to dip their toes in the ransomware game.\nBut not all RaaS offerings provide the same features. Intel 471 says it\'s been tracking these\nservices across three different tiers, depending on the RaaS\' sophistication, features, and\nproven history.\nTier 1 is for the most well-known ransomware operations today. To be classified as a Tier 1\nRaaS, these operations had to be around for months, proven the viability of their code\nthrough a large number of attacks, and continued to operate despite public exposure.\nThis tier includes the likes of REvil, Netwalker, DopplePaymer, Egregor (Maze), and Ryuk.\nWith the exception of Ryuk, all Tier 1 operators also run dedicated "leak sites" where they\nname-and-shame victims as part of their well-oiled extortion cartel.\nThese gangs also use a wide variety of intrusion vectors, each depending on the type of\naffiliates they recruit. They can breach networks by exploiting bugs in networking devices\n(by recruiting networking experts), they can drop their ransomware payload on systems\nalready infected by other malware (by working with other malware cartels), or they can\ngain access to company networks via RDP connections (by working with brute-force\nbotnet operators or sellers or compromised RDP credentials).\nTier 2 is for RaaS portals that have gained a reputation on the hacking underground,\nprovide access to advanced ransomware strains, but have yet to reach the same number\nof affiliates and attacks as Tier 1 operators.\nThis list includes the likes of Avaddon, Conti, Clop, DarkSide, Mespinoza (Pysa),\nRagnarLocker, Ranzy (Ako), SunCrypt, and Thanos \xe2\x80\x94 and these are effectively the upand-comers of the ransomware world.\nTier 3 is for newly launched RaaS portals or for RaaS offerings about which there\'s limited\nto no information available. In some cases, it is unclear if any of these are still up and\nrunning or if their authors gave up after trying and failing to get their portals off the ground.\nThis list currently includes the likes of CVartek.u45, Exorcist, Gothmog, Lolkek, Muchlove,\nNemty, Rush, Wally, Xinof, Zeoticus, and (late arrival) ZagreuS.\nAll in all, while the underground cybercrime ecosystem is generating profits through\ncriminal activity, it is still a market, and, just like all markets, it is governed by the same\nprinciples that guide any other market today.\nA large number of service providers is the tell-tale sign of a booming economy that is far\nfrom being saturated. Saturating the RaaS market will only happen when criminals create\nmore RaaS portals than affiliate groups are willing to sign up for or when companies bolster\ntheir security measures, making intrusion harder to carry out, drying up profits for crooks.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n17\n\nB. Imposing Costs on Attackers\nIn this section we will study an array of tools that the government can use to impose costs on\nattackers, starting with the tools of criminal law enforcement and then moving on to civil liability\nand beyond that to an array of options that become relevant when the attacker is or might be\nassociated with a foreign government.\n\n3. The Crime Model: Key Institutions and the CFAA\n\nLearning objectives\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\nBe able to distinguish the roles of CCIPS and NSD within DOJ, vis-\xc3\xa0-vis cyber crime.\nUnderstand the sorts of fact patterns that might implicate NSD equities (distinguishing the\nnature of the victim from the nature of the perpetrator)\nBe able to identify and distinguish the FBI and Secret Service roles in investigating cybercrime\n(at the federal level), while also noting potential role of state investigative agencies\nIdentify the organizational home and purpose of NCIJTF\nUnderstand that CFAA is not one crime but many\nFor 1030(a)(1), understand what it means to say this is a trespass+theft crime, albeit one limited\nto specific sorts of protected government information.\nFor 1030(a)(2), understand what it means to say that this too is a trespass+theft crime, this time\none that applies far more broadly than might appear at first glance (and how this is explained\nby the \xe2\x80\x9cprotected computer\xe2\x80\x9d definition)\nFor 1030(a)(3), understand what it means to say that this is a trespass-only crime, and also how\nit is limited in other ways\nFor 1030(a)(4), understand what it means to say that this is a fraud-facilitation crime, and\nespecially grasp that the deceptive element need not be part of the computer access itself,\nbut rather the computer access must be in service of the deception\nFor 1030(a)(5)(A), understand what it means to say that this is a malicious-damage crime.\nFor 1030(a)(5)(B), understand what it means to say that this is a reckless-damage crime.\nFor 1030(a)(5)(C), understand what it means to say that this is a strict-liability for damage/loss\ncrime (and know the definitional difference between \xe2\x80\x9cdamage\xe2\x80\x9d and \xe2\x80\x9closs\xe2\x80\x9d).\nDon\xe2\x80\x99t forget: 1030(b) covers \xe2\x80\x9cconspiracy\xe2\x80\x9d to do all the above, too.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n18\n\nIn this unit we are assuming the paramount policy goal is to minimize unauthorized access to (or\ndisruption of) computers, and we open by examining tools that advance this aim by imposing\ncosts on attackers. Among the most visible and discussed of these tools is criminal prosecution.\nA. Meet the Government\xe2\x80\x99s Investigators\nThere are a surprising number of government agencies responsible for investigating cybercrime,\nand their roles often overlap. As you read the information below, you might want to create a list\nor chart that identifies each agency, the relevant department/structure within the agency, and\ntheir basic responsibilities. Throughout the semester, it may be useful to refer back to this list and\nupdate as needed.\nDepartment of Justice\n\nAs you read here and here to learn about the Department of Justice\'s role in investigating and\nprosecuting attackers, consider the following questions:\n\xe2\x80\xa2 What is the office at DOJ that has special responsibility for this area, in general?\n\xe2\x80\xa2 Which office at the Justice Department appears to have had lead responsibility in the\nAPT 10 Group case, and why do you suppose that is?\n\nFBI\n\nAs you read here and here to learn about the FBI\'s role in investigating and prosecuting\nattackers, consider the following questions:\n\xe2\x80\xa2 What part of FBI focuses on computer crime, in general?\n\xe2\x80\xa2 Can you specify the various roles FBI plays?\n\nU.S. Secret Service\n\nAs you read here about the Secret Service\'s role in investigating and prosecuting attackers,\nconsider the following questions:\n\xe2\x80\xa2 What role does the Secret Service play?\n\xe2\x80\xa2 Why is the Secret Service involved in this area?\n\nWe are focused for the moment on prosecuting hacking as a crime. But it\xe2\x80\x99s worth pausing to\nremind ourselves that \xe2\x80\x9ccrime\xe2\x80\x9d is not always the most relevant label to describe an unauthorized\naccess scenario, even if it does involve a violation of criminal law.\n\nSo stretch your mind a bit, recalling the reference in the readings above to DOJ\xe2\x80\x99s National\nSecurity Division:\n\xe2\x80\xa2 When DOJ decides to prosecute, how might this have implications\xe2\x80\x94perhaps negative\nones\xe2\x80\x94for the missions of other U.S. government agencies or departments?\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n19\n\nB. The Computer Fraud and Abuse Act\nThere are many federal crimes that might be implicated by the activity we are discussing, but the\nmost significant one is the Computer Fraud and Abuse Act, or CFAA. The CFAA is codified in Title\n18 of the United States Code (the U.S. Code is the compilation of federal statutes organized\ntopically, and Title 18 is the main place to find federal criminal laws). In particular, it is codified as\n18 U.S.C. Section 1030.\nFor some of you, this will be your first time to really examine a criminal statute. You may be surprised\nby how convoluted it seems to be once you begin reading it closely. I assure you: You can handle\nit, so long as you take your time parsing the language.\nThe part we want to focus on here is the first subsection, 1030(a). As you will see, it actually\ncontains seven separate criminal offenses. I reprint them below, but you can also find the full text\nof the statute (including the relevant definitions) here. Read them through one time, slowly, and\nthen proceed to the questions below.\nSection 1030(a) imposes felony liability on whomever:\n(1)\n\nhaving knowingly accessed a computer without authorization or exceeding\nauthorized access, and by means of such conduct having obtained information\nthat has been determined by the United States Government pursuant to an\nExecutive order or statute to require protection against unauthorized disclosure for\nreasons of national defense or foreign relations, or any restricted data, as defined\nin paragraph y. of section 11 of the Atomic Energy Act of 1954, with reason to\nbelieve that such information so obtained could be used to the injury of the\nUnited States, or to the advantage of any foreign nation willfully communicates,\ndelivers, transmits, or causes to be communicated, delivered, or transmitted, or\nattempts to communicate, deliver, transmit or cause to be communicated,\ndelivered, or transmitted the same to any person not entitled to receive it, or\nwillfully retains the same and fails to deliver it to the officer or employee of the\nUnited States entitled to receive it;\n\n(2)\n\nintentionally accesses a computer without authorization or exceeds authorized\naccess, and thereby obtains\xe2\x80\x94\n(A) information contained in a financial record of a financial institution, or\nof a card issuer as defined in section 1602(n) of title 15, or contained in a\nfile of a consumer reporting agency on a consumer, as such terms are\ndefined in the Fair Credit Reporting Act (15 U.S.C. 1681 et seq.);\n(B) information from any department or agency of the United States; or\n(C) information from any protected computer;\n\n(3)\n\nintentionally, without authorization to access any nonpublic computer of\na department or agency of the United States, accesses such a computer of\nthat department or agency that is exclusively for the use of the Government of the\nUnited States or, in the case of a computer not exclusively for such use, is used by\nor for the Government of the United States and such conduct affects that use by\nor for the Government of the United States;\n\n(4)\n\nknowingly and with intent to defraud, accesses a protected computer without\nauthorization, or exceeds authorized access, and by means of such conduct\nfurthers the intended fraud and obtains anything of value, unless the object of the\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n20\n\nfraud and the thing obtained consists only of the use of the computer and\nthe value of such use is not more than $5,000 in any 1-year period;\n(5)\n(A) knowingly causes the transmission of a program, information, code, or\ncommand, and as a result of such conduct, intentionally\ncauses damage without authorization, to a protected computer;\n(B) intentionally accesses a protected computer without authorization,\nand as a result of such conduct, recklessly causes damage; or\n(C) intentionally accesses a protected computer without authorization,\nand as a result of such conduct, causes damage and loss.\n(6)\n\nknowingly and with intent to defraud traffics (as defined in section 1029) in any\npassword or similar information through which a computer may be accessed\nwithout authorization, if\xe2\x80\x94\n(A) such trafficking affects interstate or foreign commerce; or\n(B) such computer is used by or for the Government of the United States;\n\n(7)\n\nwith intent to extort from any person any money or other thing of value, transmits\nin interstate or foreign commerce any communication containing any\xe2\x80\x94\n(A) threat to cause damage to a protected computer;\n(B) threat to obtain information from a protected computer without\nauthorization or in excess of authorization or to impair the confidentiality of\ninformation obtained from a protected computer without authorization or\nby exceeding authorized access; or\n(C) demand or request for money or other thing of value in relation\nto damage to a protected computer, where such damage was caused to\nfacilitate the extortion. . . .\n\nAlso note that the statute contains several definitions in 1030(e), too many to list here. Here are\nthe highlights:\n(1)\n\nthe term \xe2\x80\x9ccomputer\xe2\x80\x9d means an electronic, magnetic, optical, electrochemical, or\nother high speed data processing device performing logical, arithmetic, or storage\nfunctions, and includes any data storage facility or communications facility directly\nrelated to or operating in conjunction with such device, but such term does not\ninclude an automated typewriter or typesetter, a portable hand held calculator,\nor other similar device;\n\n(2)\n\nthe term \xe2\x80\x9cprotected computer\xe2\x80\x9d means a computer\xe2\x80\x94\n(A) exclusively for the use of a financial institution or the\nUnited States Government, or, in the case of a computer not exclusively for\nsuch\nuse,\nused\nby\nor\nfor\na financial\ninstitution or\nthe\nUnited States Government\nand\nthe\nconduct\nconstituting\nthe offense affects that use by or for the financial institution or the\nGovernment; or\n(B) which is used in or affecting interstate or foreign commerce or\ncommunication,\nincluding\na computer\nlocated\noutside\nthe\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n21\n\nUnited States that is used in a manner that affects interstate or foreign\ncommerce or communication of the United States;\n\xe2\x80\xa6\n(6)\n\nthe term \xe2\x80\x9cexceeds authorized access\xe2\x80\x9d means to access a computer with\nauthorization and to use such access to obtain or alter information in\nthe computer that the accesser is not entitled so to obtain or alter;\n\n\xe2\x80\xa6\n(8)\n\nthe term \xe2\x80\x9cdamage\xe2\x80\x9d means any impairment to the integrity or availability of data,\na program, a system, or information;\n\n\xe2\x80\xa6\n(11)\n\nthe term \xe2\x80\x9closs\xe2\x80\x9d means any reasonable cost to any victim, including the cost of\nresponding to an offense, conducting a damage assessment, and restoring the\ndata, program, system, or information to its condition prior to the offense, and any\nrevenue lost, cost incurred, or other consequential damages incurred because of\ninterruption of service; and\n\n(12)\n\nthe term \xe2\x80\x9cperson\xe2\x80\x9d means any individual, firm, corporation, educational\ninstitution, financial institution, governmental entity, or legal or other entity.\n\nTo help you make sense of the statute, consider the following:\n\xe2\x80\xa2 Make a list, chart, flash cards, or something else that helps you break down the key\nelements for each of these separate crimes. Start by giving each one a label, in your\nown words, that fairly describes the unique aspect of that particular provision. Then list\nthe elements necessary for an offense, including the necessary actions, the required\nmental state, and any other conditions mentioned.\n\xe2\x80\xa2 Do any of the provisions seem problematic to you? Be prepared to explain why.\n\xe2\x80\xa2 Which provisions seem must relevant to a classic \xe2\x80\x9chacking\xe2\x80\x9d scenario in which someone\nuses an exploit to gain unauthorized access to someone else\xe2\x80\x99s computer, and\nthereafter exfiltrates data from it?\n\xe2\x80\xa2 Is the CFAA only concerned with such hacking scenarios?\n\nNotice that the CFAA goes on, in subsection 1030(b), to criminalize conspiracies and attempts to\ncommit the offenses listed in 1030(a).\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n22\n\n4. CFAA Case Studies and Interpretations\n\nLearning Objectives:\n1. Understand whether and how the CFAA applies in the case of unintentional\xe2\x80\x94but\nreckless\xe2\x80\x94impact on others (the Morris case)\n2. Understand the controversy regarding the CFAA-based prosecution of Aaron Swartz\n3. Grasp the difference between a system owner (a) choosing to give someone access to\ncertain information and (b) specifying rules for what that person can do with that\ninformation. Can you see why the system owner might feel that the former depends on\nthe latter?\n4. Know the CFAA definition for exceeding authorized access.\n5. Understand why point 3 above raises a tricky question regarding the precise meaning of\nthat definition, such that we might interpret \xe2\x80\x9cexceeding access\xe2\x80\x9d either broadly or\nnarrowly.\n6. Understand how the Supreme Court has addressed this issue in Van Buren\nAs we read through various cases where individuals were charged with violating the CFAA, bear\nin mind that the statute has been amended several times throughout the years. For some of these\ncases, the charged offenses will differ slightly from the modern ones. As you read, consider\nwhether it would be easier or harder to charge the same individual with a CFAA violation today,\nand whether any other offenses might apply to the same conduct.\nA. United States v. Morris\nThe first big CFAA prosecution involved the ground-breaking\xe2\x80\x94and largely accidental\xe2\x80\x94\xe2\x80\x9cMorris\nWorm.\xe2\x80\x9d\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n23\n\nRead about the underlying events here, and then read the court opinion affirming his\nconviction\xe2\x80\x93\xe2\x80\x93United States v. Morris, 928 F.2d 504 (2d Cir. 1991).\n\xe2\x80\xa2 Do you agree that Morris violated the CFAA\xe2\x80\x93\xe2\x80\x93either today or as it was written then?\n\xe2\x80\xa2 What were the best legal arguments for and against prosecuting Morris?\n\xe2\x80\xa2 Does the prosecution make normative sense to you? In other words, does it make\nsense to prosecute people like Morris?\n\nB. United States v. Swartz\nThe controversy surrounding the Morris case was nothing compared to that generated by the later\nprosecution of Aaron Swartz.\n\nRead this article about the Swartz prosecution, and consider the same questions from the\nMorris case.\n\xe2\x80\xa2 Do you agree that Swartz violated the CFAA\xe2\x80\x93\xe2\x80\x93either today or as it was written then?\n\xe2\x80\xa2 What were the best legal arguments for and against prosecuting Swartz?\n\xe2\x80\xa2 Does the prosecution make normative sense to you? In other words, does it make\nsense to prosecute people like Swartz?\n\nC. United States v. Van Buren\nThe Supreme Court recently issued its first opinion construing the CFAA: United States v. Van Buren.\nRead the opinion here, focusing on pages 3-16 and 17-20. Take special note of footnote 8, on\np.13.\n\nBe prepared to:\n\xe2\x80\xa2 Identify the precise portion of the CFAA in dispute, the competing proposed\ninterpretations, and the best arguments for and against each proposal\n\xe2\x80\xa2 Explain which interpretation the Court adopted, including especially the idea that a\n\xe2\x80\x9cgate\xe2\x80\x9d is \xe2\x80\x9cup or down\xe2\x80\x9d in a way that defines the scope of an authorized users access\nto a computer\n\xe2\x80\xa2 Can you explain footnote 8?\n\xe2\x80\xa2 Defend your view on whether the Court got it right or wrong\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n24\n\n5. Other Criminal Statutes\n\nLearning Objectives\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\nUnderstand that Wire Fraud is a common charge both because the elements are relatively\nbroad (use of telecoms to further some fraudulent scheme) and the penalties are\ncomparatively serious\nAppreciate the degree of leverage over defendants that follows from the fact that\nprosecutors can charge multiple counts of the same type of crime, if there are multiple\ninstances (which there almost certainly will be in the wire fraud context)\nThe Anthony Clark prosecution illustrates that it can be a bit trick to sort out who is being\nvictimized in a fraud scenario (it wasn\xe2\x80\x99t the buyers who paid him, nor Microsoft (Xbox), but\nrather the gaming company (on the theory that their system was duped into issuing things of\nvalue to him).\nUnderstand why cases involving attackers located overseas present a layer of complexity\ninsofar as it may be difficult to arrange an arrest.\nUnderstand why the lack of an extradition treaty does not mean the U.S. government\ncannot go into a particular location to physically seize a person.\nUnderstand the competing equities (other than the interests of law enforcement, that is) that\narise when there is a proposal to arrest someone who is a foreign national, and how this has\nimplications for how a well-designed government decisionmaking process should go about\nensuring that all such competing equities are given due consideration.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\n25\n\nBe able to explain how the Track2 case illustrates these complexities, including especially the\nrisk of unanticipated collateral consequences (Sergey Mikhailov)\nUnderstand that each state has its own computer crime laws, mostly similar to the federal\nones we\xe2\x80\x99ve studied but sometimes distinct in interesting ways.\nAppreciate how Section 33.02 of the Texas Penal Code, for example, is akin to CFAA Section\n1030(a)(2), except that it requires *no* exfiltration of data (and thus is a type of \xe2\x80\x9ctrespassonly\xe2\x80\x9d provision) and uses an \xe2\x80\x9ceffective consent\xe2\x80\x9d standard that is separately defined (in\nSection 33.01(12)) in a way that expressly makes the owner/operator\xe2\x80\x99s intentions in granting\nconditional access part of the statutory standard (in contrast to the indeterminacy on this\npoint for \xe2\x80\x9cexceeds authorized access\xe2\x80\x9d that has given rise to the federal Van Buren case).\nUnderstand that international law is not the law of a foreign state, but rather a species of law\nthat in theory is common to all states (or at least to the states that are party to a particular\ntreaty)\nThere can be rules of international law that constitute criminal law (there are law-of-war rules\nlike this, notably), but you do not normally see that with ordinary crime situations\xe2\x80\x94and there\nare no such rules as to computer crimes.\nInstead, what you often get are treaties in which states agree to pass ordinary domestic\ncriminal laws on a given subject, and to cooperate with each other\xe2\x80\x99s criminal investigations.\nThe Budapest Convention is like that.\nUnderstand that Russia and China declined to join it, and ponder why.\nUnderstand that Russia, China, and other authoritarian states are pushing a new treaty that\nhas been criticized on the ground that it will give cover to countries to criminalize unwelcome\nonline speech.\n\nA. Other Relevant Criminal Laws\nThe CFAA isn\xe2\x80\x99t the only tool in the toolbox for federal prosecutors dealing with cybercrime. There\nare some statutes of more-general applicability that often fit well with hacking scenarios, and\nthere also are some highly-tailored statutes to consider.\nThe most-relevant of the generally-applicable criminal laws, in this respect, is the \xe2\x80\x9cwire fraud\xe2\x80\x9d\nstatute\xe2\x80\x93\xe2\x80\x9318 U.S.C. 1343:\nWhoever, having devised or intending to devise any scheme or artifice to defraud,\nor for obtaining money or property by means of false or fraudulent pretenses,\nrepresentations, or promises, transmits or causes to be transmitted by means of\nwire,\nradio,\nor\ntelevision\ncommunication\nin\ninterstate\nor foreign\ncommerce, any writings, signs, signals, pictures, or sounds for the purpose of\nexecuting such scheme or artifice, shall be fined under this title or imprisoned not\nmore than 20 years, or both. \xe2\x80\xa6\n\nConsider the following questions:\n\xe2\x80\xa2 How does the wire fraud statute differ from the CFAA?\n\xe2\x80\xa2 Why might a prosecutor find this statute handy?\nTo get a further sense of what a wire fraud prosecution linked to hacking might look like, check\nout this article about an unusual wire fraud prosecution. Goooooooooooooooal!\nApart from \xe2\x80\x9cwire fraud,\xe2\x80\x9d there are several other, more-specific fraud statutes. While I do not intend\nfor you to learn the particulars with them (unlike the CFAA and Wire Fraud), I do want you to be\nfamiliar with the general idea behind them. So skim the following information on identify fraud,\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n26\n\nidentity theft, and access device fraud. Don\xe2\x80\x99t invest too much time in this section; just do enough\nto be able to articulate what these laws forbid in general, and ponder how this could be useful in\na cybersecurity scenario.\nThe \xe2\x80\x9cidentity fraud\xe2\x80\x9d statute, 18 USC 1028, is complex. It lists a variety of identity fraud scenarios (see\n(1)-(8) below), and allows the government to prosecute such activity when certain conditions are\nmet. First, skim the list of fraud scenarios:\n(1)\n\nknowingly\nand\nwithout\nlawful\nauthority produces an identification\ndocument, authentication feature, or a false identification document;\n\n(2)\n\nknowingly transfers an identification document, authentication feature, or a\nfalse identification document knowing that such document or feature was stolen\nor produced without lawful authority;\n\n(3)\n\nknowingly possesses with intent to use unlawfully or transfer unlawfully five or\nmore identification documents (other than those issued lawfully for the use of the\npossessor), authentication features, or false identification documents;\n\n(4)\n\nknowingly possesses an identification document (other than one issued lawfully for\nthe use of the possessor), authentication feature, or a false identification\ndocument, with the intent such document or feature be used to defraud the\nUnited States;\n\n(5)\n\nknowingly produces, transfers,\nor\npossesses\na document-making\nimplement or authentication feature with the intent such document-making\nimplement or authentication feature will be used in the production of a false\nidentification\ndocument or\nanother document-making\nimplement or authentication feature which will be so used;\n\n(6)\n\nknowingly possesses an identification document or authentication feature that is\nor appears to be an identification document or authentication feature of the\nUnited States or a sponsoring entity of an event designated as a special event of\nnational significance which is stolen or produced without lawful authority knowing\nthat such document or feature was stolen or produced without such authority;\n\n(7)\n\nknowingly transfers, possesses, or uses, without lawful authority, a means of\nidentification of another person with the intent to commit, or to aid or abet, or in\nconnection with, any unlawful activity that constitutes a violation of Federal law,\nor that constitutes a felony under any applicable State or local law; or\n\n(8)\n\nknowingly traffics in false or actual authentication features for use\nfalse identification documents, document-making implements, or means\nidentification;\n\nin\nof\n\nAs noted, those scenarios can be prosecuted federally when certain conditions are met. To wit:\n(1)\n\nthe identification\ndocument, authentication\nfeature, or\nfalse identification\ndocument is or appears to be issued by or under the authority of the\nUnited States or a sponsoring entity of an event designated as a special event of\nnational significance or the document-making implement is designed or suited for\nmaking\nsuch\nan\nidentification\ndocument, authentication\nfeature, or\nfalse identification document;\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n(2)\n\nthe offense is an offense under subsection (a)(4) of this section; or\n\n(3)\n\neither\xe2\x80\x94\n\n27\n\n(A) the production, transfer, possession, or use prohibited by this section is\nin or affects interstate or foreign commerce, including the transfer of a\ndocument by electronic means; or\n(B) the means of identification, identification document, false identification\ndocument, or document-making implement is transported in the mail in the\ncourse of the production, transfer, possession, or use prohibited by this\nsection.\nMeanwhile, identity theft, 18 USC 1028A, allows the government to prosecute an individual who:\nduring and in relation to any felony violation enumerated in subsection (c) [more\non this below], knowingly transfers, possesses, or uses, without lawful authority,\na means of identification of another person . . .\nSubsection (c) lists several offenses contained in other statutes, including theft and embezzlement;\n"false personification of citizenship"; "false statements in connection with the acquisition of a\nfirearm"; fraud; mail, bank, and wire fraud; several immigration-related offenses; "obtaining\ncustomer information by false pretenses"; and "false statements relating to" Social Security\nprograms.\nNext we have \xe2\x80\x9caccess device\xe2\x80\x9d fraud. What a confusing term of art that is. Let\xe2\x80\x99s define it first.\nAccording to the relevant statute, this means:\nany card, plate, code, account number, electronic serial number, mobile\nidentification\nnumber,\npersonal\nidentification\nnumber,\nor\nother\ntelecommunications service, equipment, or instrument identifier, or other means of\naccount access that can be used, alone or in conjunction with another access\ndevice, to obtain money, goods, services, or any other thing of value, or that can\nbe used to initiate a transfer of funds (other than a transfer originated solely by\npaper instrument)\nSo, what sorts of charges can be brought? 18 USC 1029 allows the government to prosecute an\nindividual who, in affecting interstate commerce:\n(1)\n\nknowingly and with intent to defraud produces, uses, or traffics in one or more\ncounterfeit access devices;\n\n(2)\n\nknowingly and with intent to defraud traffics in or uses one or more unauthorized\naccess devices during any one-year period, and by such conduct obtains\nanything of value aggregating $1,000 or more during that period;\n\n(3)\n\nknowingly and with intent to defraud possesses fifteen or more devices which are\ncounterfeit or unauthorized access devices;\n\n(4)\n\nknowingly, and with intent to defraud, produces, traffics in, has control or custody\nof, or possesses device-making equipment;\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n28\n\n(5)\n\nknowingly and with intent to defraud effects transactions, with 1 or more access\ndevices issued to another person or persons, to receive payment or any other thing\nof value during any 1-year period the aggregate value of which is equal to or\ngreater than $1,000;\n\n(6)\n\nwithout the authorization of the issuer of the access device, knowingly and with\nintent to defraud solicits a person for the purpose of\xe2\x80\x94\n(A)\n\noffering an access device; or\n\n(B)\n\nselling information regarding or an application to obtain an access device;\n\n(7)\n\nknowingly and with intent to defraud uses, produces, traffics in, has control or\ncustody of, or possesses a telecommunications instrument that has been modified\nor altered to obtain unauthorized use of telecommunications services;\n\n(8)\n\nknowingly and with intent to defraud uses, produces, traffics in, has control or\ncustody of, or possesses a scanning receiver;\n\n(9)\n\nknowingly uses, produces, traffics in, has control or custody of, or possesses\nhardware or software, knowing it has been configured to insert or modify\ntelecommunication identifying information associated with or contained in a\ntelecommunications instrument so that such instrument may be used to obtain\ntelecommunications service without authorization; or\n\n(10)\n\nwithout the authorization of the credit card system member or its agent, knowingly\nand with intent to defraud causes or arranges for another person to present to the\nmember or its agent, for payment, 1 or more evidences or records of transactions\nmade by an access device;\n\nFor a fascinating case showing how a variety of these statutes might be used in combination, we\nwill discuss the prosecution of Roman Zeleznev (aka \xe2\x80\x9cTrack2\xe2\x80\x9d).\n\nRead about Track2 here and consider the following questions:\n\xe2\x80\xa2 This case turned out well for the government; do you think it indicates that similar\nsuccess is possible in most such cases? Read this and this for a glimpse of some\nunusual complications.\n\xe2\x80\xa2 What made this case harder than normal? What factors explain how DOJ prevailed\nanyway? Does this show DOJ can generally prevail in similar cases?\n\nNote: There are other criminal laws that are important in this space, though we will not explore\nthem in the interest of moving along to other topics. For the record, however, I\xe2\x80\x99ll still proceed to\nname a few of them: 18 USC 641 (theft of government property); 18 USC 2511 (unauthorized\ninterception of communications); 18 USC 2701 (unauthorized accessing of stored\ncommunications); and 18 USC 793\xe2\x80\x93798 (various provisions relating to espionage and protection of\ndefense information). There also is 17 USC 1201\xe2\x80\x931205, aka the Digital Millennium Copyright Act\n(\xe2\x80\x9cDMCA\xe2\x80\x9d).\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n29\n\nB. State Criminal Laws\nStates have statutes analogous to the CFAA. For an overview of the relevant Texas statute,\nincluding observations on how it differs from CFAA in certain respects, read this article.\n\nBe prepared to articulate whether / how the Texas statute differs from the CFAA.\n\nC. International Cybercrime Enforcement\nThe United States is party to the \xe2\x80\x9cBudapest Convention on Cybercrime\xe2\x80\x9d\xe2\x80\x93\xe2\x80\x93an international treaty\npromoting cooperation between nations in combating cybercrime.\n\nSkim its provisions to get a rough sense of what it is trying to accomplish.\n\xe2\x80\xa2 What do the parties to this treaty actually promise to do that seems genuinely\nsignificant?\n\xe2\x80\xa2 Why do you suppose Russia, China, and Iran are not parties to this treaty?\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n30\n\n6. Civil Liability under the CFAA\n\nLearning objectives\n1. Be able to explain the pros and cons of modulating (calibrating) \xe2\x80\x9ccivil liability\xe2\x80\x9d as a tool to\nadvance a government\xe2\x80\x99s policy goals for a given industry or problem set such as\ncybersecurity.\n2. Understand that such modulation can involve both (a) expanding or shrinking the grounds for\nsuing and (b) expanding or shrinking the procedural and evidentiary obstacles to actually\nprevailing in court once you have a ground to sue.\n3. Appreciate that the CFAA (section 1030(g)) reflects a purposeful expansion of the grounds to\nsue in the computer crime context, but of course there were (and still are) various pre-existing\ngeneral-purpose grounds to sue people who cause harm intentionally, recklessly, or\nnegligently (and many of these \xe2\x80\x9cold school\xe2\x80\x9d torts apply pretty well in the context of hacking)\n4. Understand that 1030(g) only allows suit against the attacker (and note the \xe2\x80\x9cbelt and\nsuspenders\xe2\x80\x9d line confirming this extra-clearly as to software/hardware makers who plainly were\nrather worried about negligence suits, even though 1030(g) on its face does not authorize\nsuch suits).\n5. Understand the four \xe2\x80\x9cgateways to litigation land\xe2\x80\x9d included in CFAA Section 1030(g), and note\nthat the first gateway (involving aggregate costs of $5000) doesn\xe2\x80\x99t count unless the costs\ninvolved \xe2\x80\x9ceconomic damage.\xe2\x80\x9d\n6. Be able to explain the holding in the Facebook case.\n7. Be able to explain the holding in the LinkedIn case.\n8. Be able to describe how the Facebook and LinkedIn decisions can be distinguished (a hint:\ncan you analogize one of them to a situation in which a guy wants to run a website showing\nthe day\xe2\x80\x99s local gas prices, and gathers his information simply by driving around looking at\nwhat the signs say?)\n9. Once you grasp that distinction, can you form a view on whether the CFAA really should\napply differently in those two scenarios?\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n31\n\nA. The CFAA\xe2\x80\x99s Civil Liability Provision\nIt turns out the CFAA is not just a criminal statute, but also a civil liability statute\xe2\x80\x93\xe2\x80\x93that is, it also\ncreates a \xe2\x80\x9cprivate right of action\xe2\x80\x9d enabling suits for money damages in certain circumstances.\nHere\'s the basic provision making it possible to sue someone who breaches the CFAA, 18 U.S.C.\n1030(g):\n(g)\n\nAny person who suffers damage or loss by reason of a violation of this section may\nmaintain a civil action against the violator to obtain compensatory damages and\ninjunctive relief or other equitable relief. A civil action for a violation of this section\nmay be brought only if the conduct involves 1 of the factors set forth in\nsubclauses (I), (II), (III), (IV), or (V) of subsection (c)(4)(A)(i). Damages for a violation\ninvolving only conduct described in subsection (c)(4)(A)(i)(I) are limited to\neconomic damages. No action may be brought under this subsection unless such\naction is begun within 2 years of the date of the act complained of or the date of\nthe discovery of the damage. No action may be brought under this subsection for\nthe negligent design or manufacture of computer hardware, computer software,\nor firmware.\n\nThat\xe2\x80\x99s not the most straightforward provision, given the complicated cross-reference in the second\nsentence. It would have been clearer if the drafters had simply said in the text itself that the right\nto sue for a CFAA violation exists only where the violation involved one of the following five\nsituations:\n(I)\n\nloss to 1 or more persons during any 1-year period \xe2\x80\xa6 aggregating at least $5,000 in\nvalue;\n\n(II)\n\nthe modification or impairment, or potential modification or impairment, of the\nmedical examination, diagnosis, treatment, or care of 1 or more individuals;\n\n(III)\n\nphysical injury to any person;\n\n(IV)\n\na threat to public health or safety;\n\n(V)\n\ndamage affecting a computer used by or for an entity of the United States\nGovernment in furtherance of the administration of justice, national defense, or\nnational security;\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\n32\n\nWhat do you suppose is the purpose of having any such limits?\nDo you have an opinion on whether these conditions are too narrow or too broad?\nNotice that 1030(g) includes a caveat to the effect that a situation covered by scenario\n(I) above only counts if the damages involved are \xe2\x80\x9ceconomic damages.\xe2\x80\x9d That is a wellestablished concept in tort law, reflecting the idea that there is a distinction between\nharms that are readily-quantifiable in dollar terms (such as lost wages or bills for services\nthat a victim incurred in response to an incident) and those that are more subjective\n(such as pain-and-suffering). Why insist on this limitation in the CFAA context?\nNotice the last sentence of 1030(g).\no Whom does this protect?\no Would such entities likely be subject to 1030(g) liability absent this sentence?\no Does this sentence preclude lawsuits based on theories other than the\nCFAA?\no What sees to be the point of this provision?\n\nB. Case Study: Facebook\xe2\x80\x99s Effort to Shut Down Power Ventures\nIn 2016, the Ninth Circuit Court of Appeals issued a ruling in Facebook v. Vachani, a CFAA case in\nwhich Facebook sought to stop Vachani\xe2\x80\x99s company (\xe2\x80\x9cPower Ventures\xe2\x80\x9d) from continuing to\naccess data from the accounts of Facebook users who willingly shared their login credentials with\nPower Ventures. What follows below is an excerpt from the analysis of that decision from Professor\nOrin Kerr (from a contemporaneous post to the blog the Volokh Conspiracy):\nI think this decision is wrong, and that it has big implications going forward. Here\xe2\x80\x99s a\nrundown of the case and why it matters. I\xe2\x80\x99ll conclude with a thought about a possible way\nto read the case more narrowly, as well as why I\xe2\x80\x99m not convinced that narrow reading is\ncorrect.\nI. The Facts\nSteve Vachani is the chief executive and founder of Power Ventures, which had a website\nat Power.com. (I\xe2\x80\x99ll refer to Vachani and Power Ventures collectively as \xe2\x80\x9cPower.\xe2\x80\x9d) Power\nhad a service that let users aggregate their contacts on different social media sites.\nPower\xe2\x80\x99s software allowed Facebook users to authorize Power to go into their Facebook\naccounts and gather information for them for use at Power\xe2\x80\x99s website. Power users also\nauthorized the software to send Facebook messages to other Facebook users for them.\nFacebook didn\xe2\x80\x99t appreciate this, and it sent a \xe2\x80\x9ccease and desist\xe2\x80\x9d letter to Power telling\nthe company to stop. The cease-and-desist letter told Power that it was violating\nFacebook\xe2\x80\x99s terms of use and warned Power that it may have violated federal and state\nlaw. Facebook also blocked Power\xe2\x80\x99s IP addresses. Power just changed IP addresses and\ncontinued operating.\nFacebook then sued, claiming that Power\xe2\x80\x99s conduct violated the CFAA, a somewhat\nsimilar California unauthorized access statute and the CAN-SPAM Act. Just to keep things\nsimple, I\xe2\x80\x99ll focus this post only on the claims brought under the CFAA.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n33\n\nII. The New Decision\nIn the new decision, the court holds that Power violated the CFAA when it continued to\naccess Facebook\xe2\x80\x99s computers with users\xe2\x80\x99 permission after receiving the cease-and-desist\nletter. Oddly, Judge Susan P. Graber\xe2\x80\x99s explanation for why Power violated the CFAA\nfocuses almost exclusively on Power\xe2\x80\x99s state of mind rather than what Power did. The CFAA\nprohibits intentionally accessing a computer without authorization. Instead of explaining\nwhat counts as access \xe2\x80\x9cwithout authorization,\xe2\x80\x9d Judge Graber focuses mostly on whether\nPower had a culpable state of mind with respect to whether it was doing something\nunwanted.\nHere\xe2\x80\x99s the key analysis:\nInitially, Power users arguably gave Power permission to use Facebook\xe2\x80\x99s computers to\ndisseminate messages. Power reasonably could have thought that consent from\nFacebook users to share the promotion was permission for Power to access Facebook\xe2\x80\x99s\ncomputers. [FN: Because, initially, Power users gave Power permission to use Facebook\xe2\x80\x99s\ncomputers to disseminate messages, we need not decide whether websites such as\nFacebook are presumptively open to all comers, unless and until permission is revoked\nexpressly.] . . . Power users took action akin to allowing a friend to use a computer or to log\non to an e-mail account. Because Power had at least arguable permission to access\nFacebook\xe2\x80\x99s computers, it did not initially access Facebook\xe2\x80\x99s computers \xe2\x80\x9cwithout\nauthorization\xe2\x80\x9d within the meaning of the CFAA.\nBut Facebook expressly rescinded that permission when Facebook issued its written cease\nand desist letter to Power on December 1, 2008. Facebook\xe2\x80\x99s cease and desist letter\ninformed Power that it had violated Facebook\xe2\x80\x99s terms of use and demanded that Power\nstop soliciting Facebook users\xe2\x80\x99 information, using Facebook content, or otherwise\ninteracting with Facebook through automated scripts. Facebook then imposed IP blocks\nin an effort to prevent Power\xe2\x80\x99s continued access.\nThe record shows unequivocally that Power knew that it no longer had authorization to\naccess Facebook\xe2\x80\x99s computers, but continued to do so anyway. In requests for admission\npropounded during the course of this litigation, Power admitted that, after receiving notice\nthat its use of or access to Facebook was forbidden by Facebook, it \xe2\x80\x9ctook, copied, or\nmade use of data from the Facebook website without Facebook\xe2\x80\x99s permission to do so.\xe2\x80\x9d\n(Emphasis added; capitalization omitted.)\n. . . In sum, as it admitted, Power deliberately disregarded the cease and desist letter and\naccessed Facebook\xe2\x80\x99s computers without authorization to do so. It circumvented IP barriers\nthat further demonstrated that Facebook had rescinded permission for Power to access\nFacebook\xe2\x80\x99s computers. [FN: Simply bypassing an IP address, without more, would not\nconstitute unauthorized use. Because a blocked user does not receive notice that he has\nbeen blocked, he may never realize that the block was imposed and that authorization\nwas revoked. Or, even if he does discover the block, he could conclude that it was\ntriggered by misconduct by someone else who shares the same IP address, such as the\nuser\xe2\x80\x99s roommate or co-worker.] We therefore hold that, after receiving written notification\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n34\n\nfrom Facebook on December 1, 2008, Power accessed Facebook\xe2\x80\x99s computers \xe2\x80\x9cwithout\nauthorization\xe2\x80\x9d within the meaning of the CFAA and is liable under that statute.\nAs I read the court\xe2\x80\x99s opinion, the main issue is state of mind. Did you know that the\ncomputer owner didn\xe2\x80\x99t want you to visit the website? At first, Power didn\xe2\x80\x99t know\nFacebook\xe2\x80\x99s view. But after the cease-and-desist letter, Power knew Facebook\xe2\x80\x99s position.\nAs a result, it was a federal crime to use Facebook after having received Facebook\xe2\x80\x99s letter\ntelling it to stay away. If I\xe2\x80\x99m reading the opinion correctly, it appears that every contact\nwith the computer that its owner doesn\xe2\x80\x99t want is \xe2\x80\x9cwithout authorization.\xe2\x80\x9d The main question\nbecomes mens rea: The visit becomes a federal crime when the visitor knows that the\ncomputer owner doesn\xe2\x80\x99t want it.\nIII. The Thin (Nonexistent?) Line Between Terms of Use and Cease-and-Desist Letters\nAt this point you may be thinking: Hey, wait, didn\xe2\x80\x99t the en banc 9th Circuit rule in Nosal I\nthat using a computer in violation of its terms of use is not a CFAA violation? If intentionally\nusing a computer in violation of the terms of use is legal authorized access, as the en banc\n9th Circuit held in Nosal I, why is intentionally using a computer after receiving a ceaseand-desist letter criminal access \xe2\x80\x9cwithout authorization\xe2\x80\x9d? In one case, the user goes to the\nwebsite and sees the terms; in the other, the website owner contacts the user and shows\nthe terms to them. But it\xe2\x80\x99s the same thing, right?\nJudge Graber offers two explanations for the difference. First:\n[A]lthough Nosal I makes clear that violation of the terms of use of a website cannot itself\nconstitute access without authorization, this case does not involve non-compliance with\nterms and conditions of service. Facebook and Power had no direct relationship, and it\ndoes not appear that Power was subject to any contractual terms that it could have\nbreached.\nI don\xe2\x80\x99t follow this.\nFirst, I don\xe2\x80\x99t understand why it matters whether there is an existing contractual relationship.\nMaybe that\xe2\x80\x99s relevant to whether we are in the illegal \xe2\x80\x9caccess without authorization\xe2\x80\x9d box\nor the equally illegal \xe2\x80\x9cexceeds authorized access\xe2\x80\x9d box, which Judge Graber elsewhere\nnotes is a possible difference between this case and Nosal I. But I don\xe2\x80\x99t see how it could\nbe the difference between illegal \xe2\x80\x9caccess without authorization\xe2\x80\x9d and legal authorized\naccess.\nSecond, both terms of use and cease-and-desist letters are just written statements about\nwhat the computer owner wants you to do with the computer. If Facebook\xe2\x80\x99s terms say,\n\xe2\x80\x9cno social media aggregators such as Power.com are permitted to visit,\xe2\x80\x9d it\xe2\x80\x99s hard for me\nto distinguish between that and a letter to Power saying \xe2\x80\x9cwe do not permit social media\naggregators such as you and therefore you cannot visit.\xe2\x80\x9d\nIf you have to really come up with a difference, I suppose terms of use imply a conditional\nthat cease-and-desist letters don\xe2\x80\x99t. Terms of use requires the visitor to see that his act is\nprohibited and therefore unwanted. There can be uncertainty about whether that\ncondition is met. But that\xe2\x80\x99s solely a matter of state of mind rather than the act. It goes to\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n35\n\nwhether the act is intentional, which is a separate element of the crime. I don\xe2\x80\x99t understand\nhow one can be criminal \xe2\x80\x9caccess without authorization\xe2\x80\x9d and the other is legal authorized\naccess.\nJudge Graber also offers this distinction between terms of use and cease-and-desist letters:\nFinally, Nosal I [on terms of use] was most concerned with transforming \xe2\x80\x9cotherwise\ninnocuous behavior into federal crimes simply because a computer is involved.\xe2\x80\x9d Id. at 860.\nIt aimed to prevent criminal liability for computer users who might be unaware that they\nwere committing a crime. But, in this case, Facebook clearly notified Power of the\nrevocation of access, and Power intentionally refused to comply. Nosal I\xe2\x80\x99s concerns about\noverreaching or an absence of culpable intent simply do not apply here. This case is closer\nto Nosal II, wherein liability attached after permission to access computers was expressly\nrevoked, but then the defendant deliberately circumvented the rescission of authorization.\nThis makes no sense to me. Again, Graber appears to have a misplaced emphasis on state\nof mind. She is focused on whether people had \xe2\x80\x9cculpable intent,\xe2\x80\x9d and letting those\n\xe2\x80\x9cunaware\xe2\x80\x9d escape liability while those who acted \xe2\x80\x9cdeliberately\xe2\x80\x9d are punished. But that\ncan\xe2\x80\x99t explain why you can intentionally violate terms of use but you can\xe2\x80\x99t intentionally\nignore cease-and-desist letters. The state-of-mind question is about a different element of\nthe CFAA \xe2\x80\x94 whether the unauthorized access was \xe2\x80\x9cintentional,\xe2\x80\x9d not whether the act was\nan unauthorized access in the first place. The difference in the legal treatment of the two\nacts has to rest on the difference between the acts themselves, not the differences\nbetween possible states of mind about those acts.\nIV. The Physical World Analogy\nFinally, Judge Graber offers a physical-world analogy that I suspect may really explain the\ndecision.\nSuppose that a person wants to borrow a friend\xe2\x80\x99s jewelry that is held in a safe deposit box\nat a bank. The friend gives permission for the person to access the safe deposit box and\nlends him a key. Upon receiving the key, though, the person decides to visit the bank while\ncarrying a shotgun. The bank ejects the person from its premises and bans his reentry. The\ngun-toting jewelry borrower could not then reenter the bank, claiming that access to the\nsafe deposit box gave him authority to stride about the bank\xe2\x80\x99s property while armed. In\nother words, to access the safe deposit box, the person needs permission both from his\nfriend (who controls access to the safe) and from the bank (which controls access to its\npremises). Similarly, for Power to continue its campaign using Facebook\xe2\x80\x99s computers, it\nneeded authorization both from individual Facebook users (who controlled their data and\npersonal pages) and from Facebook (which stored this data on its physical servers).\nI explained my problem with this kind of analogy in my recent article \xe2\x80\x9cNorms of Computer\nTrespass.\xe2\x80\x9d As I see it, the problem is that the trespass norms of private spaces like homes or\ncommercial stores can\xe2\x80\x99t be blindly applied to a public website. Trespass is always normsdependent, and each kind of space has its own set of norms. In the case of a bank, we\nrecognize that the bank is a private business that only permits visitors that it wants to enter.\nThe trespass norm is that staying when the bank wants you out is a trespass.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n36\n\nPublic websites are different, I think. The web is a publishing platform, and everyone is\ninherently authorized to visit a public website. True, Power did more than just visit the public\nface of the website. Power also accessed the individual accounts of users acting as their\nagents. But as I see it, that\xe2\x80\x99s not enough to constitute a computer trespass because it\xe2\x80\x99s\nwithin the permission of the user and acting as the user\xe2\x80\x99s agent. The only non-public access\nwas to the virtual space the user controlled, so I think the user\xe2\x80\x99s permission should be\nenough.\nThis doesn\xe2\x80\x99t mean that what Power did is necessarily a good thing. Maybe there should\nbe other causes of action against Power for its conduct. But as I see it, the CFAA shouldn\xe2\x80\x99t\nbe one of them based on these facts. Facebook also could suspend the accounts of its\nusers who authorized Power, or it could take technical steps to stop Power\xe2\x80\x99s entry inside\nFacebook\xe2\x80\x99s network. But I don\xe2\x80\x99t think it should have been allowed to rely on the CFAA to\nkeep Power away with a letter.\nV. A Narrower Reading?\nThis is an important case. This was a civil dispute, but the CFAA is also criminal statute. If\nread broadly, the case seems to say that if you want to make it a crime for someone to\nvisit your website, you just need to give them notice that you don\xe2\x80\x99t want them to visit. I\ngather that as long as you phrase the notice as a command to cease and desist, rather\nthan as just general terms of use, it becomes legally binding.\nOne question is whether you can read the decision more narrowly to apply only to\naccessing an account rather than visiting a website. Here\xe2\x80\x99s the uncertainty: Is the decision\nsaying broadly that you can\xe2\x80\x99t visit the public face of a website after the computer owner\nsaid \xe2\x80\x9cno,\xe2\x80\x9d or is the decision saying more narrowly that you can\xe2\x80\x99t access an individual\naccount with the user\xe2\x80\x99s permission after the computer owner said \xe2\x80\x9cno\xe2\x80\x9d? I would still\ndisagree with the narrower reading, but it would be a lot less objectionable than the\nbroader one.\nReading over the opinion, though, I don\xe2\x80\x99t see a lot of reason to think the court had the\nnarrower interpretation in mind. Consider these clues. First, Footnote 1 states:\nBecause, initially, Power users gave Power permission to use Facebook\xe2\x80\x99s computers to\ndisseminate messages, we need not decide whether websites such as Facebook are\npresumptively open to all comers, unless and until permission is revoked expressly.\nThe court then cites a law review article \xe2\x80\x9casserting that websites are the cyber-equivalent\nof an open public square in the physical world.\xe2\x80\x9d By not deciding that question, the court\nappears not to be hinging its analysis on a distinction between visiting the public part of a\nwebsite and accessing a private account that happens to be accessible over the web.\nThe effect of a cease-and-desist letter appears to be the same in both cases.\nSecond, when the court explains the difference between terms of use on a website and a\ncease-and-desist letter, it doesn\xe2\x80\x99t just say that the difference is that terms of use often\napplies to the public that uses the website while the cease-and-desist letter here was for\nconduct that required account access. That would have been a ready distinction to\nmake, but the court didn\xe2\x80\x99t make it.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n37\n\nThird, the court says that by sending the cease-and-desist letter, \xe2\x80\x9cFacebook explicitly\nrevoked authorization for any access[.]\xe2\x80\x9d (emphasis in original). It doesn\xe2\x80\x99t say that the\nauthorization was revoked for the account access but not for visiting material accessible\nto the public on its computers (content such as this, for example, which anyone can\naccess). Again, that suggests the broader reading rather than the narrower reading.\nVI. What Next?\nGiven the wafer-thin distinction between this case and the en banc decision in Nosal I, will\nthe 9th Circuit grant a petition for rehearing en banc? I hope so. As always, stay tuned.\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\nSince that time, the Supreme Court decided Van Buren, as you know. Which way\ndoes Van Buren cut?\nCan you explain the Court\xe2\x80\x99s argument for why Power Ventures violated the CFAA?\nCan you distinguish and state the various critiques offered by Professor Kerr?\nWho has it right?\n\nNote: The Supreme Court refused to review the Ninth Circuit\xe2\x80\x99s ruling, thus ending the case.\nC. Case Study: LinkedIn\xe2\x80\x99s Effort to Shut Down HiQ\nRead the following excerpt from the 2019 decision of the Ninth Circuit Court of Appeals in\nLinkedIn v. HiQ:\nMay LinkedIn, the professional networking website, prevent a competitor, hiQ, from\ncollecting and using information that LinkedIn users have shared on their public profiles,\navailable for viewing by anyone with a web browser? HiQ, a data analytics company,\nobtained a preliminary injunction forbidding LinkedIn from denying hiQ access to publicly\navailable LinkedIn member profiles. At this preliminary injunction stage, we do not resolve\nthe companies\xe2\x80\x99 legal dispute definitively, nor do we address all the claims and defenses\nthey have pleaded in the district court. Instead, we focus on whether hiQ has raised\nserious questions on the merits of the factual and legal issues presented to us, as well as\non the other requisites for preliminary relief.\nFounded in 2002, LinkedIn is a professional networking website with over 500 million\nmembers. Members post resumes and job listings and build professional "connections"\nwith other members. LinkedIn specifically disclaims ownership of the information users\npost to their personal profiles: according to LinkedIn\xe2\x80\x99s User Agreement, members own the\ncontent and information they submit or post to LinkedIn and grant LinkedIn only a nonexclusive license to "use, copy, modify, distribute, publish, and process" that information.\nLinkedIn allows its members to choose among various privacy settings. Members can\nspecify which portions of their profile are visible to the general public (that is, to both\nLinkedIn members and nonmembers), and which portions are visible only to direct\nconnections, to the member\xe2\x80\x99s "network" (consisting of LinkedIn members within three\ndegrees of connectivity), or to all LinkedIn members. This case deals only with profiles\nmade visible to the general public.\nDirect connections (or first-degree connections) are people to whom a LinkedIn member\nis connected by virtue of having invited them to connect and had the invitation\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n38\n\naccepted, or of having accepted their invitation to connect. Second-degree\nconnections are people connected to a member\xe2\x80\x99s first-degree connections. Thirddegree connections are people connected to a member\xe2\x80\x99s second-degree connections.\nA LinkedIn member\xe2\x80\x99s network consists of the member\xe2\x80\x99s first-degree, second-degree, and\nthird-degree connections, as well as fellow members of the same LinkedIn Groups\n(groups of members in the same industry or with similar interests that any member can\nrequest to join).\nLinkedIn also offers all members\xe2\x80\x94whatever their profile privacy settings\xe2\x80\x94a "Do Not\nBroadcast" option with respect to every change they make to their profiles. If a LinkedIn\nmember selects this option, her connections will not be notified when she updates her\nprofile information, although the updated information will still appear on her profile page\n(and thus be visible to anyone permitted to view her profile under her general privacy\nsetting). More than 50 million LinkedIn members have, at some point, elected to employ\nthe "Do Not Broadcast" feature, and approximately 20 percent of all active users who\nupdated their profiles between July 2016 and July 2017\xe2\x80\x94whatever their privacy setting\xe2\x80\x94\nemployed the "Do Not Broadcast" setting.\nLinkedIn has taken steps to protect the data on its website from what it perceives as\nmisuse or misappropriation. The instructions in LinkedIn\xe2\x80\x99s "robots.txt" file\xe2\x80\x94a text file used\nby website owners to communicate with search engine crawlers and other web robots\xe2\x80\x94\nprohibit access to LinkedIn servers via automated bots, except that certain entities, like\nthe Google search engine, have express permission from LinkedIn for bot access.\nLinkedIn also employs several technological systems to detect suspicious activity and\nrestrict automated scraping. For example, LinkedIn\xe2\x80\x99s Quicksand system detects nonhuman activity indicative of scraping; its Sentinel system throttles (slows or limits) or even\nblocks activity from suspicious IP addresses; and its Org Block system generates a list of\nknown "bad" IP addresses serving as large-scale scrapers. In total, LinkedIn blocks\napproximately 95 million automated attempts to scrape data every day, and has\nrestricted over 11 million accounts suspected of violating its User Agreement, including\nthrough scraping.\nSection 8.2 of the LinkedIn User Agreement to which hiQ agreed states that users agree\nnot to "[s]crape or copy profiles and information of others through any means (including\ncrawlers, browser plugins and add-ons, and any other technology or manual work),"\n"[c]opy or use the information, content or data on LinkedIn in connection with a\ncompetitive service (as determined by LinkedIn)," "[u]se manual or automated software,\ndevices, scripts robots, other means or processes to access, \xe2\x80\x98scrape,\xe2\x80\x99 \xe2\x80\x98crawl\xe2\x80\x99 or \xe2\x80\x98spider\xe2\x80\x99\nthe Services or any related data or information," or "[u]se bots or other automated\nmethods to access the Services." HiQ is no longer bound by the User Agreement, as\nLinkedIn has terminated hiQ\xe2\x80\x99s user status.\nHiQ is a data analytics company founded in 2012. Using automated bots, it scrapes\ninformation that LinkedIn users have included on public LinkedIn profiles, including name,\njob title, work history, and skills. It then uses that information, along with a proprietary\npredictive algorithm, to yield "people analytics," which it sells to business clients.\nHiQ offers two such analytics. The first, Keeper, purports to identify employees at the\ngreatest risk of being recruited away. According to hiQ, the product enables employers\nto offer career development opportunities, retention bonuses, or other perks to retain\nvaluable employees. The second, Skill Mapper, summarizes employees\xe2\x80\x99 skills in the\naggregate. Among other things, the tool is supposed to help employers identify skill gaps\nin their workforces so that they can offer internal training in those areas, promoting\ninternal mobility and reducing the expense of external recruitment.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n39\n\nHiQ regularly organizes "Elevate" conferences, during which participants discuss hiQ\xe2\x80\x99s\nbusiness model and share best practices in the people analytics field. LinkedIn\nrepresentatives participated in Elevate conferences beginning in October 2015. At least\nten LinkedIn representatives attended the conferences. LinkedIn employees have also\nspoken at Elevate conferences. In 2016, a LinkedIn employee was awarded the Elevate\n"Impact Award." LinkedIn employees thus had an opportunity to learn about hiQ\xe2\x80\x99s\nproducts, including "that [one of] hiQ\xe2\x80\x99s product[s] used data from a variety of sources\xe2\x80\x94\ninternal and external\xe2\x80\x94to predict employee attrition" and that hiQ "collected skills data\nfrom public professional profiles in order to provide hiQ\xe2\x80\x99s customers information about\ntheir employees\xe2\x80\x99 skill sets."\nIn recent years, LinkedIn has explored ways to capitalize on the vast amounts of data\ncontained in LinkedIn profiles by marketing new products. In June 2017, LinkedIn\xe2\x80\x99s Chief\nExecutive Officer ("CEO"), Jeff Weiner, appearing on CBS, explained that LinkedIn hoped\nto "leverage all this extraordinary data we\xe2\x80\x99ve been able to collect by virtue of having\n500 million people join the site." Weiner mentioned as possibilities providing employers\nwith data-driven insights about what skills they will need to grow and where they can find\nemployees with those skills. Since then, LinkedIn has announced a new product, Talent\nInsights, which analyzes LinkedIn data to provide companies with such data-driven\ninformation.\nIn May 2017, LinkedIn sent hiQ a cease-and-desist letter, asserting that hiQ was in\nviolation of LinkedIn\xe2\x80\x99s User Agreement and demanding that hiQ stop accessing and\ncopying data from LinkedIn\xe2\x80\x99s server. The letter stated that if hiQ accessed LinkedIn\xe2\x80\x99s\ndata in the future, it would be violating state and federal law, including the Computer\nFraud and Abuse Act ("CFAA"), the Digital Millennium Copyright Act ("DMCA"), California\nPenal Code \xc2\xa7 502(c), and the California common law of trespass. The letter further stated\nthat LinkedIn had "implemented technical measures to prevent hiQ from accessing, and\nassisting others to access, LinkedIn\xe2\x80\x99s site, through systems that detect, monitor, and block\nscraping activity."\nHiQ\xe2\x80\x99s response was to demand that LinkedIn recognize hiQ\xe2\x80\x99s right to access LinkedIn\xe2\x80\x99s\npublic pages and to threaten to seek an injunction if LinkedIn refused. A week later, hiQ\nfiled suit, seeking injunctive relief based on California law and a declaratory judgment\nthat LinkedIn could not lawfully invoke the CFAA, the DMCA, California Penal Code \xc2\xa7\n502(c), or the common law of trespass against it. HiQ also filed a request for a temporary\nrestraining order, which the parties subsequently agreed to convert into a motion for a\npreliminary injunction.\nThe district court granted hiQ\xe2\x80\x99s motion. It ordered LinkedIn to withdraw its cease-anddesist letter, to remove any existing technical barriers to hiQ\xe2\x80\x99s access to public profiles,\nand to refrain from putting in place any legal or technical measures with the effect of\nblocking hiQ\xe2\x80\x99s access to public profiles. LinkedIn timely appealed.\n\xe2\x80\xa6 The pivotal CFAA question here is whether once hiQ received LinkedIn\xe2\x80\x99s cease-anddesist letter, any further scraping and use of LinkedIn\xe2\x80\x99s data was "without authorization"\nwithin the meaning of the CFAA and thus a violation of the statute. 18 U.S.C. \xc2\xa7 1030(a)(2).\nIf so, hiQ could have no legal right of access to LinkedIn\xe2\x80\x99s data and so could not\nsucceed on any of its state law claims, including the tortious interference with contract\nclaim we have held otherwise sufficient for preliminary injunction purposes.\nWe have held in another context that the phrase " \xe2\x80\x98without authorization\xe2\x80\x99 is a nontechnical term that, given its plain and ordinary meaning, means accessing a protected\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n40\n\ncomputer without permission." Nosal II , 844 F.3d at 1028. Nosal II involved an employee\naccessing without permission an employer\xe2\x80\x99s private computer for which access\npermissions in the form of user accounts were required. Id. at 1028\xe2\x80\x9329. Nosal II did not\naddress whether access can be "without authorization" under the CFAA where, as here,\nprior authorization is not generally required, but a particular person\xe2\x80\x94or bot\xe2\x80\x94is refused\naccess. HiQ\xe2\x80\x99s position is that Nosal II is consistent with the conclusion that where access is\nopen to the general public, the CFAA "without authorization" concept is inapplicable. At\nthe very least, we conclude, hiQ has raised a serious question as to this issue.\nFirst, the wording of the statute, forbidding "access[ ] ... without authorization," 18 U.S.C. \xc2\xa7\n1030(a)(2), suggests a baseline in which access is not generally available and so\npermission is ordinarily required. "Authorization" is an affirmative notion, indicating that\naccess is restricted to those specially recognized or admitted. See, e.g. , Black\xe2\x80\x99s Law\nDictionary (10th ed. 2014) (defining "authorization" as "[o]fficial permission to do\nsomething; sanction or warrant"). Where the default is free access without authorization,\nin ordinary parlance one would characterize selective denial of access as a ban, not as\na lack of "authorization." Cf. Blankenhorn v. City of Orange , 485 F.3d 463, 472 (9th Cir.\n2007) (characterizing the exclusion of the plaintiff in particular from a shopping mall as\n"bann[ing]").\nSecond, even if this interpretation is debatable, the legislative history of the statute\nconfirms our understanding. "If [a] statute\xe2\x80\x99s terms are ambiguous, we may use ...\nlegislative history[ ] and the statute\xe2\x80\x99s overall purpose to illuminate Congress\xe2\x80\x99s intent."\nJonah R. v. Carmona , 446 F.3d 1000, 1005 (9th Cir. 2006).\nThe CFAA was enacted to prevent intentional intrusion onto someone else\xe2\x80\x99s computer\xe2\x80\x94\nspecifically, computer hacking. See United States v. Nosal (Nosal I) , 676 F.3d 854, 858 (9th\nCir. 2012) (citing S. Rep. No. 99-432, at 9 (1986) (Conf. Rep.)).\nThe 1984 House Report on the CFAA explicitly analogized the conduct prohibited by\nsection 1030 to forced entry: "It is noteworthy that section 1030 deals with an\n\xe2\x80\x98unauthorized access\xe2\x80\x99 concept of computer fraud rather than the mere use of a\ncomputer. Thus, the conduct prohibited is analogous to that of \xe2\x80\x98breaking and entering\xe2\x80\x99\n....\xe2\x80\x99 " H.R. Rep. No. 98-894, at 20 (1984); see also id. at 10 (describing the problem of "\n\xe2\x80\x98hackers\xe2\x80\x99 who have been able to access (trespass into) both private and public\ncomputer systems"). Senator Jeremiah Denton similarly characterized the CFAA as a\nstatute designed to prevent unlawful intrusion into otherwise inaccessible computers,\nobserving that "[t]he bill makes it clear that unauthorized access to a Government\ncomputer is a trespass offense, as surely as if the offender had entered a restricted\nGovernment compound without proper authorization." 132 Cong. Rec. 27639 (1986)\n(emphasis added). And when considering amendments to the CFAA two years later, the\nHouse again linked computer intrusion to breaking and entering. See H.R. Rep. No. 99612, at 5\xe2\x80\x936 (1986) (describing "the expanding group of electronic trespassers," who\ntrespass "just as much as if they broke a window and crawled into a home while the\noccupants were away").\nIn recognizing that the CFAA is best understood as an anti-intrusion statute and not as a\n"misappropriation statute," Nosal I , 676 F.3d at 857\xe2\x80\x9358, we rejected the contract-based\ninterpretation of the CFAA\xe2\x80\x99s "without authorization" provision adopted by some of our\nsister circuits. Compare Facebook, Inc. v. Power Ventures, Inc. , 844 F.3d 1058, 1067 (9th\nCir. 2016), cert. denied , \xe2\x80\x93\xe2\x80\x93\xe2\x80\x93 U.S. \xe2\x80\x93\xe2\x80\x93\xe2\x80\x93\xe2\x80\x93, 138 S. Ct. 313, 199 L.Ed.2d 206 (2017) ("[A] violation\nof the terms of use of a website\xe2\x80\x94without more\xe2\x80\x94cannot establish liability under the\nCFAA."); Nosal I , 676 F.3d at 862 ("We remain unpersuaded by the decisions of our sister\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n41\n\ncircuits that interpret the CFAA broadly to cover violations of corporate computer use\nrestrictions or violations of a duty of loyalty."), with EF Cultural Travel BV v. Explorica, Inc. ,\n274 F.3d 577, 583\xe2\x80\x9384 (1st Cir. 2001) (holding that violations of a confidentiality agreement\nor other contractual restraints could give rise to a claim for unauthorized access under\nthe CFAA); United States v. Rodriguez , 628 F.3d 1258, 1263 (11th Cir. 2010) (holding that a\ndefendant "exceeds authorized access" when violating policies governing authorized\nuse of databases).\nWe therefore look to whether the conduct at issue is analogous to "breaking and\nentering." H.R. Rep. No. 98-894, at 20. Significantly, the version of the CFAA initially\nenacted in 1984 was limited to a narrow range of computers\xe2\x80\x94namely, those containing\nnational security information or financial data and those operated by or on behalf of the\ngovernment. See Counterfeit Access Device and Computer Fraud and Abuse Act of\n1984, Pub. L. No. 98-473, \xc2\xa7 2102, 98 Stat. 2190, 2190\xe2\x80\x9391. None of the computers to which\nthe CFAA initially applied were accessible to the general public; affirmative authorization\nof some kind was presumptively required.\nWhen section 1030(a)(2)(c) was added in 1996 to extend the prohibition on unauthorized\naccess to any "protected computer," the Senate Judiciary Committee explained that\nthe amendment was designed to "to increase protection for the privacy and\nconfidentiality of computer information." S. Rep. No. 104-357, at 7 (emphasis added). The\nlegislative history of section 1030 thus makes clear that the prohibition on unauthorized\naccess is properly understood to apply only to private information\xe2\x80\x94information\ndelineated as private through use of a permission requirement of some sort. As one\nprominent commentator has put it, "an authentication requirement, such as a password\ngate, is needed to create the necessary barrier that divides open spaces from closed\nspaces on the Web." Orin S. Kerr, Norms of Computer Trespass , 116 Colum. L. Rev. 1143,\n1161 (2016). Moreover, elsewhere in the statute, password fraud is cited as a means by\nwhich a computer may be accessed without authorization, see 18 U.S.C. \xc2\xa7 1030(a)(6),\nbolstering the idea that authorization is only required for password-protected sites or sites\nthat otherwise prevent the general public from viewing the information.\nWe therefore conclude that hiQ has raised a serious question as to whether the\nreference to access "without authorization" limits the scope of the statutory coverage to\ncomputer information for which authorization or access permission, such as password\nauthentication, is generally required. Put differently, the CFAA contemplates the\nexistence of three kinds of computer information: (1) information for which access is\nopen to the general public and permission is not required, (2) information for which\nauthorization is required and has been given, and (3) information for which authorization\nis required but has not been given (or, in the case of the prohibition on exceeding\nauthorized access, has not been given for the part of the system accessed). Public\nLinkedIn profiles, available to anyone with an Internet connection, fall into the first\ncategory. With regard to such information, the "breaking and entering" analogue\ninvoked so frequently during congressional consideration has no application, and the\nconcept of "without authorization" is inapt.\nNeither of the cases LinkedIn principally relies upon is to the contrary. LinkedIn first cites\nNosal II , 844 F.3d 1024 (9th Cir. 2016). As we have already stated, Nosal II held that a\nformer employee who used current employees\xe2\x80\x99 login credentials to access company\ncomputers and collect confidential information had acted " \xe2\x80\x98without authorization\xe2\x80\x99 in\nviolation of the CFAA." Nosal II , 844 F.3d at 1038. The computer information the\ndefendant accessed in Nosal II was thus plainly one which no one could access without\nauthorization.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n42\n\nSo too with regard to the system at issue in Power Ventures , 844 F.3d 1058 (9th Cir. 2016),\nthe other precedent upon which LinkedIn relies. In that case, Facebook sued Power\nVentures, a social networking website that aggregated social networking information\nfrom multiple platforms, for accessing Facebook users\xe2\x80\x99 data and using that data to send\nmass messages as part of a promotional campaign. Id. at 1062\xe2\x80\x9363. After Facebook sent\na cease-and-desist letter, Power Ventures continued to circumvent IP barriers and gain\naccess to password-protected Facebook member profiles. Id. at 1063. We held that after\nreceiving an individualized cease-and-desist letter, Power Ventures had accessed\nFacebook computers "without authorization" and was therefore liable under the CFAA.\nId. at 1067\xe2\x80\x9368. But we specifically recognized that "Facebook has tried to limit and\ncontrol access to its website" as to the purposes for which Power Ventures sought to use\nit. Id. at 1063. Indeed, Facebook requires its users to register with a unique username and\npassword, and Power Ventures required that Facebook users provide their Facebook\nusername and password to access their Facebook data on Power Ventures\xe2\x80\x99 platform.\nFacebook, Inc. v. Power Ventures, Inc. , 844 F. Supp. 2d 1025, 1028 (N.D. Cal. 2012). While\nPower Ventures was gathering user data that was protected by Facebook\xe2\x80\x99s username\nand password authentication system, the data hiQ was scraping was available to\nanyone with a web browser.\nIn sum, Nosal II and Power Ventures control situations in which authorization generally is\nrequired and has either never been given or has been revoked. As Power Ventures\nindicated, the two cases do not control the situation present here, in which information is\n"presumptively open to all comers." Power Ventures , 844 F.3d at 1067 n.2.\n\xe2\x80\xa6 For all these reasons, it appears that the CFAA\xe2\x80\x99s prohibition on accessing a computer\n"without authorization" is violated when a person circumvents a computer\xe2\x80\x99s generally\napplicable rules regarding access permissions, such as username and password\nrequirements, to gain access to a computer. It is likely that when a computer network\ngenerally permits public access to its data, a user\xe2\x80\x99s accessing that publicly available\ndata will not constitute access without authorization under the CFAA. The data hiQ seeks\nto access is not owned by LinkedIn and has not been demarcated by LinkedIn as private\nusing such an authorization system. \xe2\x80\xa6\nLess than two weeks after the Supreme Court\xe2\x80\x99s decision in Van Buren, the Court granted\nLinkedIn\xe2\x80\x99s request for review of the Ninth Circuit\xe2\x80\x99s ruling, immediately vacating the Ninth Circuit\xe2\x80\x99s\nruling and remanding the case back to the Ninth Circuit for reconsideration in light of Van Buren.\n\n\xe2\x80\xa2\n\nDoes Van Buren require a different outcome?\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n43\n\n7. What if the Attacker is a Foreign Government? (I)\n\nLearning objectives\n1. Be able to describe (and distinguish among) the various categories of state behavior in the\ncyber domain\n2. Appreciate the point of having the ability to apply those distinctions: the idea is no more and\nno less than to help ensure clear-eyed decisionmaking when responding to a situation that\nappears to involve an adversarial cyber action from a foreign government.\n3. Bear in mind that a given scenario might implicate more than one such category.\n4. Understand the problem of indeterminacy: given missing facts, or incorrect beliefs, it may be\nvery hard in practice to apply these categories accurately.\n5. Understand the problem of multiplicity: a given scenario might actually (or seemingly)\ninvolve more than one possible purpose\n6. Understand that everything can change over time: at any given moment you are looking at\na snapshot, but the facts might have been different before and might change again later.\nThis suggests the need to continuously reassess.\n7. Understand that the \xe2\x80\x9cwhat is it\xe2\x80\x9d question is different from (though it might be informed by)\nthe \xe2\x80\x9cwho done it\xe2\x80\x9d question.\n8. Understand that the \xe2\x80\x9cwho done it\xe2\x80\x9d question typically is called \xe2\x80\x9cattribution\xe2\x80\x9d (which we\xe2\x80\x99ll study\nin class 8).\n9. Ponder the complications where the foreign attacker is a seemingly-private actor with ties to\nthe government.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n44\n\nUp until now, we have proceeded from the assumption that instances of unauthorized access\ninvolved run-of-the-mill criminal or tortious activity conducted by private individuals or\norganizations. But sometimes the perpetrator is acting on behalf of a foreign government.\nGovernments hack for many different (and sometimes overlapping) reasons, and we need to\nintroduce these possibilities before turning to the questions that arise when we consider how the\nU.S. government attempts to impose costs on foreign governments in these situations.\nThe primary purposes behind government hacking, in no particular order, include:\no\n\nLaw Enforcement: A government may engage in hacking to advance its own law\nenforcement interests. This could involve hacking to investigate or gather evidence on a\ncrime that has already been committed, or perhaps executing a kind of sting operation.\n\no\n\nCrime: Some regimes are desperate for cash. Private persons are not the only ones who\nmight hack for financial gain.\n\no\n\nInformation Collection: Most states are in the business of stealing secrets in order to inform\ndecision-making or to advance other goals, though states vary widely in their capacity to\nactually do this effectively. It is an ancient art, one that always has involved both technical\nand non-technical means. As more and more information and communications have\ngone digital, hacking has become ever more central to intelligence collection. Often we\ncall this \xe2\x80\x9cspying\xe2\x80\x9d or \xe2\x80\x9cespionage,\xe2\x80\x9d terms that call to mind images of civilian agencies\nstealing secrets for the benefit of a government (or, in the practice of some states\xe2\x80\x94though\nnot the United States\xe2\x80\x94for the benefit of state-controlled or state-favored private\nenterprises). But civilian agencies are not the only ones that engage in surreptitious\ninformation collection. When conducted by the military, we sometimes refer to this activity\nas intelligence, surveillance, and reconnaissance (\xe2\x80\x9cISR\xe2\x80\x9d). ISR has connotations of informing\ntactical, operational, or even strategic military planning. Whatever the label, though, the\nbottom line is that hacking is an increasingly-necessary aspect of stealing secrets.\n\no\n\nCovert Action: As our review of the CFAA underscored, the general label of \xe2\x80\x9chacking\xe2\x80\x9d\nencompasses more than just unauthorized access to steal information; sometimes the\naccess is sought in order to alter or destroy data or to cause harm to a system controlled\nor impacted by that data. When a government pursues that approach, a question arises\nregarding how to categorize the activity. Sometimes such activity will be part of an armed\nconflict, and we will say more about that in just a moment. For now, what matters is that\nnot every such hack occurs in the context of armed conflict; indeed, most do not. And\nyet they are not instances of espionage, either. So what are they? Well, if the government\ninvolved is trying to keep its role secret, then the best answer usually will be \xe2\x80\x9ccovert action.\xe2\x80\x9d\nThere are some complicated nuances here, at least within the U.S. legal system, when the\ngovernment entity involved is a military entity\xe2\x80\x93\xe2\x80\x93but we will save that for later in the course.\nCovert action can encompass a wide-range of cyber operations, from information\noperations (propaganda, disinformation, etc.) to efforts to create damaging physical\neffects (sabotage).\n\no\n\nArmed Conflict: Though journalists and others routinely refer to "cyber attacks\xe2\x80\x9d and\n\xe2\x80\x9ccyberwar\xe2\x80\x9d when talking about hostile foreign cyber activities targeting U.S. systems, the\nfact is that these actions rarely actually concern genuine armed conflict involving the\nUnited States. But they certainly could, and sometimes they really do. And so the threshold\nquestion you must ask is: Is there already a relevant state of armed conflict, or could this\naction on its own engender one? If not, then it is better not to talk in terms of war and\ncombat; covert action may be the better label.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n45\n\no\n\nPreparation of the Battlefield: This is military jargon for the idea that it is at times useful or\neven necessary for the armed forces to take certain actions in advance of potential\nhostilities\xe2\x80\x94sometimes far in advance\xe2\x80\x94in order to be in a better position to carry out\ncertain operations later (that is, if and when an armed conflict actually begins). In the\nphysical world, for example, special operators might enter enemy territory prior to a\nconflict in order to determine optimal routes, preposition supplies, and so forth. So too,\nthen, with cyber operations. In order to be able to take an action involving a targeted\nsystem later, it may be wise or even necessary to establish access to that system now. Of\ncourse, in that case, it\xe2\x80\x99s best to remain undetected, lest that \xe2\x80\x9cpreparation of the\nbattlefield\xe2\x80\x9d go to waste. But what if one actually wants to be detected? That leads us to\nthe distinct concept of a \xe2\x80\x9chold-at-risk\xe2\x80\x9d strategy.\n\no\n\nHold-at-Risk: This perhaps unfamiliar phrase is a shorthand for a simple idea. It refers to\nthe idea that one might want to demonstrate to a rival or prospective opponent\xe2\x80\x94in a\nvery credible way\xe2\x80\x94that one has the capacity to cause damage to something that they\nvalue. That is, the idea is to prove that you are holding something they value \xe2\x80\x9cat risk,\xe2\x80\x9d and\nthat the other side had best not forget this when interacting with you in other settings.\nSimply put, a \xe2\x80\x9chold-at-risk\xe2\x80\x9d strategy is an effort to improve your deterrence posture in\nrelation to an opponent, thus impacting their calculations and actions in a way that is\nfavorable to you. In this sense, it is akin to a \xe2\x80\x9cshow of force\xe2\x80\x9d in which a government puts\nequipment or personnel, quite visibly, in geographic position to carry out certain\noperations (e.g., positioning an aircraft carrier nearby). In the cyber context, penetrating\na system that contains valuable data or controls a valuable system\xe2\x80\x94and allowing the\nother side to detect that you have done this\xe2\x80\x94is a way of signaling that you truly do have\nthe means to harm that data or system (and perhaps others as well).\n\no\n\nThe Indeterminacy and Multiplicity Problems: Here\xe2\x80\x99s the most important point of them all:\nIn many instances, it is not easy for a defender to tell which of these aims might explain\nwhy someone has hacked into a particular system. To be sure, it can become clear\nenough once the hacker begins making use of that access in order to do certain things.\nBut because all of the aforementioned motivations for state-sponsored hacking begin with\nsocial engineering or malware in order to gain unauthorized access to a system, a\ndefender who has detected such an intrusion may be left with little basis for predicting\nwhat the intruder intends. Sometimes the context will help, of course, and eventually time\nwill tell. In rare instances, moreover, external sources of information might shed useful light\ntoo. But in the meantime, the defender is left to make the best guess possible in the\ncircumstances. Note, too, that the intruder might have in mind one purpose at one time,\nand may switch to a different purpose later.\n\nBearing the above in mind, perform the following exercise:\n\xe2\x80\xa2 Pick a foreign power with whom the United States has particularly bad relations.\nImagine you are in a position of authority and trust in that government, and imagine a\nconcrete example of an American target that you might like to have your government\npenetrate for each of the purposes mentioned above.\n\xe2\x80\xa2 Be able to explain what your country gets from each scenario, as well as the offsetting\nrisks that might give you pause.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n46\n\n8. What if the Attacker is a Foreign Government? (II)\n\nLearning objectives\n1. Develop a view on whether our pantheon of malicious cyber activity categories fits only for\nforeign governments, or if instead it also works for activity attributed to foreign non-state\nactors (groups or individuals)\n2. Develop a view on whether \xe2\x80\x9cterrorism\xe2\x80\x9d is a distinct-enough category to warrant separate\ninclusion in the pantheon\n3. Understand the various dimensions along which the United States could be described as\nunusually-vulnerable to malicious cyber activity, relative to the vulnerability of other states\n4. Be able to articulate how the relative (asymmetric) vulnerability of the United States should\nimpact American calculations relating to deterrence in general, and the concept of\nescalation dominance in particular\n5. Speaking of escalation dominance: be able to define it, and relate it to the real-world\nexample of the U.S. response to Iranian DDoS attacks on US banks.\n6. Be able to distinguish among defense, deterrence, and disruption as distinct strategies for\nadvancing the overall goal of minimizing the incidence and impact of hostile cyber\nactivities.\n7. Also be able to explain how both defense and disruption strategies have a dynamic\nrelationship with deterrence.\n8. Understand the distinction between \xe2\x80\x9cwithin-domain\xe2\x80\x9d and \xe2\x80\x9ccross-domain.\xe2\x80\x9d\n9. Be able to explain what \xe2\x80\x9cescalation risk\xe2\x80\x9d means and how this can play a key role in the\nprocess of determining how a government will respond to a hostile foreign cyber action.\n10. Appreciate that responses do not have to be \xe2\x80\x9cwithin-domain,\xe2\x80\x9d and that there may be costs\nor benefits to responding in a cross-domain fashion (though those costs and benefits may be\nimpacted by calibrating the intensity and nature of the response).\n11. Understand the distinction between \xe2\x80\x9cattribution\xe2\x80\x9d and the set of\ninformation/evidence/intelligence that supports that attribution.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n47\n\n12. Appreciate that both attribution, and the underlying support for the attribution, can be kept\nentirely private, made wholly public, or something in between.\n13. Consider why a government might calibrate things along those dimensions, and why it might\nmatter which foreign government is at issue.\n14. Understand that attribution can itself be a cost-imposition mechanisms (\xe2\x80\x9cname-andshame\xe2\x80\x9d), but also recognize that countries vary in the degree to which this will have an\nimpact.\nA. A Framework for Thinking about Threat Reduction\nConversations about the threat foreign governments may pose to networks in the United States\n(including not just threats associated with formal parts of those governments, like their militaries\nand intelligence services, but also private persons/organizations that may act on behalf of those\ngovernments) often are framed in terms of \xe2\x80\x9cdeterrence,\xe2\x80\x9d \xe2\x80\x9cescalation risk,\xe2\x80\x9d and other familiar\nconcepts from the international relations and security literatures. And rightly so. Before exploring\nthose concepts in detail, however, it might help to spend a moment considering, at a high level\nof generality, how such concepts fit into a larger picture.\nLet\xe2\x80\x99s say you are the President of the United States, and you and your advisors are formulating a\nstrategy in response to your belief that a foreign government\xe2\x80\x94let\xe2\x80\x99s say Iran\xe2\x80\x94might take an action\nyou view as a serious threat to U.S. interests. That action could involve the use of an existing\ncapability in some unwelcome way\xe2\x80\x93\xe2\x80\x93a use of military force, an intervention in the oil market, etc.\nOr it might involve an attempt to acquire some new capability that would make the foreign state\na greater threat in the future\xe2\x80\x93\xe2\x80\x93a nuclear bomb, for example. The point is, your overarching goal\nis to minimize the net danger.\nTo achieve that overarching goal, there are at least three subsidiary strategies you might consider\n(they are not mutually exclusive):\n\nDisruption\nPrevent the other state\nfrom becoming\ncapable of taking the\nundesirable action.\nOr, if it has capability\nalready, destroy (or at\nleast degrade) it.\n\nDeterrence\nConvince them not to\ntake the undesirable\naction by maximizing\ntheir expected costs\nand minimizing their\nexpected benefits.\n\nDefense\nMinimize the harm you\nwould suffer if the\nundesirable action\noccurs by maximizing\nrelevant defenses and\nestablishing resiliency.\n\nNote that the disruption, deterrence, and defense strategies can relate to one another. For\nexample, if you build strong defenses and your adversary knows this, this may cause an increase\nin their expected costs of the action (for they may conclude they must put more of their own\nresources into the effort) or a decrease in their expected benefits (for they may have to revise\ntheir odds of success). Either way, their cost-benefit assessment will be less appealing, and the\ndegree of deterrent persuasion increased.\nB. Notes on the U.S. Defensive Posture in Cyberspace: America the Vulnerable?\nRead this article about how extensive \xe2\x80\x9cdigitalization\xe2\x80\x9d of the United States results in strategic\nvulnerabilities that, in turn, cast a shadow over U.S. policymaking and operational decision-making\nin response to adversary actions in cyberspace.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n48\n\nAs you read, consider the following:\n\xe2\x80\xa2 What are the six vulnerabilities described, and precisely why it should matter to U.S.\npolicymakers pondering their options in response to hostile foreign cyber activity?\n\xe2\x80\xa2 What larger lessons do you draw?\nC. Key Terms Relating to Deterrence\nThe following set of readings are designed to introduce you to some of the terminology related to\ndeterrence.\n\nSkim this article in order to develop an understanding of these terms:\n\xe2\x80\xa2 Deterrence\n\xe2\x80\xa2 Cross-domain deterrence\n\xe2\x80\xa2 Within-domain deterrence\n\xe2\x80\xa2 Escalation\n\xe2\x80\xa2 Escalation risk\n\xe2\x80\xa2 Escalation dominance\nNext, read the following excerpts from this article by Shaun Waterman for Cyberscoop:\nWhen the Obama administration was weighing a response to distributed denial-ofservice attacks against U.S. banks in 2012, officials vetoed any retaliation because they\nwere worried that the country\xe2\x80\x99s digital infrastructure wouldn\xe2\x80\x99t be able to deal with\ncounterattacks, according to former Director of National Intelligence James Clapper.\nThe DDoS attacks, which slammed dozens of U.S. banks with increasing force, were\ntraced back to Iran by U.S. intelligence, Clapper recently told the ICF CyberSci\nSymposium in Fairfax, Virginia. The attacks, launched from networks of compromised\nservers around the world, struck 46 major banks and other financial institutions \xe2\x80\x94\nincluding Bank of America, Capital One, JPMorgan Chase, PNC Bank, New York Stock\nExchange and Nasdaq. Hundreds of thousands of customers were unable to access their\nbank accounts online and the victim companies spent tens of millions of dollars to\nmitigate the attacks.\n\xe2\x80\x9cWe\xe2\x80\x99d all built up quite a head of steam, [thinking] \xe2\x80\x98By God, we\xe2\x80\x99re not going to let the\nIranians get away with this! We\xe2\x80\x99re going to do something!\'\xe2\x80\x9d Clapper said, describing a\n2012 National Security Council meeting where intelligence officials laid out options for\nretaliatory cyber measures against Iranian hackers believed responsible.\n\xe2\x80\x9cWe had teed up a bunch of options for cyberattack against the very same players who\nhad participated in these denial of service attacks [against the banks],\xe2\x80\x9d he said. \xe2\x80\x9cThe\ninitial instinct was: Let\xe2\x80\x99s attack back.\xe2\x80\x9d\nAccording to Clapper, then-Secretary of the Treasury Tim Geithner ultimately put a stop\nto the attack after expressing concern over the banks\xe2\x80\x99 ability to withstand a counterretaliation. Additionally, the U.S. also chose not to formally raise the issue with Iran\nthrough diplomatic channels, but instead enlisted allies across the world to help\ndismantle the global infrastructure used to launch the attacks.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n49\n\nClapper added that the conclusion he drew was that no matter how accurate your\nattribution, cyberattacks were always going to rely on robust online fortifications.\n\xe2\x80\x9cThe big take away for me, is that unless you are very confident in your cyberdefenses,\nit\xe2\x80\x99s almost pointless to talk about cyberattacks. The very essence of offense is, you have\nto have a good defense,\xe2\x80\x9d he said. \xe2\x80\x9cAnd what complicates it further is, we in the U.S., we\nhave an inclination to be very precise, very limited, very surgical, legalistic. You cannot\nbe assured that the adversary is going to be similarly precise and surgical and legalistic.\nSo if you attack them, you have a anticipate a probably much \xe2\x80\xa6 greater retaliation as a\nresult.\xe2\x80\x9d\nSam Visner, an ICF executive and former senior NSA official, told CyberScoop the\nquestions the decision raised made sense to him.\nFrom Visner\xe2\x80\x99s perspective, the question is \xe2\x80\x9cWould Iran\xe2\x80\x99s counteraction also be in\nproportion, or would it have sought to demonstrate the capacity to damage and/or\ndestabilize the international monetary system? Would Iran have seen itself as a\nstakeholder in the stability of that system, or as an insurgent?\xe2\x80\x9d\nIt was the prospect of just such an all-out assault by Iranian hackers, rather than any\ndoubt about the attribution, that stayed the hand of the U.S., Clapper said.\n\xe2\x80\x9cWe had the Iranians cold,\xe2\x80\x9d he added, \xe2\x80\x9cThe forensics were quite precise, quite good\nand also quite fun.\xe2\x80\x9d\nClapper\xe2\x80\x99s remarks are a reference to the detailed profiles that U.S. agencies were able\nto build of the alleged attackers, many elements of which were made public when the\nJustice Department indicted seven of them last year. One hacker, for instance, was\nallegedly given credit towards his compulsory military service obligations for his work on\nthe huge botnet that launched the assault \xe2\x80\x94 at that time among the largest DDoS\nattacks ever seen.\nClapper did not elaborate on his comments any further after his speech when\napproached by reporters. The Department of the Treasury declined to comment through\na spokesman. Representatives of Warburg Pincus, where Geithner now works, did not\nrespond to a request for comment.\nClapper said the incident was one of two in Obama\xe2\x80\x99s tenure where the administration\nweighed, but ultimately decided against online retaliation. The other incident was the\nNorth Korean attack on Sony Pictures Entertainment in 2014.\n\xe2\x80\x9cAgain, we had excellent attribution with the North Koreans,\xe2\x80\x9d he said, adding that there\nwas a different \xe2\x80\x9ccomplicating issue\xe2\x80\x9d in this case. \xe2\x80\x9cWas it okay to go through some other\ncountry\xe2\x80\x99s infrastructure when you\xe2\x80\x99re doing essentially a cyber act of war against your\nadversary?\xe2\x80\x9d he asked.\nNorth Korea, which has very limited connectivity to the outside world, relies on China for\nits internet access.\nWhen intelligence officials raised this option, Clapper said, \xe2\x80\x9cThe lawyers went nuts, so we\ndidn\xe2\x80\x99t do anything on the cyber front. We ended up sanctioning a bunch of North\nKorean generals.\xe2\x80\x9d\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n50\n\nClapper added he believed that, at least in the first term of the Obama administration,\nofficials had made the mistake of separating cyber out from other instruments of national\npower; both for the U.S. and its adversaries.\n\xe2\x80\x9cIn the end,\xe2\x80\x9d he concluded, \xe2\x80\x9ccyber\xe2\x80\x99s a tool, not an end in and of itself\xe2\x80\xa6 [Our\nadversaries] do it to achieve an outcome, not because cyber\xe2\x80\x99s cool.\xe2\x80\x9d\n\nConsider the following questions:\n\xe2\x80\xa2 Should the government always make public that it has taken an action in response to\nanother state\xe2\x80\x99s hacking? Can deterrence work without public claims of that kind?\n\xe2\x80\xa2 In answering those questions, give thought to the different possible \xe2\x80\x9caudiences\xe2\x80\x9d for\nsuch actions. Obviously, one would be the foreign government to which the U.S. is\nresponding. But who else might be watching?\nOn \xe2\x80\x9cattribution\xe2\x80\x9d in the cyberspace context, we\xe2\x80\x99ll read to excerpts. First, consider the following\nexcerpt from this Lily Hay Newman article in Wired:\nAFTER MONTHS OF news about Russian meddling in this year\'s US presidential election\nyou\'re probably sick of speculation and ready for answers: What exactly did Russia do\nand why? It sounds simple enough, but a fundamental concept in cybersecurity and\ndigital forensics is the fact that it is sometimes extremely difficult after a cyberattack to\ndefinitively name a perpetrator. Hackers have a lot of technical tools at their disposal to\ncover their tracks. And even when analysts figure out which computer a hacker used,\ngoing from there to who used it is very difficult. This is known as the attribution problem.\nTL;DR: The attribution problem is the idea that identifying the source of a cyber attack or\ncyber crime is often complicated and difficult because there is no physical act to\nobserve and attackers can use digital tools to extensively cover their tracks.\nThe quandary has gained visibility in recent years as more nation-state hacking makes\nattribution a geopolitical issue. And this amplifies the problem significantly by\nnecessitating public disclosures. In the US, when the intelligence community is in\nagreement about an attribution and is ready for the presidential administration to share it\npublicly, citizens want proof or an explanation of how the attribution was reached. But\nreleasing information about technical and physical intelligence capabilities and\ninitiatives can undermine current and future operations. As a result, even when\nintelligence agencies can make a determination with a high degree of confidence, they\nface a second attribution problem in the court of public opinion.\nThe idea that attribution is not possible really doesn\xe2\x80\x99t carry any weight in the technically\ninformed community anymore.\n"Obviously there are cases where we cannot come to a clear conclusion in digital\nforensics. It\xe2\x80\x99s always a question of what evidence did you get," says Thomas Rid, a\ncybersecurity-focused professor in the department of War Studies at King\xe2\x80\x99s College\nLondon and author of the 2014 paper Attributing Cyber Attacks. "But there is still this\n\'attribution is impossible\' knee jerk reaction that occasionally pops up, which really\ndoesn\xe2\x80\x99t make much sense. The idea that attribution is not possible really doesn\xe2\x80\x99t carry\nany weight in the technically informed community anymore."\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n51\n\nWhen the Obama administration placed blame for the 2014 Sony Pictures hack on North\nKorea, for example, much of the security community agreed with the consensus, but\nthere was also some prominent skepticism. Part of this was because Obama did not\ndisclose that the US had the direct ability to spy on North Korean internet activity before\nand during the attack on Sony. These details were later reported by the New York Times.\nBut inconsistent access to full evidence can make it difficult for individuals and civilian\nsecurity firms to vet government attributions.\nIn 2016, President-elect Trump has leaned on the attribution problem to dismiss consensus\nabout Russia\'s political hacking during the presidential campaign. Speaking to FOX News\non Dec. 11, Trump said, "Once they hack, if you don\'t catch them in the act you\'re not\ngoing to catch them. [Intelligence agencies] have no idea if it\'s Russia or China or\nsomebody. It could be somebody sitting in a bed some place. ... I don\'t really think it is\n[the Russians], but who knows? I don\'t know either. They don\'t know and I don\'t know."\nPresident-elect Trump has made many similar statements referencing the difficulty of\ntracing well-executed cyber attacks. But this frames the attribution problem at an\ninaccurate extreme, suggesting that it is absolutely never possible to determine the\nsource of a cyber attack unless analysts observe it as it is happening. (Trump\'s statements\nare also inaccurate given that digital forensic analysts, particularly the civilian firm\nCrowdStrike, did catch Russian actors "in the act.") "What I can say is in my experience\nbeing in an intelligence agency, if the CIA came to me and had a high confidence level\nwith supporting evidence\xe2\x80\x94to dismiss that is definitely alarming," says David Kennedy,\nCEO of the security firm TrustedSec, who formerly worked at the NSA and with the Marine\nCorps\xe2\x80\x99 signal intelligence unit. "No supporting evidence has been released to the public,\nbut would assume it has to Obama, intelligence officers, and Trump."\nIn a broad sense, the attribution problem applies to any type of investigation, not just a\ndigital one. There isn\'t always iron-clad direct proof of who committed a crime and it can\nbe difficult or even impossible to discern a culprit from the evidence and information\navailable. Nonetheless, it is possible to codify a justice system that identifies suspects and\nthen decides whether they are innocent or guilty of crimes based on available\nevidence. Absent perfect information, a justice system will certainly make inaccurate\ndeterminations at times, but if the overall rate of success is satisfactory the framework\ncan function.\nThough cyber attacks and digital attribution are in their infancy compared with that of\nphysical crimes, systems for cyber attribution are slowly developing in the same way. And\nsince attribution deals in degrees of certainty, not absolutes, people are still evolving their\nstandard for what rate of success and confidence level is enough. "Attribution is\nextremely difficult and requires intelligence sources that are reliable and accurate,"\nKennedy says. "The intelligence community typically monitors specific groups and activity\nin order to have high confidence. It\'s not a perfect system, but the US is one of the best."\nFor now, the intelligence community consensus about the Russian attribution is not firm\nenough for some, who still have doubts about whether the US can reasonably base\nretaliation against Russia on it. The attribution problem is exactly that\xe2\x80\x94a problem. But it is\nnot an irreconcilable barrier. "You can identify hackers even if you do not catch them in\nthe act," Rid says. "Digital forensics as a profession is exactly there to solve that problem\nand it can be solved. Sometimes it can\xe2\x80\x99t, but often it can."\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n52\n\nNext, read this excerpt from this piece by David Sanger and Martin Fackler in the New York\nTimes:\n\nThe trail that led American officials to blame North Korea for the destructive cyberattack\non Sony Pictures Entertainment in November winds back to 2010, when the National\nSecurity Agency scrambled to break into the computer systems of a country considered\none of the most impenetrable targets on earth.\nSpurred by growing concern about North Korea\xe2\x80\x99s maturing capabilities, the American\nspy agency drilled into the Chinese networks that connect North Korea to the outside\nworld, picked through connections in Malaysia favored by North Korean hackers and\npenetrated directly into the North with the help of South Korea and other American\nallies, according to former United States and foreign officials, computer experts later\nbriefed on the operations and a newly disclosed N.S.A. document.\nA classified security agency program expanded into an ambitious effort, officials said, to\nplace malware that could track the internal workings of many of the computers and\nnetworks used by the North\xe2\x80\x99s hackers, a force that South Korea\xe2\x80\x99s military recently said\nnumbers roughly 6,000 people. Most are commanded by the country\xe2\x80\x99s main intelligence\nservice, called the Reconnaissance General Bureau, and Bureau 121, its secretive\nhacking unit, with a large outpost in China.\nThe evidence gathered by the \xe2\x80\x9cearly warning radar\xe2\x80\x9d of software painstakingly hidden to\nmonitor North Korea\xe2\x80\x99s activities proved critical in persuading President Obama to accuse\nthe government of Kim Jong-un of ordering the Sony attack, according to the officials\nand experts, who spoke on the condition of anonymity about the classified N.S.A.\noperation.\nMr. Obama\xe2\x80\x99s decision to accuse North Korea of ordering the largest destructive attack\nagainst an American target \xe2\x80\x94 and to promise retaliation, which has begun in the form of\nnew economic sanctions \xe2\x80\x94 was highly unusual: The United States had never explicitly\ncharged another government with mounting a cyberattack on American targets.\nMr. Obama is cautious in drawing stark conclusions from intelligence, aides say. But in this\ncase \xe2\x80\x9che had no doubt,\xe2\x80\x9d according to one senior American military official.\n\xe2\x80\x9cAttributing where attacks come from is incredibly difficult and slow,\xe2\x80\x9d said James A.\nLewis, a cyberwarfare expert at the Center for Strategic and International Studies in\nWashington. \xe2\x80\x9cThe speed and certainty with which the United States made its\ndeterminations about North Korea told you that something was different here \xe2\x80\x94 that\nthey had some kind of inside view.\xe2\x80\x9d\nFor about a decade, the United States has implanted \xe2\x80\x9cbeacons,\xe2\x80\x9d which can map a\ncomputer network, along with surveillance software and occasionally even destructive\nmalware in the computer systems of foreign adversaries. The government spends billions\nof dollars on the technology, which was crucial to the American and Israeli attacks on\nIran\xe2\x80\x99s nuclear program, and documents previously disclosed by Edward J. Snowden, the\nformer security agency contractor, demonstrated how widely they have been deployed\nagainst China.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n53\n\nBut fearing the exposure of its methods in a country that remains a black hole for\nintelligence gathering, American officials have declined to talk publicly about the role\nthe technology played in Washington\xe2\x80\x99s assessment that the North Korean government\nhad ordered the attack on Sony.\nThe extensive American penetration of the North Korean system also raises questions\nabout why the United States was not able to alert Sony as the attacks took shape last fall,\neven though the North had warned, as early as June, that the release of the movie \xe2\x80\x9cThe\nInterview,\xe2\x80\x9d a crude comedy about a C.I.A. plot to assassinate the North\xe2\x80\x99s leader, would\nbe \xe2\x80\x9can act of war.\xe2\x80\x9d\nDinner in Pyongyang\nThe N.S.A.\xe2\x80\x99s success in getting into North Korea\xe2\x80\x99s systems in recent years should have\nallowed the agency to see the first \xe2\x80\x9cspear phishing\xe2\x80\x9d attacks on Sony \xe2\x80\x94 the use of emails\nthat put malicious code into a computer system if an unknowing user clicks on a link \xe2\x80\x94\nwhen the attacks began in early September, according to two American officials.\nBut those attacks did not look unusual. Only in retrospect did investigators determine that\nthe North had stolen the \xe2\x80\x9ccredentials\xe2\x80\x9d of a Sony systems administrator, which allowed the\nhackers to roam freely inside Sony\xe2\x80\x99s systems.\nIn recent weeks, investigators have concluded that the hackers spent more than two\nmonths, from mid-September to mid-November, mapping Sony\xe2\x80\x99s computer systems,\nidentifying critical files and planning how to destroy computers and servers.\n\xe2\x80\x9cThey were incredibly careful, and patient,\xe2\x80\x9d said one person briefed on the investigation.\nBut he added that even with their view into the North\xe2\x80\x99s activities, American intelligence\nagencies \xe2\x80\x9ccouldn\xe2\x80\x99t really understand the severity\xe2\x80\x9d of the destruction that was coming\nwhen the attacks began Nov. 24.\nIn fact, when, Gen. James R. Clapper Jr., the director of national intelligence, had an\nimpromptu dinner in early November with his North Korean counterpart during a secret\nmission to Pyongyang to secure the release of two imprisoned Americans, he made no\nmention of Sony or the North\xe2\x80\x99s growing hacking campaigns, officials say.\nIn a recent speech at Fordham University in New York, Mr. Clapper acknowledged that\nthe commander of the Reconnaissance General Bureau, Kim Yong-chol, with whom he\ntraded barbs over the 12-course dinner, was \xe2\x80\x9clater responsible for overseeing the attack\nagainst Sony.\xe2\x80\x9d (General Clapper praised the food; his hosts later presented him with a bill\nfor his share of the meal.)\nAsked about General Clapper\xe2\x80\x99s knowledge of the Sony attacks from the North when he\nattended the dinner, Brian P. Hale, a spokesman for the director of national intelligence,\nsaid that the director did not know he would meet his intelligence counterpart and that\nthe purpose of his trip to North Korea \xe2\x80\x9cwas solely to secure the release of the two\ndetained U.S. citizens.\xe2\x80\x9d\n\xe2\x80\x9cBecause of the sensitivities surrounding the effort\xe2\x80\x9d to win the Americans\xe2\x80\x99 release, Mr.\nHale said, \xe2\x80\x9cthe D.N.I. was focused on the task and did not want to derail any progress by\ndiscussing other matters.\xe2\x80\x9d But he said General Clapper was acutely aware of the North\xe2\x80\x99s\ngrowing capabilities.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n54\n\nJang Sae-yul, a former North Korean army programmer who defected in 2007, speaking\nin an interview in Seoul, said: \xe2\x80\x9cThey have built up formidable hacking skills. They have\nspent almost 30 years getting ready, learning how to do this and this alone, how to target\nspecific countries.\xe2\x80\x9d\nStill, the sophistication of the Sony hack was such that many experts say they are\nskeptical that North Korea was the culprit, or the lone culprit. They have suggested it was\nan insider, a disgruntled Sony ex-employee or an outside group cleverly mimicking North\nKorean hackers. Many remain unconvinced by the efforts of the F.B.I. director, James B.\nComey, to answer critics by disclosing some of the American evidence.\nMr. Comey told the same Fordham conference that the North Koreans got \xe2\x80\x9csloppy\xe2\x80\x9d in\nhiding their tracks, and that hackers periodically \xe2\x80\x9cconnected directly and we could see\nthem.\xe2\x80\x9d\n\xe2\x80\x9cAnd we could see that the I.P. addresses that were being used to post and to send the\nemails were coming from I.P.s that were exclusively used by the North Koreans,\xe2\x80\x9d he said.\nSome of those addresses appear to be in China, experts say.\nThe skeptics say, however, that it would not be that difficult for hackers who wanted to\nappear to be North Korean to fake their whereabouts. Mr. Comey said there was other\nevidence he could not discuss. So did Adm. Michael S. Rogers, the N.S.A. director, who\ntold the Fordham conference that after reviewing the classified data he had \xe2\x80\x9chigh\nconfidence\xe2\x80\x9d the North had ordered the action.\nA Growing Capability\nNorth Korea built its first computer with vacuum tubes in 1965, with engineers trained in\nFrance. For a brief time, it appeared ahead of South Korea and of China, which not only\ncaught up but also came to build major elements of their economic success on their\nhardware and software.\nDefectors say that the Internet was first viewed by North Korea\xe2\x80\x99s leadership as a threat,\nsomething that could taint its citizens with outside ideas.\nBut Kim Heung-kwang, a defector who said in an interview that he helped train many of\nthe North\xe2\x80\x99s first cyberspies, recalled that in the early 1990s a group of North Korean\ncomputer experts came back from China with a \xe2\x80\x9cvery strange new idea\xe2\x80\x9d: Use the\nInternet to steal secrets and attack the government\xe2\x80\x99s enemies. \xe2\x80\x9cThe Chinese are already\ndoing it,\xe2\x80\x9d he quoted one of the experts as saying.\nDefectors report that the North Korean military was interested. So was the ruling Workers\xe2\x80\x99\nParty, which in 1994 sent 15 North Koreans to a military academy in Beijing to learn about\nhacking. When they returned, they formed the core of the External Information\nIntelligence Office, which hacked into websites, penetrated fire walls and stole\ninformation abroad. Because the North had so few connections to the outside world, the\nhackers did much of their work in China and Japan.\nAccording to Mr. Kim, the military began training computer \xe2\x80\x9cwarriors\xe2\x80\x9d in earnest in 1996\nand two years later opened Bureau 121, now the primary cyberattack unit. Members\nwere dispatched for two years of training in China and Russia. Mr. Jang said they were\nenvied, in part because of their freedom to travel.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n55\n\n\xe2\x80\x9cThey used to come back with exotic foreign clothes and expensive electronics like rice\ncookers and cameras,\xe2\x80\x9d he said. His friends told him that Bureau 121 was divided into\ndifferent groups, each targeting a specific country or region, especially the United\nStates, South Korea and the North\xe2\x80\x99s one ally, China.\n\xe2\x80\x9cThey spend those two years not attacking, but just learning about their target country\xe2\x80\x99s\nInternet,\xe2\x80\x9d said Mr. Jang, 46, who was a first lieutenant in a different army unit that wrote\nsoftware for war game simulations.\nMr. Jang said that as time went on, the North began diverting high school students with\nthe best math skills into a handful of top universities, including a military school\nspecializing in computer-based warfare called Mirim University, which he attended as a\nyoung army officer.\nOthers were deployed to an \xe2\x80\x9cattack base\xe2\x80\x9d in the northeastern Chinese city of Shenyang,\nwhere there are many North Korean-run hotels and restaurants. Unlike the North\xe2\x80\x99s nuclear\nand ballistic missile programs, the cyberforces can be used to harass South Korea and\nthe United States without risking a devastating response.\n\xe2\x80\x9cCyberwarfare is simply the modern chapter in North Korea\xe2\x80\x99s long history of asymmetrical\nwarfare,\xe2\x80\x9d said a security research report in August by Hewlett-Packard.\nAn Attack in Seoul\nWhen the Americans first gained access to the North Korean networks and computers in\n2010, their surveillance focused on the North\xe2\x80\x99s nuclear program and its leadership, as well\nas efforts to detect attacks aimed at United States military forces in South Korea, said one\nformer American official. (The German magazine Der Spiegel published an N.S.A.\ndocument on Saturday that provides some details of South Korea\xe2\x80\x99s help in spying on the\nNorth.) Then a highly destructive attack in 2013 on South Korean banks and media\ncompanies suggested that North Korea was becoming a greater threat, and the focus\nshifted.\n\xe2\x80\x9cThe big target was the hackers,\xe2\x80\x9d the official said.\nThat attack knocked out almost 50,000 computers and servers in South Korea for several\ndays at five banks and television broadcasters.\nThe hackers were patient, spending nine months probing the South Korean systems. But\nthey also made the mistake seen in the Sony hack, at one point revealing what South\nKorean analysts believe to have been their true I.P. addresses. Lim Jong-in, dean of the\nGraduate School of Information Security at Korea University, said those addresses were\ntraced back to Shenyang, and fell within a spectrum of I.P. addresses linked to North\nKorean companies.\nThe attack was studied by American intelligence agencies. But after the North issued its\nwarnings about Sony\xe2\x80\x99s movie last June, American officials appear to have made no\nreference to the risk in their discussions with Sony executives. Even when the spearphishing attacks began in September \xe2\x80\x94 against Sony and other targets \xe2\x80\x94 \xe2\x80\x9cit didn\xe2\x80\x99t set\noff alarm bells,\xe2\x80\x9d according to one person involved in the investigation.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n56\n\nThe result is that American officials began to focus on North Korea only after the\ndestructive attacks began in November, when pictures of skulls and gruesome images of\nSony executives appeared on the screens of company employees. (That propaganda\nmove by the hackers may have worked to Sony\xe2\x80\x99s benefit: Some employees unplugged\ntheir computers immediately, saving some data from destruction.)\nIt did not take long for American officials to conclude that the source of the attack was\nNorth Korea, officials say. \xe2\x80\x9cFiguring out how to respond was a lot harder,\xe2\x80\x9d one White\nHouse official said.\n\nConsider these questions:\n\xe2\x80\xa2 Why do some claim attribution is especially difficult in the cyberspace context, and\nwhy would that be different than, say, nuclear weapons?\n\xe2\x80\xa2 What impact does such difficulty mean as to decision-making in particular cases?\n\xe2\x80\xa2 Should the government always make public that it has taken an action in response to\nanother state\xe2\x80\x99s hacking? Can deterrence work without public claims of that kind?\n\xe2\x80\xa2 In answering those questions, give thought to the different possible \xe2\x80\x9caudiences\xe2\x80\x9d for\nsuch actions. Obviously, one would be the foreign government to which the U.S. is\nresponding. But who else might be watching?\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n57\n\n9. What if the Attacker is a Foreign Government (III)\n\nLearning Objectives\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\nKnow that, prior to 2014, US policy did not allow for the indictment of foreign government\nagents for hacking activities; understand that this changed as to particular scenarios\n(commercial espionage, election interference)\nAppreciate that intelligence collection on such foreign activities is not, itself, a costimposition tool (though it can lead to the use of such tools).\nAppreciate that diplomacy in the form of a complaint (without the threat or imposition of a\ncost or prospect of a benefit) can still be viewed as a soft form of cost imposition, though\nonly some foreign governments will find this significant.\nUnderstand that prosecution can be a cost-imposition tool in and of itself, but also can be a\nhigh-credibility variant of the name-and-shame tool and further might be a useful tool for an\nentirely-distinct cost-imposition strategy: creation of \xe2\x80\x9cinternational norms\xe2\x80\x9d of proper state\nbehavior in the cyber domain.\nUnderstand that a \xe2\x80\x9cnorm\xe2\x80\x9d is not the same as a rule of international \xe2\x80\x9claw,\xe2\x80\x9d and may or may\nnot have real constraining impact.\nAppreciate how the United States and allies have worked to create international agreement\nas to certain norms (including by issuing joint statements and through the UN \xe2\x80\x9cGroup of\nGovernment Experts\xe2\x80\x9d process), but with limited success given divergent national interests\ninvolving some states (particularly Russia, China, and authoritarian states).\n\nA. The Toolkit\nA government interested in imposing costs on a foreign entity can draw, in theory, on a broad\ntoolkit. Options include:\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n58\n\n1. Diplomatic complaint: using formal diplomatic channels to express displeasure, with or\nwithout suggesting possible consequences and with or without making a specific\ndemand.\n2. \xe2\x80\x9cName and shame\xe2\x80\x9d for violating \xe2\x80\x9cnorms\xe2\x80\x9d: going public with an attribution blaming the\nforeign government for an action that violated some particular norm of international\nbehavior (or, if there\xe2\x80\x99s a claim of actual illegality, asserting so)\n3. Prosecution: pursuing criminal charges against the specific foreign persons associated\nwith the action in question. Sometimes this becomes a vehicle for naming-and-shaming,\nnotably, and also a way to put weight behind claims about where the normative and\nlegal lines should be drawn.\n4. Civil suits: foreign governments generally enjoy immunity from civil litigation in US courts,\nbut suits nonetheless are attempted with frequency against both foreign government\nentities and individuals.\n5. Economic sanctions: one of the most commonly used tools in the American foreignpolicy toolkit are economic sanctions. Note that sanctions have more bite when other\ncountries follow suit (either on an ad hoc cooperative basis, or pursuant to collective\naction from the United Nations)\n6. Withholding other benefits: a government also can impose costs internationally by\nretracting or withholding various benefits, such as loans, immigration opportunities, and\nany number of other things.\n7. Providing benefits to the other government\xe2\x80\x99s adversaries: this can take the form of arms\nsales, diplomatic support, etc.\n\nBe prepared to discuss the pros and cons of using each of these levers.\n\nLet\xe2\x80\x99s take a closer look at some of these tools, starting with prosecution.\nB. Prosecution\nConsider the following account from Associate Deputy Attorney General Sujit Raman from a\nspeech delivered in May 2019:\nFor many years, we have targeted and successfully disrupted transnational criminal\nsyndicates engaged in cybercrime, as well as the digital infrastructure those actors\nemploy. More recently, we began publicly charging foreign state actors whose malicious\ncyber activity broke U.S. law. It is fair to ask why we devote significant resources to\nprosecuting state actors whom we may never bring to the United States to face\njustice. And it is fair to ask why we shifted from an approach that relied mainly on\nintelligence collection and diplomacy to one that includes a law enforcement\nresponse. As I will explain, prosecutions of state-sponsored malicious cyber activity serve\nan important purpose, even if we cannot guarantee that we will be able to produce in\ncourt every individual involved.\nSince the indictment of Chinese PLA officers in 2014, the Department of Justice has\nremained focused on state-sponsored criminal activity that targets U.S. companies. We\nare also now focused on activity that targets the U.S. political process. In the past two\nyears, the Department brought more national security cyber cases against criminals acting\non behalf of our major adversaries than in the previous five years.\nThere are several reasons for the increasing prosecutions. The main one is that we are\nfollowing the threat, just as we did in responding to the threat of terrorism. As I\xe2\x80\x99ve\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n59\n\nexplained, nation states are engaged in activity that victimizes individuals and companies\nin the United States, violates U.S. law, and departs from international norms of responsible\nstate behavior\xe2\x80\x94norms that benefit all nations. Our criminal cases reflect our adversaries\xe2\x80\x99\nefforts to harm our companies and our nation.\nSecond, the increasing number of national security cyber cases reinforces the lesson that\nour adversaries\xe2\x80\x99 conduct lies outside the norms of responsible behavior. The actions we\nhighlight in indictments are not legitimate state-craft. They are crimes without justification\nin international relations. I will say more about that in a moment.\nThird, our cases reflect our increasingly sophisticated ability to attribute this criminal\nconduct to the individuals and states involved. This ability is closely related to my second\npoint, because it shows the commitment of our law enforcement and intelligence\nagencies to work closely together, while protecting intelligence sources and\nmethods. These partnerships, which were forged in the counterterrorism context, serve to\nsolidify the consensus that a law enforcement response to malign nation-state cyber\nactivity makes sense.\nIn bringing these cases, we are guided by six basic principles.\nFirst, the Department has a duty to enforce our laws and protect our people. We cannot\nrefuse to act when foreign state actors violate our criminal laws, transgress established\nnorms, and victimize our citizens. That is especially true when such crimes often represent\nsevere violations of the victim\xe2\x80\x99s privacy rights, and can have lasting, damaging\nimpact. The Department has an obligation to work toward a future where our citizens can\nlive and conduct their business with confidence in the integrity of their information and\ninstitutions.\nSecond, attribution is the key to deterrence. \xe2\x80\x9cWithout attribution, there will be no\nconsequences . . . and thus, no deterrence.\xe2\x80\x9d[14] Attribution through the criminal justice\nsystem escalates the stakes for state-sponsored activity in a way that a press release or a\npublic statement alone would not. We have on occasion obtained custody of foreign\ncriminal defendants. Our indictments limit their travel. And the prospect of criminal\nindictment can help deter some cyber actors from engaging in such conduct in the first\nplace. This can make it more difficult for states to recruit the manpower and resources for\ncyber-attacks, and raise the cost of engaging in malicious cyber activity.\nThird, attribution through the criminal justice system is a powerful way to expose state\nconduct that violates norms of responsible behavior. It complicates our adversaries\xe2\x80\x99\nattempts to feign ignorance of illegal acts they thought could be taken in secret, or to\nhide behind public denials. Our cases are governed by well-known policies relating to the\nconduct of all federal prosecutors. An indictment is brought by a grand jury, under\nestablished procedures; charges are brought only when the facts and law justify it. The\nallegations in our indictments are thorough and detailed, and we can prove them in a\ncourtroom, using admissible evidence, at proof beyond any reasonable doubt. For all\nthese reasons, criminal indictments are among the most powerful statements we can\nmake as a government.\nFourth, unsealed indictments promote transparency. There will always be cases in which\nour ability to expose malicious cyber activity is limited by our obligation to protect\nintelligence sources and methods or sensitive ongoing investigations. But where we are\nable to do so, we strive to expose such schemes to the American people and the\ninternational community. Attribution through detailed indictments educates the public\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n60\n\nabout our adversaries\xe2\x80\x99 efforts and methods to spread disinformation, steal commercial\ntechnology, and target computer networks.\nFifth, although our goal is to hold accountable in court those we charge with trade theft\nor cyber crimes, our investigations can provide critical support for the use of civil,\ndiplomatic, economic, and military tools. Some thoughtful critics have criticized the\nDepartment\xe2\x80\x99s so-called \xe2\x80\x9cname and shame\xe2\x80\x9d strategy on the theory that our indictments\nhave failed to stanch the activity. But you can\xe2\x80\x99t separate our indictments from the\nbroader array of tools our government now uses to counter malign cyber activity. These\ninclude freezing assets or prohibiting transactions, or adding companies to the\nDepartment of Commerce Entity List. As the National Security Advisor has confirmed, it\nalso includes \xe2\x80\x9cundertaking offensive cyber operations\xe2\x80\x9d[15] aimed at defending our\nnational interests. Our tools also include other authorities that can block criminals\xe2\x80\x99 assets,\nrestrict their access to the banking system, and prohibit them from freely engaging in\ntrade. We developed this approach to address terrorism and terrorist financing. We are\napplying it to the cyber threat, as well.\nFinally, by using public law to emphasize the need to protect private U.S. victims against\nnation-state actors, we help develop the framework of public-private cooperation that is\ncritical to cybersecurity. The Department tries to show through our actions how we can\nhelp companies respond to nation-state threats they cannot face alone, in a way that\nrespects their status as victims. The Department has developed strong relationships with\nthe private sector based on our aggressive pursuit of criminal nation-state conduct,\nranging from cyber theft to information operations using third-party social media platforms.\nNo one seriously suggests that we can prosecute our way out of this problem. But to dismiss\nthe role that federal law enforcement plays in the government\xe2\x80\x99s shared fight against\ncyber-enabled threats is to unfairly discount\xe2\x80\x94and diminish\xe2\x80\x94our nation\xe2\x80\x99s powerful\ncommitment to the rule of law, both within our borders and without.\nC. Economic Sanctions\nEconomic sanctions are a vast and important topic, the breadth of which is well beyond the\nscope of our course. Nonetheless, this section conveys what you should understand at a minimum.\nWhen we talk of \xe2\x80\x9csanctions\xe2\x80\x9d in this setting, we are referring to the ability of the U.S. government\neither to freeze the U.S.-based assets of a foreign person, organization, or government, or to\ndeclare some or all transactions with the sanctioned party unlawful\xe2\x80\x93\xe2\x80\x93meaning no purchases,\nsales, trade, donations, services, exchanges, etc.\nCongress at times has passed laws that directly impose sanctions, but it is much more common\nthese days for Congress to delegate to the President the authority to impose sanctions based on\ncertain criteria Congress sets. For example, Congress recently enacted the Countering America\xe2\x80\x99s\nAdversaries Through Sanctions Act (CAATSA, pronounced \xe2\x80\x9cCats-uh\xe2\x80\x9d or \xe2\x80\x9cCots-uh\xe2\x80\x9d), which among\nother things calls for sanctions in response to interference with U.S. elections. And definitely be\naware of the International Emergency Economic Powers Act (IEEPA, pronounced \xe2\x80\x9cEye-EEP-uh\xe2\x80\x9d),\nwhich since the 1970s has served as a broad delegation of authority for the president to sanction\nforeign entities so long as the president has publicly declared the existence of a \xe2\x80\x9cnational\nemergency\xe2\x80\x9d relating to a foreign affairs matter and the sanctions are related to that situation.\nNote: Don\xe2\x80\x99t be misled by the seeming gravity of declaring a national emergency; the public over\ntime has proven to be largely uninterested when such declarations occur, and thus it has proven\nrelatively easy to declare them when deemed useful.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n61\n\nBy and large, presidential authority to issue sanctions under these and similar statutes ends up\nbeing delegated, through an executive order, to the Treasury Department. The body within\nTreasury that manages sanctions is the Office of Foreign Assets Control (\xe2\x80\x9cOFAC\xe2\x80\x9d). Periodically,\nOFAC will announce new entities or individuals to be sanctioned under one or more of the\ncurrently active sanction regimes.\nWhat makes people comply with sanctions? Criminal penalties for violating them, derived from\nthe statutes that created the sanction rules in the first place. Can you sanction someone for their\nviolation of other sanctions? Yes, that\xe2\x80\x99s called \xe2\x80\x9csecondary sanctions.\xe2\x80\x9d This is a hot topic vis-\xc3\xa0-vis\nforeign companies that want to do business with foreign entities (such as certain Iranian entities)\nthat are themselves the subject of sanctions.\nUnilateral sanctions (that is, those imposed only by the United States) can have an impact, but\nmultilateral sanctions of course can have a greater impact. To get other states to follow suit, the\nU.S. government can try diplomatic persuasion. To actually compel other governments to follow\nsuit? That requires a U.N. Security Council Resolution, which is no easy thing to obtain given the\nconstellation of competing national interests the Council represents (and the fact that China,\nRussia, the UK, France, and the United States all have permanent authority to veto UNSC action).\n\nConsider the utility of sanctions vis-\xc3\xa0-vis: Russia, China, Iran, and North Korea\n\xe2\x80\xa2 Are sanctions equally useful in each case? Why or why not?\n\nD. Russia\nRead this New York Times account from December 2016, which focuses on Russian election\ninterference in 2016, and this one on possible responses. Note that in July 2018, a federal grand\njury did issue an indictment (no need to read it, but it is here if you wish to) of various Russian\nofficers, in an early example of the prosecution tool being put to use (at least nominally; no Russian\nofficer was or is in actual US custody):\n\nAs you read, consider the following questions:\n\xe2\x80\xa2 How did hacking in this context relate to a larger \xe2\x80\x9cinformation operation\xe2\x80\x9d? What\nlessons does this episode suggest about vulnerability to spear-phishing?\n\xe2\x80\xa2 How do you assess the response of (i) the FBI in particular and (ii) the U.S. government\nmore generally?\n\xe2\x80\xa2 What insights did you gather regarding the entities that conduct such activities for the\nRussian government? How would you characterize what Russia did here? (Crime?\nEspionage? Covert action? Some combination, or something else?)\n\xe2\x80\xa2 What would you have done differently had you been president?\n\xe2\x80\xa2 And, finally, is any of this actually beyond the pale, in the sense that you would not\nwant to see the United States doing the same thing (and do you see how that is a\ndifferent question from asking whether the United States should do what it can to stop\nsuch actions from succeeding against it)?\n\nRead this Washington Post story regarding another Russia incident. Again, there was an\nindictment (no need to read it, but it is here if you wish to). Do read the latest developments in\nthat case.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\nHow do you assess the effectiveness of the U.S. government response in this instance? Can\nthe same model reliably be applied elsewhere?\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n62\n\n\x0cChesney on Cybersecurity\n\n63\n\n10. What if the Attacker is a Foreign Government? (IV)\n\nLearning objectives\n1. Appreciate that the power to impose sanctions that have real bite is not evenly distributed\naround the world; the US has loads of it (understand why), the EU has a lot of it, and China\nincreasingly has a lot of it too.\n2. Appreciate that it is one thing to declare a sanction, but another to have the ability to enforce\nit such that relevant people/entities will obey.\n3. Understand that the US legal framework for sanctions is rooted in this divide: the president\ncontrols foreign relations, yes, but only Congress can pass statutes that give rise to criminal\nsanctions or civil liabilities that actually require compliance.\n4. Understand what IEEPA is and how it works, including especially how it can be used in a\ncalibrated, step-by-step way that enables the President to send varied levels of threat signals.\n5. Understand that statutes like CAATSA demonstrate that Congress at times still wants to have a\nmore-direct voice in deciding when and how sanctions should be used.\n6. Understand the costs of using the sanctions mechanism, including impacts on your own\neconomy, risks of retaliation (escalation risk) both within domain and cross domain, risks of\nincentivizing restructuring that may leave you with less sanctions leverage (as well as other lost\nadvantages, such as possible access to an adversary\xe2\x80\x99s supply chain) going forward.\n7. Appreciate how this last point relates to the idea of a \xe2\x80\x9cgreat decoupling\xe2\x80\x9d between the United\nStates and China, as both sides increasingly focus not only on supply chain security exposure\n(espionage risk) but also on supply-chain sanctions exposure.\n8. Appreciate that sanctions work better with more countries involved.\n9. Know the options for seeking such cooperation (cooperative persuasion, coercive persuasion,\nUN Security Council Resolution), but understand why these options might not work.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n64\n\n10. Understand additional cost-imposition tools available in the foreign-attacker setting, including:\nmilitary force, within-domain cyber responses, withholding of benefits (from immigration\nbenefits to financial aid, etc.), PNG\xe2\x80\x99ing personnel or closing facilities, and more.\n11. Always bear in mind that the utility of each of these options (in terms of what they will mean\nto the adversary) and the credibility of using them (in terms of how realistic it is for you to\nactually employ them, including having the will to do so) will vary greatly over time,\ncircumstance, and adversary.\n12. Be able to identify a broad range of cost-imposition options that were available to the\nObama Administration in 2016, assessing the pros and cons of using each.\n13. Understand which options the administration actually used, and why (including why there\nwere escalation dominance concerns).\n14. Be able to explain the difference of view between the United States and China regarding\n\xe2\x80\x9ccommercial espionage\xe2\x80\x9d and why this matters.\n15. Appreciate that the question of whether to treat commercial espionage as normativelyillegitimate is distinct from the question of whether to defend against it; one defends against\n\xe2\x80\x9ctraditional\xe2\x80\x9d espionage vigorously even if one accepts that such activity is legitimate in a\nnormative sense.\n16. Understand which cost-imposition measures the United States imposed in relation to China in\nearly 2013, in 2014, and then in the run-up to the \xe2\x80\x9cObama-Xi agreement\xe2\x80\x9d (pay particular\nattention to the calibrated use of IEEPA)\n17. Be able to explain why Chinese commercial espionage for a time seemed to decrease, but\nonly for a time as it turned out.\nIn this reading, we continue by looking at the specific issue of Chinese-sponsored hacking.\nRead this Christian Science Monitor piece examining Chinese-government sponsored hacking\nagainst U.S. targets (public and private) in recent years.\n\nConsider the following questions:\n\xe2\x80\xa2 How does Chinese-government sponsored hacking differ from the Russian activities\ndescried above, and what follows from this as a matter of policy?\n\xe2\x80\xa2 Should it be off-limits to hack businesses in hopes of providing competitive\nadvantages for your own nation\xe2\x80\x99s companies (and does it really matter if the\ncompanies in question, on either end, are formally owned in part or in whole by the\nstate)?\n\xe2\x80\xa2 Should the United States have done more to respond to these hacks?\n\nThe Obama administration surprised many observers when it brought criminal charges against a\ngroup of PLA hackers (United States v. Dong (W.D. Pa.). You can skim the indictment here, but\nthe main thing is to actually read this story and this story about the case.\nAnalysis of the impact of this effort has been conflicted. Compare this account and this account.\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\nWhat lessons if any do you draw from this? Is prosecution an effective approach?\nScalable?\nDoes news of this recent arrest \xe2\x80\x93possibly linked to the famous OPM hack\xe2\x80\x94change\nyour view?\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n65\n\nProsecution is not the only tool available, of course. Read this Executive Order from President\nObama, which in April 2015 established a system for sanctioning the beneficiaries of cyberespionage used for commercial advantage. Read more here and here, too.\n\nWhat are the pros and cons of this approach?\n\nEventually, the U.S. and Chinese government struck a deal, of sorts.\n\nRead this recent account, and consider the following questions:\n\xe2\x80\xa2 What was the deal, and has it helped?\n\xe2\x80\xa2 What lessons do you draw?\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n66\n\nC. Encouraging Potential Victims to Defend Better\nMinimizing unauthorized (and excessive) access is not just a function of imposing painful\nconsequences on intruders. It is also a function of making it harder for them to succeed when\nthey do make an attempt\xe2\x80\x94i.e., it is a function of improving defense, too.\nRecall how we distinguished disruption, deterrence, and defense in the readings above.\nImproving defense will, at the margins, prevent some intrusions in the direct sense that some\nattacks that might otherwise have succeeded will now fail. Moreover, even for attackers who are\nable and willing to overcome the improved defense, the improvement increases the attacker\xe2\x80\x99s\ncosts, thereby making the effort marginally less attractive (by reducing prospective return on\ninvestment) and perhaps even causing the attacker to reduce the scope of their activities due to\nresulting resource constraints. Sometimes this is called \xe2\x80\x9cdeterrence by denial.\xe2\x80\x9d Incentivizing\npotential victims (whether they are private or public entities or individuals) to improve their\ndefenses on a systemic basis thus can serve important goals of cybersecurity policy.\nOf course, most potential victims already have at least some incentive to develop and improve\ndefenses, even absent any form of external intervention to encourage them further. Some have\ntrade secrets to protect. Most desire to keep at least some things private. Some need to keep\ncustomers happy. And so forth. As a result, we can safely assume there will be some defensive\nactivity even if no external forces intervene to encourage such steps. It\xe2\x80\x99s rather like the situation\nof a building owner. Most building owners would take at least some steps to make the building\nsafe even if there were no building codes, insurers, or plaintiff\xe2\x80\x99s lawyers with which to contend.\nWe might call this the \xe2\x80\x9cnatural level\xe2\x80\x9d of investment in defense.\nIs the natural level good enough? In the building-safety context, society has answered that\nquestion with a resounding no. Governments, insurers, and litigators intervene in all sorts of ways\nto spur further safety measures in that setting. And the same is true with respect to various other\ncontexts, such as pollution and public health. In these and other settings, we see extensive\ninterventions in the name of promoting safety or well-being (whether all such interventions are\ngenuinely motivated by such noble goals, and whether they are warranted in light of offsetting\ncosts, are entirely different questions, of course).\nSo too with cybersecurity policy. Just like the building-safety context, there are an array of\nadditional incentives that have been (or could be) brought to bear to incentivize greater\ninvestment in safeguards in the cybersecurity context. Indeed, many of the levers are the same.\nIn both settings we find regulators who might dictate rules and standards, litigants who might sue,\ninsurers who might set and enforce coverage conditions, and contract counterparties who might\ninsist on certain actions as a condition of the deal.\nThese external incentive structures are not the only levers promoting improved defense on a\nsystematic basis, however. Another involves efforts to promote sharing of information that might\nassist the cause of improved defense. And another tool is \xe2\x80\x9cpruning\xe2\x80\x9d\xe2\x80\x94that is, legislation that\nrepeals or carves out exceptions to existing laws that may be useful for other purposes, but that\nhas the collateral impact of discouraging desirable defensive measures.\nIn the pages that follow in this subsection, we will survey each of these levers before concluding\nwith a look at how the U.S. government organizes to promote better defense of (1) its own systems\nand (2) the systems associated with \xe2\x80\x9ccritical infrastructure\xe2\x80\x9d owned by the private sector.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n67\n\n11. The Role of Regulators (I)\n\nLearning Objectives\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\nUnderstand the role that \xe2\x80\x9cexternalities\xe2\x80\x9d analysis plays in the decision not to leave privatesector cybersecurity decisions entirely to the market (be able to state the analogy to\nsituations such as building safety, health codes, and car safety).\nBe able to describe the array of strategies (tools) governments might try to use if and when\nthey want to alter the incentive structures relating to investment in safety measures.\nUnderstand the role that regulatory agencies might play.\nUnderstand the two core prohibitions in Section 5 of the FTC Act, and how each of them\nmight separately be the basis for an enforcement action relating to poor cybersecurity\nBe able to explain why it is easier to explain the FTC\xe2\x80\x99s role in this area when it acts under its\n\xe2\x80\x9cdeception\xe2\x80\x9d authority than under its \xe2\x80\x9cunfair competition\xe2\x80\x9d authority, but be able to make the\nlatter case.\nBe able to explain how it is that the FTC can be said to have produced cybersecurity-related\nrules even without issuing cybersecurity-specific regulations (hint: think of the cumulative\nimpact of their enforcement actions).\nForm an opinion on the propriety of treating poor cybersecurity as an instance of unfair\ncompetition.\nBe able to explain why Section 5(n) applies only to the \xe2\x80\x9cunfair\xe2\x80\x9d prong and how it functions\nalmost like a definition of \xe2\x80\x9cunfair.\xe2\x80\x9d\nBe able to list the conditions specified in Section 5(n).\nForm a view on whether the meaning of \xe2\x80\x9cunfair\xe2\x80\x9d should vary depending on the resources\nand sophistication of the actor in question.\nUnderstand (from the Wyndham and LabMD cases) whether the courts agree that the FTC\ncan develop the specific meaning of unfairness in this setting via enforcement actions\ninstead of via rule-making.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\n68\n\nAppreciate that the Wyndham decision was the first to affirm that the unfairness prong could\nbe used as the basis to proceed against a company for poor cybersecurity practices without\nhaving to show an element of deception.\nUnderstand that Wyndham was an easy case given the egregiousness of its omissions.\nAppreciate that when the FTC brings an enforcement action within itself, the outcome it can\nachieve is limited to directives to do/not do certain things (that is, to injunctive-style relief)\nrather than money damages.\nUnderstand that many enforcement actions end in a settlement (called a Consent Decree),\nand that the FTC can sue in federal court later if it believes the defendant is violating the\nterms.\n\nIn theory, one way to promote better defense on a systematic basis is to create legally-binding\nrules or standards that oblige potential victims to take certain steps towards that end. Who might\ndo that? In the first instance, of course, we should look to legislatures (both state and federal). In\nour separation-of-powers system, after all, that is the part of government meant to make laws.\nThat said, anyone with even glancing familiarity with federal and state government over the past\ncentury will understand that a vast amount of rulemaking\xe2\x80\x94for better or worse\xe2\x80\x94stems not directly\nfrom legislation but rather from regulations promulgated by \xe2\x80\x9cadministrative agencies.\xe2\x80\x9d\nA. About Federal Administrative Agencies\nThe federal government contains a large number of administrative agencies. Each has some\nparticular field of subject-matter responsibility (the scope of which is defined by statute in most\ncases). Each typically performs many functions, but we are especially concerned with two core\ncapacities.\nFirst, rulemaking. An agency might have authority to promulgate legally-binding regulations (that\nis, to engage in \xe2\x80\x9crulemaking\xe2\x80\x9d) in furtherance of some goal specified by Congress. For example,\nCongress has given the Environmental Protection Agency authority to promulgate regulations to\nfurther the goals of the Clean Air Act in certain ways. There are a host of complex procedural\nrules associated with agency rulemaking, but for now it is enough to know that this has been a\ncommon mode of creating law since the 20th century.\nSecond, enforcement. Congress sometimes authorizes an agency to initiate and pursue\n\xe2\x80\x9cenforcement\xe2\x80\x9d proceedings. The idea is that the agency may be tasked with investigating\npossible rule violations (whether a rule stated directly in a statute enacted by Congress, or a rule\npromulgated by an agency pursuant to authority delegated by Congress) and then initiating civil\nproceedings to enforce alleged violations. In some cases, the enforcement action might take\nthe form of an ordinary civil suit, with the agency suing the alleged violator in federal court. But\nsometimes Congress empowers the agency also or instead to adjudicate the enforcement\nprocess internally (at least as an initial matter), with a litigation process involving an administrative\nlaw judge within the agency itself. Either way, the general idea is to secure a determination that\nsomeone violated a rule, producing a costly fine/damages, an order obliging (enjoining) the\nviolator to take or cease some particular action(s), or both.\nLike other forms of litigation, agency enforcement proceedings routinely result in settlements in\nwhich the alleged violator agrees to take or cease certain actions, with the possibility of more\nsevere consequences later on if the party breaches that obligation.\nNote that other parties in an industry may take note of the initiation and resolution of enforcement\nactions. Enforcement actions thus can cast a shadow\xe2\x80\x94sometimes a very long shadow\xe2\x80\x94\nimpacting how other players decide to act.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n69\n\nBearing that in mind, can you make an argument that \xe2\x80\x9cenforcement\xe2\x80\x9d authority is itself a\nsecond form of rule-making authority?\n\nB. There Is Not (Yet) An \xe2\x80\x9cEPA\xe2\x80\x9d For Cybersecurity\nI mentioned the EPA above. It was created during the Nixon Administration at a time of mounting\nconcern about the harmful effects of pollution. Over time, Congress has granted various\nrulemaking and enforcement authorities to the EPA in furtherance of this general mission. One\nmight argue that mounting concern about inadequate cybersecurity warrants creation of a\nsimilar dedicated agency. It is important to grasp, however, that Congress so far has not taken\nthat step. As we will see later in this unit, there is an important agency within the Department of\nHomeland Security known now (though not originally) as the Cybersecurity and Infrastructure\nSecurity Agency (CISA), but its role does not (yet) include rulemaking and enforcement authority\nencompassing the private sector.\nAll that said: just as nature abhors a physical vacuum, so too government bureaucracies seem to\nabhor perceived regulatory vacuums. There are existing administrative agencies with broad\njurisdiction that have, in various ways, taken up at least some aspects of the cybersecurity\nregulatory challenge\xe2\x80\x94sometimes because Congress has directed them expressly to do so, and\nsometimes because they have noted that their existing jurisdiction arguably encompasses certain\naspects of cybersecurity and they have acted accordingly.\nYour goal in light of all that: understand how certain pre-existing agencies have managed to\nparticipate in cybersecurity promotion. We\xe2\x80\x99ll start with the one you hear about the most in this\nspace: the FTC.\nC. The Federal Trade Commission (\xe2\x80\x9cFTC\xe2\x80\x9d) and The FTC Act\nFor a very brief introduction to the FTC, read this.\n\nBased only on this overview, would you expect the FTC to have a role in setting or enforcing\nstandards for cybersecurity? Why or why not?\n\nOne of the statutes the FTC is empowered to enforce is the Federal Trade Commission Act (\xe2\x80\x9cFTC\nAct\xe2\x80\x9d). The FTC has not engaged in any rulemaking relating to cybersecurity under this statute.\nInstead, it has focused on enforcement actions, based on the claim that some situations involving\npoor cybersecurity violated a rule set forth in the FTC Act itself. In fact, it has initiated more than\n60 enforcement actions along these lines, and has touted the resulting body of cases as\nfunctioning, collectively, as a form of guidance to the private sector. In a moment I\xe2\x80\x99ll ask you to\nconsider whether this level of enforcement, without tailored rulemaking, is desirable. But first you\nneed to know just what they\xe2\x80\x99ve been enforcing and how they\xe2\x80\x99ve been doing it.\nGoal #1: Understand what exactly the FTC Act prohibits. The answer is found in 15 U.S.C. 45(a)(1).\n(1)\n\nUnfair methods of competition in or affecting commerce, and unfair or deceptive\nacts or practices in or affecting commerce, are hereby declared unlawful.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n70\n\nThere\xe2\x80\x99s an opening clause about unfair competition, and a second clause that refers alternatively\nboth to \xe2\x80\x9cunfair\xe2\x80\x9d practices and \xe2\x80\x9cdeceptive\xe2\x80\x9d practices that impact interstate commerce.\n\nConsider the following questions:\n\xe2\x80\xa2 Can you explain how unfairness is different from deception?\n\xe2\x80\xa2 Does either concept seem relevant to a situation in which some entity has poor\ncybersecurity?\n\xe2\x80\xa2 In terms of clarity (and thus understanding on the part of those who must comply),\nhow does this compare to the various subparts of the CFAA?\n\nGoal #2: Understand how 15 U.S.C. 45(n) limits one (but not both) of those two prohibitions.\n(n)\n\nStandard of proof; public policy considerations\nThe Commission shall have no authority under this section or section 57a of this title\nto declare unlawful an act or practice on the grounds that such act or practice is\nunfair unless the act or practice causes or is likely to cause substantial injury to\nconsumers which is not reasonably avoidable by consumers themselves and not\noutweighed by countervailing benefits to consumers or to competition. In\ndetermining whether an act or practice is unfair, the Commission may consider\nestablished public policies as evidence to be considered with all other evidence.\nSuch public policy considerations may not serve as a primary basis for such\ndetermination.\n\nNotice that this applies only where the enforcement action by the FTC takes place under\nthe \xe2\x80\x9cunfair\xe2\x80\x9d prong. Can you see how this section functions almost like a definition of \xe2\x80\x9cunfair,\xe2\x80\x9d\nand if so can you summarize the various elements of the definition in the form of a list?\n\nGoal #3: Understand whether there are significant limits with respect to who has to care about\nthe FTC Act. Read 15 U.S.C. 45(a)(2).\n(2)\n\nThe Commission is hereby empowered and directed to prevent persons,\npartnerships, or corporations, except banks, savings and loan institutions described\nin section 57a(f)(3) of this title, Federal credit unions described in section 57a(f)(4)\nof this title, common carriers subject to the Acts to regulate commerce, air carriers\nand foreign air carriers subject to part A of subtitle VII of title 49, and persons,\npartnerships, or corporations insofar as they are subject to the Packers and\nStockyards Act, 1921, as amended [7 U.S.C. 181 et seq.], except as provided in\nsection 406(b) of said Act [7 U.S.C. 227(b)], from using unfair methods of\ncompetition in or affecting commerce and unfair or deceptive acts or practices in\nor affecting commerce.\n\nDoes subsection 45(a)(2) encompass everyone?\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n71\n\nGoal #4: Understand how the FTC goes about enforcing the FTC Act. It has two available options.\nRead 45(b) and 45(m).\n(b)\n\nProceeding by Commission; modifying and setting aside orders\nWhenever the Commission shall have reason to believe that any such person,\npartnership, or corporation has been or is using any unfair method of competition\nor unfair or deceptive act or practice in or affecting commerce, and if it shall\nappear to the Commission that a proceeding by it in respect thereof would be to\nthe interest of the public, it shall issue and serve upon such person, partnership, or\ncorporation a complaint stating its charges in that respect and containing a notice\nof a hearing upon a day and at a place therein fixed at least thirty days after the\nservice of said complaint. The person, partnership, or corporation so complained\nof shall have the right to appear at the place and time so fixed and show cause\nwhy an order should not be entered by the Commission requiring such person,\npartnership, or corporation to cease and desist from the violation of the law so\ncharged in said complaint. Any person, partnership, or corporation may make\napplication, and upon good cause shown may be allowed by the Commission to\nintervene and appear in said proceeding by counsel or in person. The testimony in\nany such proceeding shall be reduced to writing and filed in the office of the\nCommission. If upon such hearing the Commission shall be of the opinion that the\nmethod of competition or the act or practice in question is prohibited by this\nsubchapter, it shall make a report in writing in which it shall state its findings as to\nthe facts and shall issue and cause to be served on such person, partnership, or\ncorporation an order requiring such person, partnership, or corporation to cease\nand desist from using such method of competition or such act or practice. Until the\nexpiration of the time allowed for filing a petition for review, if no such petition has\nbeen duly filed within such time, or, if a petition for review has been filed within such\ntime then until the record in the proceeding has been filed in a court of appeals of\nthe United States, as hereinafter provided, the Commission may at any time, upon\nsuch notice and in such manner as it shall deem proper, modify or set aside, in\nwhole or in part, any report or any order made or issued by it under this section.\nAfter the expiration of the time allowed for filing a petition for review, if no such\npetition has been duly filed within such time, the Commission may at any time, after\nnotice and opportunity for hearing, reopen and alter, modify, or set aside, in whole\nor in part any report or order made or issued by it under this section, whenever in\nthe opinion of the Commission conditions of fact or of law have so changed as to\nrequire such action or if the public interest shall so require, except that (1) the said\nperson, partnership, or corporation may, within sixty days after service upon him or\nit of said report or order entered after such a reopening, obtain a review thereof in\nthe appropriate court of appeals of the United States, in the manner provided in\nsubsection (c) of this section; and (2) in the case of an order, the Commission shall\nreopen any such order to consider whether such order (including any affirmative\nrelief provision contained in such order) should be altered, modified, or set aside,\nin whole or in part, if the person, partnership, or corporation involved files a request\nwith the Commission which makes a satisfactory showing that changed conditions\nof law or fact require such order to be altered, modified, or set aside, in whole or\nin part. The Commission shall determine whether to alter, modify, or set aside any\norder of the Commission in response to a request made by a person, partnership,\nor corporation under paragraph [1] (2) not later than 120 days after the date of the\nfiling of such request.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n(m)\n\n72\n\nCivil actions for recovery of penalties for knowing violations of rules and cease and\ndesist orders respecting unfair or deceptive acts or practices; jurisdiction;\nmaximum amount of penalties; continuing violations; de novo determinations;\ncompromise or settlement procedure\n(1)\n(A) The Commission may commence a civil action to recover a civil\npenalty in a district court of the United States against any person,\npartnership, or corporation which violates any rule under this\nsubchapter respecting unfair or deceptive acts or practices (other\nthan an interpretive rule or a rule violation of which the Commission\nhas provided is not an unfair or deceptive act or practice in\nviolation of subsection (a)(1)) with actual knowledge or knowledge\nfairly implied on the basis of objective circumstances that such act\nis unfair or deceptive and is prohibited by such rule. In such action,\nsuch person, partnership, or corporation shall be liable for a civil\npenalty of not more than $10,000 for each violation.\n(B) If the Commission determines in a proceeding under subsection\n(b) that any act or practice is unfair or deceptive, and issues a final\ncease and desist order, other than a consent order, with respect to\nsuch act or practice, then the Commission may commence a civil\naction to obtain a civil penalty in a district court of the United States\nagainst any person, partnership, or corporation which engages in\nsuch act or practice\xe2\x80\x94\n(1) after such cease and desist order becomes final\n(whether or not such person, partnership, or corporation was\nsubject to such cease and desist order), and\n(2) with actual knowledge that such act or practice is unfair\nor deceptive and is unlawful under subsection (a)(1) of this\nsection.\nIn such action, such person, partnership, or corporation shall be\nliable for a civil penalty of not more than $10,000 for each violation.\n(C) In the case of a violation through continuing failure to comply\nwith a rule or with subsection (a)(1), each day of continuance of\nsuch failure shall be treated as a separate violation, for purposes of\nsubparagraphs (A) and (B). In determining the amount of such a\ncivil penalty, the court shall take into account the degree of\nculpability, any history of prior such conduct, ability to pay, effect\non ability to continue to do business, and such other matters as\njustice may require.\n(2) If the cease and desist order establishing that the act or practice is unfair or\ndeceptive was not issued against the defendant in a civil penalty action under\nparagraph (1)(B) the issues of fact in such action against such defendant shall be\ntried de novo. Upon request of any party to such an action against such\ndefendant, the court shall also review the determination of law made by the\nCommission in the proceeding under subsection (b) that the act or practice which\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n73\n\nwas the subject of such proceeding constituted an unfair or deceptive act or\npractice in violation of subsection (a).\n(3) The Commission may compromise or settle any action for a civil penalty if such\ncompromise or settlement is accompanied by a public statement of its reasons\nand is approved by the court.\n\nCan you explain the difference between the two procedures in terms of who decides whether\nthe FTC\xe2\x80\x99s allegation is correct? In terms of what remedies appear to be available if the FTC\nwins?\n\nD. Case Study #1: Uber\nRead this complaint filed by the FTC.\n\nConsider the following questions:\n\xe2\x80\xa2 Which enforcement path did the FTC use in this case?\n\xe2\x80\xa2 In what way(s) did Uber allegedly violate Section 45(a)?\n\xe2\x80\xa2 Assuming all the allegations to be true, would you agree with the FTC that this violates\nthe statute?\n\nEventually Uber settled with the FTC, but then in April 2018, the FTC announced it had reopened\nthe case due to Uber\xe2\x80\x99s failure to disclose that, during the pendency of the case at the earlier\nstage, Uber had experienced another data breach. This led to a revised settlement agreement.\n\nScan the document to get a sense of the commitments FTC extracted from Uber.\n\xe2\x80\xa2 What are those commitments, and was this a good outcome?\n\nThe FTC was not the only problem Uber faced in connection with these events. A number of state\nAttorneys General decided to team up and sue Uber together, based on various state databreach liability laws we will examine in the next class. For now, it is enough to note that Uber faced\nthis massive and well-resourced lawsuit at the same time that it faced the FTC\xe2\x80\x99s renewed\nenforcement action.\n\nConsider how the pendency of parallel litigation might matter. Oh, by the way, Uber and the\nstates have just announced (9/26/18) that they are settling for $148 million.\n\nE. Case Study #2: Wyndham Hotels\nHere\xe2\x80\x99s an example of the FTC suing in federal court. Read this note summarizing the litigation\ninvolving Wyndham Hotels.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n74\n\nConsider the following questions:\n\xe2\x80\xa2 What was Wyndham\xe2\x80\x99s argument about the propriety of suing them under the\n\xe2\x80\x9cunfairness\xe2\x80\x9d prong of Section 45(a)(1)?\no How did the court rule on that point, and do you agree?\n\xe2\x80\xa2 What was Wyndham\xe2\x80\x99s second argument, concerning \xe2\x80\x9cfair notice\xe2\x80\x9d?\no How did the court rule on that one, and do you agree?\n\nNote: Wyndham and the FTC settled later, with Wyndham agreeing to take on a variety of\nsecurity-focused practices (as well as annual audits) for the next 20 years.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n75\n\n12. The Role of Regulators (II)\nLearning objectives\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\nUnderstand that the Eleventh Circuit in LabMD did not object to the common-law\nenforcement methods of the FTC, but did object to the FTC\xe2\x80\x99s attempt to impose remedies\nthat were not very specific in the obligations they entailed.\nUnderstand that the same agency (the FTC) enforces both the FTC Act (Section 5) and the\nGLB Act (Safeguards Rule)\nBe able to describe the category of entities subject to the GLB Act\nBe able to describe what the Safeguards Rule actually requires (written information security\npolicy, actual risk assessments, and adequate safeguard)\nUnderstand the arguments for and against having such indeterminate standards\nBe prepared to defend your view on whether the FTC\xe2\x80\x99s Safeguards Rule enforcement action\nagainst TaxSlayer was fair\nKnow what a credential-stuffing attack is, why these often work, and some steps to defend\nagainst them\nUnderstand that other federal regulators (SEC, FCC, FDA, etc.) frequently have authorities\nsimilar to the GLB Act, to be enforced against particular sectors\nAppreciate that both U.S. states and foreign governments also have various regulatory\nagencies who may have jurisdiction in a given case\nBe able to explain the pros and cons of having multiple relevant regulators with overlapping\njurisdiction\nGive thought to the optimal way to act via such agencies if you believe more pressure\nshould be placed on companies to invest more/smarter in defense\nUnderstand California\xe2\x80\x99s new \xe2\x80\x9csecurity of connected devices\xe2\x80\x9d law as a direct regulation of\nIOT manufacturers who sell their products in California, and be able to explain what exactly it\nrequires/forbids\n\nA. Case Study #3: LabMD\nThis was a remarkable case in many respects. I won\xe2\x80\x99t summarize it here, but rather will ask you to\nread this short overview from Prof. Dan Solove.\n\n\xe2\x80\xa2\n\nCan you summarize how the outcome in LabMD compares to Wyndham?\n\nB. The FTC and the Gramm-Leach-Bliley Act\nAs it happens, the FTC also has authority to enforce other statutes, and in some cases to\npromulgate regulations relating to them. One such statute is the Gramm-Leach-Bliley Act (the\n\xe2\x80\x9cGLB Act\xe2\x80\x9d), which, among other things, concerns the protection of customer data by financial\ninstitutions.\nThe FTC has promulgated a set of regulations on that issue, known collectively as the \xe2\x80\x9cSafeguards\nRule\xe2\x80\x9d (found in 16 Code of Federal Regulations Part 314). Here is an overview of the rule written\nby the FTC (if you want to see the actual text of the Rule, it is here):\nMany companies collect personal information from their customers, including names, addresses,\nand phone numbers; bank and credit card account numbers; income and credit histories; and\nSocial Security numbers. The Gramm-Leach-Bliley (GLB) Act requires companies defined under\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n76\n\nthe law as \xe2\x80\x9cfinancial institutions\xe2\x80\x9d to ensure the security and confidentiality of this type of\ninformation. As part of its implementation of the GLB Act, the Federal Trade Commission (FTC)\nissued the Safeguards Rule, which requires financial institutions under FTC jurisdiction to have\nmeasures in place to keep customer information secure. \xe2\x80\xa6\nThe definition of \xe2\x80\x9cfinancial institution\xe2\x80\x9d includes many businesses that may not normally describe\nthemselves that way. In fact, the Rule applies to all businesses, regardless of size, that are\n\xe2\x80\x9csignificantly engaged\xe2\x80\x9d in providing financial products or services. This includes, for example,\ncheck-cashing businesses, payday lenders, mortgage brokers, nonbank lenders, personal\nproperty or real estate appraisers, professional tax preparers, and courier services. The\nSafeguards Rule also applies to companies like credit reporting agencies and ATM operators that\nreceive information about the customers of other financial institutions. \xe2\x80\xa6\nThe Safeguards Rule requires companies to develop a written information security plan that\ndescribes their program to protect customer information. The plan must be appropriate to the\ncompany\xe2\x80\x99s size and complexity, the nature and scope of its activities, and the sensitivity of the\ncustomer information it handles. As part of its plan, each company must:\n\xe2\x80\xa2\n\ndesignate one or more employees to coordinate its information security program;\n\n\xe2\x80\xa2\n\nidentify and assess the risks to customer information in each relevant area of the company\xe2\x80\x99s\noperation, and evaluate the effectiveness of the current safeguards for controlling these risks;\n\n\xe2\x80\xa2\n\ndesign and implement a safeguards program, and regularly monitor and test it;\n\n\xe2\x80\xa2\n\nselect service providers that can maintain appropriate safeguards, make sure your contract\nrequires them to maintain safeguards, and oversee their handling of customer information;\nand\n\n\xe2\x80\xa2\n\nevaluate and adjust the program in light of relevant circumstances, including changes in the\nfirm\xe2\x80\x99s business or operations, or the results of security testing and monitoring.\n\nThe requirements are designed to be flexible. Companies should implement safeguards\nappropriate to their own circumstances. \xe2\x80\xa6\nThe Safeguards Rule requires companies to assess and address the risks to customer\ninformation in all areas of their operation, including three areas that are particularly important to\ninformation security: Employee Management and Training; Information Systems; and Detecting\nand Managing System Failures. One of the early steps companies should take is to determine\nwhat information they are collecting and storing, and whether they have a business need to do\nso. You can reduce the risks to customer information if you know what you have and keep only\nwhat you need.\nDepending on the nature of their business operations, firms should consider implementing the\nfollowing practices:\n\xe2\x80\xa6\n\xe2\x80\xa2\n\nLimiting access to customer information to employees who have a business reason to see it.\nFor example, give employees who respond to customer inquiries access to customer files,\nbut only to the extent they need it to do their jobs.\n\n\xe2\x80\xa2\n\nControlling access to sensitive information by requiring employees to use \xe2\x80\x9cstrong\xe2\x80\x9d passwords\nthat must be changed on a regular basis. (Tough-to-crack passwords require the use of at\nleast six characters, upper- and lower-case letters, and a combination of letters, numbers,\nand symbols.)\n\n\xe2\x80\xa2\n\nUsing password-activated screen savers to lock employee computers after a period of\ninactivity.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n77\n\n\xe2\x80\xa2\n\nDeveloping policies for appropriate use and protection of laptops, PDAs, cell phones, or other\nmobile devices. For example, make sure employees store these devices in a secure place\nwhen not in use. Also, consider that customer information in encrypted files will be better\nprotected in case of theft of such a device.\n\n\xe2\x80\xa2\n\nTraining employees to take basic steps to maintain the security, confidentiality, and integrity\nof customer information, including:\n\no\n\nLocking rooms and file cabinets where records are kept;\n\no\n\nNot sharing or openly posting employee passwords in work areas;\n\no\n\nEncrypting sensitive customer information when it is transmitted electronically via public\nnetworks;\n\no\n\nReferring calls or other requests for customer information to designated individuals who have\nbeen trained in how your company safeguards personal data; and\n\no\n\nReporting suspicious attempts to obtain customer information to designated personnel.\n\n\xe2\x80\xa2\n\nRegularly reminding all employees of your company\xe2\x80\x99s policy \xe2\x80\x94 and the legal requirement \xe2\x80\x94\nto keep customer information secure and confidential. For example, consider posting\nreminders about their responsibility for security in areas where customer information is\nstored, like file rooms.\n\n\xe2\x80\xa2\n\nDeveloping policies for employees who telecommute. For example, consider whether or how\nemployees should be allowed to keep or access customer data at home. Also, require\nemployees who use personal computers to store or access customer data to use protections\nagainst viruses, spyware, and other unauthorized intrusions.\n\n\xe2\x80\xa2\n\nImposing disciplinary measures for security policy violations.\n\n\xe2\x80\xa2\n\nPreventing terminated employees from accessing customer information by immediately\ndeactivating their passwords and user names and taking other appropriate measures.\nInformation Systems. Information systems include network and software design, and\ninformation processing, storage, transmission, retrieval, and disposal. Here are some\nsuggestions on maintaining security throughout the life cycle of customer information, from\ndata entry to data disposal:\n\n\xe2\x80\xa2\n\nKnow where sensitive customer information is stored and store it securely. Make sure only\nauthorized employees have access. For example:\n\n\xe2\x80\xa2\n\no\n\nEnsure that storage areas are protected against destruction or damage from physical\nhazards, like fire or floods.\n\no\n\nStore records in a room or cabinet that is locked when unattended.\n\no\n\nWhen customer information is stored on a server or other computer, ensure that the\ncomputer is accessible only with a \xe2\x80\x9cstrong\xe2\x80\x9d password and is kept in a physicallysecure area.\n\no\n\nWhere possible, avoid storing sensitive customer data on a computer with an Internet\nconnection.\n\no\n\nMaintain secure backup records and keep archived data secure by storing it off-line\nand in a physically-secure area.\n\no\n\nMaintain a careful inventory of your company\xe2\x80\x99s computers and any other equipment\non which customer information may be stored.\n\nTake steps to ensure the secure transmission of customer information. For example:\no\n\nWhen you transmit credit card information or other sensitive financial data, use a\nSecure Sockets Layer (SSL) or other secure connection, so that the information is\nprotected in transit.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n\xe2\x80\xa2\n\n78\n\no\n\nIf you collect information online directly from customers, make secure transmission\nautomatic. Caution customers against transmitting sensitive data, like account\nnumbers, via email or in response to an unsolicited email or pop-up message.\n\no\n\nIf you must transmit sensitive data by email over the Internet, be sure to encrypt the\ndata.\n\nDispose of customer information in a secure way and, where applicable, consistent with the\nFTC\xe2\x80\x99s Disposal Rule. For example:\no\n\nConsider designating or hiring a records retention manager to supervise the disposal\nof records containing customer information. If you hire an outside disposal company,\nconduct due diligence beforehand by checking references or requiring that the\ncompany be certified by a recognized industry group.\n\no\n\nBurn, pulverize, or shred papers containing customer information so that the\ninformation cannot be read or reconstructed.\n\no\n\nDestroy or erase data when disposing of computers, disks, CDs, magnetic tapes,\nhard drives, laptops, PDAs, cell phones, or any other electronic media or hardware\ncontaining customer information.\nDetecting and Managing System Failures. Effective security management requires\nyour company to deter, detect, and defend against security breaches. That means\ntaking reasonable steps to prevent attacks, quickly diagnosing a security incident,\nand having a plan in place for responding effectively. Consider implementing the\nfollowing procedures:\n\n\xe2\x80\xa2\n\nMonitoring the websites of your software vendors and reading relevant industry publications\nfor news about emerging threats and available defenses.\n\n\xe2\x80\xa2\n\nMaintaining up-to-date and appropriate programs and controls to prevent unauthorized\naccess to customer information. Be sure to:\n\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\no\n\ncheck with software vendors regularly to get and install patches that resolve software\nvulnerabilities;\n\no\n\nuse anti-virus and anti-spyware software that updates automatically;\n\no\n\nmaintain up-to-date firewalls, particularly if you use a broadband Internet connection\nor allow employees to connect to your network from home or other off-site locations;\n\no\n\nregularly ensure that ports not used for your business are closed; and\n\no\n\npromptly pass along information and instructions to employees regarding any new\nsecurity risks or possible breaches.\n\nUsing appropriate oversight or audit procedures to detect the improper disclosure or theft of\ncustomer information. It\xe2\x80\x99s wise to:\no\n\nkeep logs of activity on your network and monitor them for signs of unauthorized\naccess to customer information;\n\no\n\nuse an up-to-date intrusion detection system to alert you of attacks;\n\no\n\nmonitor both in- and out-bound transfers of information for indications of a\ncompromise, such as unexpectedly large amounts of data being transmitted from\nyour system to an unknown user; and\n\no\n\ninsert a dummy account into each of your customer lists and monitor the account to\ndetect any unauthorized contacts or charges.\n\nTaking steps to preserve the security, confidentiality, and integrity of customer information in\nthe event of a breach. If a breach occurs:\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n\xe2\x80\xa2\n\n79\n\no\n\ntake immediate action to secure any information that has or may have been\ncompromised. For example, if a computer connected to the Internet is compromised,\ndisconnect the computer from the Internet;\n\no\n\npreserve and review files or programs that may reveal how the breach occurred; and\n\no\n\nif feasible and appropriate, bring in security professionals to help assess the breach\nas soon as possible.\n\nConsidering notifying consumers, law enforcement, and/or businesses in the event of a\nsecurity breach. For example:\no\n\nnotify consumers if their personal information is subject to a breach that poses a\nsignificant risk of identity theft or related harm;\n\no\n\nnotify law enforcement if the breach may involve criminal activity or there is evidence\nthat the breach has resulted in identity theft or related harm;\n\no\n\nnotify the credit bureaus and other businesses that may be affected by the breach.\n\xe2\x80\xa6; and\n\no\n\ncheck to see if breach notification is required under applicable state law.\n\nWho does this govern, and (at a general level) what does it require them to do?\n\nC. Case study: In the Matter of Taxslayer\nFor a recent illustration of the Safeguards Rule in action, read pp.3-5 of this action the FTC filed\nagainst TaxSlayer:\nThe Federal Trade Commission, having reason to believe that TaxSlayer, LLC, a limited\nliability company, (\xe2\x80\x9cTaxSlayer\xe2\x80\x9d or \xe2\x80\x9cRespondent\xe2\x80\x9d), has violated the provisions of the Federal\nTrade Commission Act, 15 U.S.C. \xc2\xa7 45(a); the Privacy of Consumer Financial Information Rule\n(\xe2\x80\x9cPrivacy Rule\xe2\x80\x9d), 16 C.F.R. Part 313, recodified at 12 C.F.R. \xc2\xa7 1016 (\xe2\x80\x9cReg. P\xe2\x80\x9d), and issued\npursuant to Sections 501-504 of the Gramm-Leach-Bliley Act (\xe2\x80\x9cGLB Act\xe2\x80\x9d), 15 U.S.C. \xc2\xa7\xc2\xa7 68016803; and the Standards for Safeguarding Customer Information Rule (\xe2\x80\x9cSafeguards Rule\xe2\x80\x9d), 16\nC.F.R. Part 314, issued pursuant to Sections 501(b) and 505(b)(2) of the GLB Act, 15 U.S.C. \xc2\xa7\xc2\xa7\n6801(b), 6805(b)(2); and it appearing to the Commission that this proceeding is in the public\ninterest, alleges:\n1. Respondent is a Georgia limited liability corporation with its principal office at 3003\nTaxSlayer Drive, Evans, Georgia 30809.\n2. The acts and practices of Respondent alleged in this complaint have been in or affecting\ncommerce, as \xe2\x80\x9ccommerce\xe2\x80\x9d is defined in Section 4 of the Federal Trade Commission Act.\nRESPONDENT\xe2\x80\x99S BUSINESS PRACTICES\n3. Respondent advertises, offers for sale, sells, and distributes products and services to\nconsumers, including TaxSlayer Online, a tax return preparation and electronic filing\nsoftware and service.\n4. Respondent is a business that began more than 50 years ago as a tax return preparation\nfirm. It developed tax return preparation software for its internal use in the 1980s. In the\n1990s, it developed a browser-based software service that it advertises, offers for sale,\nsells, and distributes to assist consumers in preparing and electronically filing federal and\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\nstate income tax returns. Over the years, Respondent added other tax return preparation\nproducts, including a mobile app. This Complaint refers to the browser-based software\nservice and mobile app as \xe2\x80\x9cTaxSlayer Online.\xe2\x80\x9d\n5. In 2016, more than 950,000 individuals filed tax returns with TaxSlayer Online.\n6. Respondent typically charges consumers fees for the use of TaxSlayer Online.\n7. TaxSlayer Online users create an account by entering a username and password (\xe2\x80\x9clogin\ncredentials\xe2\x80\x9d) on an account creation page.\n8. They then input a host of personal information in order to create a tax return, including\nbut not limited to: name, Social Security number (\xe2\x80\x9cSSN\xe2\x80\x9d), telephone number, physical\naddress, income, employment status, marital status, identity of dependents, financial\nassets, financial activities, receipt of government benefits, home ownership, indebtedness,\nhealth insurance, retirement information, charitable donations, tax payments, tax refunds,\nbank account numbers, and payment card numbers. Respondent also collects IP\naddresses and persistent identifiers associated with the particular device from which the\ntax return is prepared and/or filed.\n9. TaxSlayer Online uses this personal information to prepare tax returns on behalf of\ncustomers. Once a tax return is prepared, a customer can file the return electronically\nthrough TaxSlayer Online with the Internal Revenue Service (\xe2\x80\x9cIRS\xe2\x80\x9d) and state\ndepartments of revenue. If a customer is entitled to a refund, Respondent offers the\noption of transferring the refund directly into a customer\xe2\x80\x99s bank account. Customers may\nalso elect to receive their tax refunds on a prepaid debit card.\nRESPONDENT\xe2\x80\x99S GRAMM-LEACH-BLILEY ACT (\xe2\x80\x9cGLB ACT\xe2\x80\x9d) VIOLATIONS\n10. Respondent is a financial institution subject to the GLB Act, as that term is defined by\nSection 509(3)(A) of the GLB Act, 15 U.S.C. \xc2\xa7 6809(3)(A), because among other things,\nRespondent provides tax planning and tax preparation services, 16 C.F.R.\n\xc2\xa7 313.3(k)(2)(viii); 12 C.F.R. \xc2\xa7 1016.3(l)(3)(ii)(H); 12 C.F.R. \xc2\xa7 225.28(b)(6)(vi) (\xe2\x80\x9cReg.\nY\xe2\x80\x9d), and data processing, 12 C.F.R. \xc2\xa7 225.28(b)(14). Respondent collects nonpublic\npersonal information, as defined by 16 C.F.R. \xc2\xa7 313.3(n) and 12 C.F.R. \xc2\xa7 1016.3(p)(1)(3). Because Respondent is a financial institution that collects nonpublic personal\ninformation, it is subject to the requirements of the GLB Privacy Rule, 16 C.F.R. Part\n313, Reg. P., 12 C.F.R. Part 1016, and the Safeguards Rule, 16 C.F.R. Part 314.\n\xe2\x80\xa6\nSafeguards Rule\n14. The Safeguards Rule, which implements Section 501(b) of the GLB Act,\n15 U.S.C. \xc2\xa7 6801(b), was promulgated by the Commission on May 23, 2002, and became\neffective on May 23, 2003. The Rule requires financial institutions to protect the\nsecurity, confidentiality, and integrity of customer information by developing,\nimplementing, and maintaining a comprehensive information security program that is\nwritten in one or more readily accessible parts, and that contains administrative,\ntechnical, and physical safeguards that are appropriate to the financial institution\xe2\x80\x99s size\nand complexity, the nature and scope of its activities, and the sensitivity of the customer\ninformation at issue, including:\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n80\n\n\x0cChesney on Cybersecurity\n\na. Designating one or more employees to coordinate the information security program;\nb. Identifying reasonably foreseeable internal and external risks to the security,\nconfidentiality, and integrity of customer information, and assessing the sufficiency\nof any safeguards in place to control those risks;\nc. Designing and implementing information safeguards to control the risks identified\nthrough risk assessment, and regularly testing or otherwise monitoring the\neffectiveness of the safeguards\xe2\x80\x99 key controls, systems, and procedures;\nd. Overseeing service providers, and requiring them by contract to protect the security\nand confidentiality of customer information; and\ne. Evaluating and adjusting the information security program in light of the results of\ntesting and monitoring, changes to the business operation, and other relevant\ncircumstances.\n15. Respondent violated the Safeguards Rule. For example:\na. Respondent failed to have a written information security program until November\n2015.\nb. Respondent failed to conduct a risk assessment, which would have identified\nreasonably foreseeable internal and external risks to the security, confidentiality, and\nintegrity of customer information, including risks associated with inadequate\nauthentication.\nc. Respondent failed to implement information safeguards to control the risks to\ncustomer information from inadequate authentication. For example:\ni. Respondent did not require consumers to choose strong passwords when setting\nup their accounts, which is a standard practice for accounts containing sensitive\npersonal information. Respondent\xe2\x80\x99s only requirement for passwords was that\nthey be eight to sixteen characters in length. This created a risk that attackers\ncould guess commonly-used passwords, or use dictionary attacks, to access\nTaxSlayer Online accounts.\nii. Respondent failed to implement adequate risk-based authentication measures\nsufficient to mitigate the risk of list validation attacks when such attacks became\nreasonably foreseeable. List validation attacks occur when remote attackers use\nlists of stolen login credentials to attempt to access accounts across a number of\npopular Internet sites, knowing that consumers often reuse user name and\npasswords combinations.\niii. Respondent failed to inform TaxSlayer Online users when a material change was\nmade to the mailing address, password, or security question associated with their\naccounts. Respondent also failed to inform TaxSlayer Online users when a\nmaterial change is made to the bank account routing number or the payment\nmethod for a refund (e.g., from bank account to a pre-paid debit card) associated\nwith their accounts.\niv. Respondent failed to require customers to validate their email addresses at\naccount creation, in order to verify accuracy and communicate with customers\nregarding security-related issues.\nv. Respondent failed to use readily-available tools to prevent devices or IP addresses\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n81\n\n\x0cChesney on Cybersecurity\n\n82\n\nfrom attempting to access an unlimited number of TaxSlayer Online accounts in\nrapid succession through a list validation attack.\n16. Respondent became subject to a list validation attack that began on October 10, 2015, and\nended on December 21, 2015. On that day, Respondent implemented multi-factor\nauthentication, requiring users to first submit their username and password, and then to\nauthenticate their device by, for example, entering a code that Respondent sent to the\nuser\xe2\x80\x99s email or mobile phone.\n17. As part of this list validation attack, the remote attackers were able to gain full access to\n8,882 existing TaxSlayer Online accounts. In an unknown number of instances, the\nattackers engaged in tax identity theft by altering the bank routing and refund methods, efiling\nfraudulent tax returns, and diverting the fabricated tax refunds to themselves.\nCustomers were not notified when these alterations occurred. Respondent was not aware\nof this list validation attack until a TaxSlayer Online user called on January 11, 2016 to\nreport suspicious activity on her account.\n18. Consumers who are the victims of tax identity theft spend significant time resolving this\nproblem. Victims spend time calling the IRS and state tax authorities to report the tax\nidentity theft. Victims then have to obtain PIN numbers from the IRS and file their taxes\non paper using those PIN numbers. They then have to wait months to receive their tax\nrefunds. To protect themselves and their dependents from future identity theft, victims\nfreeze or place holds on their credit, and they spend additional time monitoring their\ncredit histories and financial accounts. These victims also suffer out-of-pocket financial\nlosses\xe2\x80\xa6.\n\nD. A Quick Look at Other Federal Regulators\nThere are other federal regulators involved in cybersecurity, besides the FTC. We will not go into\nanything like the same level of detail with them, but you should have at least a glancing familiarity\nwith the idea that just about every regulator, these days, takes an interest in the cybersecurity\npractices of the entities within its reach. Consider, for example, the Securities & Exchange\nCommission (\xe2\x80\x9cSEC\xe2\x80\x9d):\nSEC: Morgan Stanley Failed to Safeguard Customer Data\nFOR IMMEDIATE RELEASE\n2016-112\nWashington D.C., June 8, 2016 \xe2\x80\x94\nThe Securities and Exchange Commission today announced that Morgan Stanley Smith Barney\nLLC has agreed to pay a $1 million penalty to settle charges related to its failures to protect\ncustomer information, some of which was hacked and offered for sale online.\nThe SEC issued an order finding that Morgan Stanley failed to adopt written policies and\nprocedures reasonably designed to protect customer data. As a result of these failures, from 2011\nto 2014, a then-employee impermissibly accessed and transferred the data regarding\napproximately 730,000 accounts to his personal server, which was ultimately hacked by third\nparties.\n\xe2\x80\x9cGiven the dangers and impact of cyber breaches, data security is a critically important aspect\nof investor protection. We expect SEC registrants of all sizes to have policies and procedures that\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n83\n\nare reasonably designed to protect customer information,\xe2\x80\x9d said Andrew Ceresney, Director of the\nSEC Enforcement Division.\nAccording to the SEC\xe2\x80\x99s order instituting a settled administrative proceeding:\nThe federal securities laws require registered broker-dealers and investment advisers to adopt\nwritten policies and procedures reasonably designed to protect customer records and\ninformation.\nMorgan Stanley\xe2\x80\x99s policies and procedures were not reasonable, however, for two internal web\napplications or \xe2\x80\x9cportals\xe2\x80\x9d that allowed its employees to access customers\xe2\x80\x99 confidential account\ninformation.\nFor these portals, Morgan Stanley did not have effective authorization modules for more than 10\nyears to restrict employees\xe2\x80\x99 access to customer data based on each employee\xe2\x80\x99s legitimate\nbusiness need.\nMorgan Stanley also did not audit or test the relevant authorization modules, nor did it monitor or\nanalyze employees\xe2\x80\x99 access to and use of the portals.\nConsequently, then-employee Galen J. Marsh downloaded and transferred confidential data to\nhis personal server at home between 2011 and 2014.\nA likely third-party hack of Marsh\xe2\x80\x99s personal server resulted in portions of the confidential data\nbeing posted on the Internet with offers to sell larger quantities.\nThe SEC\xe2\x80\x99s order finds that Morgan Stanley violated Rule 30(a) of Regulation S-P, also known as the\n\xe2\x80\x9cSafeguards Rule.\xe2\x80\x9d Morgan Stanley agreed to settle the charges without admitting or denying\nthe findings. In a separate order, Marsh agreed to an industry and penny stock bar with the right\nto apply for reentry after five years. He was criminally convicted for his actions last year and\nreceived 36 months of probation and a $600,000 restitution order.\nThe SEC\xe2\x80\x99s investigation was conducted by William Martin and Simona Suh of the Enforcement\nDivision\xe2\x80\x99s Market Abuse Unit and supervised by Joseph G. Sansone, Co-Chief of the unit. The SEC\nappreciates the assistance of the New York Field Office of the Federal Bureau of Investigation and\nthe U.S. Attorney\xe2\x80\x99s Office for the Southern District of New York.\nE. But wait, there\xe2\x80\x99s more \xe2\x80\xa6\nJust as federal regulatory agencies have paid increasing attention to cybersecurity matters, so\ntoo with state-legal agencies (including, in many cases, state Attorney General offices, as those\noffices at the state level often have an FTC-like consumer-protection function).\nAnd then there are the regulatory agencies of other countries (and, in the case of the European\nUnion, supra-national regulators). We will not explore these topics here, but you should be\naware that these other regulators may have a significant impact.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n84\n\n13. Private Lawsuits (I)\n\nLearning objectives\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\nAppreciate how the prospect of civil liability for damages relates to the incentives of\nprivate sector entities with respect to their cybersecurity investments, and how the\nability of governments to modify those prospects can be used as a tool to impact\nthose incentives.\nBe able to identify an array of entities or individuals who might fairly be described as\nthe \xe2\x80\x9cvictims\xe2\x80\x9d in the situation in which a hacker succeeds in extracting information\nfrom a company.\nKnow factors that help explain why victims don\xe2\x80\x99t often bring civil suits against the\nattacker in that situation.\nBe able to explain why the most-likely subject for such a suit is the company that\nsuffered the breach.\nUnderstand the factors that make it difficult to sue software vendors based on the\nvulns in their products.\nForm a view on whether the law should be tweaked to make vendors more\namenable to suit.\nUnderstand why settlements occur even when the defendant does not believe they\nshould be liable.\nUnderstand why class action status can be a powerful driver of settlement.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n85\n\nA. The Big Picture: Who Are the Injured Parties Who Might Become Plaintiffs?\nConsider the following depiction of the chain of actors involved in a common type of\ncybersecurity incident:\n\nVendor\n(makes\nsoftware)\n\nCompany (uses\nVendor\xe2\x80\x99s\nsoftware; has\ncustomer credit\ncard data)\n\nHacker accesses\nCompany\xe2\x80\x99s database by:\n(1) social engineering\ntricking Company\xe2\x80\x99s\nemployee into sharing\ncredentials, or\n(2) exploiting a\nvulnerability in\nVendor\xe2\x80\x99s software.\n\nShareholders\nlose value as\nstock dips\nCustomers fear\ncredit card fraud\n& identity theft.\n\nCredit card\ncompanies issue\nnew cards.\n\nLooking at the chart above, consider the following questions:\n\xe2\x80\xa2 Who would you characterize as a victim?\n\xe2\x80\xa2 One might expect that if anyone is to be sued for damages, it would be the hacker.\nThat rarely occurs, however. Why might that be?\n\nUsually the vendor is not sued either. That\xe2\x80\x99s to be expected if the hacker breached the\ncompany\xe2\x80\x99s security via social engineering; that\xe2\x80\x99s a failure on the part of the employee(s) and\nperhaps the company, but not the vendor. But what if the breach was the result of a vulnerability\nin the vendor\xe2\x80\x99s software? Read the following excerpt from this Lawfare article by Jane Chong:\n\nThe rapid evolution of software technology and the surge in the total number of\ncomputer users actually led early commentators to warn of software vendors\xe2\x80\x99 increasing\nexposure to lawsuits \xe2\x80\x94and the \xe2\x80\x9ccatastrophic" consequences to ensue. But history has\ngone the other way. Operating within a \xe2\x80\x9clegislative void,\xe2\x80\x9d the courts have consistently\nconstrued software licenses in a manner that allows software vendors to disclaim almost\nall liability for software defects. Bruce Schneier, perhaps the most prominent decrier of\nthe current no-liability regime for software vendors, puts it simply: \xe2\x80\x9cthere are no real\nconsequences for having bad security.\xe2\x80\x9d The result is a marketplace crammed with\nshoddy code.\nAs users, we tolerate defective software because defective software works most of the\ntime. And we get it much faster and with a great many features. Partly in response to\nconsumer appetite, timely release and incremental patching have become key features\nof the industry\xe2\x80\x99s \xe2\x80\x9cfix-it-later\xe2\x80\x9d culture. Software companies look for bugs late in the\ndevelopment process and knowingly package and ship buggy software with\nimpunity. Meanwhile end users are slow in acknowledging vulnerabilities, use patches\ntoo infrequently, and fail to timely deploy published updates.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n86\n\nSome experts fear that nothing short of a digital Pearl Harbor\xe2\x80\x94a large-scale attack that\nexploits critical security holes in our industrial control systems\xe2\x80\x94will create the momentum\nneeded to trigger government regulation of and private investment in quality code.\nIf that ends up being the case, it won\xe2\x80\x99t be for lack of theorizing. Suboptimal code has\nbeen recognized as a problem for decades. Certainly, there are defenders of the status\nquo who argue that holding software providers liable for their code would raise\ncosts and stifle innovation. But legal academics have spent thirty years disagreeing with\nthat proposition and dreaming up liability schemes designed to force software vendors\nto shoulder some of the costs long borne entirely by users.\n\xe2\x80\xa6 The most common analogy is the car. And there are legitimate parallels between the\nvehicle safety crisis of the 1960s and today\xe2\x80\x99s software security conundrum. Then, state\nand federal courts were reluctant to apply tort law even where automobile-accident\nvictims claimed their injuries resulted from the failure of manufacturers to exercise\nreasonable care in the design of their motor vehicles. Over the next thirty years, however,\nthe courts did an about-face: they imposed on automobile manufacturers a duty to use\nreasonable care in designing products to avoid subjecting passengers to an\nunreasonable risk of injury in the event of a collision; applied a rule of strict liability to\nvehicles found to be defective and unreasonably dangerous; and held automobile\nmanufacturers accountable for preventing and reducing the severity of accidents.\nYet to insist that software defects and automobile defects should be governed by\nsubstantively similar legal regimes is to ignore the fact that \xe2\x80\x9csoftware\xe2\x80\x9d is a category\ncomprising everything from video games to aircraft navigation systems, and that the\ntype and severity of harms arising from software vulnerabilities in those products range\ndramatically. By contrast, automobile defects more invariably risk bodily injury and\nproperty damage. To dismiss these distinctions is to contribute to an increasingly\ncontrived dichotomy, between those who see the uniqueness of software as an\nargument for exempting software programs from traditional liability rules altogether, and\nthose who stress that software is nothing special to claim that the road to software\nvendor liability lies in traditional contract or tort remedies.\n\xe2\x80\xa6Software license agreements are typically crammed with boilerplate language freeing\nthe software provider from virtually all forms of liability while binding the commercial user\nto severe use restrictions. Unhappy with that? Too bad. Anyone who has ever installed\nsoftware after \xe2\x80\x9cconsenting\xe2\x80\x9d to the terms of the accompanying clickwrap, shrinkwrap or\nbrowsewrap understands that the disgruntled user has exactly two choices when it\ncomes to mass market license agreements: take it or leave it.\nSoftware providers typically shunt all the risks associated with their products onto users\nthrough these license agreements, which the courts have generally treated as\nenforceable contracts. Think of contracts as a form of private law-making\xe2\x80\x94the parties\nagree to impose on themselves obligations not otherwise dictated by the law. Frustrated\ntheorists have looked outside of the contract realm for ways to hold software providers\naccountable for the harms that users sustain as a result of insecure code. Consumer\nprotection laws would seem to offer one narrow avenue for redress. Alternatively, users\nhave filed suit for compensation on tort grounds, alleging negligence on the part of the\nsoftware provider or product defect. Recognizing the continuing failure of contract law\nto provide software users meaningful remedies for harms caused by insecure code, as\nwell as the challenges associated with bringing a successful tort claim under the current\nlaw, Professors Michael Rustad and Thomas Koenig have gone so far as to propose\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n87\n\nenacting a statute to establish an entirely new category of tort\xe2\x80\x94\xe2\x80\x9cthe tort of negligent\nenablement of cybercrime.\xe2\x80\x9d\nSoftware license agreements have become such a bad joke for software users that it\xe2\x80\x99s\nhard to believe that once upon a time, it looked like users might be able to leverage\ncontract principles to their advantage. Specifically, commentators speculated that the\ncontract-making principles embodied in the Uniform Commercial Code (UCC)\xe2\x80\x94a set of\nmodel laws adopted at least partially by all the states\xe2\x80\x94could be used to \xe2\x80\x9cpierc[e] the\nvendor\'s boilerplate\xe2\x80\x9d and create a legal framework that would equally benefit vendors\nand users, licensors and licensees.\nAs one believer declared back in 1988, \xe2\x80\x9c[B]ecause fairness and reasonableness are\nfundamental in the Code, application of the UCC would benefit parties unfamiliar with its\nprovisions.\xe2\x80\x9d Another commentator predicted as early as 1985: \xe2\x80\x9cThe courts have\nadequate means to protect software vendees from unconscionable contract provisions\nand the UCC makes requirements for effective disclaimers of warranty clear, so that the\nUCC will adequately protect software vendees and will not serve as a vehicle for\nmanufacturers to limit their liability."\nUnfortunately, the UCC has served as just that: a liability-limitation vehicle. As one critic\nput it almost two decades ago, treating software licenses as sales governed by the\nUCC \xe2\x80\x9ccreates a legal fiction which\xe2\x80\x94contrary to the general intent of the UCC\xe2\x80\x94places\nthe purchaser at a severe disadvantage vis-\xc3\xa0-vis the vendor.\xe2\x80\x9d This is because the UCC is\nbuilt on freedom-to-contract principles that assume roughly equal bargaining power\nbetween the buyer and the seller. Since roughly the mid-1990s, the courts have\naccepted that operating assumption and allowed software providers to contract away\nresponsibility for the deficiencies of their products.\nJudicial adherence to upholding the terms of the standard software license agreement\nhas prompted Douglas Phillips, general counsel of Promontory Interfinancial Network, to\ndub it the \xe2\x80\x9clegislative license.\xe2\x80\x9d In other words, thanks to a long line of court decisions, "the\nlaw of the software license has come largely to be defined by each software license\nitself."\nUCC freedom-to-contract principles serve as the pretext by which courts are able to\nuphold the liability disclaimers and limitations on remedies found in all commercial\nsoftware licensing agreements. But this is not the end of the story. Other factors help\nexplain why, in one high-profile case after another, software users alleging defects and\nsecurity breaches get their cases thrown out of court. These factors are important insofar\nas they offer insight into how the courts understand code\xe2\x80\x94and suggest that the grounds\non which courts construe the rules of contract law in favor of software providers\nwould similarly forestall user attempts to impose liability on providers through existing\nconsumer protection laws or through claims sounding in tort. Indeed, software liability is\nunlikely to get off the ground without the help of legislation or regulation specifically\ndesigned to impose certain duties on software providers.\nAt least three factors other than the disclaimers and limitations crammed into the\nstandard license agreement prevent users from seeking compensation when they are\nharmed by defective software. To start, much software is free. This is a problem under\ncontract law because courts will not hold software providers liable for harms brought\nabout for products or services for which users did not offer some form of payment\xe2\x80\x94or\nwhat lawyers call \xe2\x80\x9cconsideration.\xe2\x80\x9d This is the basic rule underlying Bruce Schneier\xe2\x80\x99s\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n88\n\nobservation that \xe2\x80\x9c[f]ree software wouldn\'t fall under a liability regime because the writer\nand the user have no business relationship; they are not seller and buyer.\xe2\x80\x9d Schneier is\ncorrect\xe2\x80\x94as long as we\xe2\x80\x99re talking about a private ordering regime. A different legal\nframework, however, might make for a different rule. For example, providers of free\nsoftware generate revenue not by extracting money from the users, but rather by\nextracting data that they are then able to monetize. A statute that creates a duty for\nsoftware providers to institute safeguards to secure this data or restrict its use might allow\nusers to bring suit in the event of a security breach under tort theories of negligence or\nmisrepresentation.\nBut in the absence of such a statute, the fact that much software and many Internet\nservices are free will remain a sticking point for users seeking compensation for securityrelated injuries. Last year the social networking service LinkedIn was hit with a high-profile\nclass action suit after hackers breached the company server and posted 6.5 million\nhashes corresponding to LinkedIn accounts on a forum. Sixty percent of these hashes\nwere later cracked. The plaintiffs alleged that LinkedIn had failed to utilize industry\nstandard protocols and technology to protect its customers\' personally identifiable\ninformation, in violation of its own User Agreement and Privacy Policy. A federal court in\nCalifornia threw out the case this spring in part on the grounds that the policy was the\nsame for users of the free and premium versions of the service. Specifically, the court\nfound that the complaint \xe2\x80\x9cfails to sufficiently allege that Plaintiffs actually provided\nconsideration for the security services which they claim were not provided.\xe2\x80\x9d\nThe fact that popular Web applications are often free has also proven problematic for\nusers attempting to state a claim for harms stemming from a security breach under\nexisting consumer protection laws. In 2011, in lawsuits filed against Facebook and against\nApple for their policies of sharing user data with third parties, two more federal court\njudges in California ruled that consumer protection laws did not extend to the users of\nfree services. In his order dismissing the Facebook case, Chief Judge James Ware of\nthe U.S. District Court for the Northern District of California wrote, \xe2\x80\x9c[A] plaintiff who is\na consumer of certain services (i.e., who \xe2\x80\x9cpaid fees\xe2\x80\x9d for those services) may state a claim\nunder certain California consumer protection statutes when a company, in violation of its\nown policies, discloses personal information about its consumers to the public . . . . Here,\nby contrast, Plaintiffs do not allege that they paid fees for Defendant\'s services.\xe2\x80\x9d\nHere is a second reason software providers tend to prevail under a private-ordering\nregime, and remain immune even when users bring suit under various tort theories: the\ncourts are resistant to finding an implied warranty of merchantability with respect to\nsecurity for software products and services that they know cannot be made vulnerabilityfree. That is, courts tend to treat certain user security expectations as inherently\nunreasonable. For example, in 2011, several banks sued the payment transaction\ncompany that had been holding their customers\xe2\x80\x99 data when it suffered a massive\nsecurity breach. A Texas federal court rejected the suit, reasoning, \xe2\x80\x9cTo the extent that the\nFinancial Institution Plaintiffs argue that [the company\xe2\x80\x99s] statements and conduct\namounted to a guarantee of absolute data security, reliance on that statement would\nbe unreasonable as a matter of law.\xe2\x80\x9d In rejecting the plaintiffs\xe2\x80\x99 claim, the court relied on\nthe logic of yet another court decision, which declared that \xe2\x80\x9cin today\'s known world of\nsophisticated hackers, data theft, software glitches, and computer viruses, a jury could\nnot reasonably find an implied merchant commitment against every intrusion under any\ncircumstances whatsoever.\xe2\x80\x9d\nNote that this line of reasoning once got traction in the automobile context. Evans v.\nGeneral Motors Corp. was a Seventh Circuit case in which the plaintiff alleged that\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n89\n\nGeneral Motors had been negligent in designing its 1961 Chevrolet station wagon\nwithout the perimeter frame rails that were being used in many other cars to protect\noccupants during a side-impact collision. The Evans court rejected the claim on the\ngrounds that "[a] manufacturer is not under a duty to make his automobile accidentproof or foolproof.\xe2\x80\x9d As one commentator pointed out, the court exaggerated the\nplaintiff\xe2\x80\x99s claim to immunize the manufacturer from liability.\nTwo years later, the Eighth Circuit rejected this formulation of the claims in the landmark\ncase Larsen v. General Motors Corp., in which the plaintiff alleged negligent design\nbased on the displacement of the steering shaft in the Chevrolet Corvair. Specifically,\nthe Larsen court rejected General Motors\xe2\x80\x99 attempt to frame the issue as one contingent\non determining whether it had the duty to produce a crash-proof car, relying instead on\nthe idea that it was possible for General Motors to have designed a vehicle that would\nminimize the effect of accidents.\nSimilar standards based on industry best practices could be used to impose liability in the\nsoftware context, if courts conceived of software as a product that could be designed\nto minimize, though not eliminate, security vulnerabilities. But the judiciary\xe2\x80\x99s lack of\ntechnical expertise and the inherent complexity of software have long prevented the\ncourts from making this leap. In a case dating back to 1986, a federal bankruptcy court\ndeclined to enforce the implied warranty of merchantability where a DOS-based\ncomputer that represented itself as being Apple-compatible failed to run Apple\nsoftware. Noting that Apple sells thousands of software programs, the court declared,\n\xe2\x80\x9cWe simply cannot determine the extent of the incompatibility and on that failure of\nproof we conclude that there has been no breach of an implied warranty of\nmerchantability.\xe2\x80\x9d The fact that software users have been unsuccessful in asserting\nbreach of implied warranty bodes badly, in turn, for their ability to bring what amounts to\nthe \xe2\x80\x9cconceptually indistinguishable\xe2\x80\x9d tort claim for negligence against the software\nmaker.\nA third factor suggests that courts will continue construing software license agreements\xe2\x80\x94\nand, as it turns out, tort actions\xe2\x80\x94in favor of software providers: the idea that hackers, not\nproviders, are singularly responsible for security breaches. Last year, a California federal\ncourt rejected the claim that Sony had misrepresented the quality of its network security\nwhere Sony\'s privacy policy had stated that its security was not perfect, and moreover\nalso rejected plaintiffs\' claims of unfair business practices, since Sony did not benefit\nfinancially from the third-party data breach.\nThe court\xe2\x80\x99s rejection of the unfair business practice claim is noteworthy in that it suggests\na narrow view of what constitutes financial benefit. That is, the court reasons that\nsoftware providers gain nothing when malicious actors bring about security breaches,\nthereby declining to take an expansive view of the gains that software vendors (unjustly)\nreap by engaging in easy, shoddy software development and shipping practices that in\nturn contribute to security vulnerabilities and security breaches.\nThis cramped focus on the role of the hacker in executing the exploit and the refusal to\nconsider the role of the software maker in creating an environment susceptible to exploit\nsimilarly present a challenge for any attempt to bring basic tort claims. Negligence is\ngrounds for a civil lawsuit where the plaintiff is able to establish that the defendant owed\na duty, breached that duty, caused harm as a result and should pay damages to make\nHumpty Dumpty whole again. Establishing the causation element in that chain is difficult,\nif not impossible, so long as courts choose to fixate on the hacker, not the environmentcreator, when assessing who brought about the injury in question.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n90\n\nIn sum, it is significant that buttressing the courts\xe2\x80\x99 interpretation of software license\nagreements are ideas that similarly pose problems for holding software providers liable\nunder consumer protection statutes or under tort theories. But the idea that, in the\nabsence of special legislation or regulation, tort could be a viable avenue for pursuing\nliability for software providers runs up against a much bigger threshold problem. That is\nthe economic loss doctrine. Broadly speaking, the doctrine restricts tort liability to cases\ninvolving bodily injury or damage to other property. This is a special problem for tort\nclaims related to software vulnerabilities, since most security breaches give rise to purely\neconomic losses or data compromises.\nThanks to the economic loss rule, courts have long been spared the uncomfortable task\nof actually declaring that software vendors have no duty to institute reasonable\nmeasures to develop and maintain secure software. For example, back in 2000, the gas\nand oil company Hou-Tex, Inc. alleged that a software program company had\nbreached both its duty to inform its customer about a bug in the software and its duty to\nfix the problem. But the Texas state court held that the economic loss rule precluded\nHou-Tex\'s negligence claims against the software company. In a 2010 case, a New York\nfederal judge made no mention of a potential duty, and instead simply\ndismissed plaintiffs\xe2\x80\x99 claims of negligence, strict liability and gross negligence for damages\nstemming from defects in the contracted-for software, as barred by New York\'s\neconomic loss doctrine.\nThe economic loss doctrine has public policy roots. As the Supreme Court explained in\nits landmark 1986 decision East River Steamship Corp. v. Transamerica Delaval, Inc., tort\nlaw is the appropriate vehicle for addressing unexpectedly dangerous and defective\nproducts, since in the case of unexpected personal injury or property damage, the\nmanufacturer is best positioned to bear the cost of and to price the product to spread\nthe loss. Pure financial loss, however, is properly the domain of contract law, particularly\nthe law of warranty, because the rule prompts the parties to set the terms of the\nbargain. Where the consumer agrees to pay less, the manufacturer can restrict its liability\nby disclaiming warranties or limiting remedies.\nIn short, the economic loss doctrine is premised on the idea that, as declared by the East\nRiver Steamship court, \xe2\x80\x9ca commercial situation generally does not involve large\ndisparities in bargaining power . . . [thus] we see no reason to intrude into the parties\'\nallocation of the risk.\xe2\x80\x9d In other words, the rule does not account for the asymmetric\nbargaining power between software vendors and end-users\xe2\x80\x94which is pretty vast.\nAnd so after very briefly touring some of the problems with the current private-ordering\nregime, and having learned (in part) why tort law won\xe2\x80\x99t work either, we return, full circle,\nto the inadequacies of contract law and the UCC in allocating liability between software\nvendors and users.\nThe failure of software users to prevail under contract, tort, or consumer protection\nschemes when it comes to getting compensated for bad code suggests that in the\nabsence of specific legislation or regulation\xe2\x80\x94for example, restricting software vendors\xe2\x80\x99\nability to rely on blanket disclaimers\xe2\x80\x94software users will have little success in holding\nvendors accountable for vulnerabilities.\nTo put it simply, the laws on the books must change\xe2\x80\x94or the quality of our software will\nnot.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n91\n\nNoted computer security expert Daniel Geer thinks you should bear the costs of the\ninsecure code you use. It\xe2\x80\x99s nothing personal. He acknowledges that holding the end user\nresponsible for being the \xe2\x80\x9cunwitting accomplice to constant crime\xe2\x80\x9d is far from a perfect\ncybersecurity strategy. But he concludes that for the time being, it is the least \xe2\x80\x9cworst\xe2\x80\x9d\noption:\nIf you say that it is the responsibility of Internet Service Providers (ISPs) \xe2\x80\x94 that \xe2\x80\x9cclean\npipes\xe2\x80\x9d argument\xe2\x80\x94 then you are flatly giving up on not having your traffic inspected at a\nfine level of detail. If you say that it is the software manufacturer\xe2\x80\x99s responsibility, we will\nsoon need the digital equivalent of the Food and Drug Administration to set standards for\nefficacy and safety. If you say that it is the government\xe2\x80\x99s responsibility, then the mythical\nInformation Superhighway Driver\xe2\x80\x99s License must soon follow. To my mind, personal\nresponsibility for Internet safety is the worst choice, except for all the others.\nGeer\xe2\x80\x99s concern is well-founded: imposing security responsibilities on entities other than\nthe end-user will no doubt abrogate some of the freedom and functionality that end\nusers currently enjoy as consumers. This is true both with respect to software and Internet\naccess specifically and with respect to computer information systems more generally.\nBut Geer\xe2\x80\x99s conclusions are unnecessarily stark, in part because they assume that security\nis a pie that cannot be intelligently shared\xe2\x80\x94a conclusion that, it should be noted, we\nwould never be inclined to accept in our offline lives. Our physical security may\nultimately be our burden to bear, but we expect fast food chains not to poison us, local\npolice to do their rounds and our neighbors to call 9-1-1 if they see suspicious activity.\nSome invisible web of law, professional obligations and communal norms collude at all\ntimes to keep us alive and our property in our possession.\nWould vesting ISPs with circumscribed security responsibilities\xe2\x80\x94such as responding to or\nrecording highly unusual traffic patterns that suggest an ongoing DDoS attack\xe2\x80\x94require\nend-users to \xe2\x80\x9cflatly\xe2\x80\x9d relinquish data privacy? Many ISPs already implement limited\nsecurity mechanisms, and carefully designed private-public data-sharing restrictions\ncould go a long way toward addressing concerns about improper use of subscriber\ninformation.\nSimilarly, holding software providers accountable for their code need not entail exposing\nsoftware providers to lawsuits for any and all vulnerabilities found in their products.\nLiability critics battle a straw man when they make arguments like this one, from\ncomputer security authority Roger Grimes: \xe2\x80\x9cIf all software is imperfect and carries security\nbugs, that means that all software vendors\xe2\x80\x94from one-person shops to global\nconglomerate corporations\xe2\x80\x94would be liable for unintentional mistakes.\xe2\x80\x9d\nLiability is a weapon far more nuanced than its critics believe. Geer and Grimes see\nliability as a big red button\xe2\x80\x94a kind of nuclear option, to be avoided at all costs.\nMeanwhile proponents understand liability as a complex machine ideally outfitted with a\nnumber of smart levers.\nConsider: software\xe2\x80\x99s functions range from trivial to critical; security standards can be\nimposed at the development or testing stage, in the form of responsible patching\npractices or through obligations for timely disclosure of vulnerabilities or breaches; the\ncode itself might be open-source or proprietary or in any case free. An effective liability\nregime is one that takes these many factors into account when it comes to designing\nrules, creating duties or imposing standards.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n92\n\nFor starters, it would make no sense to hold all software providers to the same duty of\ncare and the same liability for breach of that duty, irrespective of the software\xe2\x80\x99s\nintended use and associated harms. As Bruce Schneier observed back in 2005, \xe2\x80\x9cNot all\nsoftware needs to be built under the overview of a licensed software engineer . . . [but]\ncommercial aircraft flight control software clearly requires certification of the responsible\nengineer.\xe2\x80\x9d All software embedded in life-critical systems or critical infrastructure should\nbe consistently made subject to more rigorous standards than standard commercial\nsoftware, and the manufacturers should be held liable either for harms caused by\nproducts that deviate from those standards, or for flaws that are not timely remediated.\nImposing this kind of liability will require restricting the disclaimers of warranty and\nlimitations on remedies found in standard software license agreements. As far as\nrecommendations go, this is a familiar rerun. In a 2007 report, the House of Lords Science\nand Technology Committee recommended that the European Union institute \xe2\x80\x9ca\ncomprehensive framework of vendor liability and consumer protection,\xe2\x80\x9d one that\nimposes liability on software and hardware manufacturers \xe2\x80\x9cnotwithstanding end user\nlicensing agreements, in circumstances where negligence can be demonstrated.\xe2\x80\x9d\nThe tricky part, of course, is putting into place a system through which negligence can\nbe reliably demonstrated. As a general principle, insofar as security can be understood\nas a process, rather than an end, negligence should be assessed based on failure to\nadhere to certain security standards rather than based on absolutes like the number of\nvulnerabilities in the software itself. Indeed, numbers might reveal more about the\nsoftware\xe2\x80\x99s popularity than its inherent insecurity. Any particular vulnerability might not\nprove a software program unacceptably defective\xe2\x80\x94but an examination of the general\nprocesses and precautions through which the software was produced just might.\nLaws merely establishing modest duties on the part of software makers\xe2\x80\x94and subjecting\nthem either to private suit or government fine in the event of harms resulting from\nbreach\xe2\x80\x94could help push the industry to develop and implement best practices. These\npractices could in turn constitute an affirmative defense against negligence claims. Best\npractices might range from periodic independent security audits to participation in what\nDavid Rice, Apple\xe2\x80\x99s global director of security, describes as a ratings system for software\nsecurity, an analogue to the National Highway Traffic Safety Administration\xe2\x80\x99s rating\nsystem for automobile safety.\nAlready existing legislation that penalizes companies for failing to safeguard sensitive user\ninformation offers a useful model for imposing narrowly circumscribed security duties on\nsoftware providers. For example, in 2006, the Indiana legislature enacted a statute that\nrequires that the owner of any database containing personal electronic data disclose\na security breach to potentially affected consumers but does not require any other\naffirmative act. The terms of the statute are decidedly narrow\xe2\x80\x94it provides the state\nattorney general enforcement powers but affords the affected customer no private right\nof action against the database owner and imposes no duty to compensate affected\nindividuals for inconvenience or potential credit-related harms in the wake of the\nbreach.\nThere are other factors to consider in calibrating a liability system. Liability exposure\nshould be to some extent contingent, for example, on the availability of the source\ncode. It is difficult to imagine, for instance, a good argument for holding the contributors\nto an open source software project liable for their code. Whether or not you believe that\nthe process by which open source software evolves actually constitutes its own security\nmechanism, a la Linus\'s Law ("given enough eyeballs, all bugs are shallow\xe2\x80\x9d), the fact is\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n93\n\nthat open-source software offers users both the cake and the recipe. Users are free to\nexamine the recipe and alter it at will. By offering users access to the source code, open\nsource software makes users responsible for the source code\xe2\x80\x94and unable to recover for\nharms.\nImposing liability on open-source software is not only an incoherent proposition, but it\nalso has problematic First Amendment implications. Code is, after all, more than a good\nor service. It is also a language and a medium. And clumsily-imposed liability rules could\nplace significant and unacceptable burdens on software speech and application-level\ninnovation.\nIn her book on the relationship between internet architecture and innovation, Barbara\nvan Schewick gives us some sense of why we should be wary of creating stifling liability\nlaws with her description of the nexus between software applications and sheer human\npotential:\nThe importance of innovation in applications goes beyond its role in fostering economic\ngrowth. The Internet, as a general-purpose technology . . . creates value by enabling\nusers to do the things they want or need to do. Applications are the tools that let users\nrealize this value. For example, the Internet\xe2\x80\x99s political, social or cultural potential\xe2\x80\x94its\npotential to improve democratic discourse, to facilitate political organization and action,\nor to provide a decentralized environment for social and cultural interaction in which\nanyone can participate\xe2\x80\x94is tightly linked to applications that help individuals, groups or\norganizations do more things or do them more efficiently, and not just in economic\ncontexts but also in social, cultural or political contexts.\nAll of this applies, of course, to proprietary applications, but the liability calculus for\nclosed-source software should come out a little different. When it comes to proprietary\napplications, the security of the code does not lie with users but remains instead entirely\nwithin the control of a commercial entity. The fact that much proprietary software is\n\xe2\x80\x9cfree\xe2\x80\x9d should not foreclose liability: a narrowly tailored liability rule might provide that\nwhere users are \xe2\x80\x9cpaying\xe2\x80\x9d for a software product or service with their data, a data\nbreach that causes damages could be grounds for government-imposed fines or, to the\nextent it causes individuals to sustain harm, private damages.\nThis is by no means a comprehensive overview of all possible approaches to constructing\na software liability regime. It is rather a glimpse of a few of the many levers we can push\nand pull to turn security from an afterthought into a priority for software makers. Such a\nchange will come with costs, imposed on software makers and redistributed to us, the\nusers. But we must keep in mind that whatever we pay in preventive costs today are low\ncompared with what we could pay in remedial security costs tomorrow.\nAs a matter of routine, we accept inconveniences, costs and risk redistribution in other\nareas of our lives. Drugs are required to undergo clinical testing, food is inspected and\noccasionally \xe2\x80\x9cadministratively detained,\xe2\x80\x9d and vaccines are taxed to compensate the\nsmall fraction of recipients who will suffer an adverse reaction. Restrained measures to\npolice software, too, can be understood as part of a commonsense tradeoff between\nwhat is cheap and functional and what is safe and secure.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n94\n\nMake a list of the obstacles to suing software providers.\n\xe2\x80\xa2 Consider the policies that might be served by each obstacle. Would you change\nany of them?\n\nThis leaves the option of suing the company that actually suffered the breach, on the theory that\nit was not just a victim but also a harm-inflictor in its own right given that it did not have better\ndefenses. Our goal now is to understand the major form of liability that companies in this situation\nmight face.\nB. Tort Liability (Liability For Lack of Due Care)\nIn our legal system, we use the word \xe2\x80\x9ctort\xe2\x80\x9d to refer to situations in which the law authorizes suits for\ndamages based on harmful actions/omissions. Some torts are \xe2\x80\x9ccommon law\xe2\x80\x9d causes of action,\nmeaning that the courts have recognized a right to sue in a particular situation even without a\nstatute calling for recognition of that tort. This is the traditional and most familiar kind of tort.\nExamples include negligence and battery. But legislatures can create torts by statute, too, if they\nwish.\nThere are many kinds of torts. One batch, called \xe2\x80\x9cintentional torts,\xe2\x80\x9d involves purposefully harmful\nconduct. That\xe2\x80\x99s not our concern here, for we are assuming that companies do not intend to be\nbreached. So that leaves us with unintentional harms. In that situation, the tort system can take\neither of two approaches. First, it can make someone strictly liable for all harms they cause.\nSecond, it can make them liable only for harms that result from lack of adequate care\xe2\x80\x94what we\ncommonly call \xe2\x80\x9cnegligence.\xe2\x80\x9d The strict-liability approach is relatively rare, and usually confined\nto ultra-hazardous activities. For companies that may have inadequate information security, the\nimportant question is negligence.\nAs all law students learn during their first year, negligence makes a defendant liable in damages\nwhere four conditions are met: (1) the defendant owed a duty of care, (2) the defendant\nbreached that duty, (3) the plaintiff suffered a legally recognizable harm, and (4) the breach was\nthe proximate (reasonably foreseeable) cause of that harm.\n\nPause now to consider how, in the scenario above, the company\xe2\x80\x99s customers might have a\nnegligence claim against (a) the company or (b) the vendor.\n\nPlaintiffs have an uphill battle in bringing negligence claims against companies that suffer a data\nbreach, because each of the elements of a traditional negligence action are difficult to show in\nthe cybersecurity context. For example, even if a court assumes that a business has a duty to\nprotect its customers\xe2\x80\x99 data, plaintiffs must show the business\xe2\x80\x99s cybersecurity practices were so\nsubstandard that it actually breached that duty of care\xe2\x80\x93\xe2\x80\x93and this requires comparing those\npractices to some standard of what \xe2\x80\x9creasonable\xe2\x80\x9d cybersecurity practices look like.\nNext, plaintiffs must show that they suffered some harm as a result of the breach. But how? For\nplaintiffs whose data has been exposed, it can be difficult to identify the amount of harm they\nactually suffered unless that data has been used against them. But even for plaintiffs who can\nshow they suffered identity theft or some other harm, how can they prove it was the result of this\nparticular breach, and not some other breach of their data?\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n95\n\nThe Supreme Court recently denied certiorari in two cases that would have addressed the\nproblems plaintiffs face in obtaining class certification in class-action suits. Here is what Joseph\nMarks at the Washington Post had to say about it in December 2018:\nTwo class-action lawsuits that could come before the Supreme Court this term seek to\ndetermine just how bad a cybersecurity lapse must be before customers can sue.\nIn both cases, federal appeals court judges formally approved lawsuits by thousands of\nconsumers who want to collectively sue major companies for cybersecurity failures \xe2\x80\x94 even\nthough the customers couldn\xe2\x80\x99t prove they\xe2\x80\x99d suffered any direct financial harm from the\ncompanies\xe2\x80\x99 digital negligence.\nThe companies are asking the high court to overturn the lower court decisions allowing the\nlawsuits. They argue that customers must suffer some concrete financial or physical harm\nbefore they can demand compensation for a data breach or for hackable vulnerabilities\ndiscovered in their products.\nFlexible tech solutions can prepare your business for nearly any challenge, but first you\nneed a game plan.\nConsumers, however, contend that setting such strict standards would give negligent\ncompanies a pass for not sufficiently protecting their products and data.\nIf the Supreme Court rules on either case, it could fundamentally reshape the responsibility\nthe private sector has over the security of Internet-connected products that could\nendanger consumers\' privacy or even their lives in the case of things like cars and medical\ndevices.\nIf the court sets a high bar for consumers to sue, it could prompt companies to play fast\nand loose with their data. If that standard is too low, however, it may deter companies\nfrom sharing information about newfound computer bugs or investing in new technologies\nout of fear they\xe2\x80\x99ll be on the hook for legal damages.\n\xe2\x80\x9cYou\xe2\x80\x99ve potentially jacked way up the monetary costs from a vulnerability that\xe2\x80\x99s disclosed\ndown the road,\xe2\x80\x9d Megan L. Brown, an attorney with Wiley Rein who deals in complex\nlitigation and technology, told me. \xe2\x80\x9cThat may affect a company\xe2\x80\x99s risk calculation and\nmake them not do some things.\xe2\x80\x9d\nThe first class action suit was sparked after a viral 2015 Wired article describing how two\nsecurity researchers hacked through the entertainment system in a Jeep Cherokee to kill\nthe brakes \xe2\x80\x94 all while the Wired reporter was driving the vehicle at 70 mph through\ndowntown St. Louis.\nAfter the article, Chrysler mailed 1.4 million vehicle owners a USB stick with software to fix\nthe vulnerability, and there\xe2\x80\x99s no evidence malicious hackers ever exploited it. Jeep owners\npoint to the hack, however, as evidence that their vehicles are \xe2\x80\x9cexcessively vulnerable\xe2\x80\x9d\nand say they should get some money back, according to Chrysler\xe2\x80\x99s petition to the high\ncourt.\nThe issue is particularly complicated because cybersecurity experts warn there\xe2\x80\x99s no way\nto ensure any system is 100 percent digitally secure.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n96\n\nEven major digital consumer products such as Microsoft\xe2\x80\x99s Office suite or Apple\xe2\x80\x99s iPhone\naren\xe2\x80\x99t invulnerable. Security researchers find hackable vulnerabilities in those products\nevery week. The most mature and cyber-sensitive companies, however, usually manage\nto find and patch the most dangerous vulnerabilities before malicious hackers exploit\nthem.\nIf the Jeep plaintiffs are successful, \xe2\x80\x9cit opens the door to litigation of all stripes and flavors\nover any consumer product that connects to the Internet,\xe2\x80\x9d Chrysler attorney Thomas H.\nDupree Jr. told me. \xe2\x80\x9cAny product, hypothetically, can be hacked and any plaintiff can\nhire a lawyer who says, \xe2\x80\x98In my opinion the product has inadequate cybersecurity even\nthough it hasn\xe2\x80\x99t been breached.\xe2\x80\x99 \xe2\x80\x9d\nIn the second case, the online retailer Zappos did suffer a malicious breach of a database\ncontaining customers\xe2\x80\x99 information, including names, contact information and possibly\ncredit card data. The company says, however, that there\xe2\x80\x99s no evidence the hackers used\nthat data to impersonate customers or to make phony credit card charges.\nThe customers dispute that characterization, however, and say hackers used their\ninformation to hack other accounts.\nThe Zappos and Jeep cases are being litigated at the U.S. District Court level while the\nlower courts wait to learn whether the Supreme Court will hear the cases. Neither case has\nmoved substantially past the questions of whether the plaintiffs have standing to sue and\nwho should be included in the plaintiffs\' class.\nThe high court held a conference on the Zappos case this month and is scheduled to meet\non the Jeep case Jan. 4. The court probably will decide whether to grant hearings in the\ncases in January.\nMeanwhile, industry groups are worried about the potential implications. Trade\nassociations like the U.S. Chamber of Commerce, the National Association of\nManufacturers and CTI, the wireless association, have filed friend-of-the-court briefs\nsupporting the companies.\nThey have reason to be concerned if the high court does take the cases. Lawsuits where\nthere\xe2\x80\x99s much clearer harm from a data breach have resulted in multimillion-dollar\nsettlements. Target, for example, paid $18.5 million to settle cases brought by state\nattorneys general over its 2013 breach of credit and debit card information for at least 40\nmillion customers and personal information about many more. The retailer is trying to\nconclude a $10 million settlement on a consumer class action stemming from that breach.\nIn other cases, assessing whether hack victims have suffered harm can be far more\ndifficult.\nThe U.S. Court of Appeals for the D.C. Circuit, for example, is mulling a case filed by federal\nemployee unions over the 2015 Office of Personnel Management data breach. Most\ncyber experts believe that breach was launched by Chinese government hackers who\nwant to use the data for blackmail or other espionage.\nThat means it\xe2\x80\x99s unlikely the data stolen from more than 21 million current and former\nfederal employees and their families will be used for identity theft or to make phony credit\ncard charges. The stolen data, however, included extremely personal background check\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n97\n\ninformation, including lengthy questionnaires about finances, housing, family relationships\nand drug and alcohol use.\nAn appeals court judge said during a Nov. 2 hearing that the government faced an \xe2\x80\x9cuphill\nbattle\xe2\x80\x9d arguing the plaintiffs didn\xe2\x80\x99t have grounds to sue in that case, as reported by\nGovExec.\nThe harm caused by that kind of hack is far different from the nebulous damage caused\nby a breach involving only information such as names and addresses, Joe Hall, chief\ntechnologist at the Center for Democracy and Technology think tank, told me.\n\xe2\x80\x9cTrivial harm should not be something that keeps us from building wonderful things,\xe2\x80\x9d Hall\nsaid. \xe2\x80\x9cBut we really need to find a way to articulate harms that are not economic but really\naffect people\xe2\x80\x99s ability to trust each other or to participate in the world.\xe2\x80\x9d\nSo, what happened next? The Supreme Court has declined to hear either case, leaving the Court\nof Appeals rulings in place.\nNext, consider the following case study, arising out of the infamous data breach at the credit\nagency Equifax. Credit-reporting agencies like Equifax are a particularly appealing target, in light\nof the vast volume and sensitive nature of the information they collect. As you might imagine,\nnews of the breach made headlines, and many lawsuits followed. Eventually, a group of plaintiffs\njoined to seek \xe2\x80\x9cclass action\xe2\x80\x9d status\xe2\x80\x94that is, to represent and seek recovery not just on their own\nbehalf but also on behalf of every other similarly-situated person. Here is an account of that suit,\nfrom Anne Bucher:\nEquifax Inc. has been hit with a class action lawsuit filed on behalf of individuals in all 50\nstates and the District of Columbia over the massive Equifax data breach that was\nannounced in September.\nA massive cybersecurity incident reportedly exposed the sensitive personal identification\nand financial information of more than 145 million people\xe2\x80\x94nearly half of the U.S\npopulation.\n\xe2\x80\x9cThis case concerns the largest data breach involving personal and financial information\nin American history,\xe2\x80\x9d the Equifax class action lawsuit says. \xe2\x80\x9cEquifax, one of the three credit\nreporting companies used by thousands of businesses to assess the credit worthiness of\ncustomers and prospective customers, failed spectacularly in protecting that data.\xe2\x80\x9d\nAs a result, sensitive consumer information such as names, birth dates, Social Security\nnumbers, drivers\xe2\x80\x99 license numbers, address history and other financial information was\nallegedly accessed by unauthorized parties from May through June.\nThe Equifax class action lawsuit claims the damage caused by the Equifax data breach\nwas compounded by the credit reporting agency\xe2\x80\x99s \xe2\x80\x9cegregious cybersecurity failures\nbefore, during, and after the breach,\xe2\x80\x9d including: failing to employ an available security\npatch, not recognizing the data breach for more than three months, failing to implement\nsecurity measures after the data breach, and failing to timely inform the public about the\nmassive data breach.\nThe plaintiffs also challenge Equifax\xe2\x80\x99s response to the data breach, including the confusing\nemails it sent to consumers about whether their information was compromised, and\ncreating a credit monitoring service with a confusing message about whether users would\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n98\n\nbe bound by an arbitration clause, and sending consumers a wrong link to have their\ncredit frozen.\n\xe2\x80\xa6 This new 323-page Equifax class action lawsuit seeks to consolidate dozens of data\nbreach lawsuits that are currently pending throughout the country. At least 150 data\nbreach lawsuits have been filed nationwide against Equifax so far.\nThe plaintiffs include individuals from all 50 states and the District of Columbia who allege\nthey have experienced fraud after their sensitive personal information was compromised\nin the data breach.\nThe Equifax class action lawsuit asserts claims for violation of the Fair Credit Reporting Act,\nnegligence, negligence per se, bailment, unjust enrichment, and violation of state\nconsumer protection and/or privacy laws. The plaintiffs are seeking monetary damages,\ndeclaratory and injunctive relief, and other remedies allowed under the applicable laws.\nThe plaintiffs in this case sought \xe2\x80\x9cclass action\xe2\x80\x9d status\xe2\x80\x94that is, they sought approval from the court\nto assert not just their own claims but those of all other similarly-situated persons.\n\nConsider the pros and cons of class-action status from the point of view of the defendant, the\nplaintiff, and the plaintiff\xe2\x80\x99s attorneys (bearing in mind that the plaintiff\xe2\x80\x99s attorneys most likely\nare being compensated on a \xe2\x80\x9ccontingent fee\xe2\x80\x9d basis\xe2\x80\x94meaning that they will receive a\npercentage of the eventual recovery, if any).\n\nIt can be hard to prove what the duty of care is, let alone that a breach of it occurred. Read this\nCNN account of the Equifax hack:\nHow did it happen? Much is still unknown. But it came down to a flaw in a tool designed\nto build web applications, the company said in a press release this week. And Equifax\nadmitted it was aware of the security flaw a full two months before the company says\nhackers first gained accessed to its data.\nSome of the information hackers had access to includes names, Social Security numbers,\nbirth dates, addresses and some driver\'s license numbers.\nThe tool is called Apache Struts, and it\'s used by many large businesses and government\norganizations. Equifax used it to support its online dispute portal\n-where Equifax (EFX) customers go to log issues with their credit reports. The flaw allowed\nhackers to take control of a website.\nA cybersecurity arm of the U.S. Department of Homeland Security, US-CERT, "identified and\ndisclosed" the Apache Struts flaw in March, Equifax said in a statement.\nAnd the company\'s security department "was aware of this vulnerability at that time, and\ntook efforts to identify and to patch any vulnerable systems."\nYet, according to the company, hackers exploited the flaw months later.\nEquifax has said it discovered the data breach on July 29. On Friday, it said it waited until\nit "observed additional suspicious activity" a day later to take the affected web application\noffline.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n99\n\nAnd on August 2 Equifax contacted Mandiant, a professional cybersecurity firm, to help\nthe company assess what data had been compromised.\nWith help from Mandiant, Equifax was able to determine a series of breaches had\noccurred from May 13 through July 30, the company said.\nPatching software at big corporations with many machines does take time. They must first\nidentify the vulnerability, then implement and test the patch to make sure it doesn\'t break\nanything before making it public.\nHowever, security experts say Equifax should have moved faster.\n"There\'s really no excuse whether it\'s a difficult patch or not, for an organization of that size\nwith that kind of magnitude of data," said Jon Hendren, director of strategy at security firm\nUpGuard. "When you\'re a big organization like that, it\'s a systemic failure of process and\nthe blame goes straight to the top."\nEquifax has also been widely criticized for waiting more than a month to alert its customers\nand shareholders about the hack.\nOn Friday, the company announced its chief information officer and chief security officer\nare "retiring."\n\nConsider the following questions:\n\xe2\x80\xa2 Assume that is all accurate. Do you feel Equifax breached a duty of care?\n\xe2\x80\xa2 What, exactly, is the duty?\n\xe2\x80\xa2 If you think Equifax breached its duty, what specifically would you say it should have\ndone? Can you explain how your understanding of Equifax\xe2\x80\x99s duty is different from\nsaying that Equifax is simply strictly liable for any breach that might occur?\n\xe2\x80\xa2 What do you suppose Equifax would argue in response?\n\nProving the existence of a duty of care, and a breach, can be difficult. But even if proven, that\xe2\x80\x99s\nnot enough. The plaintiff also must prove that the breach was the proximate cause of damage.\nThis can be a huge challenge in the context of data breaches.\nThe Electronic Frontier Foundation offers the following perspective (original here):\nThis summer 143 million Americans had their most sensitive information breached,\nincluding their name, addresses, social security numbers (SSNs), and date of birth. The\nbreach occurred at Equifax, one of the three major credit reporting agencies that\nconducts the credit checks relied on by many industries, including landlords, car lenders,\nphone and cable service providers, and banks that offer credits cards, checking\naccounts and mortgages. Misuse of this information can be financially devastating.\nWorse still, if a criminal uses stolen information to commit fraud, it can lead to the arrest\nand even prosecution of an innocent data breach victim.\nGiven the scope and seriousness of the risk that the Equifax breach poses to innocent\npeople, and the anxiety that these breaches cause, you might assume that legal\nremedies would be readily available to compensate those affected. You\xe2\x80\x99d be wrong.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n100\n\nWhile there are already several lawsuits filed against Equifax, the pathway for those\ncases to provide real help to victims is far from clear. That\xe2\x80\x99s because even as the number\nand severity of data breaches increases, the law remains too narrowly focused on\npeople who have suffered financial losses directly traceable to a breach.\nThe law consistently fails to recognize other sorts of harms to victims. In some cases this\narises in the context of threshold \xe2\x80\x9cstanding\xe2\x80\x9d to sue, a legal requirement that requires\nproof of harm (lawyers call it \xe2\x80\x9cinjury in fact\xe2\x80\x9d) to even get into the door in federal courts. In\nother cases the problem arises within the claim itself, where \xe2\x80\x9charm\xe2\x80\x9d is a legal element\nthat must be proven for a plaintiff to win the case. Regardless of how the issue of \xe2\x80\x9charm\xe2\x80\x9d\ncomes up, judges are too often failing to ensure that data breach victims have legal\nremedies.\nThe consequences of this failure are two-fold. First, there\xe2\x80\x99s the direct problem that the\ncourthouse door is closed to hundreds of millions of people who face real risk and the\naccompanying reasonable fears about the misuse of their information. Second, but\nperhaps even more important, the lack of legal accountability means that the\ncompanies that hold our sensitive data continue to have insufficient incentives to take\nthe steps necessary to protect us against the next breach.\nEffective computer security is hard, and no system will be free of bugs and errors.\nBut in the Equifax hack, as in so many others, the breach resulted from a known security\nvulnerability. A patch to fix the vulnerability had been available for two months, but\nEquifax failed to implement it even though the vulnerability was being actively exploited.\nThis wasn\xe2\x80\x99t the first time that Equifax has failed to take computer security seriously.\nEven if increasing liability only accomplished an increased incentive to patch known\nsecurity problems, that alone would protect millions of people.\nWhile there are exceptions, too often courts dismiss data breach lawsuits based on a\ncramped view of what constitutes \xe2\x80\x9charm.\xe2\x80\x9d These courts mistakenly require actual or\nimminent loss of money due to the misuse of information that is directly traceable to a\nsingle security breach.\nYet outside of data breach cases, courts routinely handle cases where damages aren\xe2\x80\x99t\njust a current loss of money or property. The law has long recognized harms such as the\ninfliction of emotional distress, assault, damage to reputation and future business\ndealings.1Victims of medical malpractice and toxic exposures can receive current\ncompensation for potential for future pain and suffering. As two law professors, EFF\nAdvisory Board member Daniel J. Solove and Danielle Keats Citron, noted in comparing\ndata breach cases to the recent claims of emotional distress brought by Terry Bollea\n(Hulk Hogan) against Gawker: \xe2\x80\x9cWhy does the embarrassment over a sex video amount\nto $115 million worth of harm but the anxiety over the loss of personal data (such as a\nSocial Security number and financial information) amount to no harm?\xe2\x80\x9d \xe2\x80\x9cWhy does the\nembarrassment over a sex video amount to $115 million worth of harm but the anxiety\nover the loss of personal data (such as a Social Security number and financial\ninformation) amount to no harm?\xe2\x80\x9d\nFor harms that can be difficult to quantify, some specific laws (e.g. copyright,\nwiretapping) provide for \xe2\x80\x9cstatutory damages,\xe2\x80\x9d which sets an amount per infraction.2\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n101\n\nThe recent decision dismissing the cases arising from the 2014-2015 Office of Personnel\nManagement (OPM) hack is a good example of these \xe2\x80\x9cdata breach blinders.\xe2\x80\x9d The court\nrequired that the plaintiffs\xe2\x80\x94mostly government employees\xe2\x80\x94demonstrate that they\nfaced a certain, impending, and substantial risk that the stolen information would be\nmisused against them, and that they be able to trace any harm they alleged to the\nactual breach. The fact that the data sufficient to impersonate was stolen, and stolen\ndue to negligence of OPM, was not sufficient. The court then disappointingly found that\nthe fact that the Chinese government\xe2\x80\x94as opposed to ordinary criminals\xe2\x80\x94are suspected\nof having stolen the information counted against the plaintiffs in demonstrating likely\nmisuse.\nThe ruling is especially troubling because we know that it can take years before the\nharms of a breach are realized. Criminals often trade our information back and forth\nbefore acting on it; indeed there are entire online forums devoted to this exchange.\nStolen credentials can be used to set up a separate persona that incurs debts, commits\ncrimes, and more for quite a long time before the victim is aware of it. And it can be\ndifficult if not impossible to trace a problem with credit or criminal activity misuse back to\nany particular breach.\nHow are you to prove that the bad data that torpedoed your mortgage application\ncame from the breaches at Equifax as opposed to the OPM, Target, Anthem, or Yahoo\nbreaches, just to name a few?\nWhen data is being declared the \xe2\x80\x98oil of the digital era\xe2\x80\x99 and millions in venture capital\nfunding await those who can exploit it, it\'s time to reevaluate how to think of data\nbreaches and misuse, and how we restore access to the courts for those impacted by\nthem.\nWhen data is being declared the \xe2\x80\x98oil of the digital era,\xe2\x80\x99 it\'s time to reevaluate how to\nthink of data breaches and misuse.\nSimply shrugging shoulders, as the OPM judge did, is not sufficient. Courts need to start\napplying what they already know in awarding emotional distress damages, reputational\ndamages, and prospective business advantage damages to data breach cases, along\nwith the recognition of current harm due to future risks, as in medical malpractice and\npollution cases. If the fear caused by an assault can be actionable, so should the fear\ncaused by the loss of enough personal data for a criminal to take out a mortgage in your\nname. These lessons can and should be brought to bear to help data breach victims get\ninto the courthouse door and all the way to the end of the case.\nIf the political will is there, legislatures, both federal and state, can step up and create\nincentives for greater security and a much steeper downside for companies that fail to\ntake the necessary steps to protect our data.\nThe standing problem requires innovation in crafting claims, but even the Supreme Court\nin the recent Spokeo decision recognized that intangible harms can still be harms under\nthe Constitution and Congress can make that intention even more clear with proper\nlegislative language. Alternately, as in copyright or wiretapping cases where the\ndamages are hard to quantify, Congress can use techniques like statutory damages to\nensure that those harmed receive compensation. Making such remedies clearly\navailable in data misuse and breach cases is worthy of careful consideration. So far, the\nfederal bills being floated in response to the Equifax breach and earlier breaches do not\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n102\n\nremove these obstacles to victims bringing legal claims and ensure a private right of\naction.\nSimilarly, outside of the shadow of federal standing requirements, state legislatures can\nconsider models of specific state law protections like California\xe2\x80\x99s Lemon Law, formally\nknown as the Song-Beverly Consumer Warranty Act. The Lemon Law provides specific\nextra remedies for those purchasing a new car that needs significant repairs. States\nshould be able to recognize that data breach situations are special and may similarly\nrequire special remedies. Things to consider are giving victims easier (and free) ways to\nclean up their credit rather than just the standard insufficient credit monitoring schemes.\nBy looking at various options, Congress and state legislatures could spur a race to the top\non computer security and create real consequences for those who choose to linger on\nthe bottom.\nOf course, shoring up our legal remedies isn\xe2\x80\x99t the only avenue for incentivizing\ncompanies to protect our data better. Government agencies like the Federal Trade\nCommission and state attorneys general have a role to play, as does public pressure and\nmedia attention.\nOne thing is for sure: as long as the consequences for neglecting to protect user data\nare weak, data breaches like the Equifax breach will continue to occur. Worse, it will\nbecome increasingly difficult for victims to demonstrate which breach caused their\ncredit rate to drop, their job prospects to dim, or their hopes for a mortgage to be\ndashed. It\xe2\x80\x99s long past time for us to rethink the approach to harm in data breach cases.\n\n\xe2\x80\xa2\n\nDo you agree?\n\nSo, what ultimately happened in the Equifax case, anyway? See here:\nEquifax\xe2\x80\x99s massive data breach in 2017 compromised 146.6 million Social Security numbers, along\nwith other personal information. As a result, the consumer credit reporting agency\nfaced numerous lawsuits, including a class-action lawsuit that reached a settlement of at least\n$650 million on Monday.\nAccording to the terms of the settlement, which still requires court approval, Equifax has to put\nat least $380.5 million into a restitution fund for consumers harmed by the breach. The creditmonitoring agency has agreed to put up an additional $125 million if consumers\xe2\x80\x99 out-of-pocket\nlosses exceed $380.5 million. The settlement also includes money Equifax will spend on free credit\nmonitoring for those affected by the breach.\nThe roughly 147 million people whose data was breached are eligible for five potential benefits:\n\xe2\x80\xa2\n\xe2\x80\xa2\n\nThey can be compensated for up to 20 hours at $25 per hour for time they spent\ndealing with identity theft or other related measures. Ten of these hours can be \xe2\x80\x9cselfcertified.\xe2\x80\x9d\nThey are also eligible to be reimbursed for up to $20,000 as a result of losses \xe2\x80\x9cfairly\ntraceable\xe2\x80\x9d to the breach. This can include a credit file being frozen or unfrozen,\nbuying credit monitoring services, out-of-pocket losses due to identity theft of fraud,\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\n103\n\nand a quarter of money paid to Equifax for credit monitoring or ID theft protection\nsubscriptions a year before the breach.\nAs a result of the settlement, class members can obtain four years of three-bureau\ncredit monitoring and ID protection through Experian \xe2\x80\x94 worth $1,200. Plus, they can\nget another six years of one-bureau credit monitoring through Equifax, valued at\n$720.\nConsumers who have existing credit-card monitoring can be paid $125.\nThe settlement also provides \xe2\x80\x9cID restoration\xe2\x80\x9d services for seven years, for those who\nwere victims of identity theft. These consumers will be assigned an \xe2\x80\x9cidentity theft\nrestoration specialist\xe2\x80\x9d who will provide them with step-by-step assistance.\n\n\xe2\x80\xa6 Back in January 2019, a judge had denied a request from Equifax to dismiss the classaction lawsuit. The New York Times notes that the settlement assumes that just 7 million will\nsign up for free creditor monitoring. According to the settlement itself, if all 147 million\npeople whose data was breached sign up for monitoring, then Equifax would have to pay\na whopping $2 billion. Consumers have six months to claim their benefits.\n\nConsider the following questions:\n\xe2\x80\xa2 Why did the company settle?\n\xe2\x80\xa2 Is this a good outcome from the point of view of the larger public interest(s) at stake?\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n104\n\n14. Private Lawsuits (II); Insurance & Contract Terms\n\nLearning Objectives\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\nUnderstand how a statute can make it easier to sue for negligence by imposing \xe2\x80\x9cstatutory\ndamages\xe2\x80\x9d and how this is one example of how a government can tweak, intentionally, the\nincentives environment\nBe able to explain why the possible role of China in both the Equifax and Anthem stories\ncomplicates the question of their liability\nContract breach claims may overlap with, but are not coextensive with, deception claims\n(ala the FTC Act); be able to explain why\nUnderstand that liability for inadequate \xe2\x80\x9cbreach notification\xe2\x80\x9d is a particularly-common\nscenario, and that anticipation of such liability is itself a factor encouraging greater investment\nin breach prevention\nAppreciate that there is not yet a uniform standard for breach notification, and that states\nvary in terms of what they require\nBe able to describe the timing requirement of the Texas breach notification law, including the\nfactors that allow flexibility\nNote that the shareholders of publicly-traded companies can bring \xe2\x80\x9cshareholder\xe2\x80\x9d suits\nBe able to explain why insurance companies are in a great position to promote improved\ncybersecurity on a wide scale, though also why such companies have had trouble fulfilling this\nrole.\nBe able to explain the two distinct roles that the insurance industry can play: \xe2\x80\x9cproxy regulator\xe2\x80\x9d\nand \xe2\x80\x9cwise counselor sharing important information\xe2\x80\x9d\nUnderstand reasons why the insurance industry has not (yet) optimized its ability to drive\ninsureds towards improved cybersecurity more effectively\nUnderstand that governments are in position to regulate insurers, and hence might be in\nposition to drive insurers to approach this issue differently than they do\nAppreciate that any contract party, in theory, can insist on certain cybersecurity practices as\na condition of the contract, but also that few entities are in a position to have a systemic\nimpact in this way\nUnderstand why the government is in such a position, and be able to describe how the\nKaspersky example illustrates what can be done with that position\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n105\n\nA. Statutory Interventions to Clarify Liability\nNote that legislatures can intervene to clarify or modify the scope of tort-style liability if they wish,\nmaking it harder or easier to sue. California, for example, recently did exactly that. Section 11 of\nthe California Consumer Privacy Act of 2018 (codified at Cal. Civil Code Section 1798.150)\nprovides that certain companies doing business in California are subject to civil suit for injunctive\nrelief or damages in the amount of the plaintiff\xe2\x80\x99s actual damages or else \xe2\x80\x9cstatutory damages\xe2\x80\x9d\n(that is, a pre-set penalty determined by the statute) in the range of $100-$750 per consumer per\nincident, whichever turns out to be higher, if \xe2\x80\x9cnonencrypted or nonredacted personal information\n. . . is subject to an unauthorized access and exfiltration, theft, or disclosure as a result of the\nbusiness\xe2\x80\x99s violation of the duty to implement and maintain reasonable security procedures and\npractices appropriate to the nature of the information\xe2\x80\xa6.\xe2\x80\x9d\n\nConsider these questions:\n\xe2\x80\xa2 How does this statutory standard compare to common-law negligence?\n\xe2\x80\xa2 In light of how the statute describes the category of information subject to the statute\xe2\x80\x99s\nprotection, what advice would you give to a company that has personal information\nto protect?\nB. Contract Liability (For Failing to Live Up to Security-Related Promises)\nIn some settings, the company that suffered a breach will have made security-related\nrepresentations in a contract of some kind. A professional-services firm, for example, might include\nsuch representations in the \xe2\x80\x9cengagement letter\xe2\x80\x9d that serves as the contract between the firm and\nits clients (sophisticated clients increasingly will insist upon this). In other settings, there may be\nterms-of-service that govern a customer\xe2\x80\x99s or user\xe2\x80\x99s relationship to a company (particularly, but not\nonly, where customers or users interact with the company via an app). These too may contain\nsecurity-related representations. These and other examples create the possibility of a breach-ofcontract lawsuit in the event of a data breach where the breach arguably shows that the\ncompany failed to live up to its promises.\nOf course, companies make some representations in settings that do not count as part of a\ncontract with a customer or user. For example, a company may make statements in\nadvertisements or on their websites, including statements about care they take to protect\ncustomer and user data.\n\nConsider how this illustrates the difference between a breach of contract claim and an FTC\nenforcement action based on deceptive advertising.\n\nC. Case Study: Anthem\nIn February 2015, the health insurance company Anthem announced that its security had been\nbreached and that a massive amount of personally identifiable information about patients had\nbeen exposed. This led to massive litigation, based on a variety of claims, including breach-ofcontract claims. Anthem tried to have these claims dismissed but was only partially successful.\nOn one hand, it did succeed in having the breach-of-contract claims dismissed, on the ground\nthat the promises it made regarding customer privacy on its website\xe2\x80\x99s \xe2\x80\x9cprivacy statement\xe2\x80\x9d and in\ncertain mailings to customers were not actually part of a contract with customers. On the other\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n106\n\nhand, the court refused to dismiss a separate cause of action, under California-state law, for\ndeceptive advertising.\nHaving failed to get the whole case dismissed, Anthem eventually settled. Read about it below\n(drawing from this):\nHealth insurer Anthem Inc. will pay $115 million to end class action litigation over a 2015\ndata breach that exposed information of nearly 80 million individuals.\nAccording to court documents, Class Members are expected to receive two years of\ncredit monitoring as well as money for any expenses due to the data breach under the\ndeal.\nSettlement documents indicate that $15 million will be reserved for any out-of-pocket\nexpenses paid by Class Members due to the breach. Anthem will also pay $38 million in\nattorneys\xe2\x80\x99 fees.\n\xe2\x80\x9cBy settling now, the class is able to take advantage of remedies that, as a practical\nmatter, will be unavailable or worth substantially less by the time this case could be\nlitigated to a final judgment,\xe2\x80\x9d noted the court document supporting the plaintiffs\xe2\x80\x99 motion\nfor preliminary approval of the class action settlement. \xe2\x80\x9cOur expert on identity theft and\nfraud protection has explained that credit monitoring services are most critical in the first\nfive years after the Anthem data breach, and the two years of free credit monitoring\nprovided by Anthem have recently expired. Similarly, changes to Anthem\xe2\x80\x99s data security\npractices will be most effective the sooner they are implemented.\xe2\x80\x9d\nAnthem is the country\xe2\x80\x99s second largest health insurer and in 2015 it was hit with a massive\ndata breach. The Anthem class action lawsuit alleged that Anthem failed to properly\nencrypt its data even after being warned by federal agencies about the risk of keeping\nhighly valuable information unprotected.\nUnder the terms of the settlement, Anthem must secure its information and make specific\nupgrades to its data security systems.\n\xe2\x80\xa6 The class action had been converted to multidistrict litigation; however, a federal\ncourt judge trimmed claims against Anthem affiliates, including Blue Cross entities, after\ndetermining they had no connection to the plaintiffs\xe2\x80\x99 claims.\nAnthem lost the bid to completely dismiss the case and a judge ordered the U.S.\ngovernment to produce documents related to a 2013 audit of Anthem\xe2\x80\x99s security systems\nearlier this year.\n\nConsider the following questions:\n\xe2\x80\xa2\n\xe2\x80\xa2\n\nWhat did the plaintiffs receive? What did the plaintiff\xe2\x80\x99s attorneys receive?\nHow do you feel about this result?\n\nBy this point, you surely are asking yourself: Didn\xe2\x80\x99t the regulators also get in on the Anthem action?\nOf course they did (just like they also got in on the Equifax action).\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n107\n\nBecause Anthem was in the insurance business, a California state insurance regulatory agency\nconducted an investigation. It took a considerably more-sympathetic view of the matter,\nemphasizing state-actor responsibility for the breach and suggesting that there was little chance\nAnthem could have long withstood the persistent efforts of a nation state to capture this data.\n\nIs this inconsistent with the civil litigation result? If so, is that a policy problem, and what might\nbe done about it?\n\nAs for the FTC, it did not get involved. But because Anthem was involved in health matters,\nanother federal agency did: the Department of Health and Human Services (\xe2\x80\x9cHHS\xe2\x80\x9d). For a quick\nglance at HHS\xe2\x80\x99s role in this space, read the following excerpt (from this):\nIf you\xe2\x80\x99re already following HIPAA compliance-related news, you\xe2\x80\x99re probably already\nfamiliar with the \xe2\x80\x9cWall of Shame.\xe2\x80\x9d If you\xe2\x80\x99re just getting started, read on. The HIPAA\nBreach Notification Rule requires Covered Entities and Business Associates\nto report HIPAA cyber security breaches of protected health information (PHI) to the U. S.\nDepartment of Health and Human Services (HHS).\nBreach means the acquisition, access, use or disclosure of protected health information\nin a manner not permitted under the HIPAA Privacy Rule, which compromises the security\nor privacy of the protected health information. HHS then investigates the breaches and\nthe outcome can range from minor corrective actions to big monetary fines.\nBut that\xe2\x80\x99s not all. Under the HITECH Act passed in 2009, the Secretary of HHS must post a\nlist of breaches of unsecured protected health information affecting 500 or more\nindividuals. These breaches are posted online at the HHS\xe2\x80\x99 website for the world to see.\nThis list is known in HIPAA circles as the \xe2\x80\x9cWall of Shame.\xe2\x80\x9d The website allows the download\nof the list into Microsoft Excel and includes information such as the name of the covered\nentity responsible for the breach, when it was reported, the number of individuals\naffected by the breach and brief summaries of the breach cases that OCR has\ninvestigated and closed.\nBreach reporting began September 23, 2009. As of July 19, 2019 there were 247 breaches\nto date in 2019. Each breach representing the unauthorized disclosure of the PHI of at\nleast 500 individuals. At the conclusion of an investigation, a breach summary is made\navailable to the public via the OCRs Breach Reporting Portal. The following is an example\nof a breach summary from AccDoc Solutions, outlining their 2018 hacking incident\nexposing their servers:\n\xe2\x80\x9cA business associate (BA), AccuDoc Solutions, Inc., discovered on September 29, 2018,\nthat an unauthorized user had gained access to a web server which contained the\nelectronic protected health information (ePHI) for seven of its covered entity (CE) clients,\naffecting 2,652,537 individuals. While no data was exfiltrated, the ePHI that was\npotentially exposed included demographic information, account balances, and\ninsurance policy information. In response to the breach, the BA terminated the\nunauthorized user\xe2\x80\x99s access and improved technical safeguards. The CEs provided\nbreach notification to affected individuals and the media. The BA provided breach\nnotification to HHS on behalf of six out of seven CE clients. One CE notified HHS on its\nown. OCR obtained assurances that the BA implemented the corrective actions listed.\xe2\x80\x9d\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n108\n\nD. Liability for Inadequate Disclosure of a Data Breach\nThe possibility of being sued for inadequate care, failing to live up to a promise, or deceptive\nadvertising all loom large when a company learns that it has been breached and that customer\nor user data has been exposed. And that in turn creates an incentive for the company leadership\nto proceed very carefully\xe2\x80\x94and thus very slowly\xe2\x80\x94in letting anyone know that the breach has\noccurred. But there is a powerful consideration pushing in the exact opposite direction: all states\nhave laws compelling companies to disclose such breaches, and to do so rapidly.\n\nCan you summarize the competing public-policy interests implicated by such laws, and how\nyou assess the balance between them?\n\nNeedless to say, we are not going to look at all the different state-breach-disclosure laws. Instead,\nwe\xe2\x80\x99ll look at Texas law as an example. From the Texas Business & Commerce Code:\nSec. 521.053. NOTIFICATION REQUIRED FOLLOWING BREACH OF SECURITY OF\nCOMPUTERIZED DATA\n\xe2\x80\xa6\n(b) A person who conducts business in this state and owns or licenses\ncomputerized data that includes sensitive personal information shall disclose any breach\nof system security, after discovering or receiving notification of the breach, to any\nindividual whose sensitive personal information was, or is reasonably believed to have\nbeen, acquired by an unauthorized person. The disclosure shall be made without\nunreasonable delay and in each case not later than the 60th day after the date on\nwhich the person determines that the breach occurred, except as provided by\nSubsection (d) or as necessary to determine the scope of the breach and restore the\nreasonable integrity of the data system.\n(b-1) If the individual whose sensitive personal information was or is reasonably\nbelieved to have been acquired by an unauthorized person is a resident of a state that\nrequires a person described by Subsection (b) to provide notice of a breach of system\nsecurity, the notice of the breach of system security required under Subsection (b) may\nbe provided under that state\'s law or under Subsection (b).\n(c) Any person who maintains computerized data that includes sensitive\npersonal information not owned by the person shall notify the owner or license holder of\nthe information of any breach of system security immediately after discovering the\nbreach, if the sensitive personal information was, or is reasonably believed to have been,\nacquired by an unauthorized person.\n(d) A person may delay providing notice as required by Subsection (b) or (c) at\nthe request of a law enforcement agency that determines that the notification will\nimpede a criminal investigation. The notification shall be made as soon as the law\nenforcement agency determines that the notification will not compromise the\ninvestigation.\n(e) A person may give notice as required by Subsection (b) or (c) by providing:\n(1) written notice at the last known address of the individual;\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n109\n\n(2) electronic notice, if the notice is provided in accordance with 15\nU.S.C. Section 7001; or\n(3) notice as provided by Subsection (f).\n(f) If the person required to give notice under Subsection (b) or (c)\ndemonstrates that the cost of providing notice would exceed $250,000, the number of\naffected persons exceeds 500,000, or the person does not have sufficient contact\ninformation, the notice may be given by:\n(1) electronic mail, if the person has electronic mail addresses for the\naffected persons;\n(2) conspicuous posting of the notice on the person\'s website; or\n(3) notice published in or broadcast on major statewide media.\n(g) Notwithstanding Subsection (e), a person who maintains the person\'s own\nnotification procedures as part of an information security policy for the treatment of\nsensitive personal information that complies with the timing requirements for notice under\nthis section complies with this section if the person notifies affected persons in\naccordance with that policy.\n(h) If a person is required by this section to notify at one time more than 10,000\npersons of a breach of system security, the person shall also notify each consumer\nreporting agency, as defined by 15 U.S.C. Section 1681a, that maintains files on\nconsumers on a nationwide basis, of the timing, distribution, and content of the notices.\nThe person shall provide the notice required by this subsection without unreasonable\ndelay.\n(i) A person who is required to disclose or provide notification of a breach of\nsystem security under this section shall notify the attorney general of that breach not later\nthan the 60th day after the date on which the person determines that the breach\noccurred if the breach involves at least 250 residents of this state. The notification under\nthis subsection must include:\n(1) a detailed description of the nature and circumstances of the\nbreach or the use of sensitive personal information acquired as a result of the breach;\n(2) the number of residents of this state affected by the breach at the\ntime of notification;\n(3) the measures taken by the person regarding the breach;\n(4) any measures the person intends to take regarding the breach after\nthe notification under this subsection; and\n(5) information regarding whether law enforcement is engaged in\ninvestigating the breach.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n110\n\nConsider these questions:\n\xe2\x80\xa2 How certain must the entity be that a breach occurred?\n\xe2\x80\xa2 Precisely how quickly must the disclosure be made as a default matter?\n\xe2\x80\xa2 How does Section 521.053(d) potentially change that timeline?\n\nThe Texas Attorney General is responsible for filing civil suits to enforce Section 521.053, but note\nthat a Section 521.053 violation may also constitute a deceptive act for purposes of a private civil\nsuit under the Texas Deceptive Trade Practices Act.\nAs you might imagine, the patchwork quilt of disclosure laws around the various states (as well as\nsome cities) has led some to argue for Congress to impose a uniform national approach.\n\n\xe2\x80\xa2\n\nWhat are the pros and cons of one national standard?\n\nDon\xe2\x80\x99t forget: Some companies will be subject to foreign jurisdictions as well, and these may be\nmore demanding than American disclosure requirements. The European Union\xe2\x80\x99s much discussed\n\xe2\x80\x9cGeneral Data Protection Regulation\xe2\x80\x9d (\xe2\x80\x9cGDPR\xe2\x80\x9d) is a particularly significant example you should\nbe aware of (though we are not studying its particular requirements in this class).\nE. Shareholder Derivative Actions\nRecall that in our generic scenario above, we noted the possibility that Company B has\nshareholders who might sue it, assuming share prices dropped once the breach became public.\nSuch \xe2\x80\x9cshareholder derivative actions\xe2\x80\x9d arise frequently with publicly traded companies when those\ncompanies experience any sort of significant reversal that might be attributed to bad decisionmaking by the company\xe2\x80\x99s officers or board of directors.\nF. Insurance\nIn any context in which entities and individuals can anticipate suffering a loss\xe2\x80\x94whether the loss\nbe from damage to possessions or a person, or from at least some forms of legal liability\xe2\x80\x94there is\na strong incentive to protect against the anticipated loss by purchasing an insurance policy.\nBecause insurers usually (though definitely not always) are at liberty to determine which sorts of\nrisks they will insure against, and subject to which conditions, the insurance industry in general is in\na powerful position to nudge or even compel certain behaviors (just think of the incentives for safe\ndriving that car insurance does or might generate). And thus, insurance has an important role to\nplay in relation to the general challenge of encouraging potential victims to engage in better\ndefense.\nFor a handy and accessible (and brief) introduction to the emerging cybersecurity insurance\nmarket, read this excerpt from this CEIP report, \xe2\x80\x9cAddressing the Private Sector Cybersecurity\nPredicament: The Indispensable Role of Insurance\xe2\x80\x9d (Nov. 2018), by Ariel Levite, Scott Kannry, and\nWyatt Hoffman:\nThe private sector is struggling to contend with the growing scope, scale, and complexity of\ncyber risks to corporations\xe2\x80\x99 finances, reputation, and even property. These risks cut across\nmultiple areas of business operations and permeate relationships with suppliers, customers, and\nthird parties. Most governments are by now aware that cyber threats can severely damage and\ndisrupt their economies and infrastructure, and many invest significant effort and resources to\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n111\n\nconfront this danger. Yet virtually all face serious bandwidth limitations in addressing cyber\nthreats to private entities. Concerns over potential escalation or blowback if they pursue or\nretaliate against foreign hackers, including potential states or proxies, further dampen\ngovernments\xe2\x80\x99 enthusiasm for defending the private sector. Furthermore, those governments that\nseek to address private sector cyber vulnerabilities face serious pushback against onerous\nregulations and reservations about creating a moral hazard if they assume responsibility for\nprotecting the private sector. These reasons and others have made a governmental solution to\nthis worsening private sector predicament unsatisfactory\xe2\x80\x94a situation that is unlikely to\nfundamentally change for the foreseeable future.\nFaced with this sobering reality, the more resourceful and sophisticated private sector entities\nare scaling up their own efforts to address cyber threats. In addition to a range of security\nmeasures, many have turned increasingly to the risk challenging mechanism offered by cyber\ninsurance policies. Yet the cyber insurance coverage presently available provides only a limited,\nuncertain, and ad hoc solution. The insurance industry harbors far greater potential to address\nthe cybersecurity challenge. Historically, insurance has played a crucial role in understanding,\nmanaging, and mitigating the risks arising from emerging domains of human activity, particularly\nin the context of evolving technologies. This holds true for cyberspace, where insurance has the\npotential to assume a more fundamental role in reshaping the risk landscape. While this\npotential has largely gone unexplored, its historical track record in other domains suggests that\nthe insurance industry could perform six core cyber risk mitigation functions: (1) engineering risks,\n(2) channeling corporate risk, (3) managing systemic risks, (4) harnessing collective security\ninsights, (5) shaping broader risk trends, and (6) harmonizing risk-related standards and practices\ninternationally.\nThe current state of cyber insurance remains far from the ideal role envisioned here. This paper\nanalyzes the range of barriers that stand in the way of a properly functioning cyber insurance\nmarket\xe2\x80\x94including practical, technical, operational, and strategic challenges, within and\noutside the insurance industry\xe2\x80\x94and explores a series of individual and complementary efforts by\nthe insurance industry, governments, vendors of information and communications technologies\n(ICTs), and other key stakeholders in the private sector toward realizing the full potential of\ninsurance to reshape the risk environment. Cyber insurance will ultimately be indispensable in a\nbroader solution to the escalating cyber risk challenge. Harnessing its full potential will be\nimperative not only for managing corporate cyber risks, but for preventing potential systemic\ncyber incidents of growing concern for governments and the private sector alike.\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\nSome say that insurance companies are the key to systematically improving\ncybersecurity defenses. How so?\nWhat obstacles appear to lie in the way of that ambition?\n\nG. Contract Terms\nWhen an insurer insists upon certain cybersecurity-related measures as a condition of coverage,\nthat is an example of using contact leverage. But insurers are by no means the only ones who\nmight choose to use that leverage for this purpose. In fact, private sector actors increasingly often\ninsist upon certain steps as a contract condition, particularly in contexts involving professional\nservices (e.g., with law firms) or supply chains. While flowing from disaggregated individual selfinterest rather than top-down government policy, this phenomenon has considerable potential to\ngenerate systematic improvements in the overall level of cybersecurity preparedness.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n112\n\nThat said, there are times when the government itself can use contract leverage toward this same\nend\xe2\x80\x94that is, not just to protect itself (we\xe2\x80\x99ll see that later, when we reach the subunit on\ngovernment efforts to improve its own defenses) but also to have a larger pro-defense effect.\nHere\xe2\x80\x99s an example from 2018 involving an attempt by the government to leverage contracting\npower to keep certain private entities from using the antivirus products and other services of\nKaspersky Lab (a Russia-based AV vendor that once had a substantial share of the US market, and\nstill has a large global presence):\nThe government is seeking to eliminate all traces of cybersecurity firm Kaspersky Labs\nfrom federal systems, issuing a new interim rule in the June 15 Federal Register to extend\nthe governmentwide ban to contractors.\nThe rule, issued by the General Services Administration, the Department of Defense and\nthe National Aeronautics and Space Administration, amends the Federal Acquisition\nRegulation to require that all contracts and solicitations finalized after July 16, 2018,\ninclude language prohibiting the presence of Kaspersky hardware, software and\nproducts.\nThe rule applies not just to federal contracts but also smaller "micro" purchases and the\npurchase of commercial off the shelf items, which are often exempt from many\ncontracting regulations. The notice states that the interim rule was issued without prior\nopportunity for public comment due to "urgent and compelling reasons."\n"While the law does not specifically address acquisitions of commercial items, including\nCOTS items, there is an unacceptable level of risk for the Government in buying\nhardware, software, or services developed or provided in whole or in part by Kaspersky\nLab," the notice reads. "This level of risk is not alleviated by the fact that the item being\nacquired has been sold or offered for sale to the general public\xe2\x80\xa6nor by the small size of\nthe purchase."\nThe Department of Homeland Security and Congress both took steps last year to ban\nfederal agencies from using of Kaspersky software and products. But it has always\nbeen less clear to what extent those restrictions might apply to contractors, and whether\nsuch prohibitions would extend only to government-supporting systems or throughout\ncontractors\' entire networks.\nThe new rule not only prohibits contractors from using Kaspersky products and services in\nfederal systems, but they must also report discovery of such products and services\ndiscovered during the performance of contract work. The ban extends down to\nsubcontractors.\nShortly after DHS issued its ban, Michael Duffy, branch chief for the DHS Office of\nCybersecurity, told reporters that when it came to contractors, the department was\nreferring to Circular A-130 guidance and indicated that it would be left up to individual\nagencies to manage their own risk in the contracting space.\n"What we\'ve tried to do is have agencies determine the risk themselves, versus us driving\nall that action," Duffy said.\nHowever, Secretary of Homeland Security Kirstjen Nielsen told Congress in May that\nsubsequent investigation revealed many contractors were not even aware they had\nKaspersky software embedded on their systems. Nielsen said her department was\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n113\n\nexploring ways to allow for the suspension of contracts from vendors who relied on the\ncompany\'s code or products.\n"It has to be that we can pause and turn off contracts the moment we have a concern,"\nNielsen said. "If someone\'s been hacked, if someone is vulnerable or someone is using\nsoftware that we know will put us at risk."\nThe move is the latest blow to Kaspersky Labs, after a pair of lawsuits challenging the\ngovernment ban were dismissed in U.S. court and the European Union passed a\nmotion calling for a similar ban throughout its institutions, saying the company\'s products\nare "confirmed as malicious."\nFor its part, the company and its founder Eugene Kaspersky have consistently denied any\ninvolvement or assistance with Russian espionage. In an attempt to allay concerns about\ncustomer data flowing to Russian servers, the company has started a transparency\ninitiative and announced it was opening up a new data center in Switzerland.\nKaspersky Labs is suspected of wittingly or unwittingly facilitating Russian espionage, but\nthus far virtually all the evidence demonstrating that threat -- such as the theft of\nclassified files from an National Security Agency contractor\'s home computer -- have\ncome from media reports. The federal government has declined to confirm or deny\nthose reports. In court filings, government lawyers and DHS officials have claimed\nthe potential threat alone posed by Kaspersky Labs software and hardware is enough to\njustify the ban on national security grounds.\nThat has led other cybersecurity vendors, such as Dragos CEO Robert M. Lee and\nRendition Infosec founder Jake Williams, to call on the government to release more\ninformation about its case against the company. Earlier this week, former CIA Director\nMichael Hayden told CyberScoop that he hopes the government has "a case rather\nthan a concern" against Kaspersky, because otherwise the move could lead to\nretaliation against U.S. products and companies.\n\nCan you identify limits to the utility of this approach, based on this example? What are the\npros and cons?\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n114\n\n15. Facilitating Better Defense through Information Sharing (I)\n\nLearning Objectives\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\nUnderstand that information sharing is a critical consideration for many security challenges,\nwith the relevant information ranging from highly-technical data that may be critical for\ndefense in specific instances to highly-generic intelligence about threat actor intentions\nBe able to distinguish \xe2\x80\x9ccyber threat intelligence\xe2\x80\x9d and \xe2\x80\x9cindicators of compromise\xe2\x80\x9d\nBe able to explain why private actors might be reluctant to share information with each other,\nwhy government entities might be reluctant to do the same, and why the same also might be\ntrue as between the public and private sectors\nUnderstand the \xe2\x80\x9cproprietary model\xe2\x80\x9d of information sharing: there is a vast universe of private\ncompanies that sell products and services relating to cybersecurity (we\xe2\x80\x99ll call them vendors),\nand understand that information-sharing (from the vendor to the client) often is an essential\nelement of those relationships\nBearing this in mind, be able to explain why a vendor ever would \xe2\x80\x9cgo public\xe2\x80\x9d with an\nannouncement revealing important cyber threat intelligence (hint: consider factors including\nefforts to convince customers of the threat and of the skills of the vendor, but also ponder how\nit would look if society writ large suffered significant harms as a result of some exploit that was\nknown to a specific vendor but not shared with others).\nUnderstand what Virus Total does, and appreciate that it is providing an important informationpooling service for the public without a government having to create or compel such a\ncapability\nAppreciate why private companies that could compete with each other in terms of having\nunique access to threat intelligence would instead share that information with each other,\ncompeting on other grounds instead\nUnderstand how Cyber Command\xe2\x80\x99s disclosure of Russian government malware, via VT,\nconstitutes both (i) promotion of defense via information-sharing and (ii) affirmative disruption\nof adversary capabilities\nAppreciate that in any defense-oriented disclosure setting, the first step generally is to disclose\nprivately to the relevant vendor (in order that they might mitigate the problem before it\nbecomes public). Public disclosure is a second step, carried out either to force the vendor to\nact or, if the vendor has now acted, to spread awareness of a threat (and, hopefully, the\nmitigation for that threat).\nUnderstand how Project Zero and Zero Day Initiative differ from VT, and from each other\nBe able to articulate the difference between Project Zero and the \xe2\x80\x9cinsecurity industry,\xe2\x80\x9d and\nthe arguments for and against the latter\nBe able to explain the utility of MITRE\xe2\x80\x99s \xe2\x80\x9cATT&CK\xe2\x80\x9d typology\nBe able to explain the utility of MITRE\xe2\x80\x99s \xe2\x80\x9cCommon Vulnerabilities and Exposures\xe2\x80\x9d (CVE)\ndatabase\nBe able to explain the utility of \xe2\x80\x9cISACs,\xe2\x80\x9d \xe2\x80\x9cISAOs,\xe2\x80\x9d and the Cyber Threat Alliance\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n115\n\nConsider for a moment the idea of \xe2\x80\x9cpublic health\xe2\x80\x9d policy\xe2\x80\x94that is, the important set of goals\nassociated with minimizing and mitigating disease and injury on a systematic basis. As with\ncybersecurity, a wide variety of both public and private actors seek to promote public health.\nAnd as with cybersecurity, those actors employ many different tools. Some of these tools are\nfamiliar to us from the cybersecurity setting, in fact; regulations, for example, play a key role in\npromoting public health. And so, we might take the comparison a bit further, using the familiar\npublic-health model as a way to appreciate another parallel with cybersecurity policy: facilitation\nof information-sharing as a means to promote safety.\nSome amount of information-sharing will occur without external interventions by public or privatesector actors, of course. But the \xe2\x80\x9cnatural\xe2\x80\x9d level of such sharing may be suboptimal (too limited,\ntoo slow, too confusing, too inaccurate, etc.) for any number of reasons. And if that is the case,\nthen there is an argument for someone to take steps to improve things from that baseline level. In\nthe public-health setting, we find governmental and international entities like the Centers for\nDisease Control and the World Health Organization which do this sort of thing, as well as an array\nof private sector actors (including both non-profit and for-profit entities). In various ways, these\nactors develop, curate, and disseminate a wide array of useful information, ranging from highly\ntechnical information to \xe2\x80\x9cbest practices\xe2\x80\x9d and procedures.\nSo too with cybersecurity. That is, an important part of cybersecurity policy is the facilitation of\ninformation-sharing intended to facilitate and promote defense. Our goal in the next two classes\nis to become better acquainted with some of the key information-sharing actors and activities,\nand then to examine an important piece of legislation that attempts to prune away legal\ndisincentives to information sharing.\nA. What Information Might We Want to Share?\nThere are many possibilities. Let\xe2\x80\x99s start with the sharing of \xe2\x80\x9cthreat intelligence.\xe2\x80\x9d Note that this is a\nterm of convenience (the meaning of which can vary from audience to audience) rather than a\nterm of art (with a well-settled meaning and scope). That caveat aside, what is the general idea?\nFor starters, threat intelligence includes \xe2\x80\x9cIndicators of Compromise\xe2\x80\x9d (aka \xe2\x80\x9cIOCs\xe2\x80\x9d). This is a\nshorthand for the idea that there are technical signatures and other objective indicia that might\nbe useful as a basis for detecting unauthorized activity in a system. This could be, for example, a\nsignature element of an exploit, the fact that a system has a particularly important vuln, the URL\nof a known botnet command-and-control server, and so forth; the common idea is that the\ninformation is something one can search for in a scalable way, and that it is correlated with\nmalicious activity.\nFor at least some people, threat intelligence has a broader scope than just IOCs. That is, the\nphrase might also encompass all sorts of additional, useful information, some of it technical (for\nexample, details about a newly discovered vulnerability or newly circulated patch) and some of\nit otherwise (for example, information about the capabilities, motives, intentions, or characteristic\ntactics, techniques, and procedures of potentially hostile entities or individuals).\n\nBe prepared to identify and distinguish these categories, and to explain why sharing\ninformation of each kind can be helpful for improving defense.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n116\n\nThreat intelligence is not the only relevant category of information we might hope to spread as a\nmeans to boost cybersecurity on a widespread basis. We might also want to spread knowledge\nof what we might call \xe2\x80\x9ceffective practices\xe2\x80\x9d or \xe2\x80\x9cbest practices.\xe2\x80\x9d\nThe idea here is straightforward: we want as many individuals and organizations as possible to at\nleast be aware of optimal policies, practices, techniques, or procedures, just as we do in the\npublic-health setting (just think of the efforts made to encourage people to wash their hands,\ncover their sneezes, get flu shots, quit smoking, etc.). Sometimes we go further, of course, actually\ncompelling adoption of such practices (just think of the FTC\xe2\x80\x99s current attempt to revise the G-L-B\nAct Safeguards Rule in order to require, among other things, the use of multi-factor authentication\nin some circumstances). But here we are talking about the less intrusive step of simply increasing\nthe chance that someone will adopt such measures voluntarily.\nThis raises a question: If a practice is desirable, why not always go with mandatory rules rather\nthan merely helpful advisories? First, sometimes the case for mandating use of a particular\nmeasure just isn\xe2\x80\x99t clear, as when the measure entails offsetting costs that might in some cases\noutweigh the benefits. In such circumstances, promoting awareness of the measure helps\nindividuals and organizations make their own judgment about that cost-benefit tradeoff.\nSecond, even if the measure might be worthy of a mandate, there may be any number of reasons\nwhy it is not currently possible to get Congress or a relevant agency to take that particular step.\nMerely sharing information about the measure normally will not require anything like the same\ndegree of political will. Indeed, as we will see below, it may not require government intervention\nat all.\n\nBe able to explain how mandatory rules and informational advisories relate to each other,\nand why the former is generally more difficult to employ than the latter.\nB. Why is Information-Sharing Difficult, in Theory?\nInformation-sharing can be conducted on a government-to-government, government-to-private,\nprivate-to-government, and private-to-private basis. Each dynamic presents its own challenges,\ngiving rise to the possibility that we might not get sufficient sharing, on a systematic basis, without\ninterventions.\n\nConsider these questions:\n\xe2\x80\xa2 Why might one government entity be reluctant to share information with another?\n\xe2\x80\xa2 Why might the government be reluctant to share with the private sector?\n\xe2\x80\xa2 Why might the private sector be reluctant to share with the government?\n\xe2\x80\xa2 Why might one private sector entity resist sharing with another?\n\xe2\x80\xa2 Do your answers depend on which type of information is at issue?\n\nC. Key Information-Sharing Institutions\nLet\xe2\x80\x99s now have a look at some of the institutions and systems involved in promoting informationsharing relating to cybersecurity. What follows below is not meant to be comprehensive, by any\nstretch. That said, this selective survey will give you a feel for some of the key systems and\ninstitutional players, while underscoring that much of the work under this heading is carried out\nthrough the private sector.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n117\n\nSecurity Vendors:\nWe will start by observing that there is a large and dynamic \xe2\x80\x9csecurity vendor\xe2\x80\x9d community\nconsisting of an array of for-profit businesses that provide various cybersecurity-related products\nand services. Of course, one must pay to get the benefits of these products and services in most\ncircumstances, so most of the security benefits that vendors provide do not properly qualify for\ndiscussion under the heading of information-sharing. But vendors frequently do provide certain\nsecurity-related information on a free and open basis, as when companies publish special\n\xe2\x80\x9creports\xe2\x80\x9d identifying newly discovered malware campaigns.\n\nCan you explain why a for-profit enterprise would publish such a report?\n\nVirusTotal:\nVirusTotal is a company founded in Spain in 2004, later acquired by Google, and now operated\nby Chronicle (a fellow subsidiary of Google\xe2\x80\x99s parent entity, Alphabet). The basic idea is simple:\nVirusTotal aggregates the capabilities of a large number of antivirus and URL/domain blacklisting\ncompanies, and provides a user-friendly way to check files against the sum of their capabilities.\nThe value proposition for users is obvious enough, but what\xe2\x80\x99s in it for all those companies? Well,\nthey get to see the results too, and thus can improve their own individual capabilities. It would\nnot work if all those companies still competed (as they used to) primarily on the basis of having\nexclusive, propriety databases of threat indicators, but these days the bigger companies mostly\nembrace a model of open sharing of such information while competing based on other\nconsiderations. That\xe2\x80\x99s a big win for the public at large, and VirusTotal is a notable mechanism for\ntransmitting the resulting benefits in a user-friendly way.\n\nCan you describe how this shift is analogous to public health and pharmaceuticals?\nFor a more detailed explanation of what one can do with VirusTotal, and how the communitygood model of information-sharing about threat indicators can be used as an instrument of\nstatecraft, read the following excerpt from a 2018 article at Motherboard:\nThis week, US Cyber Command (CYBERCOM), a part of the military tasked with\nhacking and\ncybersecurity\nfocused\nmissions,\nstarted\npublicly\nreleasing\nunclassified samples of adversaries\xe2\x80\x99 malware it has discovered. CYBERCOM says the move\nis to improve information sharing among the cybersecurity community, but in some ways\nit could be seen as a signal to those who hack US systems: we may release your tools to\nthe wider world. \xe2\x80\x9cThis is intended to be an enduring and ongoing information sharing effort,\nand it is not focused on any particular adversary,\xe2\x80\x9d Joseph R. Holstead, acting director of\npublic affairs at CYBERCOM told Motherboard in an email.\nOn Friday, CYBERCOM uploaded multiple files to VirusTotal, a Chronicle-owned search\nengine and repository for malware. Once uploaded, VirusTotal users can download the\nmalware, see which anti-virus or cybersecurity products likely detect it, and see links to\nother pieces of malicious code. One of the two samples CYBERCOM distributed on Friday\nis marked as coming from APT28, a Russian government-linked hacking group\xe2\x80\xa6also known\nas \xe2\x80\xa6 Fancy Bear. \xe2\x80\xa6CYBERCOM announced its new initiative on Monday, and uploaded\nits first two samples on the same day.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n118\n\nWhat do you make of CYBERCOM\xe2\x80\x99s decision to burn Russian tools via VirusTotal?\nProject Zero:\nProject Zero is part of Google. Here is a recent account, again from Motherboard:\nEver since Project Zero was announced in 2014, these hackers have taken apart software\nused by millions of people\xe2\x80\x94and predominantly written by other company\xe2\x80\x99s engineers\xe2\x80\x94\nwith a mission to \xe2\x80\x9cmake zero-day hard.\xe2\x80\x9d \xe2\x80\xa6\nIn five years, Project Zero researchers have helped find and fix more than 1,500\nvulnerabilities in some of the world\xe2\x80\x99s most popular software, according Project Zero\xe2\x80\x99s own\ntally. In Apple products, Beer and his colleagues have found more than 300 bugs; in\nMicrosoft\xe2\x80\x99s products they found more than 500; in Adobe\'s Flash, they found more than\n200. Project Zero has also found critical issues in CloudFlare, several antivirus apps,\nand chat apps such as WhatsApp and FaceTime. A Project Zero researcher was also part\nof the group who found the infamous Spectre and Meltdown flaws in Intel chips.\nThese numbers show Project Zero has had a massive impact on the security of devices,\noperating systems, and applications used by millions of people every day.\nFor Google, these disclosures give the internet giant good publicity by showing how much\nthe company cares for the security of not just its users\xe2\x80\x94but everyone else too. In\nassembling one of the most elite hacking teams on the planet, Google is messaging to its\ncustomers that it takes security very seriously. Along the way, Google has given itself an\nexcuse to probe its competitors products and software, doubtlessly learning from others\'\nsecurity mistakes. Project Zero has been able to poke holes in the bulletproof mystique of\nthe iPhone\'s security, which is widely believed to be the hardest consumer device to hack.\nIn doing so, Google is able to insert itself into conversations it might not otherwise be a part\nof.\nRegardless of Project Zero\'s true mission, there\xe2\x80\x99s no doubt that the team has had a\nprofound influence on the cybersecurity industry in the last five years.\n\xe2\x80\x9cWithout this level of technical detail in the public eye, defenders don\'t stand a chance.\xe2\x80\x9d\nFor one, Project Zero has normalized something that years ago was more controversial: a\nstrict 90-day deadline for companies that receive its bug reports to patch the\nvulnerabilities. If they don\'t patch in that time frame, Google drops the bugs itself.\nMicrosoft, in particular, was not a fan of this policy at the beginning. Today, most\ncompanies that interact with Project Zero respect that 90-day deadline as an industry\nstandard, a tidal change in the always controversial debate on the so-called \xe2\x80\x9cresponsible\ndisclosure\xe2\x80\x9d\xe2\x80\x94the idea that security researchers who find vulnerabilities should first disclose\nthem to the affected company, so that it can fix them before the bugs are exploited by\nhackers. According to its own tally, around 95 percent of bugs reported by Project Zero\nget patched within that deadline.\n\xe2\x80\x9cPeople looked at the way the wind was blowing and then decided that\xe2\x80\x94maybe just\nmaybe\xe2\x80\x94 instead of creating a fuss, creating a fix within 90 days was just easier,\xe2\x80\x9d said Chris\nEvans, Project Zero\xe2\x80\x99s original team leader.\nBut perhaps no accolade is more significant than how much people on the other side of\nProject Zero\xe2\x80\x99s fence, whom Evans would call the \xe2\x80\x9cinsecurity industry,\xe2\x80\x9d hate the Google\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n119\n\nhackers. This \xe2\x80\x9cinsecurity industry\xe2\x80\x9d is made of companies like Azimuth Security and NSO\nGroup, government contractors whose job is to find bugs and write exploits. But, instead\nof reporting the vulnerabilities to the companies who own the software, these companies\nsell them to governments who turn them into tools to hack and surveil targets.\n\xe2\x80\x9cFuck those guys,\xe2\x80\x9d said a researcher who works for a company that does offensive security,\nreferring to Project Zero. \xe2\x80\x9cThey don\xe2\x80\x99t make the world safer.\xe2\x80\x9d\nThe researcher, who spoke on condition of anonymity because they are not allowed to\ntalk to the press, said that zero-day vulnerabilities are sometimes used to go after terrorists\nor dangerous criminals. So when Project Zero kills those bugs, it may be killing tools used by\nintelligence agencies to go after the bad guys, according to the researcher.\n\nConsider these questions:\n\xe2\x80\xa2 Can you explain how this activity differs from VirusTotal?\n\xe2\x80\xa2 What are the pros and cons of this model?\n\nAlso check out Zero-Day Initiative here:\nThe Zero Day Initiative (ZDI) was created to encourage the reporting of 0-day\nvulnerabilities privately to the affected vendors by financially rewarding researchers. At\nthe time, there was a perception by some in the information security industry that those\nwho find vulnerabilities are malicious hackers looking to do harm. Some still feel that way.\nWhile skilled, malicious attackers do exist, they remain a small minority of the total\nnumber of people who actually discover new flaws in software.\nIncorporating the global community of independent researchers also augments our\ninternal research organizations with the additional zero-day research and exploit\nintelligence. This approach coalesced with the formation of the ZDI, launched on July 25,\n2005. The main goals of the ZDI are to:\n\xe2\x80\xa6 Encourage the responsible reporting of zero-day vulnerabilities through financial\nincentives.\n\xe2\x80\xa6\nToday, the ZDI represents the world\xe2\x80\x99s largest vendor-agnostic bug bounty program. Our\napproach to the acquisition of vulnerability information is different than other programs.\nNo technical details concerning the vulnerability are sent out publicly until the vendor\nhas released a patch.\nWe do not resell or redistribute the vulnerabilities that are acquired through the ZDI.\nSubmitting through the ZDI program also relieves you from the burden of tracking the bug\nwith the vendor. We make every effort to work with vendors to ensure they understand\nthe technical details and severity of a reported security flaw, which leaves researchers\nfree to go find other bugs. We will let you know where things stand with all of your own\ncurrent cases with regards to vendor disclosure. In no cases will an acquired vulnerability\nbe "kept quiet" because a product vendor does not wish to address it.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n120\n\nInterested researchers provide us with exclusive information about previously un-patched\nvulnerabilities they have discovered. The ZDI then collects background information in\norder to validate the identity of the researcher strictly for ethical and financial oversight.\nOur internal researchers and analysts validate the issue in our security labs and make a\nmonetary offer to the researcher. If the researcher accepts the offer, a payment will be\npromptly made. As a researcher discovers and provides additional vulnerability research,\nbonuses and rewards can increase through a loyalty program similar to a frequent flier\nprogram.\nAfter an agreement has been reached for the acquisition of a researcher\'s bug report,\nprotection filters for Trend Micro customers are developed and deployed.\nSimultaneously, the ZDI notifies the affected vendor so that they can develop a\nvulnerability patch. The ZDI discloses any and all acquired vulnerabilities to product\nvendors in accordance with our disclosure policy. This disclosure policy ensures that both\nresearchers and product vendors understand how ZDI handles vulnerability information.\nThis policy further reassures researchers that in no case will any of their discoveries be\n"swept under the rug". It also reassures product vendors that there is a professional and\nstandard set of guidelines they can expect to be utilized throughout the disclosure\nprocess.\nOnce a patch is ready from the affected vendor, the ZDI works collaboratively with the\nvendor to notify the public of the vulnerability through a joint advisory that provides full\ncredit to the originating researcher, unless the researcher chooses to remain anonymous.\nBefore public disclosure of the vulnerability, we may choose to share technical details of\nthe vulnerability with other security vendors so they too may prepare an appropriate\nsecurity response for their customers. This practice allows us to facilitating the protection\nof a customer base larger than our own.\nIn order to maintain the secrecy of a researcher\'s vulnerability discovery until a product\nvendor can develop a patch, Trend Micro customers are only given a generic\ndescription of the filter provided, not the vulnerability itself. Once details are made public\nin coordination with the product vendor, an updated description is made public so our\ncustomers can identify the appropriate filters that were protecting them. In other words,\nwhile our customers will be protected from the vulnerability in advance, they will not be\nable to discern the vulnerability itself.\n\xe2\x80\xa6\nThis policy outlines how the Zero Day Initiative (ZDI) handles responsible vulnerability\ndisclosure to product vendors, Trend Micro customers, security vendors and the general\npublic. ZDI will responsibly and promptly notify the appropriate product vendor of a\nsecurity flaw with their product(s) or service(s). The first attempt at contact will be through\nany appropriate contacts or formal mechanisms listed on the vendor Web site, or by\nsending an e-mail to security@, support@, info@, and secure@company.com with the\npertinent information about the vulnerability. Simultaneous to the vendor notification,\nprotection filters may be distributed to Trend Micro customers through approved\nchannels.\nIf a vendor fails to acknowledge ZDI initial notification within five business days, ZDI will\nattempt a second formal contact by a direct telephone call to a representative for that\nvendor. If a vendor fails to respond after an additional five business days following the\nsecond notification, ZDI may rely on an intermediary to try to establish contact with the\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n121\n\nvendor. If ZDI exhausts all reasonable means in order to contact a vendor, then ZDI may\nissue a public advisory disclosing its findings fifteen business days after the initial contact.\nIf a vendor response is received within the timeframe outlined above, ZDI will allow the\nvendor 4-months (120 days) to address the vulnerability with a security patch or other\ncorrective measure as appropriate. At the end of the deadline, if a vendor is not\nresponsive or unable to provide a reasonable statement as to why the vulnerability is not\nfixed, the ZDI will publish a limited advisory including mitigation in an effort to enable the\ndefensive community to protect the user. We believe that by taking these actions, the\nvendor will understand the responsibility they have to their customers and will react\nappropriately. Extensions to the 120-day disclosure timeline will not be granted.\nIf a product vendor is unable to, or chooses not to, patch a particular security flaw, ZDI\nwill offer to work with that vendor to publicly disclose the flaw with some effective\nworkarounds. In no cases will an acquired vulnerability be \xe2\x80\x9ckept quiet\xe2\x80\x9d because a\nproduct vendor does not wish to address it. To maintain transparency into our process,\nwe plan on publishing a summary of the communication we\'ve had with the vendor\nregarding the issue. We hope that this level of insight into our process will allow the\ncommunity to better understand some of the difficulties vendors have when remediating\nhigh-impact bugs. ZDI will make every effort to work with vendors to ensure they\nunderstand the technical details and severity of a reported security flaw.\nZDI will formally and publicly release its security advisories on our Web site. Only advisories\nlisted on the website should be considered official ZDI advisories.\n\n\xe2\x80\xa2\n\nHow does ZDI differ from the other programs we\xe2\x80\x99ve examined?\n\nThe MITRE ATT&CK Matrix:\nNow for something different. The MITRE Corporation is a large non-profit research enterprise that\nhouses a variety of federally funded research and development centers (FFRDCs). Put simply: it\xe2\x80\x99s\na research institute that carries out government-funded projects. Among many other things, MITRE\nhas an array of cybersecurity-related programs. One of these\xe2\x80\x94known as the ATT&CK Matrix\xe2\x80\x94has\ngained a remarkable following in recent years, and increasingly is used as a common touchstone\nfor understanding\xe2\x80\x94and having a common way to talk about\xe2\x80\x94the full spectrum of activities in\nwhich a malicious actor might engage. Read this excerpt from this account:\nMITRE started ATT&CK in 2013 to document common tactics, techniques, and procedures\n(TTPs) that advanced persistent threats use against Windows enterprise networks. ATT&CK\nwas created out of a need to document adversary behaviors for use within a MITRE\nresearch project called FMX. FMX\xe2\x80\x99s objective was to investigate use of endpoint telemetry\ndata and analytics to improve post-compromise detection of adversaries operating\nwithin enterprise networks. Much of that work is documented here: Finding Threats with\nATT&CK-based Analytics and the Cyber Analytics Repository.\nBased on our research, we decided we needed a framework to address four main issues:\n1. Adversary behaviors. Focusing on adversary tactics and techniques allowed\nus to develop analytics to detect possible adversary behaviors. Typical\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n122\n\nindicators such as domains, IP addresses, file hashes, registry keys, etc. were\neasily changed by adversaries and were only useful for point in time\ndetection \xe2\x80\x94 they didn\xe2\x80\x99t represent how adversaries interact with systems, only\nthat they likely interacted at some time.\n2. Lifecycle models that didn\xe2\x80\x99t fit. Existing adversary lifecycle and Cyber Kill\nChain concepts were too high-level to relate behaviors to defenses \xe2\x80\x94 the\nlevel of abstraction wasn\xe2\x80\x99t useful to map TTPs to new types of sensors.\n3. Applicability to real environments. TTPs need to be based on observed\nincidents to show the work is applicable to real environments.\n4. Common taxonomy. TTPs need to be comparable across different types of\nadversary groups using the same terminology.\nWe strongly believe that offense is the best driver for defense. An organization\xe2\x80\x99s ability to\ndetect and stop an intrusion improves greatly by maintaining strong offense and defense\nteams that work together. Within FMX, ATT&CK was the framework used to build adversary\nemulation scenarios. The emulation team used these scenarios to inject real-world inspired\nactivity into the network. Then the team used the tests to verify that the sensors and\nanalytics were working to detect adversarial behavior within a production network. The\napproach resulted in a rapid improvement in detection capability, and, most importantly,\nin a measured and repeatable way.\nATT&CK became the go-to tool both for the adversary emulation team to plan events\nand for the detection team to verify their progress. This was such a useful process for\nMITRE\xe2\x80\x99s research program that we felt it should be released to benefit the entire\ncommunity, so MITRE released ATT&CK to the public in May 2015. ATT&CK has since\nexpanded significantly to incorporate techniques used against macOS and Linux,\nbehaviors used by adversaries against mobile devices, and adversary strategies for\nplanning and conducting operations pre-exploit.\n\nWhat is ATT&CK?\nATT&CK is largely a knowledge base of adversarial techniques \xe2\x80\x94 a breakdown and\nclassification of offensively oriented actions that can be used against particular platforms,\nsuch as Windows. Unlike prior work in this area, the focus isn\xe2\x80\x99t on the tools and malware\nthat adversaries use but on how they interact with systems during an operation.\nATT&CK organizes these techniques into a set of tactics to help explain to provide context\nfor the technique. Each technique includes information that\xe2\x80\x99s relevant to both a red team\nor penetration tester for understanding the nature of how a technique works and also to a\ndefender for understanding the context surrounding events or artifacts generated by a\ntechnique in use.\nTactics represent the \xe2\x80\x9cwhy\xe2\x80\x9d of an ATT&CK technique. The tactic is the adversary\xe2\x80\x99s tactical\nobjective for performing an action. Tactics serve as useful contextual categories for\nindividual techniques and cover standard, higher-level notations for things adversaries do\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n123\n\nduring an operation, such as persist, discover information, move laterally, execute files,\nand exfiltrate data.\nTechniques represent \xe2\x80\x9chow\xe2\x80\x9d an adversary achieves a tactical objective by performing an\naction. For example, an adversary may dump credentials to gain access to useful\ncredentials within a network that can be used later for lateral movement. Techniques may\nalso represent \xe2\x80\x9cwhat\xe2\x80\x9d an adversary gains by performing an action. This is a useful\ndistinction for the Discovery tactic as the techniques highlight what type of information an\nadversary is after with a particular action. There may be many ways, or techniques, to\nachieve tactical objectives, so there are multiple techniques in each tactic category.\n\nThe ATT&CK\xe2\x84\xa2 Matrix\nThe relationship between tactics and techniques can be visualized in the ATT&CK Matrix.\nFor example, under the tactic Persistence (this is the adversary\xe2\x80\x99s goal \xe2\x80\x94 to persist in the\ntarget environment), there are a series of techniques including AppInit DLLs, New\nServiceand Scheduled Task. Each of these is a single technique that adversaries may use\nto achieve the goal of persistence.\n\nThe ATT&CK Matrix is probably the most widely recognizable aspect of ATT&CK because\nit\xe2\x80\x99s commonly used to show things like defensive coverage of an environment, detection\ncapabilities in security products, and results of an incident or red team engagement.\n\nCyber Threat Intelligence\nAnother important aspect of ATT&CK is how it integrates cyber threat intelligence (CTI).\nUnlike previous ways of digesting CTI that were used primarily for indicators, ATT&CK\ndocuments adversary group behavior profiles, such as APT29, based on publicly available\nreporting to show which groups use what techniques.\nUsually, individual reports are used to document one particular incident or group, but this\nmakes it difficult to compare what happened across incidents or groups and come to a\nconclusion on what types of defenses were most effective. With ATT&CK, analysts can\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n124\n\nlook across groups of activity by focusing on the technique itself. When deciding how to\nfocus defensive resources, analysts might want to start with techniques that have the\nhighest group usage.\nExamples of how particular adversaries use techniques are documented in its ATT&CK\npage, which represents that group\xe2\x80\x99s procedure for using the technique. The procedure is\na particular instance of use and can be very useful for understanding exactly how the\ntechnique is used and for replication of an incident with adversary emulation and for\nspecifics on how to detect that instance in use.\n\nWhere ATT&CK is Today\nATT&CK has expanded quite significantly over the past five years, from Windows to other\nplatforms and technologies. It\xe2\x80\x99s in use by many different government organizations and\nindustry sectors, including financial, healthcare, retail, and technology. The public\nadoption and use has led to significant contributions back to ATT&CK to keep it up-todate and useful for the community. We want to continue this trend, so MITRE has big\nplans to keep growing ATT&CK to ensure its future as a valuable public resource.\n\nConsider these questions:\n\xe2\x80\xa2 After perusing the site, can you sum up the role that the ATT&CK Matrix plays?\n\xe2\x80\xa2 Does this properly count as part of the information-sharing ecosystem?\n\nCyber Threat Alliance:\nCTA shows us another model, one that might be described as a hybrid between the full\ncommunity-good model of VirusTotal and the proprietary model associated with private sector\nsecurity vendors. Here is how CTA sums up its origin and core function:\nWe were founded in 2014 through an informal agreement to share intelligence among\nFortinet, McAfee, Palo Alto Networks, and Symantec. They called this arrangement the\nCyber Threat Alliance, but CTA had no dedicated staff nor any legal paperwork. In 2015,\nthe companies developed a white paper on the Cryptowall Crimeware. The paper\ngarnered a lot of attention and showed the value of collaboration among the\ncybersecurity community.\nAt this point, the companies realized that they were involved in something bigger. In order\nto increase the impact across the ecosystem, CTA needed to scale. To achieve this, the\nFounding Members decided to establish CTA as an independent organization and relaunch it in February 2017 at RSA. The revamped CTA now has dedicated staff, resources,\nand a technology platform for sharing advanced threat data. As a result, CTA members\ncan all share timely, actionable, contextualized, and campaign-based intelligence that\ncan be used to improve their products and services to better protect their customers, more\nsystematically thwart adversaries, and improve the security of the digital ecosystem.\nCTA has been growing rapidly and earning a positive reputation. To understand it better, consider\nthis account, from CTA itself, of the unusual role it can play:\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n125\n\nOn May 23, 2018, Cisco\xe2\x80\x99s Talos Intelligence Group publicly exposed a new malware threat\nthey dubbed VPNFilter. VPNFilter is a sophisticated modular malware system targeting\nnetworking equipment all over the world. This malware allowed for theft of website\ncredentials, collection of data, injection of malicious content into network traffic as it\npasses through an infected device, and destruction of the infected device.\nEarlier in May, VPNFilter had begun a large-scale infection of devices in Ukraine and\neventually targeted at least 500,000 network devices worldwide. This happened to be right\naround the time of the one-year anniversary of NotPetya, the Ukrainian Constitution Day,\nand the European Soccer Championship. The threat of a destructive attack timed with\nany of these events forced Talos\xe2\x80\x99 hand and pushed them to release all of the information\nthey currently had on the malware to the public, in coordination with law enforcement.\nThis is pretty typical for many cybersecurity companies. They are researching a threat and\neventually decide to expose it. However, Talos did something special that has the\npotential to improve our cybersecurity over the long run. They informed fellow members in\nthe Cyber Threat Alliance of the threat of VPNFilter before they released it publicly. Why\nwould one company provide their competitors with advance notice of such a significant\nmalware release?\nTalos realized that VPNFilter had the potential to be a massive problem for internet users\nacross the globe. If the destructive module of the malware was activated, it could cut off\ninternet access for millions of people. They also recognized that they needed assistance\nin addressing the problem and informing the public of the risk. The devices that VPNFilter\ntargeted are on the perimeter of most organizations\xe2\x80\x99 networks and difficult to defend,\ntypically do not have a host-based protection system, have hundreds of publicly known\nvulnerabilities, and are difficult for organizations to patch. To quickly handle this threat, CTA\nmembers would need to amplify Talos\xe2\x80\x99 alert and spread mitigation information as quickly\nas possible.\nTalos leveraged CTA\xe2\x80\x99s Algorithm & Intelligence (A&I) Committee to provide CTA members\nwith VPNFilter cyber threat indicators and defensive measures, including VPNFilter samples\nand analytic findings. They also provided a briefing to members to answer questions and\nengage on how to mitigate the threat. CTA members were then able to quickly perform\ntheir own analysis to verify and validate Talos\xe2\x80\x99 work and use that to develop protections\nfor their cybersecurity products.\nWhen Talos released their blog at 9:00 am eastern time on May 23, CTA members already\nhad protections in place, defending and protecting their customers as quickly as possible.\nThis allowed our members to avoid the usual scramble and delay of trying to obtain new\nmalware samples, performing analysis, and developing protections when another\ncompany publishes a significant report. CTA members, such as Fortinet, Symantec, Sophos,\nPalo Alto Networks, McAfee, Juniper, and Rapid7, published their own findings and analysis\nover the next few hours and days, amplifying the messaging. These blogs were collected\nby CTA and published in a single location for the public to find information on VPNFilter.\nCTA members continued to discuss and share information on VPNFilter within A&I meetings.\nThis included updates on victim telemetry, additional affected infrastructure, and new\ninsights on malicious modules. Talos provided public updates on VPNFilter on June\n6 and September 27, and the malware samples and analysis were shared with CTA\nmembers in advance. As before, CTA members provided additional analysis and\namplification of the warnings of VPNFilter to assist with mitigation.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n126\n\nImpact and Assessment\nWas this successful? As of the publication of this blog post, the destructive module of\nVPNFilter was never employed. So that\xe2\x80\x99s a good thing. Based on our collective visibility it\nappears that VPNFilter activity has been severely degraded since the release of\ninformation in May and operational coordination actions with law enforcement,\nintelligence organizations, and CTA and its members. Talos has seen no signs of the actor\ntrying to reconnect with the devices that still have the Stage 1 malware, and most C2\nchannels for the malware have been mitigated. While it is highly unlikely that the highly\ncapable actor behind VPNFilter has stopped their activities, it does appear that they were\nforced to abandon the VPNFilter framework due to these coordinated actions.\nOne of the other effects of Talos\xe2\x80\x99 early sharing and CTA\xe2\x80\x99s response has been an increased\nwillingness of CTA members to share information on significant malicious cyber activity with\neach other before the release of details publicly. These disruption activities seek to prevent\nactors from succeeding in their goals and increase the costs of their malicious cyber\nactivities. By coordinating ahead of release on significant issues, CTA members leverage\ntheir data, analysis, and cybersecurity products to expose the activity, prevent additional\nharm, and mitigate any of the activity\xe2\x80\x99s effects as early as possible. In the months since\nVPNFilter, Symantec (Thrip, Leafminer), Fortinet (Emotet), Sophos (SamSam), and Palo Alto\nNetworks (Gorgon Group, KONNI, and DOGCALL) have all provided CTA members with\nearly access to malicious cyber activity analysis and samples. In fact, this early release\nmomentum continues today with Symantec\xe2\x80\x99s release of information and analysis on a new\nthreat actor they call Gallmaker. CTA encourages our members to continue this type of\nsharing moving forward.\nThe members of CTA seek to work together in good faith to share cyber threat intelligence\nto disrupt malicious actors and protect their customers. We share cyber threat indicators\nand defensive measures for the purposes of improving defenses against advanced cyber\nadversaries across member organizations and their customers, to advance the\ncybersecurity of critical information technology infrastructure, and to increase the security,\navailability, integrity, and efficiency of information systems. We recognize that not every\ncybersecurity provider has the same visibility into the threat, and the only way we can\nexpand our knowledge base is to share with one another and then act for the greater\ngood. We are all stronger when we work together. As we move forward, the early sharing\ndemonstrated through VPNFilter provides just a glimpse of the potential impact that CTA\ncan have to improve the overall security of the internet.\n\nCan you articulate the value proposition CTA is describing in this story?\n\nISACs and ISAOs\nCTA is not the only, or the first, model for cross-company collaborations involving cybersecurity\ninformation-sharing. \xe2\x80\x9cISACs\xe2\x80\x9d and \xe2\x80\x9cISAOs\xe2\x80\x9d are similar. The following account (from an ISAO known\nas the Advanced Cyber Security Center (ACSC)) provides a handy introduction:\nWhen it comes to sharing cybersecurity information, it can get complicated fast.\nOrganizations have to navigate a tight workforce, conflicting laws and regulations, and\nprioritize protections within their organizations -- often on penny-pinching budgets. Public\nentities like the Federal Bureau of Investigation (FBI) and the Department of Homeland\nSecurity (DHS) strive for better engagement with corporations to improve collaboration\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n127\n\nand communication but concerns over sharing sensitive information or giving competitors\ninsight into business operations limit collaboration.\nIn 2015, the White House addressed those hurdles with Executive Order 13691: Promoting\nPrivate Sector Cybersecurity Information Sharing. \xe2\x80\xa6 EO 13691 was designed to help fill the\nneed for security information sharing beyond federal agencies and to \xe2\x80\x9cencourage the\nvoluntary formation of [information sharing organizations], to establish mechanisms to\ncontinually improve the capabilities and functions of these organizations, and to better\nallow these organizations to partner with the Federal Government on a voluntary basis.\xe2\x80\x9d\nAlthough the executive order provided a basis for DHS to support broadening the\necosystem, these \xe2\x80\x9cvoluntary\xe2\x80\x9d sharing organizations added a layer of complexity that\nconfused even the cybersecurity community. Information Sharing and Analysis Centers\n(ISACs) and Information Sharing and Analysis Organizations (ISAOs) established by the\nexecutive order differ in role and benefits but both are critically important to successful\ncollaboration. Below, we provide a short summary of how these types of information\nsharing organizations operate. \xe2\x80\xa6\nISACs: Sector-Specific Collaboration\nTo address the need for better sharing of information about cyber risks and\npreparedness, Presidential Decision Directive 63, signed in 1998, encouraged critical\ninfrastructure sectors to establish information sharing organizations. The directive\nestablished clear responsibilities at the government level for building collaborations with\norganizations to \xe2\x80\x9cserve as the mechanism for gathering, analyzing, appropriately sanitizing\nand disseminating private sector information\xe2\x80\x9d to industry and the government. Therefore,\nthe ISACs aligned specifically with each individually designated critical infrastructure\nsector. ISACs provide real-time threat and attack intelligence sharing, training and curated\nreporting to their members, who may pay an annual fee depending on the market sector.\nInformation sharing through ISACs is usually protected by legal agreements that protect\nagainst non-disclosure and attribution back to the reporting organization, providing some\nprotection for their members against inappropriate disclosure. In addition, the advent of\nautomated sharing platforms hosted by some ISACs can allow for consistent collaboration\nbetween member organizations and some may be able to respond and share actionable\nthreat intelligence more quickly than the government. Many have also grown to reach\nwell beyond the US, building international membership opportunities.\nISAOs: Effective-Practice Sharing Networks\nWhile ISACs covered the emerging information sharing needs of critical infrastructure\ninitially, the rapidly evolving cybersecurity landscape necessitated the need for Executive\nOrder 13691 encouraging ISAO development. \xe2\x80\xa6 [T]o encourage innovative information\nsharing\xe2\x80\xa6, \xe2\x80\x9cISAOs may be organized on the basis of sector, sub-sector, region, or any other\naffinity, including in response to particular emerging threats or vulnerabilities.\xe2\x80\x9d These new\ninformation sharing organizations were also envisioned to be sector-agnostic, allowing for\nmembership to \xe2\x80\x9cbe drawn from the public or private sectors, or consist of a combination\nof public and private sector organizations.\xe2\x80\x9d Like ISACs, information sharing through ISAOs\nmay be protected by legal agreements that protect against non-disclosure and\nattribution back to the reporting organization.\n\xe2\x80\xa6. ISAOs have evolved to focus beyond threat sharing and towards effective-practice\nsharing within a more geography-centric local community\xe2\x80\xa6.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n128\n\nTask: Do some searching to see if you can identify at least three distinct ISACs or ISAOs. Come\nto class prepared to name them, describe their particular areas of focus, and share anything\nyou could glean about the nature of their activities\n\xe2\x80\xa2 How, if at all, is the ISAC/ISAO model different from CTA?\n\xe2\x80\xa2 Can you articulate why some people are reluctant to see NSA involved in defenseoriented activity?\n\xe2\x80\xa2 What is the best response to such concerns?\n\nAt this point, you may have noticed that we have not yet turned our attention to some key\ngovernment institutions that play a direct role in promotion of information-sharing. We\xe2\x80\x99ve saved\nthat for last on purpose, for the role played by DHS\xe2\x80\x99s Cybersecurity & Infrastructure Security\nAgency (CISA) goes hand-in-hand with a key statute that will require careful parsing. We\xe2\x80\x99ll do all\nof that below, in the next reading.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n129\n\n16. Facilitating Better Defense through Information-Sharing (II)\n\nLearning Objectives\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\nUnderstand that DHS CISA has functions (in its Cybersecurity Division) that include promotion\nof public-private information sharing, both in the form of narrative alerts/bulletins and\nespecially in the form of the Automated Indicator Sharing (AIS) system for real-time distribution\n(and upload) of threat intelligence\nUnderstand that NSA now has a \xe2\x80\x9cCybersecurity Directorate\xe2\x80\x9d focused on promoting defense\nnot only of certain U.S. government systems but also those of private companies in the Defense\nIndustrial Base\xe2\x80\x94and that the Directorate sometimes advances that mission by sharing cyber\nthreat intelligence (including public sharing that might include attributions of state\nresponsibility)\nHomework: Playing the role of a staffer providing a memo, describe the array of options the\ngovernment has if it wants to disrupt the ability of a foreign adversary to make use of an exploit\nWith respect to the goal of promoting federal sharing of information with the private sector\n(and state/local government), understand that the 2015 Act focused on solving the problem\nof federal officials who might not be sure that such sharing was part of their organization\xe2\x80\x99s\naffirmative responsibilities\xe2\x80\x94and be able to identify where and how the Act remedies that\nproblem.\nUnderstand why the Act does not attempt to compel private sector entities to receive such\ninformation, and why the Act in fact makes clear such entities cannot be held liable for\ndeclining the opportunity.\nWith respect to the goal of promoting private-sector sharing of information with the federal\ngovernment, understand how the 2015 Act tries to prune away various disincentives including\nlost intellectual-property protections, waiver of privileges, exposure to FOIA, and incurring civil\nliability.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\n130\n\nUnderstand that these aspects of the Act incurred substantial opposition from privacy\nadvocates, and be able to describe how the Act tries to ameliorate those concerns by limiting\nthe ways in which the federal government can use the information provided by the private\nsector under the Act (in particular, be able to answer whether and when such information\ncan be used by law enforcement).\nUnderstand why the Act does not attempt to compel private sector entities to provide such\ninformation, and be able to discuss whether you think that should be changed.\nAppreciate that the Act is not limited to information-sharing provisions, despite its title; be able\nto describe how private-sector concerns about the impact of the Computer Fraud and Abuse\nAct in self-defense settings led the Act\xe2\x80\x99s authors to include additional provisions unrelated to\ninformation sharing.\nBe able to describe what the Act has to say about the defensive use of \xe2\x80\x9cmonitoring\xe2\x80\x9d activities\noccurring within one\xe2\x80\x99s own system, and whether the CFAA otherwise would have been\nviolated by such activities.\nBe able to describe how the Act defines \xe2\x80\x9cdefensive measures,\xe2\x80\x9d and how this differs from the\n\xe2\x80\x9cmonitoring\xe2\x80\x9d scenario.\nBe able to explain how the Act\xe2\x80\x99s blessing of \xe2\x80\x9cdefensive measures\xe2\x80\x9d relates to the scope of the\nCFAA. In particular, be able to state and defend a view regarding whether the Act would\nencompass scenarios including (i) beacons, (ii) backdoors, and (iii) destructive malware, and\nwhether the Act should be understood as making a meaningful change to the scope of\npotential liability an entity would face under the CFAA for such measures.\n\nIn this class, we conclude our survey of key information-sharing actors, and then turn our attention\nto an important 2015 statute designed to improve information-sharing by pruning away various\ndisincentives.\nA. More Information-Sharing Institutions\nThe Cybersecurity Division at DHS\xe2\x80\x99s Cybersecurity and Infrastructure Security Agency (CISA):\nIn addition to encouraging formation of ISACs and ISAOs, the federal government has taken\ncertain institutional-design steps in order to promote information sharing. Specifically, it has\ncharged a particular agency with this mission: the Cybersecurity and Infrastructure Security\nAgency (CISA, pronounced \xe2\x80\x9csis-uh\xe2\x80\x9d).\nCISA is a component of the Department of Homeland Security (DHS). Previously known by the\nmuch less evocative moniker, the \xe2\x80\x9cNational Protection and Programs Directorate\xe2\x80\x9d (NPPD), CISA\nhas been growing rapidly both in stature and capability, and the recent name change was an\nimportant symbolic marker of that success. CISA today encompasses several distinct functional\ndivisions, including not only its Cybersecurity Division but also its Infrastructure Security Division, the\nNational Risk Management Center, and the Emergency Communications Division. Our primary\nconcern is with the Cybersecurity Division.\nWhat exactly does the Cybersecurity Division do? It has a number of distinct responsibilities. Some\nof these are focused on improving the security of the federal government\xe2\x80\x99s own systems. We will\nread about that more soon enough. Others involve cybersecurity services CISA can provide on a\nvoluntary basis to state and local government entities and to certain private-sector entities,\nservices that range from risk-assessment and capacity-building to penetration testing and\nassistance with incident response. We will table all of that for now, too, in order to stay focused\non the topic of information-sharing and CISA\xe2\x80\x99s role in that setting.\nAs we noted earlier in this reading, there are several dimensions to information-sharing as an area\nof cybersecurity policy. Ideally, there would be an efficient flow of useful information from the\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n131\n\nfederal government to the private sector, from the private sector to the government, and among\nvarious private sector entities. A variety of obstacles historically have impeded these flows,\nhowever, and thus a core challenge for CISA has been to develop useful mechanisms for\novercoming those obstacles as much as possible.\nHow to do that? CISA in recent years operationalized these functions primarily through its 24/7\nwatch-and-operations center known until recently as National Cybersecurity and\nCommunications Integration Center (NCCIC, pronounced \xe2\x80\x9cN-kick\xe2\x80\x9d). Since its establishment in\n2009, NCCIC has served as a hub for information exchange, among other things. Those functions\ncontinue today, though recent reshufflings of internal organizational labels suggest that it may be\nbest to eschew a focus on that precise label and to concentrate instead on simply understanding\nthe functions CISA performs in this area.\nOne notable example is the Automated Indicator Sharing (AIS) Program. AIS is a free service\nconsisting of a bi-directional information-exchange platform that facilitates real-time, automated\nsharing of threat indicators between CISA and voluntarily-participating private-sector entities. The\nbasic idea is that a participating private-sector entity which identifies a threat indicator can\nupload signatures to CISA at machine speed via AIS, and CISA can in turn use AIS to share those\nsignatures to all other participants in addition to using them for its own defensive purposes (note\nhow this is akin to, say, VirusTotal). CISA can originate the dissemination as well.\nSeparately, CISA promotes a distinct form of information-sharing by producing (and distributing\nthe old fashioned way) a variety of bulletins and technical advisories. Here\xe2\x80\x99s a current list of them,\nfrom CISA:\nSubscriptions are available to all users for the following products:\n\xe2\x80\xa2\n\nCurrent Activity entries provide up-to-date information about high-impact types of\nsecurity activity affecting the community at large.\n\n\xe2\x80\xa2\n\nAlerts provide timely information about current security issues, vulnerabilities, and\nexploits.\n\n\xe2\x80\xa2\n\nBulletins provide weekly summaries of new vulnerabilities. Patch information is\nprovided when available.\n\n\xe2\x80\xa2\n\nTips provide advice about common security issues for the general public.\n\n\xe2\x80\xa2\n\nAnalysis Reports provide in-depth analysis on a new or evolving cyber threat.\n\n\xe2\x80\xa2\n\nIndustrial Control Systems Alerts provide timely notification to critical infrastructure\nowners and operators concerning threats or activity with the potential to impact\ncritical infrastructure computing networks.\n\n\xe2\x80\xa2\n\nIndustrial Control Systems Advisories provide timely information about current\nindustrial control systems (ICS) security issues, vulnerabilities, and exploits\n\nAs we will soon explore in more detail, CISA also plays an especially important informationsharing role in the special context of private sector entities that constitute \xe2\x80\x9ccritical infrastructure.\xe2\x80\x9d\nWe explore that topic separately below. For now, we will move on to close out our review of key\ninformation-sharing actors by looking briefly to the National Security Agency (NSA).\nNSA\xe2\x80\x99s New Cybersecurity Directorate:\nNSA is, of course, most famous for its role as the nation\xe2\x80\x99s lead agency for collection and analysis\nof \xe2\x80\x9csignals intelligence\xe2\x80\x9d (SIGINT). In practical terms, this means that NSA is in the business of\nespionage targeting electronic communications, stored data, and so forth. At first blush, then, it\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n132\n\nwould seem we should not be talking about NSA at all, until Unit II of this course. But NSA also has\nimportant protective functions related to cybersecurity. Who better to understand attackers\xe2\x80\x99\ncapabilities, after all, than our own premier electronic espionage agency? While this protective\nmission is largely a matter of protecting the government\xe2\x80\x99s own systems (again, a topic we will\naddress in an upcoming class rather than here), there is an aspect of this protective mission that\nalso concerns private-sector entities with strategic significance and the broader public. That\xe2\x80\x99s\nwhy we are talking about it briefly here.\nThe organizational home for this function, within NSA, has undergone various name and\norganizational-chart revisions in recent years. For a long period, it was embodied by the\n\xe2\x80\x9cInformation Assurance Directorate,\xe2\x80\x9d or IAD. After a complicated period of recent change, NSA\nhas recently reorganized again, and now we find this function in the newly christened\nCybersecurity Directorate. The general idea appears to be to maximize the effect of defensive\nefforts\xe2\x80\x94particularly with an eye towards preventing significant intellectual-property theft by other\nstates\xe2\x80\x94by collocating a range of NSA capabilities (including collection capabilities, presumably)\nand creating a mission-oriented team environment for them.\nThe head of CD, Anne Neuberger, has explained:\n[O]ne of her directorate\xe2\x80\x99s new goals is to provide more actionable threat intelligence at\nthe unclassified level so that partners, customers and private sector firms can actually reap\nbenefits in real-time. The NSA, she said, will strive to declassify and share threat intelligence\nfaster. . . .\nThe Cybersecurity Directorate\xe2\x80\x99s early mission is to \xe2\x80\x9cprevent and eradicate threats\xe2\x80\x9d to\nnational security and weapons systems and the defense industrial base, which face\nincreasingly complex cyber threats from China, Russia, Iran and North Korea. . . .\nOne of the ways the Cybersecurity Directorate aims to do that is by producing \xe2\x80\x9cbetter\nthreat alerts with more context,\xe2\x80\x9d Neuberger said. The directorate released such\nan advisory on Oct. 7, detailing to the public how multiple nation-state actors \xe2\x80\x9chave\nweaponized\xe2\x80\x9d certain virtual private network vulnerabilities. The advisory included a list of\naffected systems and recommended patches and other strategies to harden systems\nagainst intrusion.\n\nCan you relate this to the note above regarding USCYBERCOM\xe2\x80\x99s contributions to VirusTotal?\n\nHaving described a variety of private and public actors who do important things to promote\ninformation-sharing, we should now turn our attention to an issue that has greatly complicated\nthat project over time: How, if at all, should Congress intervene to support such efforts via\nlegislation intended to \xe2\x80\x9cprune\xe2\x80\x9d away disincentives to information-sharing?\nB. What Do We Mean by \xe2\x80\x9cPruning\xe2\x80\x9d?\nIn some situations, an entity might be willing (perhaps even eager) to pursue some particular\nsecurity measure, yet may be deterred from doing so by the potential applicability of a legal\nconstraint (criminal, civil liability, regulatory pressure, etc.). And that might be a good thing; the\nlegal constraint presumably serves some otherwise-desirable purpose, after all, and the resulting\nbenefits associated with that purpose might well outweigh the opportunity cost associated with\ndiscouraging uptake of the security measure in question. But then again, the balance also might\ncut the opposite way. If so, some \xe2\x80\x9cpruning\xe2\x80\x9d\xe2\x80\x94that is, changes to the law so that it no longer will\ndiscourage the measure\xe2\x80\x94might be in order.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n133\n\nAfter many years of debate, Congress in 2015 enacted a law designed to do just this in relation\nto the circulation of cybersecurity-relevant information. The rest of this reading examines that\nlegislation.\nC. The Cybersecurity Information Sharing Act of 2015\nIn 2015, Congress passed and President Obama signed into law the \xe2\x80\x9cCybersecurity Information\nSharing Act of 2015.\xe2\x80\x9d Since that law has the same acronym as the newly renamed DHS agency\ndescribed above, one must now be careful and clear when referring to \xe2\x80\x9cCISA.\xe2\x80\x9d Here, I\xe2\x80\x99ll refer to\nit simply as the Act or the 2015 Act, in hopes of keeping things simple.\nThe full text of the 2015 Act can be found here, but for our purposes you should focus only on the\nsections quoted in the text below and the questions that follow for each.\nDefinitions:\nAs an initial matter, read these two definitions from the statute. First, Section 102(6) defines \xe2\x80\x9ccyber\nthreat indicator\xe2\x80\x9d to mean information used to \xe2\x80\x9cdescribe or identify":\n(A)\n\nmalicious reconnaissance, including anomalous patterns of communications that\nappear to be transmitted for the purpose of gathering technical information\nrelated to a cybersecurity threat or security vulnerability;\n\n(B)\n\na method of defeating a security control or exploitation of a security vulnerability;\n\n(C)\n\na security vulnerability, including anomalous activity that appears to indicate the\nexistence of a security vulnerability;\n\n(D)\n\na method of causing a user with legitimate access to an information system or\ninformation that is stored on, processed by, or transiting an information system to\nunwittingly enable the defeat of a security control or exploitation of a security\nvulnerability;\n\n(E)\n\nmalicious cyber command and control;\n\n(F)\n\nthe actual or potential harm caused by an incident, including a description of the\ninformation exfiltrated as a result of a particular cybersecurity threat;\n\n(G)\n\nany other attribute of a cybersecurity threat, if disclosure of such attribute is not\notherwise prohibited by law; or\n\n(H)\n\nany combination thereof.\n\nSecond, Section 102(7) defines the term \xe2\x80\x9cdefensive measure\xe2\x80\x9d as follows:\nan action, device, procedure, signature, technique, or other measure applied to an\ninformation system or information that is stored on, processed by, or transiting an\ninformation system that detects, prevents, or mitigates a known or suspected cybersecurity\nthreat or security vulnerability \xe2\x80\xa6 [but] does not include a measure that destroys, renders\nunusable, provides unauthorized access to, or substantially harms an information system\nor information stored on, processed by, or transiting such information system not owned by\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n134\n\n\xe2\x80\xa6the private entity operating the measure \xe2\x80\xa6 or \xe2\x80\xa6another entity or Federal entity that is\nauthorized to provide consent and has provided consent to that private entity for\noperation of such measure.\nNow we will turn to the key substantive provisions in the statute. As you will see, I\xe2\x80\x99ve reordered\nand grouped them in a way designed to highlight the distinct things Congress was trying to\naccomplish.\nTwo Major Goals:\nIt helps to think of the 2015 Act as pursuing two overarching goals. First, it sought to increase the\nflow of information between the government and the private sector (in both directions). Second,\nit sought to increase the likelihood that private sector entities would feel free to use certain\ndefensive measures. Alas, the drafters did not organize the 2015 Act in a way that maps easily\nonto that two-prong framework. Accordingly, I\xe2\x80\x99ve excerpted the relevant sections of the Act,\nbelow, in an order that should be easier for you to follow (as compared to the mind-numbing\neffect of reading the sections in their original order).\nGoal #1: Facilitate the Flow of Information between Government and the Private Sector\nA major goal of the Act was to make it easier for the government to share certain information with\nthe private sector, and vice-versa. Section 103 addresses the former scenario, and Section 105\naddresses the latter.\na. Section 103 (When the Federal Government Shares with Others)\n(a)\n\n[T]he Director of National Intelligence, the Secretary of Homeland Security, the\nSecretary of Defense, and the Attorney General . . . shall jointly develop and issue\nprocedures to facilitate and promote\n(1)\n\nthe timely sharing of classified cyber threat indicators [see definition below]\nand defensive measures [see definition below] in the possession of the\nFederal Government with representatives of relevant Federal entities and\nnon-Federal entities that have appropriate security clearances;\n\n(2)\n\nthe timely sharing with relevant Federal entities and non-Federal entities of\ncyber threat indicators, defensive measures, and information relating to\ncybersecurity threats or authorized uses under this title, in the possession of\nthe Federal Government that may be declassified and shared at an\nunclassified level;\n\n(3)\n\nthe timely sharing with relevant Federal entities and non-Federal entities, or\nthe public if appropriate, of unclassified, including controlled unclassified,\ncyber threat indicators and defensive measures in the possession of the\nFederal Government;\n\n(4)\n\nthe timely sharing with Federal entities and non-Federal entities, if\nappropriate, of information relating to cybersecurity threats or authorized\nuses under this title, in the possession of the Federal Government about\ncybersecurity threats to such entities to prevent or mitigate adverse effects\nfrom such cybersecurity threats; and\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n(5)\n\n135\n\nthe periodic sharing, through publication and targeted outreach, of\ncybersecurity best practices that are developed based on ongoing\nanalyses of cyber threat indicators, defensive measures, and information\nrelating to cybersecurity threats or authorized uses under this title, in the\npossession of the Federal Government, with attention to accessibility and\nimplementation challenges faced by small business concerns.\n\nBe able to explain how the five subparts of Section 103 accomplish different things (note how\nthis exercise is similar to parsing the CFAA).\n\xe2\x80\xa2 What specific information-sharing obstacle do these subparts appear designed to\naddress? That is to say: In what sense might this be described as a \xe2\x80\x9cpruning\xe2\x80\x9d?\n\xe2\x80\xa2 Note that Section 103 does not compel private-sector entities to receive whatever\ninformation the government is willing to provide. Why not take that further step?\n\nOf course, the voluntariness of the system won\xe2\x80\x99t seem authentic if entities could be sued,\nsomehow, for failing to participate.\n\nCan you come up with an argument a plaintiff might make, along those lines?\n\nTo head off that prospect, Congress included the following language in Section 108:\n(f)\n\nInformation Sharing Relationships.\xe2\x80\x93\xe2\x80\x93Nothing in this title shall be construed\xe2\x80\x93\xe2\x80\x93 . . . to\nrequire the use of the capability and process within the Department of Homeland\nSecurity developed under section 105(c).\n\n(ii)\n\nNo Liability for Non-Participation.\xe2\x80\x93\xe2\x80\x93Nothing in this title shall be construed to subject\nany entity to liability for choosing not to engage in the voluntary activities\nauthorized in this title.\n\n(k)\n\nFederal Preemption.\xe2\x80\x93\xe2\x80\x93 . . . This title supersedes any statute or other provision of law\nof a State or political subdivision of a State that restricts or otherwise expressly\nregulates an activity authorized under this title.\n\nWhat work do these provisions do?\n\nb. Section 105 (When Others Share with the Federal Government)\nSection 105 is a very long and complicated provision. I\xe2\x80\x99m going to quote from it selectively and\nwith extensive paraphrasing, to keep this readable and focused.\nFirst, there are two subsections (105(a) and (c)) that combine to require the federal government\nto take an important institutional step to facilitate the process of receiving information from others.\nSpecifically, these subsections require the government to rapidly develop a process for receiving\ncyber-threat indicators and defensive measures provided by the private sector, with an emphasis\non speed, automation, and distribution within the federal government once received. So far so\ngood. But note that there was much anxiety, in some quarters, about this idea while the bill was\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n136\n\npending. Some felt it opened the door to a privacy problem, with the government potentially\nobtaining personally identifiable information about customers, employees, and so forth.\nAccordingly, a separate subsection\xe2\x80\x94105(b)\xe2\x80\x94requires that the process be developed in a way\nthat addresses such privacy and civil-liberties interests.\nNote that you have seen the eventual result of Section 105, above, in the form of CISA\xe2\x80\x99s programs\nfor information sharing. But there\xe2\x80\x99s more, so let\xe2\x80\x99s return to the details of the statute.\nCongress anticipated that private sector entities might be reluctant to work with the government\nin the form of information-sharing partnerships, but it did not go so far as to mandate such\ncooperation. What it tried, instead, was to encourage private sector entities to participate in the\nsystem by pruning away potential disincentives. Specifically, Section 105(d) provides a host of\nprotections, including but not limited to these three:\n(1)\n\nThe provision of cyber threat indicators and defensive measures to the Federal\nGovernment under this title shall not constitute a waiver of any applicable privilege\nor protection provided by law, including trade secret protection.\n\n(2)\n\n[A] cyber threat indicator or defensive measure provided by a non-Federal entity\nto the Federal Government under this title shall be considered the commercial,\nfinancial, and proprietary information of such non-Federal entity when so\ndesignated by the originating non-Federal entity or a third party acting in\naccordance with the written authorization of the originating non-Federal entity.\n\n(3)\n\n[This one exempts the information shared by a private entity from disclosure by the\ngovernment when the government receives freedom-of-information requests].\n\nDo you think this is adequate to encourage participation? If not, what else would you be\nwilling to try?\n\nA separate policy challenge that emerged during the drafting of the 2015 Act concerned the\npossibility that the government might obtain information from the private sector for cybersecurity\npurposes, yet end up using the information for other purposes.\n\nIs that a bad thing? Be able to advance at least one argument against this, and one in favor\nof it.\n\nAt any rate, Congress decided to address this issue. It did so in a complicated way, however.\nSubsection 105(d)(5) states that the information provided to the government through this\nmechanism may only be used for:\n(i)\n\na cybersecurity purpose;\n\n(iii)\n\nthe purpose of responding to, or otherwise preventing or mitigating, a specific\nthreat of death, a specific threat of serious bodily harm, or a specific threat of\nserious economic harm . . .;\n\n(iv)\n\nthe purpose of responding to, investigating, prosecuting, or otherwise preventing\nor mitigating a serious threat to a minor, including sexual exploitation and threats\nto physical safety; or\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n(v)\n\n137\n\nthe purpose of preventing, investigating, disrupting, or prosecuting [certain\noffenses involving fraud, identity theft, espionage, censorship, and protection of\ntrade secrets].\n\nIs that an adequate solution (assuming a solution was needed)?\n\nThat was not the only concern Congress tried to address in subsection 105(d)(5), though. Consider\nthis language:\nExcept as provided [below], cyber threat indicators and defensive measures provided to\nthe Federal Government under this title shall not be used by any Federal, State, tribal, or\nlocal government to regulate, including an enforcement action, the lawful activities of\nany [private-sector entity, except that such information can be used to inform regulatory\nefforts intended to support prevention/mitigation of cybersecurity threats]\n\nThink back to our unit on regulators.\n\xe2\x80\xa2 What sort of fears might a private-sector entity have that this language tries to\naddress?\n\xe2\x80\xa2 Does the language really address those concerns?\n\nNext we will look at Section 104(c), titled \xe2\x80\x9cAuthorization for Sharing or Receiving Cyber Threat\nIndicators or Defensive Measures\xe2\x80\x9d:\n(1)\n\nIn general.\xe2\x80\x93\xe2\x80\x93Except as provided in paragraph (2) and notwithstanding any other\nprovision of law, a non-Federal entity may, for a cybersecurity purpose and\nconsistent with the protection of classified information, share with, or receive from,\nany other non-Federal entity or the Federal Government a cyber threat indicator\nor defensive measure.\n\nThis is followed (out of sequence) by 106(b), which provides:\nNo cause of action shall lie or be maintained in any court against any private entity, and\nsuch action shall be promptly dismissed, for the sharing or receipt of a cyber threat indicator\nor defensive measure under section 104(c) if . . . such sharing or receipt is conducted in\naccordance with this title\n\nConsider these questions:\n\xe2\x80\xa2 What legal obstacle does all this seem designed to prune?\n\xe2\x80\xa2 Does it succeed?\n\nGoal #2: Remove Obstacles to Desirable Private-Sector Defensive Actions\nAnother major goal of the Act was to prune away the liability risks (real or perceived) that\nCongress concluded might be deterring private-sector entities from engaging in certain desirable\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n138\n\nactivities (activities that are useful for defense in their own right, and that might generate\nimportant information to be shared more broadly). Most of the relevant provisions, for purposes\nof this goal, are found in Sections 104 and 106.\na. Making it Clear That Entities Can Monitor Their Own Systems\nFirst, read Section 104(a):\nNotwithstanding any other provision of law, a private entity may, for cybersecurity\npurposes, monitor\xe2\x80\x94\n(A)\n\nan information system of such private entity;\n\n(B)\n\nan information system of another non-Federal entity, upon the authorization and\nwritten consent of such other entity;\n\n(C)\n\nan information system of a Federal entity, upon the authorization and written\nconsent of an authorized representative of the Federal entity; and\n\n(D)\n\ninformation that is stored on, processed by, or transiting an information system\nmonitored by the private entity under this paragraph.\n\nAbsent this provision, would such activity be illegal?\n\nNow read Section 106(a):\nNo cause of action shall lie or be maintained in any court against any private entity, and\nsuch action shall be promptly dismissed, for the monitoring of an information system and\ninformation under section 104(a) that is conducted in accordance with this title.\n\nConsider these questions:\n\xe2\x80\xa2 Are 104(a) and 106(a) duplicative?\n\xe2\x80\xa2 Note the language in 106(a) about \xe2\x80\x9cshall be promptly dismissed.\xe2\x80\x9d Is that unnecessary\ngiven the prior clause stating that there shall be no cause of action?\n\nb. Making it Clear Entities Can Do Other \xe2\x80\x9cDefensive\xe2\x80\x9d Things\nNext up, consider Section 104(b), titled \xe2\x80\x9cAuthorization for Operation of Defensive Measures.\xe2\x80\x9d [Tip:\ngo back and re-read the statutory definition of \xe2\x80\x9cdefensive measures,\xe2\x80\x9d above, before reading\n104(b)]\n(1)\n\nIn general.\xe2\x80\x93\xe2\x80\x93Notwithstanding any other provision of law, a private entity may, for\ncybersecurity purposes, operate a defensive measure that is applied to\xe2\x80\x94\n(A)\n\nan information system of such private entity in order to protect the rights or\nproperty of the private entity;\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n(B)\n\nan information system of another non-Federal entity upon written consent\nof such entity for operation of such defensive measure to protect the rights\nor property of such entity; and\nan information system of a Federal entity upon written consent of an\nauthorized representative of such Federal entity for operation of such\ndefensive measure to protect the rights or property of the Federal\nGovernment.\n\n(C)\n\n(2)\n\n139\n\nConstruction.\xe2\x80\x93\xe2\x80\x93Nothing in this subsection shall be construed\xe2\x80\x93\xe2\x80\x93\n(A)\n\nto authorize the use of a defensive measure other than as provided in this\nsubsection; or\n\n(B)\n\nto limit otherwise lawful activity.\n\nConsider these questions:\n\xe2\x80\xa2 What activities would 104(b) encompass beyond the \xe2\x80\x9cmonitoring\xe2\x80\x9d authorized by\n104(a) and 106(a)?\n\xe2\x80\xa2 Imagine that a company creates a trap: a file meant to be attractive to an intruder,\nbut includes within it malware that will, when opened, attempt to:\no (a) communicate with the company to reveal its location,\no (b) same as (a) but also create a backdoor through which the company can\nthen access the system where the file is found, or\no (c) delete all data on the system where it currently resides.\n\xe2\x80\xa2 Would any of those options be permissible under 104(b)?\n\nc. More Pruning\nLet\xe2\x80\x99s conclude with a look at two further pruning provisions.\nSection 106(c) adds:\nNothing in this title shall be construed . . . to create . . . (A) a duty to share a cyber threat\nindicator or defensive measure; or . . . a duty to warn or act based on the receipt of a\ncyber threat indicator or defensive measure\n\nWhat liabilities does this guard against, and is it necessary?\n\nAnd then we have Section 104(e):\n[I]t shall not be considered a violation of any provision of antitrust laws for 2 or more private\nentities to exchange or provide a cyber threat indicator or defensive measure, or\nassistance relating to the prevention, investigation, or mitigation of a cybersecurity threat,\nfor cybersecurity purposes under this title.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n140\n\nWhy might that have seemed necessary?\n\nD. Epilogue\nThe 2015 Act has now been on the books for a while, and we are beginning to learn how it is\nworking in practice. This 2018 story sounded a negative note, suggesting that relatively few\ncompanies had signed up to participate in CISA\xe2\x80\x99s AIS system:\nMore than two years after Congress passed a landmark bill incentivizing companies to\nshare with the government how and when malicious hackers are trying to penetrate their\ncomputer networks, only six companies and other non-federal entities are sharing that\ndata, according to figures provided to Nextgov.\nThat\xe2\x80\x99s compared with about 190 such entities and about 60 federal departments and\nagencies that are receiving cyber threat data from Homeland Security\xe2\x80\x99s automated\nindicator sharing program, a Homeland Security official told Nextgov.\nThat low figure for private-sector participation is an additional blow to the program, which\nhas struggled to provide companies and government agencies with the sort of actionable\ncyber intelligence that was promised by the Cybersecurity Act of 2015.\n\xe2\x80\x9cCISA clearly hasn\xe2\x80\x99t lived up to the full potential that I and many of my colleagues had\nhoped and wanted it to,\xe2\x80\x9d said Rep. Jim Langevin, D-R.I., co-founder of the Congressional\nCybersecurity Caucus and a strong supporter of the bill when it passed.\nCISA stands for the Cybersecurity Information Sharing Act, a major component of the\nCybersecurity Act of 2015, which is often used as shorthand for the full bill.\nLangevin had hoped that CISA would inspire several thousand companies or more to\nshare threat information by this time, he said. He\xe2\x80\x99d hoped that far more would be receiving\nthe data\xe2\x80\x94at least all of the Fortune 5,000.\nBut, more than two years later, only six non-federal organizations have followed through\non sharing their own data.\nIf more companies don\xe2\x80\x99t begin sharing cyber threat information, he said, the government\nshould consider mandating cyber information sharing, through regulation or legislation\xe2\x80\x94a\nshift that\xe2\x80\x99s unlikely to be popular with the regulation-averse Trump administration.\n\xe2\x80\x9cWe need to get realistic about the fact that public-private partnerships haven\xe2\x80\x99t yet borne\nthe kind of fruit that we want,\xe2\x80\x9d Langevin said. \xe2\x80\x9cPublic-private partnerships are preferable\nbut, at some point, good intentions will only get us so far.\xe2\x80\x9d\nSen. Ron Wyden, D-Ore., who opposed CISA over privacy concerns, also urged turning to\nmandates rather than voluntary partnerships with business.\n\xe2\x80\x9cThe immunity this misguided law gave to America\xe2\x80\x99s most powerful corporations appears\nto be far less useful for cybersecurity than its congressional proponents claimed,\xe2\x80\x9d Wyden\nsaid. \xe2\x80\x9cInstead of weakening privacy protections for Americans\xe2\x80\x99 personal information, it\nwould have been more productive for Congress to mandate strong encryption and other\ncommon sense cybersecurity best practices.\xe2\x80\x9d\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n141\n\nRep. Dutch Ruppersberger, D-Md., a co-sponsor of CISA, is trying to schedule a briefing\nwith the House Appropriations Committee to discuss how Homeland Security can boost\nprivate-sector participation in the program, a spokeswoman told Nextgov.\n\xe2\x80\x9cObviously, we think six non-federal entities is unacceptable, and we know the\ndepartment isn\xe2\x80\x99t happy with that number, either,\xe2\x80\x9d the spokeswoman said.\nDuring the briefing, Ruppersberger wants Homeland Security officials to \xe2\x80\x9coutline their\ngame plan on how to bring this number up and provide better context regarding these six\ncompanies,\xe2\x80\x9d the spokeswoman said.\nUltimately, she said, \xe2\x80\x9cwe need the private sector to step up and contribute more, but we\nhave to make it easier, quicker and more fulfilling for them, too.\xe2\x80\x9d\nThe low figure for active participation in Homeland Security\xe2\x80\x99s indicator sharing program\ncomes after an earlier inspector general report dinged the department for flooding\nrecipients with information but not giving them enough context to figure out what was\nimportant.\nIn one case, a federal agency received 11,447 cyber threat indicators from Homeland\nSecurity in 2016 and only two or three of them were actually useful, the inspector general\nsaid.\nRep. Bennie Thompson, D-Miss., ranking member on the Homeland Security Committee,\nurged Homeland Security to \xe2\x80\x9cimprove the timeliness and quality\xe2\x80\x9d of the information it\nshares to bolster private-sector participation. He also said the private sector \xe2\x80\x9cneeds to step\nup\xe2\x80\x9d and warned that \xe2\x80\x9cinformation sharing is not a one-way street.\xe2\x80\x9d\nInformation Sharing for Collective Defense\nCISA, which failed to pass in two successive Congresses before finally becoming law in\n2015, promised liability protections to companies if they shared cyber threat indicators with\nthe government and with each other.\nThe law didn\xe2\x80\x99t protect companies from being sued if they were breached by hackers, but\nit barred customers from suing the company merely for sharing their information with the\ngovernment.\nThe idea was that the government would organize and prioritize all that threat information\nfrom companies, combine it with the government\xe2\x80\x99s own store of threat data, collected by\nintelligence services and Homeland Security, and share the result back out with anyone\nwho was interested, bolstering the nation\xe2\x80\x99s collective cyber defense.\nThe information would all come at machine speed using special protocols too, so there\nwould be no fiddling with phone calls and emails.\nAfter years of haggling between security researchers, companies and privacy advocates,\nit was considered the most significant cyber legislation affecting the private sector to ever\npass Congress.\nWhat\xe2\x80\x99s the Business Case?\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n142\n\nThe problem, former Homeland Security officials say, comes down to incentives.\nCISA gave companies legal protection to share cyber threat information with the\ngovernment but it didn\xe2\x80\x99t make a business case for why it was in their interest to do so, said\nPhil Reitinger, who led Homeland Security\xe2\x80\x99s cyber division under President Barack Obama.\n\xe2\x80\x9cIt\xe2\x80\x99s easy to be a free rider in this this space and just consume the data other people\nproduce,\xe2\x80\x9d said Reitinger. \xe2\x80\x9cThe information security professionals get it, but there\xe2\x80\x99s more\nwork to be done convincing businesses that they\xe2\x80\x99ve got a social responsibility to do this\nand, overall, it\xe2\x80\x99s in their economic best interest.\xe2\x80\x9d\nReitinger noted that the number of companies sharing threat information may be larger\nthan it appears because some companies may be sharing information with public-private\npartnerships, known as information sharing and analysis centers, which are sharing it, in\nturn, with Homeland Security.\nBruce McConnell, another top Homeland Security cyber official under Obama, also\npointed to the free rider problem. He noted, however, some companies have improved\nsharing cyber threat information with each other in recent years, often leaving\ngovernment out of the loop.\nOne model he cited was the Cyber Threat Alliance, a coalition of tech and security\ncompanies that share threat indicators, which was launched in 2017.\n\xe2\x80\x9cUntil companies realize we\xe2\x80\x99re all in this together, the program will remain anemic,\xe2\x80\x9d\nMcConnell said of the Homeland Security sharing program.\nAlways a Long Road\nTo be clear, cyber analysts and CISA\xe2\x80\x99s sponsors never believed the legislation would be a\npanacea for cyber threats.\nWhen CISA was on the Senate floor, one of its co-sponsors, Senate Intelligence Chairman\nRichard Burr, R-N.C., stressed that the bill \xe2\x80\x9cdoes not prevent cyberattacks\xe2\x80\x9d and\nacknowledged that no Senate bill could.\nBurr praised the bill, though, for providing \xe2\x80\x9ca pathway to minimizing the amount of data\nthat is lost.\xe2\x80\x9d\nBurr\xe2\x80\x99s co-sponsor, Sen. Dianne Feinstein, D-Calif., who was then the Intelligence\nCommittee\xe2\x80\x99s ranking member, lauded the bill for receiving support from over 40 business\ngroups and the U.S. Chamber of Commerce. She also described it as a \xe2\x80\x9cfirst-step bill,\xe2\x80\x9d\nthough, that would \xe2\x80\x9cnot bring an end to successful cyberattacks or thefts.\xe2\x80\x9d\nJudged by those modest goals, Reitinger, the former homeland security official, said CISA\nshould not be deemed a failure.\nEven if most companies are only receiving rather than sending cyber threat data, that still\nhas the capability to make them significantly more secure, he said.\n\xe2\x80\x9cIn any sort of system like this, you\xe2\x80\x99re likely to get an order of magnitude more recipients\nthan donors,\xe2\x80\x9d he said. \xe2\x80\x9cI\xe2\x80\x99m very happy with having almost 200 entities receiving data right\nnow. But do I want more people contributing? For sure I do.\xe2\x80\x9d\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\n143\n\nWhy might that be? Give thought both to lingering obstacles and to the potential\nimplications of the various other sharing systems we examined in the prior reading.\nIt has been several years since that snapshot. Do a bit of digging to see if you can\ndetermine how things are going today.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n144\n\n17. How the Government Protects Itself (I)\n\nLearning objectives\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\nBe able to explain the difference between the \xe2\x80\x9ctechnical story\xe2\x80\x9d of a breach and the\n\xe2\x80\x9corganizational story\xe2\x80\x9d of that breach, and be able to relate that distinction to the OPM\nbreach.\nWith reference to a breach scenario, be able to explain the difference between the\n\xe2\x80\x9cinfection,\xe2\x80\x9d \xe2\x80\x9cdetection,\xe2\x80\x9d \xe2\x80\x9cmitigation,\xe2\x80\x9d and \xe2\x80\x9cresponse\xe2\x80\x9d stages.\nUnderstand how the OPM story illustrates the impact of organizational priorities and limited\nbudgets on the commitment of an organization to cybersecurity.\nAppreciate that in the event a breach is discovered, it often is important to take no action\nthat might tip off the attacker\xe2\x80\xa6and thus technical steps to remove the attacker might have\nto be delayed, and so too breach notification\nNotice that it is much easier for the government itself to delay breach notification (not\naccountable for complying with breach notification laws the way a private entity must),\nthough (by way of review) recall the grounds for a private entity also to delay notification (law\nenforcement request, reasonable need for mitigation purposes; appreciate the utility of\nhaving a third party advise you in writing of this)\nUnderstand how the project of \xe2\x80\x9clong term mitigation\xe2\x80\x9d might call for changes relating to the\n\xe2\x80\x9corganizational story\xe2\x80\x9d as much or as to the \xe2\x80\x9ctechnical story\xe2\x80\x9d\nAppreciate why the US government did not attempt to treat the OPM breach as normatively\nwrongful, and how this in turn limited the options for a larger US government response\nBe able to explain why neither the FTC nor insurers have a significant role in pressuring\ngovernment agencies that have shoddy cybersecurity\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\xe2\x80\xa2\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\n145\n\nBe able to explain why the prospect of civil suit means less to a government agency head\nthan to the head of a private organization\nUnderstand how \xe2\x80\x9csovereign immunity\xe2\x80\x9d precludes such suits absent specific statutes waiving\nthat protection, but also how problems still can arise thanks to the potentially-speculative\nnature of damages and the possibility that the particular statute in question might impose\nonerous requirements (such as the Privacy Act\xe2\x80\x99s requirement that the Court find that the\ngovernment acted \xe2\x80\x9cintentionally or willfully\xe2\x80\x9d\nKnow the obstacles encountered by the plaintiffs in the OPM litigation\nUnderstand that the Supreme Court has not yet held that there is a constitutional \xe2\x80\x9cdata\nprivacy\xe2\x80\x9d right as such, though of course there is a Fourth Amendment right against\nunreasonable searches and seizures that encompasses government access to things as to\nwhich one has a reasonable expectation of privacy\nBe able to distinguish among: standard-setting (including everything from broad and vague\nstandards to highly-targeted mandates); monitoring/oversight/auditing in relation to those\nstandards; and actual cybersecurity \xe2\x80\x9coperations\xe2\x80\x9d (ranging from ad hoc help with incident\nresponse to day-to-day security services).\nBe able to explain why it is so much easier for Congress to subject federal agencies to\nstandard-setting, oversight, and operational intervention from another federal agency, in\ncontrast to the headaches that would arise if Congress tried to do the same to the private\nsector (and consider whether, in light of topics we\xe2\x80\x99ve already studied, Congress has\nnonetheless succeeded in imposing at least some such interventions on the private sector)\nKnow which agencies have been given some form of standard-setting authority over other\nfederal agencies; which have a monitoring/oversight/audit role; and which perform\noperational security functions.\nConversely, be able to describe the functions assigned to DHS CISA and OMB.\nBe able to describe how the 2017 Executive Order regarding affirmative reporting of\n\xe2\x80\x9caccepted risk\xe2\x80\x9d helps to create good incentives to invest smartly in cybersecurity measures\n(and give thought to whether a well-considered report of this kind actually can function as a\ndefense for the agency if things later go wrong).\n\nIn recent classes we have surveyed the set of tools that can be used to incentivize private sector\nentities to adopt stronger security measures. But what about the government\xe2\x80\x99s own security\npractices? How might we get the government to defend itself better?\nAs with private sector entities, government entities do have internal incentives to maintain the\nsecurity and functionality of their systems. No entity wants just anyone to be able to monitor its\ninternal deliberations, for example, and plenty of entities have more particular reasons to preserve\nconfidentiality, integrity, and accessibility (the SEC does not want people to access private\ninformation and thus enable market manipulation, for example, just as NSA does not want\nadversaries to be able to learn its techniques and capabilities). Yet we have ample reason to\nbelieve that, if left to their own devices, many if not most government entities would not or could\nnot invest as much in security as they probably should. And so we need tools to compel\ngovernment entities, just like private entities, to do more.\nOur main goal in this class is to understand which tools might be relevant to this task. Before we\ndive in, though, a note is in order regarding the object of our analysis.\nThe \xe2\x80\x9cgovernment\xe2\x80\x9d is not a single entity, but rather a vast array of distinct agencies and enterprises\n(and that\xe2\x80\x99s true even if we concern ourselves only with the federal government, while ignoring\nstate, county, city, tribal, and other levels of non-federal government). Most of these entities,\nmoreover, will own and operate any number of networks, databases, and endpoints; will have\ntheir own budgetary, personnel, management, and leadership issues; and so forth. Thus, even if\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n146\n\nwe limit our focus to the U.S. government, the number of distinct security challenges for \xe2\x80\x9cthe\ngovernment\xe2\x80\x9d is bewildering.\nA. Case Study: The 2015 OPM Hack\nBefore we dig into the various tools that might be used to push government entities to devote\nmore effort to their own cybersecurity, it would be good to get a better grip on the problem we\nare trying to solve. Toward that end, let\xe2\x80\x99s start with a case study of a breach involving a\ngovernment agency: the 2015 episode in which hackers (widely thought to be acting for China\xe2\x80\x99s\nMinistry of State Security) penetrated security at the federal government\xe2\x80\x99s Office of Personnel\nManagement and thereby acquired a vast trove of security-clearance background-check files.\nAs you read about the OPM hack, bear the following in mind: Determining \xe2\x80\x9chow\xe2\x80\x9d a breach\nhappened is a complicated matter. At one level, one can answer with a \xe2\x80\x9ctechnical story\xe2\x80\x9d\xe2\x80\x94that\nis, an explanation focused on which vulnerabilities (technical or otherwise) were exploited to gain\ninitial access; which tactics or methods were then used to escalate privilege, move laterally, mask\npresence, etc.; which implants were installed; and how data was eventually exfiltrated, altered,\nor disrupted. But note that one also might answer, instead or in addition, with an \xe2\x80\x9corganizational\nstory\xe2\x80\x9d\xe2\x80\x94that is, an account that highlights features of the organization that helped produce the\ncircumstances that in turn made the technical story possible. The idea is that every organization\xe2\x80\x99s\nsecurity structure is, ultimately, a function of the organization\xe2\x80\x99s past choices on a number of\ndimensions (including how much budget to commit to security, which personnel to hire, what\nmanagement structure to employ, what training to provide, what policy or legal constraints to\nfollow, what reward (and punishment) structure to apply, and so forth) as well as employee\npersonal dynamics and organizational culture. Both stories\xe2\x80\x94the technical and the\norganizational\xe2\x80\x94deserve attention in any case study of a particular attack.\nNow, on to our case study. Please read the following excerpts from this article from Wired, which\nprovides a handy overview of what occurred:\nThe routine nature of OPM\xe2\x80\x99s business made the revelations of April 15, 2015, as perplexing as\nthey were disturbing. On that morning, a security engineer named Brendan Saulsbury set out\nto decrypt a portion of the Secure Sockets Layer (SSL) traffic that flows across the agency\xe2\x80\x99s\ndigital network. Hackers have become adept at using SSL encryption to cloak their exploits,\nmuch as online vendors use it to shield credit card numbers in transit. Since the previous\nDecember, OPM\xe2\x80\x99s cybersecurity staff had been peeling back SSL\xe2\x80\x99s camouflage to get a\nclearer view of the data sloshing in and out of the agency\xe2\x80\x99s systems.\nSoon after his shift started, Saulsbury noticed that his decryption efforts had exposed an odd\nbit of outbound traffic: a beacon-like signal pinging to a site called opmsecurity.org. But the\nagency owned no such domain. The OPM-related name suggested it had been created to\ndeceive. When Saulsbury and his colleagues used a security program called Cylance V to dig\na little deeper, they located the signal\xe2\x80\x99s source: a file called mcutil.dll, a standard component\nof software sold by security giant McAfee. But that didn\xe2\x80\x99t make sense; OPM doesn\xe2\x80\x99t use\nMcAfee products. Saulsbury and the other engineers soon realized that mcutil.dll was hiding\na piece of malware designed to give a hacker access to the agency\xe2\x80\x99s servers.\n. . . [E]arly that morning, a team of engineers from the US Computer Emergency Readiness\nTeam [US-CERT], the Department of Homeland Security unit that handles digital calamities,\nmarched into OPM\xe2\x80\x99s headquarters. The engineers set up a command post in a windowless\nstorage room in the subbasement, just down the hall from where Saulsbury had discovered\nthe hack less than 24 hours earlier. Since they couldn\xe2\x80\x99t trust OPM\xe2\x80\x99s compromised network, the\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n147\n\nvisitors improvised their own by lugging in workstations and servers that they could seal behind\na customized firewall.\n. . . One of the US-CERT team\xe2\x80\x99s first moves was to analyze the malware that Saulsbury had\nfound attached to mcutil.dll. The program turned out to be one they knew well: a variant of\nPlugX, a remote-access tool commonly deployed by Chinese-speaking hacking units. The tool\nhas also shown up on computers used by foes of China\xe2\x80\x99s government, including activists in\nHong Kong and Tibet. The malware\xe2\x80\x99s code is always slightly tweaked between attacks so\nfirewalls can\xe2\x80\x99t recognize it.\n. . . The hunt turned up not just malware but also the first inklings of the breach\xe2\x80\x99s severity. A\ntechnician from the security software company Cylance, who was supporting the effort,\nspotted encrypted .rar files that the attackers had neglected to delete. He knew that .rar files\nare used to store compressed data and are often employed by hackers to shrink files for\nefficient exfiltration. In an email to Cylance CEO Stuart McClure on Sunday, April 19, the\ntechnician was blunt in his assessment of OPM\xe2\x80\x99s situation: \xe2\x80\x9cThey are fucked btw,\xe2\x80\x9d he wrote.\nBy Tuesday the 21st, having churned through a string of nearly sleepless days and nights, the\ninvestigators felt satisfied that they\xe2\x80\x99d done their due diligence. . . . The PlugX variant they were\nseeking to annihilate was present on fewer than 10 OPM machines; unfortunately, some of\nthose machines were pivotal to the entire network. \xe2\x80\x9cThe big one was what we call the\njumpbox,\xe2\x80\x9d Mejeur says. \xe2\x80\x9cThat\xe2\x80\x99s the administrative server that\xe2\x80\x99s used to log in to all the other\nservers. And it\xe2\x80\x99s got malware on it. That is an \xe2\x80\x98Oh feces\xe2\x80\x99 moment.\xe2\x80\x9d\nBy controlling the jumpbox, the attackers had gained access to every nook and cranny of\nOPM\xe2\x80\x99s digital terrain. The investigators wondered whether the APT had pulled off that\nimpressive feat with the aid of the system blueprints stolen in the breach discovered in March\n2014. If that were the case, then the hackers had devoted months to laying the groundwork\nfor this attack.\nAt first, the investigators left each piece of malware in place, electing only to throttle its ability\nto send outbound traffic; if the attackers tried to download any data, they would find\nthemselves confined to dial-up speeds. But on April 21, Mejeur and the US-CERT team began\nto discuss whether it was time to boot the attackers, who would thus learn that they\xe2\x80\x99d been\ncaught. \xe2\x80\x9cIf I miss one remote-access tool, they\xe2\x80\x99ll come back in through that variant, they\xe2\x80\x99ll\nreestablish access, and then they\xe2\x80\x99ll go dormant for six months to a year at least,\xe2\x80\x9d says a USCERT incident responder who participated in the OPM investigation and who agreed to speak\non the condition he remain anonymous. \xe2\x80\x9cAnd then a year later, they\xe2\x80\x99ve now put malware in\na lot of different places, and you don\xe2\x80\x99t know what\xe2\x80\x99s happening because you think you\nalready mitigated the threat.\xe2\x80\x9d\nThe debate continued until the evening of Friday, April 24, when an opportunity presented\nitself: As part of a grid modernization program in Washington, OPM\xe2\x80\x99s building was scheduled\nto have its power cut for several hours. The team decided that, even though it would mostly\nbe just a psychological triumph, they would dump the malware just minutes before the\nblackout. If the attackers were monitoring the network, they wouldn\xe2\x80\x99t realize their access had\nbeen cut until everything finished booting up at least 12 hours later.\nBy the time power was restored on the 25th, the hackers no longer had the means to roam\nOPM\xe2\x80\x99s network\xe2\x80\x94or at least that\xe2\x80\x99s what everyone hoped. The investigators could finally turn\ntoward piecing together what the attackers had hauled away.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n148\n\n. . . As the investigators laboriously sifted through interview transcripts and network logs, they\ncreated a rough timeline of the attack. The earliest incursion they could identify had been\nmade with an OPM credential issued to a contractor from KeyPoint Government Solutions.\nThere was no way to know how the hackers had obtained that credential, but the investigators\nknew that KeyPoint had announced a breach of its own in December 2014. There was a good\nchance that the hackers had first targeted KeyPoint in order to harvest the single credential\nnecessary to compromise OPM.\nOnce established on the agency\xe2\x80\x99s network, they used trial and error to find the credentials\nnecessary to seed the jumpbox with their PlugX variant. Then, during the long Fourth of July\nweekend in 2014, when staffing was sure to be light, the hackers began to run a series of\ncommands meant to prepare data for exfiltration. Bundles of records were copied, moved\nonto drives from which they could be snatched, and chopped up into .zip or .rar files to avoid\ncausing suspicious traffic spikes. The records that the attackers targeted were some of the\nmost sensitive imaginable.\nThe hackers had first pillaged a massive trove of background-check data. As part of its human\nresources mission, OPM processes over 2 million background investigations per year, involving\neveryone from contractors to federal judges. OPM\xe2\x80\x99s digital archives contain roughly 18 million\ncopies of Standard Form 86, a 127-page questionnaire for federal security clearance that\nincludes probing questions about an applicant\xe2\x80\x99s personal finances, past substance abuse,\nand psychiatric care. The agency also warehouses the data that is gathered on applicants\nfor some of the government\xe2\x80\x99s most secretive jobs. That data can include everything from lie\ndetector results to notes about whether an applicant engages in risky sexual behavior.\nThe hackers next delved into the complete personnel files of 4.2 million employees, past and\npresent. Then, just weeks before OPM booted them out, they grabbed approximately 5.6\nmillion digital images of government employee fingerprints.\n. . . The Congressional hearings that take place in the wake of national calamities often have\na vicious edge, and the one looking into the OPM hack was no exception. The agency\xe2\x80\x99s\ndirector, Katherine Archuleta, turned in a clumsy performance before the House Oversight\nCommittee: She failed to offer a clear idea of how many people had been affected by the\nattack, and she seemed to duck personal responsibility by repeatedly mentioning how difficult\nit is to secure OPM\xe2\x80\x99s aging \xe2\x80\x9clegacy systems.\xe2\x80\x9d The committee\xe2\x80\x99s members reacted with\npredictable scorn.\n. . . Damning details about OPM\xe2\x80\x99s porous security emerged at the hearing. The agency\xe2\x80\x99s own\nassistant inspector general for audits testified about what he characterized as a \xe2\x80\x9clong history\nof systemic failures to properly manage its IT infrastructure.\xe2\x80\x9d\nThe tone of the hearings struck some observers as overly brutal. The OPM brain trust received\nno credit for implementing the SSL decryption program that had led to the attack\xe2\x80\x99s discovery,\nnor for acting fast to quell the threat.\n...\nArchuleta resigned under pressure, and her CIO, Donna Seymour, opted for retirement days\nbefore she was to endure another round of grilling by the House committee. The two\nexecutives\xe2\x80\x99 departures struck fear into their peers across the federal bureaucracy.\nAnd here are some additional details, summarizing criticism of OPM\xe2\x80\x99s information-security\npractices that were identified in a 2014 audit:\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n149\n\nUnqualified InfoSec Personnel\nThe OPM\xe2\x80\x99s infosec system was managed by Designated Security Officers (DSO) that weren\xe2\x80\x99t\ncertified IT security professionals and were performing DSO duties in addition to their full-time\njobs. Despite updating to new IT security and privacy policies, the DSOs just weren\xe2\x80\x99t qualified\nto implement those policies \xe2\x80\xa6infosec personnel didn\xe2\x80\x99t report to the Chief Information Security\nOfficer (CISO) and they didn\xe2\x80\x99t employ experienced infosec professionals to manage their\nsecurity.\n. . . Vulnerability Scanning? . . . [A]uditors were unable to obtain tangible evidence that\nvulnerability scans were routinely conducted on all of OPM\xe2\x80\x99s servers in 2014.\nNo Insight, No Inventory\nThe report also found that OPM doesn\xe2\x80\x99t maintain an accurate centralized inventory of all of\ntheir servers, databases or network devices that reside within the network. Without insight into\nthis basic data, it\xe2\x80\x99s pretty hard to ensure OPM data is secured.\nUntimely Patch Management\nAlthough the OCIO applies operating system patches on all devices within OPM\xe2\x80\x99s network\nweekly, and uses a third-party patching software management program to update the\nsoftware, they still found, via scans, that numerous servers were not patched on a timely basis.\n. . . Poorly Configured SIEM\nAlthough the OPM owns a security information and event management (SIEM) tool that can\ndetect, analyze and correlate security incidents over time, it wasn\xe2\x80\x99t configured to receive\ndata from 20 percent of major OPM information systems.\nThe report also stated that OPM systems were over-reporting log and event data, resulting in\ntoo much data for their security analysts to review. Plus, there was a high volume of falsepositives that created a backlog and delay in identifying real incidents.\nNo PIV Authentication\nWhile over 95 percent of OPM workstations require PIV (Personal Identity Verification)\nauthentication to access the OPM network, none of the agency\xe2\x80\x99s 47 major apps require PIV\nauthentication. PIV is a type of government-issued smart card.\nNo Two-Factor Authentication\nAccording to the NYTimes.com, in an interview, OPM\xe2\x80\x99s Chief Information Officer (CIO) Donna\nSeymour said that installing two-factor authentication (multi-factor authentication) in the\ngovernment\xe2\x80\x99s \xe2\x80\x98antiquated environment\xe2\x80\x99 was difficult and very time-consuming.\n. . . Ultimately, the security report found that OPM had not undergone an adequate security\ncontrols test in more than eight years - which is more than enough time for new vulnerabilities\nto pop up and for breaches to go unnoticed. Don\xe2\x80\x99t wait that long to take a look at your own\ncompany\xe2\x80\x99s security controls in order to avoid a preventable breach.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n150\n\nConsider the following questions:\nFocus first on the technical story:\n\xe2\x80\xa2 How did the intruders gain access to OPM\xe2\x80\x99s system in the first place?\n\xe2\x80\xa2 How were they able to move laterally and extract data without detection?\nNow focus on the organizational story:\n\xe2\x80\xa2 Can you identify (or at least imagine) a set of factors that help explain why OPM did\nnot have better security?\n\xe2\x80\xa2 For each factor you identified, what exactly would a \xe2\x80\x9cfix\xe2\x80\x9d look like?\n\xe2\x80\xa2 What factors might make it hard in practice to adopt each such fix?\nAs long as we have this case study cued up, let\xe2\x80\x99s use it for a quick review:\n\xe2\x80\xa2 Can you categorize what China apparently did here, using the typology of\ngovernment actions we reviewed earlier in the course?\n\xe2\x80\xa2 In light of that categorization, and drawing on our prior discussions of US-China\nrelations, how should the U.S. government have responded to the OPM hack? Think\nof three specific potential actions, and list pros and cons for each.\n\nB. Tools to Generate Better Government Security\nPlainly, the government\xe2\x80\x99s own cybersecurity efforts sometimes fall short. And so the question\narises: What tools can we bring to bear to get the government to try harder?\nThat\xe2\x80\x99s the same question we have been exploring throughout Unit I.B., with reference to privatesector entities as the victims. We therefore might start by considering whether the tools used to\npush the private sector to do better might also help the government to push itself to do better.\n1. Tools that Work Poorly in this Setting\nAs we saw previously, one way to encourage defensive improvements is to increase the extent to\nwhich entities perceive that they are exposed to the risk of enforcement actions by regulators\nsuch as the FTC. Another is leverage from insurance companies. Neither really work where it is\nthe government itself we are trying to impact.\n\nCan you explain why that might be?\n\nGovernment entities do face the possibility of suits brought by private plaintiffs, at least in theory.\nBut such suits have a bad track record.\nThe first problem is \xe2\x80\x9csovereign immunity.\xe2\x80\x9d Unlike a private entity, federal and state government\nentities cannot be hauled into their own courts involuntarily; as sovereigns, they can only be sued\nif they have consented.\nDoes that ever happen? Yes, in fact waiver of sovereign immunity via statute is common. Both\nfederal and state laws are full of examples of statutes expressly waiving immunity as to certain\ntypes of claims. The question for us is: Do any of them apply in a setting where the government\nentity had poor cybersecurity? There are some that might, but in practice they\xe2\x80\x99ve not yet proven\nto have much bite in the cybersecurity setting.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n151\n\nThe most well-known statute of this kind at the federal level is the Federal Tort Claims Act. It waives\nimmunity where a person suffers personal injury, property damage, or death as a result of wrongful\nor negligent conduct by a government official. Most states (including Texas) have something\nsimilar on the books. It is difficult to use these laws to sue successfully for damages relating to a\ndata breach, however, in light of the injury requirement.\nA second option is the federal Privacy Act, which attempts to protect the confidentiality of\npersonally identifiable information held by the U.S. government. In relevant part, 5 U.S.C.\n552a(e)(10) states that the government must:\nestablish appropriate administrative, technical, and physical safeguards to insure the\nsecurity and confidentiality of records and to protect against any anticipated threats or\nhazards to their security or integrity which could result in substantial harm, embarrassment,\ninconvenience, or unfairness to any individual on whom information is maintained . . . .\nThe Privacy Act is a key part of the plaintiffs\xe2\x80\x99 claims in currently pending litigation known as In re:\nU.S. Office of Personnel Management Data Security Breach Litigation, which is a would-be classaction stemming from the OPM breach. The plaintiffs argue that OPM\xe2\x80\x99s poor security measures\nviolate the Privacy Act (among other things). Here, too, the question of damages looms large.\nThe Supreme Court in 2012\xe2\x80\x99s FAA v. Cooper had held, after all, that \xe2\x80\x9cemotional damages\xe2\x80\x9d are not\ncognizable under the Privacy Act. And with the OPM hack attributed widely to China as an act\nof espionage rather than an effort to raise money via identity theft, it was not surprising when the\ntrial court initially dismissed the lawsuit on the ground that the claims of damage were speculative,\nand thus that the plaintiffs lacked standing:\nRejecting plaintiffs\xe2\x80\x99 argument that they faced a heightened risk of identity theft due to the\nbreaches, the court held that the facts alleged failed to plausibly support the conclusion\nthat this risk of future injury was either substantial or clearly impending. The district court\nultimately concluded that only those plaintiffs who specifically identified out-of-pocket\nlosses stemming from the actual misuse of their data had suffered an injury in fact sufficient\nfor standing purposes. But even those plaintiffs lacked standing, the district court\nconcluded, because they failed to allege facts demonstrating that the misuse of their\ninformation was traceable to the OPM breaches in particular.\nBut then, in the summer of 2019, a divided D.C. Circuit Court of Appeals partially reversed this\ndetermination. The majority explained:\n[T]he district court should not have relied even in part on its own surmise that the Chinese\ngovernment perpetrated these attacks. Absent any factual allegations regarding the\nidentity of the cyberattackers, the district court was not free to conduct its own extrarecord research and then draw inferences from that research in OPM\xe2\x80\x99s and KeyPoint\xe2\x80\x99s\nfavor.\n. . . Beyond that, although a cyberattack on a government system might well be motivated\nby a purpose other than identity theft, given the type of information stolen in the OPM\nbreaches and Arnold Plaintiffs\xe2\x80\x99 allegations regarding the subsequent misuse of that\ninformation, it is just as plausible to infer that identity theft is at least one of the hackers\xe2\x80\x99\ngoals, even if those hackers are indeed affiliated with a foreign government. Our\ndissenting colleague takes a different tack, suggesting that because this case involves\ngovernment databases, \xe2\x80\x9cespionage is an \xe2\x80\x98obvious alternative explanation\xe2\x80\x99\xe2\x80\x9d for the\nattacks. . . . We disagree as to just how obvious an explanation this is based on the facts\nalleged in the complaint. Furthermore, given that espionage and identity theft are not\nmutually exclusive, the likely existence of an espionage-related motive hardly renders\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n152\n\nimplausible Arnold Plaintiffs\xe2\x80\x99 claim that they face a substantial future risk of identity theft\nand financial fraud as a result of the breaches.\n. . . Because Arnold Plaintiffs adequately allege a substantial risk of future identity theft,\nany expenses they have reasonably incurred to mitigate that risk likewise qualify as injury\nin fact.\n\nAre you persuaded? Why, or why not?\n\nAnother major hurdle that all plaintiffs under the Privacy Act must confront if they hope to recover\nmoney damages is the statute\xe2\x80\x99s peculiar mens rea requirement for that scenario. Simply put, the\nstatute provides that damages may be awarded for violations of the aforementioned duty\n(among other reasons), but only where \xe2\x80\x9cthe court determines that the agency acted in a manner\nwhich was intentional or willful \xe2\x80\xa6 \xe2\x80\x9d and the plaintiff suffered damages as a result. 5 U.S.C.\n552a(g)(4). Note that there is no such mens rea requirement if the plaintiff instead is seeking only\ninjunctive relief (that is, a court order directing an agency to do, or not do, some specific thing).\nSee id. at 552a(g)(2-3).\n\nWould you characterize OPM as having intentionally or willfully failed to meet its Privacy Act\nobligations?\n\nIntriguingly, some of the plaintiffs in the OPM litigation argued that OPM\xe2\x80\x99s poor effort to protect\ntheir information violated not just the Privacy Act but also the Constitution itself. Specifically, they\nargued that there is an (unwritten) constitutional right to \xe2\x80\x9cinformational privacy\xe2\x80\x9d that can be\nderived from the Due Process Clause of the Fifth Amendment (the text of which prohibits the\ndeprivation of life, liberty or property without due process of law), and that this asserted right\nperhaps could be read to impose an obligation of reasonable efforts to protect personally\nidentifiable information once in the government\xe2\x80\x99s hands.\nIs there such a right in the first place? The Supreme Court has largely dodged the question. In its\n2009 NASA v. Nelson decision, the majority assumed without deciding that some such a right might\nexist, citing two earlier cases that it depicted as having made a similar move (Justices Scalia and\nThomas dissented, calling for clear recognition that no such right has as yet been made part of\nthe Constitution, however desirable such a right might be as a matter of policy). But some circuit\ncourts, such as the Ninth Circuit, have been willing to go further, and in the same D.C. Circuit\ndecision in the OPM case discussed above, the majority was willing to assume, at least for now,\nthat such a claim exists.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n153\n\nConsider these questions:\n\xe2\x80\xa2 As a normative matter, what are the best arguments for and against permitting\npersons to sue for damages in circumstances like the OPM breach?\n\xe2\x80\xa2 If such a right should exist, should it take the form of a statute or of a constitutional\nright?\n\xe2\x80\xa2 Let\xe2\x80\x99s assume the government can be sued in these cases. Do you think that\nanticipation of liability risk for the government as a whole will impact agency decisionmaking in a manner similar to the way that litigation risk may impact the decisionmaking of private entities? Put yourself in the position of an agency head making\nbudget plans. What are your incentives, exactly?\n\n2. Tools that Work Well in this Setting\na) Direct mandates to do or not do certain things\nWhereas regulatory enforcement, insurance leverage, and liability risk all work better for\ninfluencing the private sector than for influencing the government itself, the reverse is true with\nrespect to another tool: direct mandates to do (or not do) certain things.\n\nWhy would it be easier for the government to impose direct mandates on itself, as compared\nto imposing them on the private sector?\n\nOur task now is to understand the way that the federal government, over time, has developed a\ncomplex system for imposing security mandates on itself.\nLet\xe2\x80\x99s start (somewhat arbitrarily) in 1996, during the Clinton administration. A statute passed that\nyear tasked the Secretary of Commerce with establishing information-security standards that most\nof the rest of the government would henceforth have to follow (the obligation would not extend\nto defense and intelligence agencies, however; they remained free to develop and enforce their\nown rules in this respect). The statute specified that the Secretary should base his or her directives\non the standards and guidelines developed by the Commerce Department\xe2\x80\x99s National Institute of\nStandards and Technology (better known as \xe2\x80\x9cNIST\xe2\x80\x9d), which is a deeply respected technical\norganization.\nFast-forward six years, to the early years of the George W. Bush administration. In 2002, at a time\nbefore the Department of Homeland Security existed, Congress passed the Federal Information\nSystems Management Act of 2002 (\xe2\x80\x9cFISMA,\xe2\x80\x9d pronounced \xe2\x80\x9cfiz-muh\xe2\x80\x9d). FISMA did three significant\nthings, for our purposes. First, it took the standard-setting role away from Commerce and gave it\nto the White House\xe2\x80\x99s Office of Management and Budget (OMB) (though in fulfilling that role OMB\nstill would remain reliant on the guidance provided by NIST, which remained part of the\nCommerce Department). Second, FISMA charged OMB with a critical further task: to monitor, on\nat least an annual basis, whether other agencies actually complied with its standards. And third,\nFISMA called for creation of an \xe2\x80\x9cinformation security incident center\xe2\x80\x9d that would both provide\nexpert advice (including in the face of an unfolding emergency) and function as a threatintelligence hub (collecting and analyzing information). This eventually resulted in creation of USCERT, which you read about previously in relation to the Equifax and OPM case studies.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n154\n\nSix years later, with DHS now in existence, President Bush issued National Security Presidential\nDirective 54/Homeland Security Presidential Directive 23. That 2008 Directive called for DHS to\nplay the lead role in protecting federal networks (other than military and intelligence systems).\nThis meant something much more concrete and direct than simply generating rules for other\nagencies to follow and then monitoring to see whether they complied. The order made US-CERT\npart of DHS (in particular, part of the directorate that eventually became CISA), and directed DHS\nto act through US-CERT to monitor and protect all \xe2\x80\x9cexternal access points\xe2\x80\x9d associated with federal\ngovernment systems, and to provide intrusion detection, incident analysis, and other capabilities.\nThat is to say, the order called upon DHS to take on operational responsibility for certain security\nfunctions on behalf of all other non-military, non-intelligence agencies. DHS responded to that\nassignment by, among other things, developing and deploying an intrusion-detection system that\ncame to be known as \xe2\x80\x9cEinstein.\xe2\x80\x9d Here is a DHS account of Einstein versions 2 and 3 from a few\nyears ago:\nDHS is deploying, as part of its EINSTEIN 2 activities, signature-based sensors capable of\ninspecting Internet traffic entering Federal systems for unauthorized accesses and malicious\ncontent. The EINSTEIN 2 capability enables analysis of network flow information to identify\npotential malicious activity while conducting automatic full packet inspection of traffic\nentering or exiting U.S. Government networks for malicious activity using signature-based\nintrusion detection technology. . . . EINSTEIN 2 is capable of alerting US-CERT in real time to the\npresence of malicious or potentially harmful activity in federal network traffic and provides\ncorrelation and visualization of the derived data. [Meanwhile, DHS is developing a new\nsystem], called EINSTEIN 3, [that] will draw on commercial technology and specialized\ngovernment technology to conduct real-time full packet inspection and threat-based\ndecision-making on network traffic entering or leaving these Executive Branch networks. . . .\nThe EINSTEIN 3 system will also support enhanced information sharing by US-CERT with Federal\nDepartments and Agencies by giving DHS the ability to automate alerting of detected\nnetwork intrusion attempts and, when deemed necessary by DHS, to send alerts that do not\ncontain the content of communications to the National Security Agency (NSA) so that DHS\nefforts may be supported by NSA exercising its lawfully authorized missions. . . . DHS will be able\nto adapt threat signatures determined by NSA in the course of its foreign intelligence and DoD\ninformation assurance missions for use in the EINSTEIN 3 system in support of DHS\xe2\x80\x99s federal\nsystem security mission. Information sharing on cyber intrusions will be conducted in\naccordance with the laws and oversight for activities related to homeland security,\nintelligence, and defense in order to protect the privacy and rights of U.S. citizens.\n\nCan you sum up what the Einstein system actually does, and for whom?\n\nWith DHS thus emerging as the lead agency for most aspects of the federal government\xe2\x80\x99s own\ncybersecurity, a question arose regarding whether it still made sense for OMB to have the oversight\nrole assigned to it by the 2002 FISMA (that is, the role of ensuring that other agencies were\ncomplying with OMB\xe2\x80\x99s NIST-based standards). In 2010, the Obama administration concluded that\nthe answer was no, and notwithstanding FISMA, proceeded to direct OMB to delegate its\noversight role to DHS. Then, in 2014, Congress ratified that division of labor in \xe2\x80\x9cFISMA 2014.\xe2\x80\x9d\nSo far so good. But note that, up to this point, the ability of DHS to compel other agencies to take\nparticular steps in the name of cybersecurity was limited to articulation of standards and\nmonitoring for compliance. Apart from the implicit name-and-shame element that came with\nthe filing of periodic reports from that compliance-monitoring process (an element that didn\xe2\x80\x99t\nseem to move the needle much in the case of OPM, it is worth noting), it was not clear what\nnegative consequences if any an uncooperative or non-responsive agency faced if it more-or-\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n155\n\nless just ignored DHS. Which helps us understand why, in 2014 and again in 2015, Congress granted\ncertain additional authorities to DHS. Specifically, DHS gained authority to issue mandatory\ndirectives addressing cybersecurity issues for all federal information systems (other than those\nassociated with the military and the Intelligence Community).\nThis authority comes in two varieties. First, CISA can issue \xe2\x80\x9cbinding operational directives\xe2\x80\x9d (\xe2\x80\x9cBODs\xe2\x80\x9d)\nin order to compel implementation of cybersecurity policies. This authority is codified at 44 U.S.C.\n3553(b)(2), and has been in place since FISMA 2014. Second, thanks to a statute Congress\nenacted in late 2015 (section 229 of the \xe2\x80\x9cFederal Cybersecurity Enhancement Act of 2015\xe2\x80\x9d), CISA\nalso can issue \xe2\x80\x9cemergency directives\xe2\x80\x9d (\xe2\x80\x9cEDs\xe2\x80\x9d) to compel agencies to take particular steps in\nresponse to specific security threats. This authority is codified at 44 U.S.C. 3553(h).\nThe full list of BODs and EDs that have been issued is found at https://cyber.dhs.gov/directives/. As\nof October 2020, there had been nine BODs and four EDs:\nBinding Operational Directives\n\xe2\x80\xa2 BOD 20-01 - Develop and Publish a Vulnerability Disclosure Policy\n\xe2\x80\xa2 BOD 19-02 - Vulnerability Remediation Requirements for Internet-Accessible Systems\n\xe2\x80\xa2 BOD 18-02 - Securing High Value Assets\n\xe2\x80\xa2 BOD 18-01 - Enhance Email and Web Security\n\xe2\x80\xa2 BOD 17-01 - Removal of Kaspersky-branded Products\n\xe2\x80\xa2 BOD 16-03 - 2016 Agency Cybersecurity Reporting Requirements\n\xe2\x80\xa2 BOD 16-02 - Threat to Network Infrastructure Devices\n\xe2\x80\xa2 BOD 16-01 - Securing High Value Assets (Revoked)\n\xe2\x80\xa2 BOD 15-01 - Critical Vulnerability Mitigation (Revoked)\nEmergency Directives\n\xe2\x80\xa2 ED 21-04 - Mitigate Windows Print Spooler Service Vulnerability\n\xe2\x80\xa2 ED 21-03 - Mitigate Pulse Connect Secure Product Vulnerabilities\n\xe2\x80\xa2 ED 21-02 - Mitigate Microsoft Exchange On-Premises Product Vulnerabilities\n\xe2\x80\xa2 ED 21-01 - Mitigate SolarWinds Orion Code Compromise\n\xe2\x80\xa2 ED 20-04 - Mitigate Netlogon Elevation of Privilege Vulnerability from 8/20 Patch Tuesday\n\xe2\x80\xa2 ED 20-03 - Mitigate Windows DNS Server Vulnerability from July 2020 Patch Tuesday\n\xe2\x80\xa2 ED 20-02 - Mitigate Windows Vulnerabilities from January 2020 Patch Tuesday\n\xe2\x80\xa2 ED 19-01 - Mitigate DNS Infrastructure Tampering\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\nCome to class prepared to describe a problem that gave rise to a BOD, and what\nthe BOD directed federal agencies to do in response to that problem.\nDo the same with respect to one of the EDs.\nCan you explain why CISA uses the BOD authority in some contexts and the ED\nauthority in others?\nNotice BOD 17-01. Does it strike you as different in kind from the other BODs?\nCongress later codified the prohibition on Kaspersky products, highlighting that similar\neffects can be achieved directly by statute. Why have BOD/ED authority, given that\noption?\nShould Congress extend CISA\xe2\x80\x99s authority to issue BODs and EDs so that it can issue\norders not just to government agencies, but also at least some private-sector\nentities? Be prepared to state the pros and cons, and consider separately the\npractical obstacles to adopting such a policy.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n156\n\nb) Provision of special services\nThere are other things CISA does to help level-up security for other government entities. For\nexample, CISA sometimes provides agencies with the sort of security-enhancing services that\none normally would hire a private information-security company to provide. The following chart\nprovides a rough overview of the sort of services CISA can provide (resources permitting):\n1. Continuous Diagnostics and Mitigation\n2. Enhanced Cybersecurity Services (Domain Name System sinkholing; email filtering)\n3. Hunt and Incident Response Team support (remote assistance; advisory deployment;\nremote deployment; on-site deployment)\n4. Advanced Malware Analysis Center\n5. Distribution to the public of threat intelligence and other useful information (ex: the FY2019\nRVA findings mapped to ATT&CK)\n6. Vulnerability Scanning\n7. Web App Scanning\n8. Phishing Campaign Assessment\n9. Remote Penetration Testing\n10. Risk & Vulnerability Assessment\n11. Cyber Resilience Review\n12. External Dependencies Management Assessment\n13. Cyber Infrastructure Survey\n14. Cyber Security Evaluation Tool\n15. Validated Architecture Design Review\nAt this point, we are ready to connect this topic directly to the case study on Holiday Bear and\nSolarWinds with which this book began. As you will recall, SVR managed to place SUNBURST on\na variety of federal agency systems via SolarWinds Orion, deploy Cobalt Strike BEACON on those\ncompromised systems, swim upstream into M365 cloud environments, and ultimately to exfiltrate\nemails and other information. Having just read about CISA\xe2\x80\x99s role in boosting federal agency\ncybersecurity, you might be wondering whether there was some way CISA could or should have\ndetected these activities. The short answer is no, because at that time each separate agency\nwas responsible in the first instance for its own security, and CISA had only limited ability\xe2\x80\x94\nrequiring the approval of those agencies\xe2\x80\x99 leaders\xe2\x80\x94to monitor for threats within those systems.\nFortunately, a statute passed in 2020 extended new authority to CISA on this very topic,\nauthorizing CISA to engage in threat-hunting on federal civilian executive branch systems\nwithout always having to secure the advance permission of agency leaders. While certainly not\na silver bullet for the Holiday Bear scenario, this will help.\nFinally, before leaving the topic of centralized security services, a quick note about the current\nstatus of US-CERT is in order. You may recall from our initial introduction to CISA that the functions\nof NCCIC remain in place even as internal organizational realignments call into question the\ncontinuing relevance of that specific name. Well, suffice to say that much the same can be\nsaid about US-CERT: the functions of US-CERT remain as before, and the name itself is still in use in\ncertain respects, but it is no longer clear that the old label is the best way to capture how CISA\nitself refers to these functions. For those of us on the outside, therefore, the same advice obtains:\nconcentrate on learning the functionality, and be mindful that different people may be using\ndifferent organizational labels to refer to the personnel executing those functions.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n157\n\nc) Risk management obligations\nIn May 2017, when President Trump issued Executive Order 13,800 (May 11, 2017), \xe2\x80\x9cStrengthening\nthe Cybersecurity of Federal Networks and Critical Infrastructure.\xe2\x80\x9d For now, we are concerned\nonly with Section 1 of that order. In relevant part, it states:\n(c) Risk Management\n(i)\n\nAgency heads will be held accountable by the President for implementing\nrisk management measures commensurate with the risk and magnitude of\nthe harm that would result from unauthorized access, use, disclosure,\ndisruption, modification, or destruction of IT and data. They will also be held\naccountable by the President for ensuring that cybersecurity risk\nmanagement processes are aligned with strategic, operational, and\nbudgetary planning processes.\n\n(ii)\n\nEffective immediately, each agency head shall use The Framework for\nImproving Critical Infrastructure Cybersecurity (the Framework) developed\nby the National Institute of Standards and Technology, or any successor\ndocument, to manage the agency\xe2\x80\x99s cybersecurity risk. Each agency head\nshall provide a risk management report to the Secretary of Homeland\nSecurity and the Director of the Office of Management and Budget (OMB)\nwithin 90 days of the date of this order. The risk management report shall:\n(A) document the risk mitigation and acceptance choices made by each\nagency head as of the date of this order, including:\n(1) the strategic, operational, and budgetary considerations that\ninformed those choices; and\n(2) any accepted risk, including from unmitigated vulnerabilities;\nand\n(B) describe the agency\xe2\x80\x99s action plan to implement the Framework.\n\n(iii)\n\nThe Secretary of Homeland Security and the Director of OMB\xe2\x80\xa6shall jointly\nassess each agency\xe2\x80\x99s risk management report to determine whether the\nrisk mitigation and acceptance choices set forth in the reports are\nappropriate and sufficient to manage the cybersecurity risk to the\nexecutive branch enterprise in the aggregate (the determination).\n\nIn what precise way does this approach increase pressure on agencies?\n\nIn our next reading, we will examine the most recent White House intervention in the general\nspace of government self-regulation, which to some extent is responsive to the Holiday Bear\ndebacle.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n158\n\n18. How the Government Protects Itself (II)\n\nLearning Objectives\n\xe2\x80\xa2\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\nBe able to describe the key features of President Biden\xe2\x80\x99s May 2021 Executive Order\nBe able to explain the difference among blue space, red space, and gray space (including\nhow to categorize a situation in which an adversary is using a server without the\nowner/operator\xe2\x80\x99s awareness)\nUnderstand the difference among these blue space scenarios: the DoDIN, foreign\ngovernment system\xe2\x80\x99s where the US military operates by invitation of the host government, and\nDefense Support of Civil Authorities\nWith respect to defense of the DoDIN, be able to describe why we have \xe2\x80\x9cCyber Protection\nTeams\xe2\x80\x9d (as part of JFHQ-DODIN) in addition to personnel attached directly to the particularly\nDoD entities whose systems they defend\nBe able to explain how JFHQ-DODIN has a role analogous to that of CISA in terms of\ncoordination, standard-setting, oversight/auditing, and issuance of directives\nUnderstand the policy rationales supporting the use of Cyber Protection Teams in \xe2\x80\x9chunt\nforward\xe2\x80\x9d missions\nUnderstand why both state/local/tribal governments in the United States, as well as other\nfederal government entities, might at time wish to draw on U.S. military defensive capabilities,\nand how the Stafford Act and the Economy Act enable this\nAppreciate why the \xe2\x80\x9cPosse Comitatus Act\xe2\x80\x9d is irrelevant to such support\nUnderstand what a \xe2\x80\x9cnational security system\xe2\x80\x9d is, and how NSA plays a role analogous to that\nof CISA in terms of coordination, standard-setting, etc. for such systems\n\nA. The May 2021 Biden Cybersecurity Executive Order\nPresident Biden issued an important executive order on cybersecurity in May 2021, one that\ntouches on many topics but that includes some elements further spurring the government\xe2\x80\x99s efforts\nto protect itself. Here are key excerpts from an overview I wrote with Trey Herr of the Atlantic\nCouncil for Lawfare:\nYesterday evening, the Biden administration released its much-anticipated \xe2\x80\x9cExecutive\nOrder on Improving the Nation\xe2\x80\x99s Cybersecurity.\xe2\x80\x9d\nIt is tempting to yawn; every\nadministration in recent memory has done something of this kind, after all, and not always\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n159\n\nto significant effect. But this executive order deserves your attention. It contains concrete\nmeasures tailored to respond to lessons learned from recent crises, especially the\nSolarWinds and Microsoft Exchange compromises.\nIs there more work to do? Obviously, yes. But to a significant extent that\xe2\x80\x99s a job for\nCongress. The question at the moment is whether the Biden administration with this\nexecutive order has made good use of the limited tools that it controls directly. As we\nexplain below, the answer is largely yes.\n\xe2\x80\xa6\n2. Cybersecurity is a sprawling problem. Which specific parts of that problem does the EO\naim to address?\nThe EO does not aim to address the entirety of the cybersecurity landscape. Instead, it\nfocuses on a handful of important aspects of that larger challenge, with a clear (and\nexpected) emphasis on those that were central to the SolarWinds/Sunburst and Microsoft\nExchange messes. Here\xe2\x80\x99s a shorthand overview of which parts of the order cover which\ngeneral topics:\nStages in the Cybersecurity Cycle and Corresponding Contributions From the EO\nPreventing intrusion\nSection 3 (cloud services; multi-factor authentication)\nSection 4 (software supply chain standards; \xe2\x80\x9cInternet of Things\xe2\x80\x9d (IoT) transparency)\nMinimizing impact of intrusion (pre-detection)\nSection 3 (data encryption; zero trust environment)\nDetecting and responding to intrusion\nSection 2 (notification requirements; enabled/required vendor cooperation)\nSection 3 (additional information sharing)\nSection 6 (uniform incident response playbook)\nSection 7 (endpoint detection and response; centralized threat-hunting)\nSection 8 (logging requirements)\nLearning (and disseminating) lessons from intrusion\nSection 5 (Cyber Safety Review Board)\nThat\xe2\x80\x99s the big picture. But remember: The EO largely is focused on the federal\ngovernment\xe2\x80\x99s own cybersecurity posture. This makes sense, given the limits on what the\npresident can accomplish unilaterally and given the role that SolarWinds/Sunburst\xe2\x80\x94an\nintrusion that made its way deep into government and private-sector systems\xe2\x80\x94played in\ngiving rise to this effort.\n3. Let\xe2\x80\x99s get to the specifics. What exactly is in the operative sections of the EO?\nThe operative parts of the EO are Sections 2-9. Here\xe2\x80\x99s what you need to know about each.\nSection 2: Ensuring that private entities supplying IT/OT services to federal agencies can\nand will share threat information with CISA, the FBI, etc.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n160\n\nSection 2 takes on an aspect of the information-sharing problem that was highlighted\xe2\x80\x94\nnot in a good way\xe2\x80\x94by the SolarWinds/Sunburst mess. Many federal information systems\nare run or supported by a private-sector service provider. These arrangements are\nsometimes based on contracts that are written in ways that fail to require the private\nvendor to share threat and incident information with other federal agencies, like CISA or\nthe FBI. Some such contracts may even prohibit such sharing. At any rate, the experience\nwith SolarWinds/Sunburst demonstrates that such contract complications really do\ninterfere with the ability of CISA and the FBI to obtain quick cooperation from outside\nvendors.\nIf contracts are the problem, then the procurement power is the solution. And that\xe2\x80\x99s what\nSection 2 is all about. It puts into motion a two-month process to review the contracting\nrules known as the Federal Acquisition Regulation (FAR) and the Defense Federal\nAcquisition Regulation Supplement (DFARS) with an eye toward a host of changes meant\nto address the aforementioned issue. The disclosure rules cover software products as well\nas, critically, any \xe2\x80\x9csupport system for a software product or service.\xe2\x80\x9d This covers a potential\nreporting gap for core technology systems like identity management (the kinds of systems\nrepeatedly abused in the SolarWinds/Sunburst crisis).\nEventually, FAR and DFARS will oblige service providers to do what boils down to three\nthings. First, they\xe2\x80\x99ll have to collect and preserve a broad array of information (including\ninformation relating to \xe2\x80\x9cevent prevention,\xe2\x80\x9d not just incident response). Second, they\xe2\x80\x99ll\nhave to share such information with the government when the information relates to an\nincident (or potential incident) that is relevant to the contract in question. And they\xe2\x80\x99ll have\nto cooperate with the federal entities involved in addressing or investigating incidents or\npotential incidents.\nAnother part of Section 2 sets in motion a separate change to FAR that eventually will result\nin a requirement that such providers also must affirmatively and \xe2\x80\x9cpromptly\xe2\x80\x9d report\ncybersecurity incidents involving a product or service provided to the government (or the\nsupport systems for such services/products). This, too, clearly reflects concerns brought to\nlight by recent experience.\nWhile incident data takes the starring role here, notice that the administration appears\ninterested in more than that. There is language as well about information necessary for the\ngovernment \xe2\x80\x9cto respond to cyber threats, incidents, and risks.\xe2\x80\x9d This implies a much broader\npotential range of data, and it may implicate companies that sell this kind of threat\nintelligence and cybersecurity data directly to the federal government. It\xe2\x80\x99s unclear if the\nnew rule will come with waivers to permit that kind of sale or if it will be covered under\nthese new disclosure guidelines. There is a wild card in Section (3) (e), moreover, with an\nopen-ended direction to DHS and the Office of Management and Budget (OMB) to\nensure service providers share this data \xe2\x80\x9cto the greatest extent possible.\xe2\x80\x9d Much of the\npractical impact of this section will come out in the implementation for these rules, so stay\ntuned.\nSection 3: Getting the government\xe2\x80\x99s own house in order (aka Cloud, More Cloud, and Don\xe2\x80\x99t\nTrust Anybody)\nIt\xe2\x80\x99s official: Cloud is in. While policies to encourage and support cloud adoption have been\nspreading across federal information technology over the past decade, the governance\nof cloud security has remained relatively immature. \xe2\x80\x9cSection 3. Modernizing Federal\nGovernment Cybersecurity\xe2\x80\x9d takes direct aim at this problem, charging CISA to develop\nsecure cloud adoption practices and guidelines, offer cloud incident responses to the\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n161\n\n.gov, and set policy on how agencies should work with partners like CISA and the FBI in\nresponding to cloud incidents. Per the executive order, OMB also will play an important\nrole, drafting a federal cloud security strategy with associated guidance for agencies. The\nchallenge for CISA (and OMB) is that the timeline to develop these complex policies is\ntight, 90 days or less in each case.\nSection 3 also includes a small but significant set of actions to modernize FedRAMP (the\nfederal government\xe2\x80\x99s main security authorization program for cloud services). The\nlanguage reads almost like language taken right from the Cloud Service Provider\nplaybook, with emphasis on more-automated, more-rapid and less-duplicative reviews of\nnew cloud services. The devil is in the details (the word \xe2\x80\x9cautomation\xe2\x80\x9d is plenty fungible),\nbut the inclusion of the entire cycle of FedRAMP (including continuous monitoring) pushes\nthe scope of these prospective changes out a long way, into the full life cycle of cloud\nservices. Most expansive is the possibility of mapping other security certifications and\ncompliance frameworks to FedRAMP in order to speed cloud service providers\xe2\x80\x99\nauthorization. That opens up significant opportunities for industry-led compliance\nframeworks, targeting, for example, only software as a service (SaaS) in order to supplant\nslower moving FedRAMP processes.\nAlongside the cloud lovefest is the \xe2\x80\x9czero trust architecture\xe2\x80\x9d concept. Zero trust is a loose\ncollection of technology concepts and security design philosophies rooted in the\nassumption that a breach is inevitable and that, accordingly, there should be strict limits\non access and authorization within a network. On this model, every device and every\ninteraction is presumptively suspicious and should be scrutinized accordingly, and access\nshould be strictly limited against a set of conditions and \xe2\x80\x9croles\xe2\x80\x9d (for example, CEO, system\nadministrator, and guest). The practical effect of zero trust is to require new processes to\nset and enforce rules for nearly everything that takes place\xe2\x80\x94from opening files on a share\ndrive to signing up a new mobile phone for Wi-Fi. The EO emphasizes zero trust as a means\nof ensuring more robust defenses even where supply chains are compromised or\norganizations breached. Implementing this kind of design philosophy is tough and time\nintensive. There is no one-stop-shop to \xe2\x80\x9cbuy\xe2\x80\x9d zero trust right now as it is as much about\nchanging culture as the type of technology users have. Whether a set of 60-day sprints\ncan successfully kickstart that transformation remains to be seen.\nA final note on Section 3: It also sets a 180-day deadline for all Federal Civilian Executive\nBranch (FCEB) entities to adopt multi-factor authentication and data encryption\npractices, and they will owe progress reports to CISA (and help from CISA) along the way.\nSection 4: Getting serious about software supply chain security\nIf you came for the software security, grab your popcorn because \xe2\x80\x9cSection. 4 Enhancing\nSoftware Supply Chain Security\xe2\x80\x9d does not disappoint. It takes an unusually specific\ntechnical view in places, and runs nearly to the end of the alphabet for sub-section\nheadings. It boils down to four broad areas:\nSoftware supply chain security guidance from the National Institute of Standards and\nTechnology (informed by a heavy emphasis on the security of the development\nenvironment and integrity/vulnerability checking), with eventual OMB enforcement to\nensure that agencies insist on compliance.\nInclusion of a Software Bill of Materials (SBOM) requirement in that guidance (and a\ndirective to the Department of Commerce (NTIA this time) to produce minimum\nspecifications for SBOMs).\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n162\n\nA definition of (and trailing set of actions based on) the concept of \xe2\x80\x9ccritical software,\xe2\x80\x9d\nincluding enforcement by OMB, along with support and guidance from DHS and NIST.\nEncouragement of IoT security and labeling.\nThe core software supply chain security guidance is in the hands of NIST, which is a popular\nrecurring character throughout the section. This is tricky territory for NIST, the Marylandbased boffins whose remit most generally tracks toward developing best practices and\nextensive consensus building around voluntary guidelines and special publications.\nSoftware supply chain security has been a challenge for policymakers in part because of\nthe gap between software development in standards and development in practice.\nPlacing most to all of the software supply chain security responsibility on a standards and\ntechnology research body may prove challenging.\nSoftware development gets a lot of attention in this section, but the focus is largely in line\nwith ensuring integrity of code at the root of the software supply chain. There are also\nseveral requirements for vendors to attest to the development and security standards\nrequired of them, including a limited public disclosure. Injecting this kind of information\nabout vendor security posture into the market is a good thing and a useful signal for\npotential customers of these companies outside the federal space. And SBOM is here at\nlast; look for more in the form of a minimum viable specification from Commerce in the\nnext 60 days.\nAll of these supply chain guidelines and practices will be applied to vendors of \xe2\x80\x9ccritical\nsoftware,\xe2\x80\x9d a term the EO introduces but will need DHS, the Office of the Director of National\nIntelligence, and others to precisely define. Agencies will similarly have new restrictions\nand guidance on how they operate \xe2\x80\x9ccritical software,\xe2\x80\x9d but it is unclear how this will\ninteract with existing programs like the DHS/NIST High Value Asset (HVA) program.\nTucked into the later stages of Section 4 are a sequence of actions on IoT supply chain\nsecurity addressing baseline security and development practices of vendors with input\nfrom NIST and a labeling program supported by the Federal Trade Commission. This\nincludes a big role for NIST to identify and ingest all existing cybersecurity and secure\nsoftware development labeling schemes and best practices and, in the case of software,\npossibly produce a \xe2\x80\x9ctiered software security rating system.\xe2\x80\x9d The prospect for movement\non cybersecurity labeling for IoT is exciting, answering several calls for such a program in\nthe United States and matching up with policies in the United Kingdom, Singapore and\nelsewhere. It may yet prove necessary for Congress to act in this space, however, before\nthere is widespread uptake of such transparency measures.\nSection 5: An NTSB for significant cyber incidents\nAnother much-anticipated idea breathed to life by the EO is the Cyber Safety Review\nBoard. The board will be an interagency group convened by DHS and featuring\nrepresentatives from the Defense Department, the Justice Department, CISA, the National\nSecurity Agency (NSA) and the FBI, as well as appointees from the private sector (tailored\nto the circumstances of the particular incident under review). The idea is to review\n\xe2\x80\x9csignificant cyber incidents\xe2\x80\x9d (which might involve breach of federal systems but also might\nencompass certain private-sector incidents), in order to extract lessons learned and then\ndisseminate those lessons appropriately.\nThe model is inspired by the National\nTransportation Safety Board, which reviews major transportation accidents like airplane\ncrashes and whose detailed investigative write-ups help inform risk assessments, vendor\nevaluations and operational practices.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n163\n\nThe EO specifies a specific first job for the Cyber Safety Review Board: extracting lessons\nlearned from SolarWinds/Sunburst. Of course, the EO itself shows that this learning process\nis already well in motion. That said, the EO also makes clear that the board in this first trot\naround the track also should use the occasion to identify lessons learned about itself,\nenabling the board process to work better in the future.\nSections 6, 7, and 8: Getting the federal cyber house in order, part II\nSections 6, 7 and 8 return to the theme of compelling federal agencies to improve their\ncybersecurity posture.\nThe sequence starts with \xe2\x80\x9cSection 6. Standardizing the Federal Government\xe2\x80\x99s Playbook for\nResponding to Cybersecurity Vulnerabilities and Incidents,\xe2\x80\x9d addressing the fact that the\nendless array of FCEB agencies apparently have an endless variety of incident response\nplaybooks.\nNo doubt the variation at least partially reflects tailoring to local\ncircumstances. But the net result of the variety is to make it more difficult for CISA, as the\ncentralized defensive lead, to ensure compliance effectively. So, Section 6 charges CISA\nto develop a standard incident response playbook (in consultation with a host of other\nagencies and organizations). It also tasks CISA to review and update the document\nannually with the NSA and clarifies CISA\xe2\x80\x99s authority to review agency response plans to\nensure conformity. In this way, Section 6 contributes to the ongoing process of moving CISA\nfurther out front as the central cybersecurity organization for FCEB agencies.\nThis is as good a time as any to recall that, in the words of one former House staffer, CISA\nis \xe2\x80\x9coverworked, understaffed and in one sense fighting half-blindfolded.\xe2\x80\x9d Increased\nauthority is good, in other words, but it needs to be matched by increased resources. The\nnext two years will be critical for CISA as Jen Easterly takes command and a prospective\ninfusion of budget paired with a surge in hiring may reshape the agency for good.\nOn to \xe2\x80\x9cSection 7. Improving Detection of Cybersecurity Vulnerabilities and Incidents on\nFederal Government Networks,\xe2\x80\x9d which responds to issues that have loomed large in the\nSolarWinds/Sunburst postmortems: the lack of strong (and consistent) endpoint detectionand-response (EDR) capabilities across many FCEB entities, and limits that existed (until\nrecently at least) on the ability of CISA to conduct threat-hunting across the systems of\nthose entities (with or without their permission). Section 7 directs all agencies to launch\ninitiatives to improve their EDR capabilities on a tight timeline, as well as other initiatives to\nenhance CISA\xe2\x80\x99s centralized threat-hunting capabilities. Relatedly, Section 7 also obliges\nagencies to enter into agreements to provide CISA access to object-level data in support\nof CISA\xe2\x80\x99s Continuous Diagnostics and Mitigation Program.\nThreat-hunting aficionados will recall that Congress actually granted CISA expanded (and\nclarified) centralized threat-hunting authority in Section 1705 of the fiscal 2021 National\nDefense Authorization Act. In a sign of the importance of that fresh authority, the EO calls\nfor CISA to produce a report in 90 days explaining how they are putting this authority to\nwork and also requires additional reporting every quarter describing its ongoing use.\nPrediction: These reports will confirm that CISA is trying to make the most of Section 1705\nbut will need more resources to make full use of it.\nNext up is \xe2\x80\x9cSection 8. Improving the Federal Government\xe2\x80\x99s Investigative and Remediation\nCapabilities.\xe2\x80\x9d Section 8 is very much a low-hanging fruit sort of provision, as it zeroes in on\nthe lack of network logs in many FCEB systems. As emphasized by some of the most\npointed criticism of vendors in the aftermath of SolarWinds/Sunburst, the amount (and\nnature) of data recorded to network logs, and how that data is retained and accessed,\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n164\n\ncan have a major influence on the speed and success of cyber incident response. DHS\naccordingly is charged with developing standard practices on logging, while OMB has\nresponsibility to enforce those practices across civilian agencies.\nNotably, some of the SolarWinds/Sunburst postmortems have suggested that FCEB logging\nissues sometimes result from financial constraints that led agencies to contract for vendor\nservices at price levels that did not include robust logging. Perhaps in response to this, the\nEO specifically directs OMB to work with agency leaders to ensure they have the resources\nneeded to meet the new logging requirements.\nSection 9: Don\xe2\x80\x99t forget about national security systems!\nAt this point it should be clear that most of the EO focuses on the .gov\xe2\x80\x94that is, the civilian\nagencies and the characters you know and love, like the Internal Revenue Service, the\nEnvironmnetal Protection Agency, the Department of State and more. But the Department\nof Defense and the intelligence community like the cloud and computing too, thank you\nvery much. So, what about them?\nScattered requirements in the main body of the EO, and especially in \xe2\x80\x9cSection 9. National\nSecurity Systems,\xe2\x80\x9d ensure that there are processes for the secretary of defense to\nincorporate all of the standards and guidelines developed in the order for national security\nsystems where applicable and appropriate. National security systems (and the .mil\nenvironment more broadly) thus are not the focus of this EO, but they do receive some\nlimited attention (with an emphasis on synchronizing with civilian agencies\xe2\x80\x99 security\ncontrols and data-collection practices).\n4. 8,000+ Words Later, Where Are We?\nIf you wanted a document that deals with critical infrastructure or taking the fight to\nforeign ransomware franchises, this EO is not for you. And that should come as no surprise.\nDespite the timing of the Colonial Pipeline incident last week, the EO is the culmination of\nan intensive period of work by the Biden cyber team sparked by the double-punch of\nSolarWinds/Sunburst and Microsoft Exchange vulnerabilities. The watchword that follows\nfrom those episodes is software security, with a heavy focus on federal incident response,\ninvestigation and remediation.\nThat\xe2\x80\x99s the center of gravity of the new EO. It is not revolutionary, but that shouldn\xe2\x80\x99t be the\nmeasure of success. The important question is whether it responds smartly to the important\nlessons learned from painful recent experience, and it does seem to do that. FCEB entities\nwill be forced to take a variety of important steps (perhaps most notably, basic things like\nthe new encryption and multi-factor authentication mandates). CISA will be pushed a bit\nfurther toward center stage, as the central cybersecurity organ of the .gov. Along the way,\nthe EO covers a lot of ground on secure software development and more risk-aware\ntreatment of \xe2\x80\x9ccritical software\xe2\x80\x9d alongside new policies on cloud security and attempts to\nshift the .gov environment to a new model of trust. There\xe2\x80\x99s even an IoT securitytransparency nudge.\nPlenty of questions and challenges remain, which is to be expected. For example, the EO\ndoes not wrestle with \xe2\x80\x9corg chart\xe2\x80\x9d challenges, such as the role in all of this for the Federal\nAcquisition Security Council or the federal chief information security officer, who go\nunmentioned. Nor does it grapple directly with the future role of the national cyber\ndirector (NCD), which soon will be filled by the esteemed Chris Inglis. It remains to be seen\nhow (if at all) the new programs and reporting lines\xe2\x80\x94many of which include reporting to,\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n165\n\nor decisions from, the assistant to the president for national security affairs\xe2\x80\x94will change at\nthat point (while the NCD is not mentioned in the main body of the EO, there is an option\nto allow that \xe2\x80\x9cportions of this order may be modified to enable the NCD to fully execute\nits duties and responsibilities\xe2\x80\x9d). That may influence the timelines of some of these activities\nas well.\nBottom line: The EO goes far toward picking the low-hanging fruit (and some not-so-lowhanging fruit) highlighted by recent challenges. In terms of systematic improvements for\nthe nation\xe2\x80\x99s cybersecurity, attention should now shift to Congress. The EO\xe2\x80\x99s prescriptive\nelements may be a useful model for how Congress might take steps to bolster security in\nat least some critical infrastructure subsectors, for example. And only Congress can\nprovide the increased resources that ultimately are needed to realize the full impact of\nthese new policies.\n\n\xe2\x80\xa2\n\nWhich parts of the EO strike you as most important in terms of improving federal\ncivilian cybersecurity?\n\nB. Cybersecurity for the Military\nWe have noted at several points that the roles played by OMB and DHS/CISA do not apply to\nsystems belonging to the military or to the Intelligence Community. Our task now, accordingly, is\nto understand at least a bit about how those critical parts of the federal government go about\ndefending themselves.\nThe efforts of the Department of Defense (\xe2\x80\x9cDoD\xe2\x80\x9d) to defend itself can be broken down into two\ncategories: First, direct defense of its own networks and other systems that might constitute \xe2\x80\x9cblue\nspace.\xe2\x80\x9d Second, indirect efforts to boost the defense of private-sector actors that play an\nimportant role in relation to national defense.\n1. Securing the DoDIN\nNot surprisingly, DoD is not subject to the OMB/CISA system of cybersecurity oversight that we\ndiscussed in the last reading. Instead, DoD itself shoulders the responsibility for ensuring that its\nown vast web of information systems and communication networks are defended appropriately.\nThat vast web is known, collectively, as the Department of Defense Information Network, or\n\xe2\x80\x9cDoDIN\xe2\x80\x9d (pronounced \xe2\x80\x9cdoh-din\xe2\x80\x9d). One commentator memorably described DoDIN as \xe2\x80\x9creally not\na single network, but a quasi-feudal patchwork of often incompatible local networks. It\xe2\x80\x99s the Holy\nRoman Empire of cyberspace.\xe2\x80\x9d\nHow does DoD organize to ensure the DoDIN is defended appropriately?\nStart with the fact that the constituent elements of the DoDIN each belong to some constituent\nelement within DoD: a combatant command (for example, Central Command (CENTCOM)), a\nservice branch (for example, the Navy), a combat-support agency (for example, the Defense\nInformation Support Agency), and so forth. As Joint Publication 13-2 explains, each such entity is\nauthorized and has some capacity of its own \xe2\x80\x9cto take . . . defensive actions . . . and to restore the\nsystem to a secure configuration.\xe2\x80\x9d Not all threats can be dealt with sufficiently by such \xe2\x80\x9clocal\xe2\x80\x9d\nresources, however, and in any event, many threats are not confined to a single entity\xe2\x80\x99s systems.\nThis, plus the general need for higher levels of planning, coordination, and oversight, eventually\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n166\n\ngave rise to the creation of a headquarters element focused on DoDIN defense: \xe2\x80\x9cJFHQ-DoDIN,\xe2\x80\x9d\nwhich stands for Joint Forces Headquarters-DoDIN.\nJFHQ-DoDIN is a \xe2\x80\x9csubordinate headquarters\xe2\x80\x9d within U.S. CYBERCOM (an organization we have\ndiscussed some already, and will discuss more once we reach Unit II). It can assign \xe2\x80\x9ccyber\nprotection teams\xe2\x80\x9d as needed to assist in defense of the DoDIN, and it also can take charge or\ncoordinate as needed where multiple elements of the system are involved, or where there may\nbe spillover effects of other kinds.\nIn addition to this operational function, JFHQ-DoDIN also has an oversight/management function\nanalogous to that performed by OMB/CISA. On that dimension, JFHQ-DoDIN oversees the\nowner/operators of the many component parts of the DoDIN as they engage in prospective riskassessment; aggregates and assesses the results from those efforts; and issues directives for\nchange where needed.\n2. Beyond the DoDIN: Defending \xe2\x80\x9cBlue Space\xe2\x80\x9d\nDoD uses the phrase \xe2\x80\x9cblue space\xe2\x80\x9d to describe cyber operational environments in which DoD is a\nknown and authorized presence. This includes, obviously, the DoDIN itself. But there are contexts\nin which DoD may become a known and authorized defender. Collectively, the combination of\nthe DoDIN with these others constitute \xe2\x80\x9cblue space\xe2\x80\x9d environments.\n\xe2\x80\x9cBlue space\xe2\x80\x9d is in contrast to operations that might occur on an adversary\xe2\x80\x99s system (\xe2\x80\x9cred space,\xe2\x80\x9d\nwhich includes any system the adversary has the ability to control to the exclusion of others), and\noperations that might occur on the systems of third parties (\xe2\x80\x9cgray space,\xe2\x80\x9d which includes any\nsystem not constituting blue space or red space).\n\n\xe2\x80\xa2\n\nCan you think of reasons why these distinctions matter?\n\nOf course, the idea of DoD being asked to defend non-DoDIN systems raises a question about\nwhen and how such requests occur. In contexts involving partner nations overseas, it typically is\nas a government-to-government agreement. CYBERCOM personnel, for example, have assisted\ncountries including Montenegro, Ukraine, and North Macedonia via \xe2\x80\x9chunt forward\xe2\x80\x9d missions\nintended to identify malware targeting critical systems there. Consider this November 2019\naccount, from Shannon Vavra at CyberScoop:\nU.S. European Command and U.S. Cyber Command are deploying an undisclosed\nnumber of defensive cyber-operators to Montenegro in order to gain insights into\ncyberthreats from adversaries before both the U.S. and Montenegrin elections next year.\nIt\xe2\x80\x99s the second time in as many years the Department of Defense is going through the\neffort as part of a partnership that\xe2\x80\x99s uniquely poised to provide insights on possible Russian\nelection interference.\nMontenegro and the U.S. both have been targeted by the Russian government-linked\nhacking outfit APT28, or Fancy Bear. If Cyber Command uncovers similar activity again in\nMontenegro, those insights could inform decisions on how to safeguard the U.S.\n\xe2\x80\x9cMontenegro is among the first in Europe to face unconventional attacks on its\ndemocracy and freedom of choice,\xe2\x80\x9d Montenegrin Defense Minister Predrag Boskovic\nsaid in a statement. \xe2\x80\x9cIt is precisely in the face of new challenges with the United States that\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n167\n\nwe seek a way, using their resources, to protect democracy in the Western Balkans from\nthose who would keep this part of Europe in conflicts, setbacks, and economic decline.\xe2\x80\x9d\nIn 2016 and 2017 Montenegro\xe2\x80\x99s government agencies and media outlets were targeted\nby several different cyberattacks that Montenegro has tied to APT28, one of the same\ngroups behind the 2016 Democratic National Committee breach.\nWhen CyberScoop asked Cyber Command to detail lessons learned from last year and\nwhat instructions American service members will be assigned while in Montenegro this\nyear, U.S. officials said only that they would be countering malicious actors on critical\nnetworks. The U.S. service members are specifically focused on finding new and unknown\nmalware that could pose a threat to the U.S. or to Montenegro.\nU.S. Secretary of State Mike Pompeo said last month the U.S. has been able to protect\nagainst the latest Russian malware as a direct result of insights gathered from last year\xe2\x80\x99s\ncollaboration. Russian hackers previously targeted Montenegro with spearphishing attacks\nthat could, for instance, yield technical data for its American allies.\n\xe2\x80\x9cWe\xe2\x80\x99ve been able to develop a patch against the latest Russian malware that now\nprotects millions of devices worldwide,\xe2\x80\x9d Pompeo said during a trip to Montenegro\xe2\x80\x99s\ncapital, Podgorica.\nWhen the U.S. deployment ended last fall, Montenegro suggested resuming the\npartnership, a Cyber Command spokesperson told CyberScoop. The Pentagon effort is\nscheduled to end by the end of this year, they added.\nThe \xe2\x80\x9chunt\xe2\x80\x9d continues\xe2\x80\xa6\nThese kinds of missions, known as \xe2\x80\x9cHunt Forward\xe2\x80\x9d operations, are relatively new for Cyber\nCommand. Last year, along with Montenegro, Cyber Command also deployed\npersonnel to Ukraine and North Macedonia to collect insights into adversarial cyberthreats\nin preparation for the 2018 midterm elections.\nA Hunt Forward mission, which typically sends anywhere between five and 30 U.S. service\nmembers to hunt for malware at a time, is broadly defined as an intelligence-gathering\none and a protection one.\n\xe2\x80\x9cThe team\xe2\x80\x99s operations are part of efforts to persistently engage adversaries in\ncyberspace, working to protect critical infrastructure alongside valued partners and\nallies,\xe2\x80\x9d the Cyber Command spokesperson told CyberScoop, adding that they \xe2\x80\x9calso\ngenerate insights into adversarial cyber threats to the upcoming U.S. and Montenegrin\nelections in 2020.\xe2\x80\x9d\nMontenegro also has been working to bolster its own efforts in other ways. It announced\nlast year it would be joining the North Atlantic Treaty Organization\xe2\x80\x99s cyberdefense\ncenter in Estonia, for example, which aims to boost information sharing among member\nnations.\nThe announcement comes weeks after Russian President Vladimir Putin joked about the\nprospect of interfering U.S. elections in 2020, saying \xe2\x80\x9cI\xe2\x80\x99ll tell you a secret: Yes, we\xe2\x80\x99ll definitely\ndo it. Just don\xe2\x80\x99t tell anyone.\xe2\x80\x9d\nThis news also comes amid warnings from the U.S. intelligence officials that multiple\nadversaries are seeking to interfere in the 2020 U.S. presidential election. While last year the\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n168\n\nNational Security Agency and Cyber Command jointly ran a task force to counter Russian\nefforts to interfere in U.S. elections, that so-called Russian Small Group has since been\nexpanded to include fend off threats from Russia, China, Iran, and North Korea.\nAside from Montenegro, it is unclear what other countries Cyber Command may be\npartnering with moving forward to run Hunt Forward missions. The Montenegro mission is\nthe only Hunt Forward operation ongoing right now. Earlier this year Cyber Command told\nreporters it had ongoing deployments abroad with multiple allies, which it declined to\nname. These have each ended at this time.\nAlmost exactly a year later, Julian Barnes at the New York Times had this assessment of morerecent \xe2\x80\x9chunt forward\xe2\x80\x9d activities:\nThe United States Cyber Command expanded its overseas operations aimed at finding\nforeign hacking groups before the election on Tuesday, an effort to identify not only\nRussian tactics but also those of China and Iran, military officials said.\nIn addition to new operations in Europe to pursue Russian hackers, Cyber Command sent\nteams to the Middle East and Asia over the past two years to help find Iranian, Chinese\nand North Korean hacking teams and identify the tools they were using to break into\ncomputer networks.\n\xe2\x80\xa6 Officials would identify only regions and not the countries they had operated in before\nthe 2020 election. But Cyber Command officials said those efforts uncovered malware\nbeing used by adversarial hacking teams. Other government agencies used that\ninformation to help state and local officials shore up their election system defenses and to\nnotify the public about threats.\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\nCan you list the benefits that \xe2\x80\x9chunt forward\xe2\x80\x9d activities yield for the United States?\nWhat are the pros and cons of having the U.S. military perform this function, and are\nthere realistic alternatives?\n\nWhen the context for non-DoDIN blue-space operations instead is domestic, things of course are\nmore complicated given the robust traditions, legal constraints, and political sensitivities that\ncombine to limit the role that the U.S. military normally can play in domestic life. That said, there\nare contexts in which DoD personnel or equipment are used to assist civil authorities during an\nexigency, particularly where the military has unique capabilities. DoD refers to this category of\nactivity, in general, as \xe2\x80\x9cDefense Support of Civil Authorities\xe2\x80\x9d (DSCA). It is the sort of thing that\ncomes up without much controversy during hurricanes or other natural disasters, but it can and\ndoes extend to other contexts. These days, one such context is cyberspace.\nThe following passage, from a recent Government Accountability Office report, provides an\neasy introduction to two statutory authorities that might result in CYBERCOM providing support to\ncivil authorities:\nUnder the Robert T. Stafford Disaster Relief and Emergency Assistance Act (the Stafford Act),\nwhen state capabilities and resources are overwhelmed and the President of the United States\ndeclares an emergency or disaster, the governor of an affected state can request assistance\nfrom the federal government for major disasters or emergencies. The Stafford Act aims to\nprovide a means of assistance by the federal government to state and local governments in\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n169\n\nresponding to a presidentially declared major disaster or emergency. A governor\xe2\x80\x99s request for\nthe President to declare a major disaster or emergency is required to be based on a finding\nthat the situation is of such severity and magnitude that effective response is beyond the\ncapabilities of the state and the affected local governments and that federal assistance is\nnecessary.\nAdditionally, under the Economy Act, a federal agency may request the support of another\nfederal agency, including DOD, without a presidential declaration of a major disaster or an\nemergency. This act permits one federal agency to request goods and services from another\nfederal agency provided that, among other things, the service is available and cannot be\nobtained more cheaply or conveniently by contract.\n\nConsider these questions:\n\xe2\x80\xa2\n\xe2\x80\xa2\n\nCan you explain why it is easier to rely on the Economy Act than the Stafford Act?\nCan you explain how each might be the vehicle allowing CYBERCOM to extend its\ndefensive capabilities to the benefit of CISA, a state, or another entity?\n\n\xe2\x80\xa2\nNote: Any conversation on this topic inevitably comes around to some version of the question:\nDoesn\xe2\x80\x99t the Posse Comitatus Act (PCA) bar the military from having any involvement in domestic\naffairs? That is a common, but incorrect, understanding of the PCA. It provides:\nWhoever, except in cases and under circumstances expressly authorized by the Constitution\nor Act of Congress, willfully uses any part of the Army or the Air Force as a posse comitatus or\notherwise to execute the laws shall be fined under this title or imprisoned not more than two\nyears, or both.\n\nCan you explain why, in light of that language, CYBERCOM at least sometimes can provide\nsupport to CISA, etc.? Try to identify two distinct reasons.\n\nC. Cybersecurity for the Intelligence Community\nWhat about protection of the information systems that carry the nation\xe2\x80\x99s classified information\nand other aspects of the intelligence enterprise, apart from the DoDIN? A key term-of-art for such\nsystems is \xe2\x80\x9cNational Security Systems.\xe2\x80\x9d As noted above, the OMB/CISA role does not apply to such\nsystems, but they are not the exclusive province of the military either. Who defends them?\nThe answer is complicated, for various agencies within the Intelligence Community have their own\nin-house capabilities with respect to the defensive aspects of cybersecurity. For our purposes, the\nmain thing to understand is that the NSA plays the most significant operational role in protecting\nthese networks.\nRelated to this is the Committee on National Security Systems. CSSS is an interagency body with\nrepresentation from 21 separate government agencies, tasked with setting national policy\xe2\x80\x94and\nissuing corresponding guidance and procedures\xe2\x80\x94with respect to protection of National Security\nSystems. NSA\xe2\x80\x99s Director is the designated \xe2\x80\x9cNational Manager\xe2\x80\x9d for this function, as one might\nexpect. Note that CSSS can and does issue directives with which agencies must comply, much\nas CISA can for civilian systems and JFHQ-DoDIN can for military systems.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n170\n\n19. Improving Cybersecurity for the Nation\xe2\x80\x99s Critical infrastructure\n\nLearning Objectives:\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\nAppreciate why it is difficult to write a precise definition of \xe2\x80\x9ccritical infrastructure\xe2\x80\x9d\nBe able to state the statutory definition found in 42 USC 5195c(e), and to explain whether and\nhow some of its key terms are indeterminate\nUnderstand how that indeterminacy leaves it to the executive branch to develop moreprecise descriptions of which entities are \xe2\x80\x9cin\xe2\x80\x9d and which are \xe2\x80\x9cout\xe2\x80\x9d\nKnow that PPD-21 adopted a 16-sector model of CI, and that it remains in force today\nUnderstand that for most of those categories, there inevitably will be close-calls on the margins\nKnow that election systems were added to the list (as a sub-sector) only after the 2016 election,\nand be able to explain why this step was controversial\nBe able to explain why private-sector ownership of most CI gives rise to substantial difficulties\ninsofar as one might want to impose strict regulations on such entities (or even have NSA or\nsome other government entity play an operational role in defending the systems of such\nentities)\nAppreciate that CISA does not have general regulatory authority over CI entities vis-\xc3\xa0-vis\ncybersecurity; ponder whether it should\nUnderstand that some CI sectors already are subject to the regulatory authority of some\nsector-specific agency, including authority relating to cybersecurity (for example, think of the\nFTC and Financial Services)\nBe able to identify a few security-related consequences that do follow from a CI designation\n(including the idea of having \xe2\x80\x9cpriority\xe2\x80\x9d for certain government actions)\nUnderstand that all CI entities are encouraged (but not required) to adopt the NIST\nCybersecurity Framework\nBe able to give a general description of what the Framework is and why it might add value\nfor an entity\nBe able to describe the various ideas that Michael Daniel summed up in his 2013 report on the\nfruits of an interagency process that brainstormed concepts for improving CI cybersecurity\nUnderstand why one might want there to be a subcategory of CI limited to the most-important\nentities, and how this relates to the idea of \xe2\x80\x9cSection 9\xe2\x80\x9d entities\nBe able to explain what consequences currently attach for an entity added to the Section 9\nlist, but also what other consequences might also apply one day (and be able to explain why\none might create the Section 9 list before adding those additional consequences)\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\n171\n\nWith respect to encouraging the Defense Industrial Base to defend itself better, be able to\nexplain the change introduced by the \xe2\x80\x9cCybersecurity Maturity Model Certification\xe2\x80\x9d\n(\xe2\x80\x9cCMMC\xe2\x80\x9d) system\nUnderstand the importance of the \xe2\x80\x9cwho is paying\xe2\x80\x9d question lurking beneath the surface of the\nCMMC, and be able to explain how it appears this question will be answered\nPonder whether the same payment model would work in other \xe2\x80\x9ccritical infrastructure\xe2\x80\x9d\ncontexts apart from the Defense Industrial Base\n\nMost breaches involving systems owned or operated by the private sector do not implicate the\nnational interest in an acute way (though the cumulative effect of such breaches is a different\nstory). But when the system in question constitutes part of the nation\xe2\x80\x99s \xe2\x80\x9ccritical infrastructure,\xe2\x80\x9d then\nby definition the stakes are higher. Our task: understanding which contexts \xe2\x80\x9ccount\xe2\x80\x9d in this\nparticular way; which officers or institutions get to decide when such a context is present; and\nwhat follows from such a determination.\nA. What Counts?\nLet\xe2\x80\x99s begin by exploring the scope of the concept \xe2\x80\x9ccritical infrastructure\xe2\x80\x9d (that is, \xe2\x80\x9cCI\xe2\x80\x9d). That\nformerly obscure label is now commonplace. But what does it really mean?\nAt a high level of generality, \xe2\x80\x9cCI\xe2\x80\x9d captures that idea that our daily lives and the economy depend\nto no small extent on certain particularly important systems, services, and structures. As DHS has\nput it:\n[C]ritical infrastructure provides the essential services that underpin American society and\nserve as the backbone of our nation\xe2\x80\x99s economy, security, and health. We know it as the\npower we use in our homes, the water we drink, the transportation that moves us, the stores\nwe shop in, and the communication systems we rely on to stay in touch with friends and\nfamily.\n\nConsider these questions:\n\xe2\x80\xa2 Are the generalized examples mentioned in that second sentence all equally\n\xe2\x80\x9ccritical\xe2\x80\x9d? If not, rank them from most vital to least as you see it.\n\xe2\x80\xa2 What policy implications follow from the idea that some CI is more critical than others?\n\nNow let\xe2\x80\x99s get more specific. A federal statute (42 U.S.C. 5195c(e)) defines \xe2\x80\x9ccritical infrastructure\xe2\x80\x9d\nto mean:\n[S]ystems and assets, whether physical or virtual, so vital to the United States that the\nincapacity or destruction of such systems and assets would have a debilitating impact on\nsecurity, national economic security, national public health or safety, or any combination\nof those matters.\nIn 2013, moreover, President Obama via Presidential Policy Directive 21 (\xe2\x80\x9cPPD-21\xe2\x80\x9d) split the general\ncategory of CI into 16 distinct \xe2\x80\x9csectors.\xe2\x80\x9d Here is the list as set forth on CISA\xe2\x80\x99s page on this topic\n(note how the list includes language identifying a \xe2\x80\x9csector-specific agency\xe2\x80\x9d to be the lead\ngovernment agency for purposes of working with companies in that sector on security matters):\n1. Chemical Sector\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n172\n\nThe Department of Homeland Security is designated as the Sector-Specific Agency for the\nChemical Sector.\n2. Commercial Facilities Sector\nThe Department of Homeland Security is designated as the Sector-Specific Agency for the\nCommercial Facilities Sector, which includes a diverse range of sites that draw large\ncrowds of people for shopping, business, entertainment, or lodging.\n3. Communications Sector\nThe Communications Sector is an integral component of the U.S. economy, underlying the\noperations of all businesses, public safety organizations, and government. The Department\nof Homeland Security is the Sector-Specific Agency for the Communications Sector.\n4. Critical Manufacturing Sector\nThe Department of Homeland Security is designated as the Sector-Specific Agency for the\nCritical Manufacturing Sector.\n5. Dams Sector\nThe Department of Homeland Security is designated as the Sector-Specific Agency for the\nDams Sector. The Dams Sector comprises dam projects, navigation locks, levees, hurricane\nbarriers, mine tailings impoundments, and other similar water retention and/or control\nfacilities.\n6. Defense Industrial Base Sector\nThe U.S. Department of Defense is the Sector-Specific Agency for the Defense Industrial\nBase Sector. The Defense Industrial Base Sector enables research, development, design,\nproduction, delivery, and maintenance of military weapons systems, subsystems, and\ncomponents or parts to meet U.S. military requirements.\n7. Emergency Services Sector\nThe Department of Homeland Security is designated as the Sector-Specific Agency for the\nEmergency Services Sector. The sector provides a wide range of prevention,\npreparedness, response, and recovery services during both day-to-day operations and\nincident response.\n8. Energy Sector\nThe U.S. energy infrastructure fuels the economy of the 21st century. The Department of\nEnergy is the Sector-Specific Agency for the Energy Sector.\n9. Financial Services Sector\nThe Department of the Treasury is designated as the Sector-Specific Agency for the\nFinancial Services Sector.\n10. Food and Agriculture Sector\nThe Department of Agriculture and the Department of Health and Human Services are\ndesignated as the co-Sector-Specific Agencies for the Food and Agriculture Sector.\n11. Government Facilities Sector\nThe Department of Homeland Security and the General Services Administration are\ndesignated as the Co-Sector-Specific Agencies for the Government Facilities Sector.\n12, Healthcare and Public Health Sector\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n173\n\nThe Department of Health and Human Services is designated as the Sector-Specific\nAgency for the Healthcare and Public Health Sector.\n13. Information Technology Sector\nThe Department of Homeland Security is designated as the Sector-Specific Agency for the\nInformation Technology Sector.\n14. Nuclear Reactors, Materials, and Waste Sector\nThe Department of Homeland Security is designated as the Sector-Specific Agency for the\nNuclear Reactors, Materials, and Waste Sector.\n15. Transportation Systems Sector\nThe Department of Homeland Security and the Department of Transportation are\ndesignated as the Co-Sector-Specific Agencies for the Transportation Systems Sector.\n16. Water and Wastewater Systems Sector\nThe Environmental Protection Agency is designated as the Sector-Specific Agency for the\nWater and Wastewater Systems Sector.\n\nWould you add anything to this list? What do you think does not belong?\n\nPPD-21 also directed the Secretary of Homeland Security to update this list periodically. Normally,\nsuch moves draw little attention. But just prior to the inauguration of President Trump in January\n2017, DHS Secretary Jeh Johnson added election systems to the CI list for the first time (adding this\nas a subsector in the \xe2\x80\x9cgovernment facilities\xe2\x80\x9d category, alongside existing subsectors for\n\xe2\x80\x9ceducation facilities\xe2\x80\x9d and \xe2\x80\x9cnational monuments and icons\xe2\x80\x9d). Secretary Johnson explained:\nI have determined that election infrastructure in this country should be designated as a\nsubsector of the existing Government Facilities critical infrastructure sector. Given the vital\nrole elections play in this country, it is clear that certain systems and assets of election\ninfrastructure meet the definition of critical infrastructure, in fact and in law. . . .\nBy \xe2\x80\x9celection infrastructure,\xe2\x80\x9d we mean storage facilities, polling places, and centralized\nvote tabulations locations used to support the election process, and information and\ncommunications technology to include voter registration databases, voting machines,\nand other systems to manage the election process and report and display results on behalf\nof state and local governments.\nPrior to reaching this determination, my staff and I consulted many state and local election\nofficials; I am aware that many of them are opposed to this designation. It is important to\nstress what this designation does and does not mean. This designation does not mean a\nfederal takeover, regulation, oversight or intrusion concerning elections in this country. This\ndesignation does nothing to change the role state and local governments have in\nadministering and running elections.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n174\n\nConsider these questions:\n\xe2\x80\xa2 Are you surprised that election infrastructure was not already covered?\n\xe2\x80\xa2 Why do you suppose it was not covered before, and for that matter, why do you\nsuppose some \xe2\x80\x9cstate and local election officials\xe2\x80\x9d were \xe2\x80\x9copposed to this designation\xe2\x80\x9d?\n\xe2\x80\xa2 The statement lists various things that will not happen as a result of the designation.\nDoes the scope of that list give you pause regarding the utility of making this\ndesignation in the first place?\n\nLet\xe2\x80\x99s use a mini-case study to give you a richer feel for the breadth of the CI definition. Recall that\nNorth Korea several years ago engaged in a massive hack of Sony Pictures Entertainment to\npunish Sony for producing the comedy \xe2\x80\x9cThe Interview.\xe2\x80\x9d Was that an attack on America\xe2\x80\x99s critical\ninfrastructure, at least insofar as DHS CISA is concerned? To answer questions like that, you have\nto be familiar with the \xe2\x80\x9csector-specific plans\xe2\x80\x9d produced by DHS for each of the 16 CI sectors listed\nabove. If you read the sector-specific plan for the \xe2\x80\x9cCommercial Facilities\xe2\x80\x9d sector, you will find that\nit includes a variety of more specific \xe2\x80\x9csub-sectors,\xe2\x80\x9d including the following:\nEntertainment and Media Subsector . . .\nThe subsector includes media production facilities (e.g., television and motion pictures),\nprint media companies (e.g., newspapers, magazines, and books), and broadcast\ncompanies (e.g., television and radio stations). These outlets reach the general population\non a continuous basis and have a significant effect on the economy.\n\xe2\x80\xa2\n\nShould Sony Pictures Entertainment qualify? Make the case for or against, bearing in\nmind the statutory definition of CI quoted earlier.\n\nB. The Consequences of a CI Designation\nWhat follows from a CI designation? Not as much as you might expect. One can imagine a world\nin which this designation carries with it robust authorities for one or more government agencies\n(CISA being the most likely candidate) to issue regulations compelling or forbidding certain things\nrelating to both cybersecurity and the physical aspects of security. As we have seen, after all,\nCISA has exactly that sort of authority with respect to cybersecurity for U.S. government entities\n(other than the military and intelligence agencies). And while it may seem unrealistic as a political\nmatter to grant any regulator such broad authority over the entirety of the private sector, it is not\nhard to imagine treating CI-designated entities differently on this dimension.\nFor the most part, however, that is not how it works. A CI designation as such carries with it no\nsuch general regulatory authority. Certain sectors may happen to be subject to regulation\n(including cybersecurity-related regulation) already thanks to other statutes, but no further\nauthority follows from a CI designation.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n175\n\nConsider these questions:\n\xe2\x80\xa2 Can you explain how the financial sector is an example of the point made in that last\nsentence? Think back to the GLB Act and the Safeguards Rule.\n\xe2\x80\xa2 What are the best arguments for and against giving CISA broad authority to regulate\nall CI-designated entities for cybersecurity (and physical security) purposes?\n\xe2\x80\xa2 Is there a good argument for giving such authority to each \xe2\x80\x9csector-specific agency,\xe2\x80\x9d\neven if not vesting all of it in CISA alone?\n\xe2\x80\xa2 Should CISA be given such authority as to all entities, period?\n\xe2\x80\xa2 Review: For an owner/operator of CI, what other incentive structures impact their\ncybersecurity risk management decisions?\nSince there is no general authority to regulate CI-designated entities, the question arises as to what\npractical consequences follow from the designation. To answer, let\xe2\x80\x99s take a close look at excerpts\nfrom this Congressional Research Service report on the consequences of the decision to extend\nCI status to election infrastructure. The report highlights three \xe2\x80\x9cnotable consequences\xe2\x80\x9d from the\ndesignation.\nFirst:\nIt raised the priority for DHS to provide security assistance to election jurisdictions that\nrequest it and for other executive branch actions, such as economic sanctions that the\nDepartment of the Treasury can impose against foreign actors who attack elements of U.S.\nCI, including tampering with elections.\n\nConsider these questions:\n\xe2\x80\xa2 Does this mean that such assistance would not be provided otherwise?\n\xe2\x80\xa2 Does this mean that sanctions would not be imposed otherwise?\n\xe2\x80\xa2 Is there real value on this dimension?\n\nWe will further explore the question of services CISA might provide, below. For now, let\xe2\x80\x99s\ncontinue to note what the CRS report had to say about the consequences of a CI designation\nfor election systems. As the second example, the report explained that the designation\nbrings the subsector under a 2015 United Nations nonbinding consensus report (A/70/174)\nstating that nations should not conduct or support cyber-activity that intentionally\ndamages or impairs the operation of CI in providing services to the public. It also states\nthat nations should take steps to protect their own CI from cyberattacks and to assist other\nnations in protecting their CI and responding to cyberattacks on it. The report was the work\nof a group of governmental experts from 20 nations, including Russia and the United States.\n\nConsider these questions:\n\xe2\x80\xa2 Do you recognize this reference to the \xe2\x80\x9cGroup of Government Experts\xe2\x80\x9d process that\nwe studied previously?\n\xe2\x80\xa2 Does this point have any practical significance? Be prepared to argue it both ways.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n176\n\nThird, the report explained that the designation also\nprovided DHS the authority to establish formal coordination mechanisms for CI sectors and\nsubsectors and to use existing entities to support the security of the subsector. Those\nmechanisms are used to enhance information sharing within the subsector and to\nfacilitate collaboration within and across subsectors and sectors.\n\nCan you relate this to our prior study of information-sharing mechanisms, including ISACs?\n\nNow, back to the aforementioned topic of services that CISA might provide to private sector\nentities, and thus especially to CI-designated entities. Just what services might this include?\nThe list has grown significantly, in terms both of numbers and significance, in recent years. CISA\nhas produced a detailed catalog here, but our purposes the following chart\xe2\x80\x94which we already\nviewed previously in connection with services CISA can provide to other federal civilian\nagencies\xe2\x80\x94will suffice:\n1. Continuous Diagnostics and Mitigation\n2. Enhanced Cybersecurity Services (Domain Name System sinkholing; email filtering)\n3. Hunt and Incident Response Team support (remote assistance; advisory deployment;\nremote deployment; on-site deployment)\n4. Advanced Malware Analysis Center\n5. Distribution to the public of threat intelligence and other useful information (ex: the FY2019\nRVA findings mapped to ATT&CK)\n6. Vulnerability Scanning\n7. Web App Scanning\n8. Phishing Campaign Assessment\n9. Remote Penetration Testing\n10. Risk & Vulnerability Assessment\n11. Cyber Resilience Review\n12. External Dependencies Management Assessment\n13. Cyber Infrastructure Survey\n14. Cyber Security Evaluation Tool\n15. Validated Architecture Design Review\nNote: CISA has limited resources, and cannot possibly provide these services to all private CI\nentities, or even to most of them.\n\n\xe2\x80\xa2\n\nShould Congress enact a tax-credit system designed to incentivize private CI entities\nto seek more such services from private-sector security companies?\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n177\n\nC. The NIST Cybersecurity Framework\nStaying with the theme of information-sharing and voluntary improvements to security for\nprivately-owned CI entities, let\xe2\x80\x99s turn now to a discussion of the \xe2\x80\x9cNIST Cybersecurity Framework.\xe2\x80\x9d\nTo understand its role, we need to go back to the 2013. On the same day that President Obama\nissued PPD-21, he also issued Executive Order 13636. EO 13636 mostly focused on encouraging\nvoluntary information-sharing by CI owner/operators (it was, in that sense, a precursor to CISA\n2015). But EO 13636 also sought to encourage better defense of CI entities via this measure:\nSec. 7. Baseline Framework to Reduce Cyber Risk to Critical Infrastructure.\n(a) The Secretary of Commerce shall direct the Director of the National Institute of\nStandards and Technology (the "Director") to lead the development of a framework to\nreduce cyber risks to critical infrastructure (the "Cybersecurity Framework"). The\nCybersecurity Framework shall include a set of standards, methodologies, procedures,\nand processes that align policy, business, and technological approaches to address cyber\nrisks. The Cybersecurity Framework shall incorporate voluntary consensus standards and\nindustry best practices to the fullest extent possible. . . .\n(b) The Cybersecurity Framework shall provide a prioritized, flexible, repeatable,\nperformance-based, and cost-effective approach, including information security\nmeasures and controls, to help owners and operators of critical infrastructure identify,\nassess, and manage cyber risk. The Cybersecurity Framework shall focus on identifying\ncross-sector security standards and guidelines applicable to critical infrastructure. The\nCybersecurity Framework will also identify areas for improvement that should be\naddressed through future collaboration with particular sectors and standards-developing\norganizations. To enable technical innovation and account for organizational differences,\nthe Cybersecurity Framework will provide guidance that is technology neutral and that\nenables critical infrastructure sectors to benefit from a competitive market for products\nand services that meet the standards, methodologies, procedures, and processes\ndeveloped to address cyber risks. The Cybersecurity Framework shall include guidance for\nmeasuring the performance of an entity in implementing the Cybersecurity Framework.\nPursuant to that directive (and consistent with a similar directive from Congress that followed in\nthe Cybersecurity Enhancement Act of 2014), NIST published the first version of the Cybersecurity\nFramework in February 2014, and then published an updated version in April 2018. The following\nlanguage (from the original 2014 version) explains what the Framework does\xe2\x80\x94and does not\xe2\x80\x94\naspire to do:\nThe Framework uses risk management processes to enable organizations to inform and\nprioritize decisions regarding cybersecurity. It supports recurring risk assessments and\nvalidation of business drivers to help organizations select target states for cybersecurity\nactivities that reflect desired outcomes. Thus, the Framework gives organizations the ability\nto dynamically select and direct improvement in cybersecurity risk management. . . . The\nFramework provides a common language for understanding, managing, and expressing\ncybersecurity risk both internally and externally. It can be used to help identify and prioritize\nactions for reducing cybersecurity risk, and it is a tool for aligning policy, business, and\ntechnological approaches to managing that risk. . . . The Core is not a checklist of actions\nto perform.\xe2\x80\x9d\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n178\n\nConsider these questions:\n\xe2\x80\xa2 How is this similar to MITRE ATT&CK Matrix, and how is it different?\n\xe2\x80\xa2 Does EO 13636 purport to make private sector critical infrastructure owners legally\nobligated to adopt and adhere to the Cybersecurity Framework?\n\xe2\x80\xa2 Should it do so?\n\xe2\x80\xa2 Is it feasible to create such an obligation via Executive Order, as opposed to\nlegislation?\n\xe2\x80\xa2 Does the existence of the Framework nonetheless cast a legal shadow of sorts, one\nthat might at least create incentives for CI owners? As you ponder that question, think\nabout how CISA 2015 anticipated and addressed parallel concerns.\n\nAn interagency study set to work brainstorming ideas for how to encourage voluntary adoption\nof the NIST Framework. As summarized later in 2013 by Michael Daniel (President Obama\xe2\x80\x99s\nCybersecurity Coordinator), the resulting ideas included:\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\nCybersecurity Insurance \xe2\x80\x94 Agencies suggested that the insurance industry be engaged\nwhen developing the standards, procedures, and other measures that comprise the\nFramework and the Program. The goal of this collaboration would be to build\nunderwriting practices that promote the adoption of cyber risk-reducing measures and\nrisk-based pricing and foster a competitive cyber insurance market. The Commerce\nDepartment\xe2\x80\x99s National Institute of Standards and Technology is taking steps to engage\nthe insurance industry in further discussion on the Framework. This process should\ncontinue as the Framework is developed and the Voluntary Program is created.\nGrants \xe2\x80\x94 Agencies suggested leveraging federal grant programs. Agencies suggest\nincentivizing the adoption of the Framework and participation in the Voluntary Program\nas a condition or as one of the weighted criteria for federal critical infrastructure grants.\nOver the next six months, agencies will develop such criteria for consideration.\nProcess Preference \xe2\x80\x94 Agencies offered suggestions on a range of government programs\nin which participating in the Voluntary Program could be a consideration in expediting\nexisting government service delivery. For example, the government sometimes provides\ntechnical assistance to critical infrastructure. Outside of incident response situations, the\ngovernment could use Framework adoption and participation in the Voluntary Program\nas secondary criteria for prioritizing who receives that technical assistance. The primary\ncriteria for technical assistance would always remain the criticality of the infrastructure,\nbut for non-emergency situations, technical assistance could be seen as an additional\nbenefit that could help to drive adoption. Agencies currently have the authority to act in\nthese areas without further legislation. As we work with the private sector over the next six\nmonths to develop the Voluntary Program, we will simultaneously identify and examine\nspecific programs where this approach could be helpful\nLiability Limitation \xe2\x80\x94 Agencies pointed to a range of areas where more information is\nnecessary to determine if legislation to reduce liability on Program participants may\nappropriately encourage a broader range of critical infrastructure companies to\nimplement the Framework. These areas include reduced tort liability, limited indemnity,\nhigher burdens of proof, or the creation of a Federal legal privilege that preempts State\ndisclosure requirements. As the Framework is developed, agencies will continue to\ngather information about the specific areas identified in the reports related to liability\nlimitation.\nStreamline Regulations \xe2\x80\x94 Agencies will continue to ensure that the Framework and the\nVoluntary Program interact in an effective manner with existing regulatory structures. As\nthe Framework and Voluntary Program are developed, agencies will recommend other\nareas that could help make compliance easier, for example: eliminating overlaps\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n179\n\namong existing laws and regulation, enabling equivalent adoption across regulatory\nstructures, and reducing audit burdens.\nPublic Recognition \xe2\x80\x94 Agencies suggested further exploration on whether optional public\nrecognition for participants in the Program and their vendors would be an effective\nmeans to incentivize participation. DHS will work with the critical infrastructure community\nto consider areas for optional public recognition as they work together to develop the\nVoluntary Program.\nRate Recovery for Price Regulated Industries \xe2\x80\x94 Agencies recommended further dialogue\nwith federal, state, and local regulators and sector specific agencies on whether the\nregulatory agencies that set utility rates should consider allowing utilities recovery for\ncybersecurity investments related to complying with the Framework and participation in\nthe Program.\nCybersecurity Research \xe2\x80\x94 Once the Framework is complete, agencies recommended\nidentifying areas where commercial solutions are available to implement the Framework\nand gaps where those solutions do not yet exist. The government can then emphasize\nresearch and development to meet the most pressing cybersecurity challenges where\ncommercial solutions are not currently available.\n\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\nBe prepared to review the pros and cons of these ideas.\n\nAlong those same lines, consider Section 8(e) of EO 13636:\n[T]he Secretary of Defense and the Administrator of General Services . . . shall make\nrecommendations to the President . . . on the feasibility, security benefits, and relative\nmerits of incorporating security standards into acquisition planning and contract\nadministration.\n\xe2\x80\xa2\n\nCan you identify any CI sectors that appear particularly ripe for this approach?\n\nD. Section 9 Entities (\xe2\x80\x9cCritical Infrastructure at Greatest Risk\xe2\x80\x9d)\nUp to this point, we have treated all CI equally, even as we defined the category broadly. But of\ncourse, CI entities are not all equally significant to the nation; nuclear power plants have more\nstrategic significance than shopping malls, for example. EO 13636 recognized this, carving out a\nsubcategory of particularly important CI that we will refer to as \xe2\x80\x9cSection 9 entities\xe2\x80\x9d (so named for\nSection 9 of EO 13636, which establishes the category and which we will examine below). Our\ngoals are to understand the test for qualifying as a Section 9 entity, what consequences follow\nfrom that designation, and what the arguments for and against taking a more proscriptive\napproach might be.\nFirst, let\xe2\x80\x99s look at the test for qualifying as a Section 9 entity:\nSec. 9. Identification of Critical Infrastructure at Greatest Risk.\n(a) . . . the Secretary shall use a risk-based approach to identify critical infrastructure where\na cybersecurity incident could reasonably result in catastrophic regional or national\neffects on public health or safety, economic security, or national security.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n180\n\nApplying that test, should the following entities qualify (and if you need more information,\nwhat information might that be)?\n\xe2\x80\xa2 nuclear power plant\n\xe2\x80\xa2 hospital that is one of three in a town with 75,000 residents\n\xe2\x80\xa2 shopping mall\n\xe2\x80\xa2 single voting machine\n\nNext, let\xe2\x80\x99s have a look at the consequences that follow from receiving this designation. For that,\nwe need to look at EO 13636 Section 10:\n(a)\n\nAgencies with responsibility for regulating the security of critical infrastructure shall\nengage in a consultative process with DHS, OMB, and the National Security Staff to\nreview the preliminary [NIST] Cybersecurity Framework and determine if current\ncybersecurity regulatory requirements are sufficient given current and projected\nrisks. In making such determination, these agencies shall consider the identification\nof critical infrastructure required under section 9 of this order. . . .\n\n(b)\n\nIf current regulatory requirements are deemed to be insufficient, . . . agencies\nidentified in subsection (a) of this section shall propose prioritized, risk-based,\nefficient, and coordinated actions . . . to mitigate cyber risk.\n\n(c)\n\n. . . agencies identified in subsection (a) of this section shall, in consultation with\nowners and operators of critical infrastructure, report to OMB on any critical\ninfrastructure subject to ineffective, conflicting, or excessively burdensome\ncybersecurity requirements. This report shall describe efforts made by agencies,\nand make recommendations for further actions, to minimize or eliminate such\nrequirements.\n\n\xe2\x80\xa6\n(e)\n\nIndependent regulatory agencies with responsibility for regulating the security of\ncritical infrastructure are encouraged to engage in a consultative process with the\nSecretary, relevant Sector-Specific Agencies, and other affected parties to\nconsider prioritized actions to mitigate cyber risks for critical infrastructure consistent\nwith their authorities.\n\nConsider these questions:\n\xe2\x80\xa2 Can you sum up the function of each of these subsections?\n\xe2\x80\xa2 Can you think of further steps that could have been taken vis-\xc3\xa0-vis Section 9 entities,\nwithout needing legislation?\n\nIt may be tempting to dismiss the combination of Sections 9 and 10 as having little bite. And\nperhaps that characterization is accurate. But note that it was thought significant enough, at the\ntime, to warrant certain limitations. First, Section 9 itself expressly prohibits this status to\n\xe2\x80\x9ccommercial information technology products\xe2\x80\x9d and \xe2\x80\x9cconsumer information technology services.\xe2\x80\x9d\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n\xe2\x80\xa2\n\n181\n\nWhat sort of businesses might fall within those categories? Why exempt them?\n\nSeparately, Section 9(c) provides that (1) any entity designated as a Section 9 entity shall receive\nnotice of the designation as well as of \xe2\x80\x9cthe basis for the determination,\xe2\x80\x9d and (2) DHS must establish\na process for which the owner/operators of such entities may then seek reconsideration.\n\n\xe2\x80\xa2\n\nWhy?\n\nThat was 2013. What has happened since then? Most recently, in May 2017, President Trump\nissued Executive Order 13800, Section 2 of which addresses cybersecurity in the CI context. We\xe2\x80\x99ll\nlook first at Section 2(b), which is focused on Section 9 entities. In relevant part it provides:\nThe Secretary of Homeland Security, in coordination with the Secretary of Defense, the\nAttorney General, the Director of National Intelligence, the Director of the Federal Bureau\nof Investigation, the heads of appropriate sector-specific agencies, . . . and all other\nappropriate agency heads, as identified by the Secretary of Homeland Security, shall:\n\n\xe2\x80\xa2\n\n(i)\n\nidentify authorities and capabilities that agencies could employ to support the\ncybersecurity efforts of . . . section 9 entities . . .;\n\n(ii)\n\nengage section 9 entities and solicit input as appropriate to evaluate whether and\nhow the authorities and capabilities identified pursuant to subsection (b)(i) of this\nsection might be employed to support cybersecurity risk management efforts and\nany obstacles to doing so;\n\n(iii)\n\nprovide a report to the President . . . that includes . . . findings and\nrecommendations for better supporting the cybersecurity risk management efforts\nof section 9 entities [based on the above inquiries].\n\nHow would you characterize this intervention?\n\nNext, look at Section 2(c), which is not limited to Section 9 entities, but is limited to CI entities that\nare owned by a publicly-traded company:\nThe Secretary of Homeland Security . . . shall provide a report to the President . . . that\nexamines the sufficiency of existing Federal policies and practices to promote appropriate\nmarket transparency of cybersecurity risk management practices by critical infrastructure\nentities, with a focus on publicly traded critical infrastructure entities.\n\n\xe2\x80\xa2\n\nCan you explain how such an approach might drive improvements to security?\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n182\n\nE. Case Study: Using Contract Leverage to Drive Change in the Defense Industrial Base\nThere is one critical infrastructure sector where the government has adopted a novel approach\nin an effort to drive systematic improvements in private-sector cybersecurity practices: the\nDefense Industrial Base (the \xe2\x80\x9cDIB\xe2\x80\x9d).\nAs CISA explains here, the DIB is:\n\xe2\x80\xa6 the worldwide industrial complex that enables research and development, as well as\ndesign, production, delivery, and maintenance of military weapons systems, subsystems,\nand components or parts, to meet U.S. military requirements. The Defense Industrial Base\npartnership consists of Department of Defense components, more than 100,000 Defense\nIndustrial Base companies and their subcontractors who perform under contract to the\nDepartment of Defense, companies providing incidental materials and services to the\nDepartment of Defense, and government-owned/contractor-operated and\ngovernment-owned/government-operated facilities.\nDIB companies routinely deal with classified information, of course, and towards that end typically\nhave access to government-defended networks designed for that purpose, such as SPIRNet (the\nSecret Internet Protocol Router Network). But DIB companies also handle a large amount of\n\xe2\x80\x9ccontrolled unclassified information\xe2\x80\x9d (\xe2\x80\x9cCUI\xe2\x80\x9d), meaning information that is not actually classified\nbut nonetheless should not be made public according to legal or policy directives. The\ngovernment has a strong interest in encouraging DIB companies to optimize the security of systems\nthat handle CUI.\nHow best to accomplish this? The DIB, by definition, depends extensively on securing government\ncontracts. Accordingly, this CI sector is particularly amenable to incentives or mandates that the\ngovernment might choose to build into those contracts.\nThe idea of using that leverage to push DIB companies to enhance their cybersecurity efforts is\nnot novel. DIB contracts are governed by a complex set of regulations that comprise the military\xe2\x80\x99s\nstandard \xe2\x80\x9cacquisition\xe2\x80\x9d process: the Defense Federal Acquisition Regulation Supplement (or simply\n\xe2\x80\x9cDFARS\xe2\x80\x9d). In 2016, a rule was added to DFARS requiring would-be contractors to certify that they\nhad implemented the aforementioned NIST Cybersecurity Framework model of cyber risk\nmanagement. The new rule also required these companies to query their own supply chains,\nmoreover, to find out whether they complied with the NIST framework (and if not, why not). Finally,\nthe rule also required contractors to give DoD notice within 72 hours in the event of a cyber\nincident.\nSo far so good. But there was a problem: the new DFARS rule did not include a mechanism for\nactually vetting these representations before the contract was let, and only limited resources were\navailable for post-agreement auditing (to be performed by the Defense Contract Management\nAgency (DCMA)). In short, the model depended primarily on trust.\nPerhaps not surprisingly, this proved ineffective, and DoD eventually began exploring a more\naggressive approach. This led to adoption of what is known as the \xe2\x80\x9cCybersecurity Maturity Model\nCertification\xe2\x80\x9d (\xe2\x80\x9cCMMC\xe2\x80\x9d) process.\nThe idea behind the CMMC is to establish a sliding-scale set of cybersecurity obligations that a\nwould-be DIB contactor must meet (with the scale demanding more from the entity in\naccordance with the sensitivity of the data the entity will have), and to require each such business\nto secure a third-party certification of compliance in order to be eligible to receive a contract.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n183\n\nWho will provide those third-party certifications of compliance? That remains to be seen, but the\ngeneral idea is to rely on a private sector market for such services rather than tasking an arm of\nthe Defense Department with doing the work. Towards this end, DOD has contracted with a\nnewly-created private entity\xe2\x80\x94the \xe2\x80\x9cCMMC Accreditation Body\xe2\x80\x9d\xe2\x80\x94designed to control the process\nof vetting and, well, certifying would-be \xe2\x80\x9cCMMC Third Party Assessor Organizations\xe2\x80\x9d (C3PAOs).\nWhat does certification cost at the various maturity levels, and who will pick up that bill? It\xe2\x80\x99s too\nsoon to say how much certifications might cost, but we do know this: DIB companies will be\nallowed to include these costs as part of their contract bid, if they wish. Note, too, that the\ncertifications are meant to be good for three-year periods.\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\nThe certification process presents a scalability issue. Can you explain how so?\nIs it optimal to leave certifications to the private sector?\nAre you concerned about the costs involved, both in absolute terms and relative to\nthe likely value-added from this process?\nCould some version of this model be used with other CI sectors?\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n184\n\n\x0cChesney on Cybersecurity\n\n185\n\nD. Organizing to Mitigate Harm\nOur final defense-oriented topic concerns the process by which the federal government\norchestrates its response when significant cyber incidents occur.\n\n20. Federal Coordination and Significant Cyber Incidents\n\nLearning Objectives\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\nAppreciate that there does not have to be a standing set of rules regarding the process for\ndeveloping a coordinated interagency response for the federal government (things can be\nhandled on an ad hoc basis, after all); be able to articulate the advantages of predetermining such questions, however\nNeeded, or not, President Policy Directive 41 (PPD-41, from 2016) established such a standing\nprocess (the public record does not yet reveal whether the Trump administration has\npreserved this framework, though we do know that the administration abolished the Special\nAdvisor to the President position previously described as the White House \xe2\x80\x9ccybersecurity czar\xe2\x80\x9d)\nUnderstand that the point of the \xe2\x80\x9cSignificant Cyber Incident\xe2\x80\x9d concept is to guide the decision\non whether a particular incident warrants activation of the federal government\xe2\x80\x99s interagency\nsystem for response coordination under PPD-41\nAppreciate that the definition is quite vague (probably by design, since there\xe2\x80\x99s something to\nbe said for leaving it to the personnel involved to exercising their own judgment on this\nquestion, and since it would be hard to articulate a more-precise test anyway)\n\nFrom a certain point of view, almost any cybersecurity incident could be said to be a matter of\nfederal government interest. Many will involve a possible violation of the Computer Fraud and\nAbuse Act, after all, so at least federal law enforcement agencies would have a stake in the\nsituation. And the sum total of the harms that flow from such incidents certainly rises to a level\nthat warrants a serious and well-considered policy response from the federal government. Only\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n186\n\na small percentage of these incidents will warrant, on their own, a coordinated federal\ninteragency response.\nThis reading focuses on those relatively-rare but important situations. What processes has the\nfederal government developed over time to regularize interagency (and, for that matter, publicprivate) coordination? And how does this relate to the question of how the federal government\nmight coordinate across agencies on common questions of policy relating to cybersecurity?\nNote that there is no requirement that there be any such formal coordinating mechanisms. In\nmany policy contexts, coordination in response to particular events occurs in an ad hoc way,\noften (though not always) working through general-purpose executive branch procedures (such\nas those associated with the National Security Council). Sometimes, however, recurring\nexperience with coordination needs relating to a particular topic results in adoption of \xe2\x80\x9cstanding\xe2\x80\x9d\ncommittee structures and related procedures. The recurring issue of terrorism spawned such a\nresponse, for example, and as we will see below this is true to some extent with cybersecurity too.\nA. Is PPD-41 Still With Us?\nThe public record regarding the Trump Administration\xe2\x80\x99s approach to interagency coordination\nof cybersecurity matters remained unclear over the years. We do know, however, that the\nadministration eliminated the White House \xe2\x80\x9ccybersecurity coordinator\xe2\x80\x9d position. Consider this\nreport from May 2018, from Brian Barrett at Wired:\nA LITTLE OVER a month ago, the White House forced out Tom Bossert, its cybersecurity\nczar. A week later, cybersecurity coordinator Rob Joyce said he would depart as well.\nAnd now, rather than replace either, the Trump administration will do without anyone at\nthe helm of its cybersecurity policy. It couldn\xe2\x80\x99t have picked a worse time.\nThe news that the newly appointed national security adviser John Bolton has decided to\nphase out the cybersecurity coordinator role was first reported by Politico. In place of a\nsingle point person in charge of guiding and shaping US cyber policy, the task will now\nfall instead to two National Security Council senior directors. The NSC did not respond to\na request for comment.\n\xe2\x80\x9cAt a minimum, this decision and the way that it\xe2\x80\x99s being communicated send the wrong\nsignal,\xe2\x80\x9d says J. Michael Daniel, who served as cybersecurity coordinator under President\nBarack Obama and currently heads up the Cyber Threat Alliance nonprofit. \xe2\x80\x9cCertainly I\nthink that our adversaries could interpret that as a signal that this administration doesn\xe2\x80\x99t\ntake the issue as seriously, regardless of if that\xe2\x80\x99s actually their intent.\xe2\x80\x9d\nIn fairness, there\xe2\x80\x99s nothing sacred about the cybercoordinator role, specifically. It didn\xe2\x80\x99t\nexist before the Obama administration, and other corners of the NSC get along fine with\na similar leadership structure to what Bolton has imposed. But the nature of cyberthreats,\nand the broad responsibilities Bossert and Joyce took on, seem particularly in need of\ncentralized command.\n\xe2\x80\x9cI think it\xe2\x80\x99s probably fair that there\xe2\x80\x99s more policy work to be done right now on cyber\nthan in certain other areas, because it is in a formative stage,\xe2\x80\x9d says Joshua Geltzer,\nformer senior director for counterterrorism at the NSC and executive director of\nGeorgetown Law School\xe2\x80\x99s Institute for Constitutional Advocacy and Protection. \xe2\x80\x9cYou\xe2\x80\x99re\nat a point where you\xe2\x80\x99re seeing new sorts of cyberthreats materialize.\xe2\x80\x9d\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n187\n\nWhile US intelligence agencies are responsible for responding to those threats\nspecifically, the cyberczar role has been in charge of organizing the political responses\nto those incidents, such as the March sanctions imposed against Russia for its destructive\nNotPetya ransomware and other online malfeasance. The position has also\nspearheaded cybersecurity policy, hardening both federal networks and infrastructure\nagainst attacks. It\xe2\x80\x99s a lot of hats\xe2\x80\x94and easier for one person to keep track of them all.\n\xe2\x80\x9cThere\xe2\x80\x99s a reason why you wanted to have a focal point for cybersecurity policy in one\nposition. I think that\xe2\x80\x99s a very valuable thing to have,\xe2\x80\x9d says Daniel.\nPolitical leaders have expressed their concerns over the move as well. \xe2\x80\x9cIt\xe2\x80\x99s frankly\nmindboggling that the Trump Administration has eliminated the top White House official\nresponsible for a whole-of-government cyber strategy, at a time when the cyber threat\nto our nation is greater than ever,\xe2\x80\x9d says senator Mark Warner (D - Virginia), the ranking\nmember of the Senate Intelligence Committee, in a statement.\nIndeed, there\'s been a demonstrable uptick in cyberattacks. In a Congressional briefing\nin February, the heads of the NSA, CIA, FBI, and ODNI all testified that Russia would\ncontinue its attempts to interfere in US democracy. North Korea unleashed WannaCry\nransomware on the world a year ago, and has been continually emboldened online.\nAnd with the US withdrawal from the Iran nuclear deal, cybersecurity experts warn that\nthe country could once again target its sophisticated cyberattacks at the US.\n\xe2\x80\x9cIf anything, our enemies are only going to do more, not less,\xe2\x80\x9d says Daniel.\nTo face those challenges\xe2\x80\x94as well as those from independent criminal actors\xe2\x80\x94without a\ncoherent cybersecurity policy in place invites unease.\n\xe2\x80\x9cBig picture, it certainly seems to send a strange message as to how this White House is\nprioritizing something most of us think the government needs to prioritize more, when it\ncomes to cyberpolicy,\xe2\x80\x9d says Geltzer.\nThe true impact of the move may not become apparent for some time. In response,\nHouse Democrats Tuesday introduced a bill that would create a National Office for\nCyberspace, with a director confirmed by the Senate. It\'s unclear what chance it might\nhave of passing. And for now, either way, fewer capable people will be focused on bigpicture cybersecurity issues at the highest level of government than there were before.\nIt\'s hard to see how that makes for an improvement.\nIt was not clear whether other aspects of the Obama administration\xe2\x80\x99s approach to coordination\nalso were significantly altered, and in particular whether the Trump administration altered the\nbasic model created by President Obama\xe2\x80\x99s Presidential Decision Directive 41 (PPD-41, \xe2\x80\x9cUnited\nStates Cyber Incident Coordination\xe2\x80\x9d), from 2016. Indeed, for this reason among others,\nCongress eventually felt obliged to intervene by creating a major new position within the\nExecutive Branch (based on the recommendation of the Congressionally-chartered Cyber\nSolarium Commission): the National Cyber Director.\nHere is my overview of the NCD position, written for Lawfare just prior to enactment of the\nstatute establishing the position in December 2020 (section 1752 of the National Defense\nAuthorization Act for Fiscal Year 2021, to be precise):\n1. What are the problems that warrant creation of the national cyber director position?\nThe Cyber Solarium Commission identified an array of problems that creation of an NCD\nmight address. I\xe2\x80\x99ve distilled them into the following four areas of concern:\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n188\n\nThe National Cyber Strategy\nThe federal government has produced national cyber strategy documents in the past\n(see the current National Cyber Strategy from 2018, and note too the 2016 Cybersecurity\nNational Action Plan, the 2009 Cyberspace Policy Review and the 2008 Comprehensive\nNational Cybersecurity Initiative). The commission observed that the process for\nproducing and updating such a strategy is not well institutionalized, however; no\nparticular official or office has lead responsibility for performing this function on a\nrecurring basis.\nThe commission also observed that we lack a process for monitoring whether the policies\nand budgets of relevant federal agencies align with the current National Cyber Strategy.\nThus, if federal agencies work at cross-purposes or fail to make needed budget\ncommitments, it is not obvious who in the federal government has ultimate responsibility\nfor spotting such problems and wrangling recalcitrant entities back into line. The Trump\nadministration exacerbated this problem in 2018 when it eliminated a White House staff\nposition that came closest to fulfilling that role. More on that in the very next point.\nPresidential Advising\nThe commission also emphasized the desirability of having a clearly identified adviser to\nthe president dedicated to cybersecurity matters (as well as to related issues at the\nintersection of technology and national security, such as 5G or internet governance). Of\ncourse, there had been such an adviser at one point, in the form of the special assistant\nto the president position known as the cybersecurity coordinator. In 2018, however,\nNational Security Adviser John Bolton eliminated that position. Bolton asserted at the time\nthat there was no need for such a dedicated position because responsibility for the topic\nwas diffused throughout the NSC apparatus. This sparked criticism, to put it mildly.\nInteragency Coordination\nThe demise of the cybersecurity coordinator position in 2018 also took away the most\nnatural official to manage interagency coordination as to both cybersecurity policy\nformation and, especially, incident response. Even when the cybersecurity coordinator\nposition was in place, however, some argued that the position lacked the stature,\nstatutory authority and staff support to carry out those functions as effectively as one\nmight wish.\nSpeaking at Home and Abroad With a Single Voice\nThe commission also noted the desirability of having a single officer empowered to serve\nas the nation\xe2\x80\x99s authoritative voice (apart from the president, of course) in\ncommunications with external audiences (both domestic and foreign) regarding the\ncollective position of the executive branch on cybersecurity topics.\n2. Which authorities would NDAA Section 1752 confer on the NCD?\nThe version of the NCD envisioned by Section 1752 addresses each of the areas\nemphasized by the commission but in some key respects is less ambitious than what the\ncommission had in mind.\nStature\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n189\n\nOne area in which Section 1752 certainly makes good on the commission\xe2\x80\x99s vision has to\ndo with the stature of the office. In contrast to the old cybersecurity coordinator position,\nthe NCD would be a Senate-confirmed official (nominated by the president, of course,\nand subject to removal at the president\xe2\x80\x99s discretion). And the NCD would, by statute,\nbecome a principal of the National Security Council. The NCD\xe2\x80\x99s pay scale would be set\nwith reference to Level II of the Executive Schedule (comparable to officials such as the\nCIA director and various departmental secretaries). The Office of the NCD, moreover,\nwould be authorized to have a staff of up to 75 persons and would be situated within the\nExecutive Office of the President. In short, the NCD and the Office of the NCD would\nresemble the structure of the Office of the United States Trade Representative, albeit with\na smaller scale.\nPresidential Advising\nTurning to the authorities conferred on the NCD, Section 1752 starts in a complex vein. It\nmakes the NCD \xe2\x80\x9cthe principal advisor to the President on cybersecurity strategy and\npolicy,\xe2\x80\x9d but with strings attached. Instead of leaving it in those general terms, the\nprovision describes this as a role specifically \xe2\x80\x9crelating to the coordination of\xe2\x80\x9d certain\ncybersecurity topics (emphasis added).\nWhich topics? Some are exactly what you would expect, such as \xe2\x80\x9cinformation security\nand data privacy.\xe2\x80\x9d Others are a bit more interesting, though, because they directly\nimplicate the equities of other agencies. For example, the list includes \xe2\x80\x9cefforts to\nunderstand\xe2\x80\x9d malicious cyber activity and to \xe2\x80\x9cdeter\xe2\x80\x9d such activity, as well as \xe2\x80\x9cdiplomatic\nand other efforts to develop norms and international consensus around responsible state\nbehavior in cyberspace.\xe2\x80\x9d These are core concerns of the National Security Agency, the\nCIA, U.S. Cyber Command and the State Department; hence, the decision to identify the\nNCD as the president\xe2\x80\x99s principal adviser on those topics would be a recipe for turf wars\n(ones the NCD would be poorly positioned to win) if not for the qualifying language I\nhighlighted above, accentuating that the NCD\xe2\x80\x99s particular function is to advise the\npresident regarding coordination, not to act as the principal adviser about those realms\nof activity as such.\nFormation of National Strategy and Policy\nSection 1752 falls short of the commission\xe2\x80\x99s vision for an NCD with lead authority over the\nprocess of updating the National Cyber Strategy and forming national policy positions\nrelating to cybersecurity. Under Section 1752(c)(1)(B), the NCD\xe2\x80\x99s role is limited to the\nability to \xe2\x80\x9coffer advice and consultation\xe2\x80\x9d to, well, everyone in the federal government\nwith equities relating to cybersecurity. The language doesn\xe2\x80\x99t require anyone else to listen\nto that advice, let alone to follow it. Nor does it describe the NCD as the statutorily\nrequired instigator of, or shepherd for, such processes. Which is not to say that the NCD\nwill not have significant influence in such matters; it\xe2\x80\x99s just that such influence will have to\nbe earned through persuasion, rather than demanded as-of-right.\nImplementation of National Strategy and Policy\nThe commission\xe2\x80\x99s hopes for a strong NCD fare somewhat better when it comes to a\nseparate function relating to national strategy and policies: conducting centralized\noversight to ensure that agencies operate in alignment with those strategies and policies\nonce they are in place. In fact, the opening lines of Section 1752(c)(1)(C) seem rather\nstrong on this point, describing the NCD as lead agency for \xe2\x80\x9ccoordination of\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n190\n\nimplementation\xe2\x80\x9d of national strategies and policies. But, once again, the devil is in the\ndetails. That same subsection goes on to specify exactly what the NCD\xe2\x80\x99s leadership role\nentails, and it arguably isn\xe2\x80\x99t much.\nFour of the particular authorities listed here boil down to this: The NCD can observe and\nadvise, but cannot force other agencies to change their policy, resource and personnel\npractices. More specifically, these four authorities provide that the NCD may:\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\nMonitor the effectiveness of implementation efforts (including their \xe2\x80\x9ccosteffectiveness\xe2\x80\x9d).\nGive advice to agency/department heads regarding personnel, budget,\norganization, etc.\nReview agency budgets for consistency with national policies/strategies and give\nadvice to the agency heads on where they may be falling short.\nAssess the \xe2\x80\x9cintegration and interoperability\xe2\x80\x9d of various Federal cyber centers advise\nthe President on needed changes.\n\nAt this point, it is worth noting that Section 1752 does deal something of a wild card to\nthe NCD. Subsection 1752(e)(3) rather casually mentions that the NCD shall have power\nto \xe2\x80\x9cpromulgate such rules and regulations as may be necessary to carry out the\nfunctions, powers, and duties vested in the Director.\xe2\x80\x9d A bold NCD might seek to leverage\nthis power to articulate and entrench broad interpretations of the aforementioned\nauthorities.\nPruning Federal Policies, Guidelines and Regulations\nSection 1752(c)(1)(C)(v) directs the NCD to \xe2\x80\x9ccoordinate\xe2\x80\x9d with the attorney general, the\nfederal chief information officer, the director of the Office of Management and Budget,\nthe director of national intelligence, and the director of the Cybersecurity & Infrastructure\nAgency (CISA) in order to \xe2\x80\x9cstreamlin[e] \xe2\x80\xa6 Federal policies and guidelines\xe2\x80\x9d and\n\xe2\x80\x9cregulations relating to cybersecurity.\xe2\x80\x9d The bill does not specify the precise purpose of\nsuch \xe2\x80\x9cstreamlining\xe2\x80\x9d efforts, but it does refer in part to existing federal law concerning the\ninformation security practices of federal agencies. For most government agencies, CISA\nalready performs the role of key overseer of their information security practices. Agencies\noperating \xe2\x80\x9cnational security systems\xe2\x80\x9d are separate from that authority, however. Hence,\none possible justification for assigning a coordinating role to the NCD in this area is to\nensure there is an official empowered to think about all government systems in the\nround, as it were. At any rate, the key thing is to appreciate that this is just a coordination\nrole, not one that empowers the NCD to compel agencies to take particular actions.\nInteragency Coordination for Incident Response: Developing Plans, Executing Plans\nThe commission\xe2\x80\x99s vision for the NCD fares well when it comes to interagency\ncoordination for incident response. The idea of an integrated response, to be clear, is not\nthe novelty here (see the \xe2\x80\x9cCyber Unified Coordination Group\xe2\x80\x9d system adopted in PPD-41\nin 2016). The novelty, rather, is in the allocation of such authority to a statutorily\nempowered office and then the spelling out of various specific steps that the office must\ncarry out as part of that mission. Section 1752(c)(1)(D) accomplishes this by directing the\nNCD to:\n\xe2\x80\xa2\n\nEstablish (in coordination with relevant agencies) \xe2\x80\x9coperational plans, processes, and\nplaybooks\xe2\x80\x9d governing incident response (including, intriguingly, a specific directive to\nensure that \xe2\x80\x9cdefensive\xe2\x80\x9d plans and capabilities are integrated with \xe2\x80\x9coffensive\xe2\x80\x9d plans\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\n191\n\nand capabilities\xe2\x80\x94which sounds to me like a requirement to ensure that plans\naccount for U.S. Cyber Command\xe2\x80\x99s potential role).\nEnsure that those plans are \xe2\x80\x9cexercised[.]\xe2\x80\x9d\nEnsure all of it is updated as needed.\nEnsure that the plans involve proper coordination with the private sector.\n\nWhat about implementation of those plans? The same section describes the NCD as\nhaving responsibility for \xe2\x80\x9censuring implementation\xe2\x80\x9d of them, but it does not elaborate on\nthe point. On the other hand, the very next subsection (1752(c)(1)(E)) appears to address\nthe topic in a way that puts the NCD in a potentially powerful position.\nSpecifically, Section 1752(c)(1)(E) provides for the NCD to lead in \xe2\x80\x9cpreparing the\nresponse by the Federal Government\xe2\x80\x9d to qualifying cyber incidents, and it further states\nthat the NCD should develop (in coordination with the national security adviser and\nheads of relevant agencies) \xe2\x80\x9coperational priorities, requirements, and plans\xe2\x80\x9d (emphasis\nadded by me). Further, Subsection (E) specifies that the NCD must ensure agencies\nexecute those plans properly.\nNo doubt there will be frictions in practice as future NCDs test the boundaries of this role\nin the context of particular cases.\nWhich cyber incidents rise to the level that trigger such an NCD-led interagency\nresponse?\nThis part of Section 1752 is especially intriguing.\nThe status quo, under PPD-41, uses the label \xe2\x80\x9csignificant cyber incidents\xe2\x80\x9d to describe the\nsubset of cyber incidents that warrant formal interagency coordination (in contrast to\nrun-of-the-mill incidents as to which one or more federal entities might have a role, but\nfor which a coordinated interagency response is not necessary). And PPD-41 explains\nthat incidents qualify for that label when they are \xe2\x80\x9clikely to result in demonstrable harm to\nthe national security interests, foreign relations, or economy of the United States or to the\npublic confidence, civil liberties, or public health and safety of the American people.\xe2\x80\x9d\nThat is a sensible, but indeterminate, definition.\nNDAA Section 1752 makes changes. First, it replaces \xe2\x80\x9csignificant cyber incidents\xe2\x80\x9d with a\nnearly identical\xe2\x80\x94but longer\xe2\x80\x94label (that is, \xe2\x80\x9ccyber attack or cyber campaign of\nsignificant consequence\xe2\x80\x9d). Second, and more important, it defines that category more\nbroadly (though still quite loosely). According to 1752(g)(2), an incident(s) qualifies if its\n\xe2\x80\x9cpurpose or effects\xe2\x80\x9d is to:\n(A) Significantly disrupt the confidentiality, integrity, or availability of any federal\ninformation system.\n(B) Harm or otherwise significantly compromise the functioning of any computer\nsupporting any entity that is part of a critical infrastructure sector (notice that this is not\nlimited to the \xe2\x80\x9cSection 9 entities\xe2\x80\x9d subcategory but rather reaches the full spectrum of\ncritical infrastructure entities, and that it does not matter whether the computer in\nquestion is important to the entity).\n(C) Otherwise significantly compromise the ability of a critical infrastructure entity to\nprovide services.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n192\n\n(D) Steal \xe2\x80\x9csignificant\xe2\x80\x9d funds or economic resources, trade secrets, personal identifiers, or\nfinancial information, when done for private financial gain or for\ncommercial/competitive advantage.\n(E) Otherwise constitute a \xe2\x80\x9csignificant threat to the national security, foreign policy, or\neconomic health or financial stability of the United States.\xe2\x80\x9d\nThere\xe2\x80\x99s a lot going on there, and plainly much of that is of indeterminate scope. That\nsaid, it seems to me much broader than the \xe2\x80\x9csignificant cyber incident\xe2\x80\x9d category under\nPPD-41. It covers any hack of a federal computer, it covers a potentially vast number of\nrun-of-the-mill identity theft and economically motivated crime situations, and it covers\ninterference with computers belonging to critical infrastructure entities where the\ncomputer might not be very important (and where, for that matter, the entity itself might\nnot be that important; remember, this is not limited to Section 9 entities). None of which is\nnecessarily a bad thing, mind you; it is better to be overinclusive than underinclusive in\nthis space.\nAnnual Reports and Other Communication/Representation Functions\nApart from a final, general charge to perform such other functions as the president may\ndirect, the only other significant duty conferred on the NCD is to report annually to\nCongress on the cybersecurity threat environment and related matters, and to report to\nthe president, the national security adviser and Congress regarding the state of U.S.\ncybersecurity.\n3. What issues and questions remain?\nThe NDAA\xe2\x80\x99s version of the NCD is not all that the commission had in mind. But it will do\nmuch good and should be enacted.\nThe demise of the cybersecurity coordinator position in 2018 demonstrated that the\npresident cannot always be trusted to perceive the importance of this topic (well, that\nmight not have been the only clue, but it underscored the point in a particularly relevant\nway). Even when that position existed, however, it did not have the institutional clout,\nstatutory authorities and staff support that the NCD would have. Passage of Section 1752\nwould address all of that to a very helpful degree, and with authorities that go some way\ntoward addressing the problem areas the commission perceived.\nTrue, Section 1752 does not do everything the commission hoped it would. As noted\nabove, the NCD would not own the National Cyber Strategy process (and other national\npolicy and strategy processes) to the same degree the commission envisioned. And\nnote, too, that despite language in 1752(c)(2)(A) confirming that the NCD may be\nincluded in preparing for and participating in \xe2\x80\x9cdomestic and international summits and\nother international meetings at which cybersecurity is a major topic,\xe2\x80\x9d the legislation\nwould not make the NCD the executive branch\xe2\x80\x99s default voice, or an independent\nvoice, in such matters (indeed, a separate section specifies that any such participation\nby the NCD \xe2\x80\x9cshall\xe2\x80\x9d be \xe2\x80\x9cin coordination with the Secretary of State\xe2\x80\x9d). But it\xe2\x80\x99s more than\nhalf a loaf, and much better than no loaf.\nOne point of sensitivity that I have not mentioned yet is whether the various directives to\nthe NCD to serve as a point of contact coordinating with the private sector (including\nespecially, it would seem, critical infrastructure entities) raises an important question\nabout deconfliction with the role of the director of CISA. Building relations with the\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n193\n\nprivate sector, and especially the owners/operators of critical infrastructure entities, is a\ncentral purpose for CISA and a key part of the director\xe2\x80\x99s job. It is not hard to imagine\nhow an NCD might encroach significantly on that territory if great care is not taken in\ndeveloping a modus vivendi between these offices.\nA final note, picking up a point I made above: It will be especially interesting to see what\nan NCD will be able to make of the aforementioned authority to act as the president\xe2\x80\x99s\nprincipal adviser on the coordination of \xe2\x80\x9cefforts to understand and deter malicious cyber\nactivity.\xe2\x80\x9d Such efforts entail some of the nation\xe2\x80\x99s most sensitive intelligence collection\ncapabilities as well as the increasingly important category of operations undertaken by\nU.S. Cyber Command under its \xe2\x80\x9cdefend forward\xe2\x80\x9d concept. If the NCD and the\nCYBERCOM commander have a strong relationship, I suppose this might work.\nTo the future NCD team: Good luck!\nThere is now a National Cyber Director: Chris Inglis, a widely-respected, longtime-NSA official. But\nDirector Inglis is not the only major figure within the Executive Office of the President with a key\nrole in shaping the interagency aspects of cybersecurity matters for the Biden administration.\nBefore Director Inglis was in position, the Biden administration decided to create a new position\nin the National Security Council structure, one focused expressly on this area: the Deputy\nNational Security Advisor for Cyber and Emerging Technology. Biden appointed another wellregarded NSA veteran\xe2\x80\x94Anne Neuberger\xe2\x80\x94to this position. It is likely that Inglis and Neuberger will\nwork very well together, given there past experience with one another. Whether the coexistence of these institutional innovations will work as well in the future, with other personnel,\nremains to be seen.\nB. Coordination/Deconfliction Challenges in an Interagency Setting\nBearing in mind the multiplicity of federal departments and agencies that have authorities and\ncapabilities that might be relevant in the context of a cybersecurity incident, an important\nquestion arises: Should there be a formal process for coordinating (and, when needed,\ndeconflicting) the efforts of those departments and agencies\xe2\x80\x94that is, a process that is\nestablished in advance and might even be the subject of training and practice so that it can\nrun as smoothly as possible in the event of an emergency? Or, instead, is it best to leave such\nmatters to be worked out on an ad hoc basis as circumstances may dictate?\n\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\nCan you think of problems that might arise if no formal coordination/deconfliction\nprocess exists? Consider that question both from the point of view of various federal\nagencies as well as from the perspective of the private sector (especially the\nperspective of a private sector victim)\nIdentify the pros and cons of establishing a coordination process in advance.\nBe sure to consider what the alternative to this would be.\n\nPPD-41 reflects a judgment that ex ante establishment of coordination mechanisms is a good\nidea. That framework to some extent is woven into the National Cyber Incident Response Plan\n(a DHS document intended to distill the legal and policy frameworks applicable to a national\ncyber incident in order to provide a clear common understanding and basis for training). Our\ntask, accordingly, is to explore the key moving parts so that you can be conversant in this model.\nFirst, note that a key element of interagency coordination involves deconfliction with respect to\nthose agencies that have similar capabilities and responsibilities relating to a particular function\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n194\n\nthat will tend to be part of the government\xe2\x80\x99s response to a cyber incident. Simply put, it might\nhelp if a particular agency is designated in advance as the \xe2\x80\x9clead agency\xe2\x80\x9d for each such\nfunction.\nPPD-41 does this by identifying three \xe2\x80\x9clines of effort\xe2\x80\x9d for federal agencies, and naming a particular\nentity as \xe2\x80\x9clead agency\xe2\x80\x9d for each. Consider first the three lines of effort:\nIn responding to any cyber incident, Federal agencies shall undertake three concurrent\nlines of effort: threat response; asset response; and intelligence support and related\nactivities. . . .\nA. Threat response activities include conducting appropriate law enforcement and\nnational security investigative activity at the affected entity\xe2\x80\x99s site; collecting evidence\nand gathering intelligence; providing attribution; linking related incidents; identifying\nadditional affected entities; identifying threat pursuit and disruption opportunities;\ndeveloping and executing courses of action to mitigate the immediate threat; and\nfacilitating information sharing and operational coordination with asset response.\nB. Asset response activities include furnishing technical assistance to affected entities to\nprotect their assets, mitigate vulnerabilities, and reduce impacts of cyber incidents;\nidentifying other entities that may be at risk and assessing their risk to the same or similar\nvulnerabilities; assessing potential risks to the sector or region, including potential\ncascading effects, and developing courses of action to mitigate these risks; facilitating\ninformation sharing and operational coordination with threat response; and providing\nguidance on how best to utilize Federal resources and capabilities in a timely, effective\nmanner to speed recovery. . . .\nC. Intelligence support and related activities facilitate the building of situational threat\nawareness and sharing of related intelligence; the integrated analysis of threat trends\nand events; the identification of knowledge gaps; and the ability to degrade or\nmitigate adversary threat capabilities.\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\nIs each line of effort limited to actions that are responsive to an ongoing or completed\nincident, or are some proactive? If the latter, which ones?\nNotice the very last clause quoted above (\xe2\x80\x9cand the ability to degrade\xe2\x80\x9d). Can you\nthink of some examples that would fall under this heading? And does this complicate\nthe issue of lead-agency responsibility for that category?\n\nNext, consider PPD-41\xe2\x80\x99s selection of lead-agency designations:\n[T]he following agencies shall serve as Federal lead agencies for the specified line of effort:\n1. In view of the fact that significant cyber incidents will often involve at least the\npossibility of a nation-state actor or have some other national security nexus, the\nDepartment of Justice, acting through the Federal Bureau of Investigation and the\nNational Cyber Investigative Joint Task Force, shall be the Federal lead agency for\nthreat response activities.\n2. The Department of Homeland Security, acting through [CISA], shall be the Federal lead\nagency for asset response activities.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n195\n\n3. The Office of the Director of National Intelligence, through the Cyber Threat\nIntelligence Integration Center, shall be the Federal lead agency for intelligence\nsupport and related activities.\nDesignation of lead agencies helps, but it does not exhaust the range of possibilities for\ncoordination. What about coordination among the lead agencies? What about coordination\nbetween the government and the private sector? What about other government agencies that\nmight have a key role to play?\nTo address such questions, PPD-41 borrows the concept of a \xe2\x80\x9cUnified Coordination Group\xe2\x80\x9d\n(\xe2\x80\x9cUCG\xe2\x80\x9d) from other emergency-response settings. The idea behind a UCG is to establish a\ncommittee structure that will be inert most of the time, but that can be called into being as\nneeded with predetermined membership and responsibilities.\nPPD-41 provides that a \xe2\x80\x9cCyber Unified Coordination Group \xe2\x80\xa6 shall serve as the primary method\nfor coordinating between and among Federal agencies in response to a significant cyber incident\nas well as for integrating private sector partners into incident response efforts, as appropriate.\xe2\x80\x9d\nThe UCG shall act to ensure inclusion of all relevant agencies in the response effort, coordinate\nthe planning and execution of both response and recovery tasks, coordinate international and\ncross-sector outreach, facilitate information-sharing, and coordinate communications with\nimpacted parties as well as the public. If the incident has physical effects, moreover, the UCG is\nto combine its efforts with the relevant lead agency or interagency group managing those\nconsequences.\nWho has a seat at the table with a Cyber UCG? PPD-41 specifies that the group should include\neach of the lead agencies for threat response (FBI), asset response (DHS-CISA), and intelligence\nsupport (ODNI), along with any relevant sector-specific agency insofar as the incident concerns\na critical infrastructure sector. The UCG also may include other federal agencies, agencies at the\nstate/local/tribal levels, NGOs, international partners, and private-sector entities.\nNote that, because some of these roles are predetermined and others foreseeable, it is possible\nto conduct training exercises to simulate UCG functions. Indeed, this is perhaps the greatest\nadvantage of having the UCG model as the default framework for incident-response\ncoordination. CISA convenes such exercises periodically under the name \xe2\x80\x9cCyber Storm,\xe2\x80\x9d and\nincludes a growing array of private-sector participants in them. See here for after-action reports\ngenerated by past Cyber Storm exercises, if you wish to explore this in more detail (unfortunately,\nthe reports from the 2018 and 2020 exercises are not yet available to the public).\nGiven that many incidents will present close calls as to whether a UCG ought to be convened,\nwho decides that question? PPD-41 provides:\nA Cyber UCG shall be formed at the direction of the NSC Principals Committee, Deputies\nCommittee, or the CRG, or when two or more Federal agencies that generally participate\nin the CRG, including relevant SSAs, request its formation. A Cyber UCG shall also be\nformed when a significant cyber incident affects critical infrastructure owners and\noperators identified by the Secretary of Homeland Security as owning or operating critical\ninfrastructure for which a cyber incident could reasonably result in catastrophic regional\nor national effects on public health or safety, economic security, or national security.\nNote the phrase \xe2\x80\x9csignificant cyber incident,\xe2\x80\x9d which I emphasized with bold font above. This is a\nterm of art under PPD-41 and the National Cyber Incident Response Plan, designed to distinguish\nbetween run-of-the-mill incidents (where there is no need for federal coordination, though one\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n196\n\nor more federal agencies (such as the FBI) might still be involved) and those important enough\nto warrant interagency coordination.\nWhat, then, makes an incident \xe2\x80\x9csignificant\xe2\x80\x9d in this sense? Here\xe2\x80\x99s what PPD-41 has to say:\nA. Cyber incident. An event occurring on or conducted through a computer network\nthat actually or imminently jeopardizes the integrity, confidentiality, or availability of\ncomputers, information or communications systems or networks, physical or virtual\ninfrastructure controlled by computers or information systems, or information resident\nthereon. For purposes of this directive, a cyber incident may include a vulnerability in\nan information system, system security procedures, internal controls, or implementation\nthat could be exploited by a threat source.\nB. Significant cyber incident. A cyber incident that is (or group of related cyber incidents\nthat together are) likely to result in demonstrable harm to the national security interests,\nforeign relations, or economy of the United States or to the public confidence, civil\nliberties, or public health and safety of the American people.\nThe National Cyber Incident Response Plan supplements that definition with this schema\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n197\n\nWhat is (are) the key element(s) in the PPD-41 definition?\nDoes the NCIRP schema actually help clarify things?\nIs definitional precision actually important here, or might vagueness be useful?\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\nPPD-41 includes an important caveat:\nThe Cyber UCG is intended to result in unity of effort and not to alter agency authorities or\nleadership, oversight, or command responsibilities. Unless mutually agreed upon between\nagency heads or their designees, and consistent with applicable legal authorities such as\nthe Economy Act of 1932 (31 U.S.C. 1535), Federal departments and agencies will maintain\noperational control over their respective agency assets.\n\nCan you anticipate problems that might arise under this heading?\nFor a recent example of a Cyber Unified Coordination Group being convened to address a\nsignificant cyber incident, consider the March 2021 announcement concerning vulnerabilities\ndiscovered in connection with Microsoft Exchange (vulnerabilities that were exploited on a\nmassive, reckless scale by hackers acting for China). As the White House press secretary\nexplained:\nLast week the National Security Council (NSC) established a Unified Coordination Group\n(UCG), a task force composed of representatives from the FBI, CISA, and ODNI, with\nsupport from the NSA, to drive a whole-of-government response to the Microsoft Exchange\nvulnerabilities. On Monday, the NSC convened a UCG leadership meeting, which included\nprivate sector members for the first time, coordinating our respective response efforts. We\ninvited the private sector partners based on their specific insights to this incident, an\napproach the NSC will take going forward as appropriate. The UCG discussed the\nremaining number of unpatched systems, malicious exploitation, and ways to partner\ntogether on incident response, including the methodology partners could use for tracking\nthe incident, going forward.\nA final note: PPD-41 also calls for the existence of a separate interagency coordinating body:\nthe Cyber Response Group (\xe2\x80\x9cCRG\xe2\x80\x9d). As set forth in part II.A. of the Annex to PPD-41, CRG\xe2\x80\x99s duties\nare to:\ni.\n\nCoordinate the development and implementation of the Federal Government\xe2\x80\x99s\npolicies, strategies, and procedures for responding to significant cyber incidents;\n\nii.\n\nReceive regular updates from the Federal cybersecurity centers and agencies on\nsignificant cyber incidents and measures being taken to resolve or respond to\nthose incidents;\n\niii.\n\nResolve issues elevated to it by subordinate bodies [more on this below] . . .;\n\niv.\n\nCollaborate with the Counterterrorism Security Group and Domestic Resilience\nGroup when a cross-disciplinary response to a significant cyber incident is required;\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n198\n\nv.\n\nIdentify and consider options for responding to significant cyber incidents, and\nmake recommendations to the Deputies Committee, where higher-level guidance\nis required . . .; and\n\nvi.\n\nConsider the policy implications for public messaging in response to significant\ncyber incidents, and coordinate a communications strategy, as necessary,\nregarding a significant cyber incident.\n\nWho has a seat this table? Any agency can be invited to participate, but as a general matter\nthe CRG should include:\nsenior representatives from the Departments of State, the Treasury, Defense (DOD), Justice\n(DOJ), Commerce, Energy, Homeland Security (DHS) and its National Protection and\nPrograms Directorate, and the United States Secret Service, the Joint Chiefs of Staff, Office\nof the Director of National Intelligence, the Federal Bureau of Investigation, the National\nCyber Investigative Joint Task Force, the Central Intelligence Agency, and the National\nSecurity Agency.\nCRG meetings are chaired by the \xe2\x80\x9cSpecial Assistant to the President and Cybersecurity\nCoordinator . . . or an equivalent successor,\xe2\x80\x9d and they \xe2\x80\x9cshall convene on a regular basis and as\nneeded.\xe2\x80\x9d\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n199\n\nII. THE OFFENSIVE PERSPECTIVE\nWe\xe2\x80\x99ve been defense-focused up to this point, in the specific sense of surveying the institutions,\nlaws, and policies intended to deter, punish, and mitigate the consequences of unauthorized\naccess. For better or worse, however, limiting unauthorized access is not always the ultimate\npolicy goal. In the U.S. system, some institutions, laws, and policies promote (or at least tolerate)\noffense\xe2\x80\x94that is, efforts to penetrate or interfere with a system without its owner\xe2\x80\x99s authorization (or,\nperhaps, awareness). For the sake of convenience, we might call this lawful-but-unauthorized\naccess (meaning lawful from a U.S. perspective; needless to say, such activity may well violate\nthe laws of other countries when they occur overseas).\nYou will note immediately, I hope, that the very idea that this category exists appears at first blush\nto be in considerable tension with the policy goals advanced by, well, pretty much everything we\nstudied in Unit I. Why, then, should there even be such a category? We will explore that question\nacross several contexts.\nTo a substantial extent, lawful-but-unauthorized access frameworks rest on the seeminglycounterintuitive claim that they can, in the right circumstances, promote security. We see this, for\nexample, in the \xe2\x80\x9chackback\xe2\x80\x9d scenario, in which some advocate empowering the private sector\nto respond to an attack with self-help measures that will have effects outside their own networks\n(that is, effects on the attacker\xe2\x80\x99s network or, more likely, effects on intermediary networks from\nwhich an attack has been staged). And we see this as well with the portion of U.S. Cyber\nCommand\xe2\x80\x99s mission that entails out-of-network operations in \xe2\x80\x9cgray space\xe2\x80\x9d and \xe2\x80\x9cred space\xe2\x80\x9d\nconducted with the intent to identify, disrupt, or prevent adversary efforts to hack U.S. or allied\nsystems. It is in this sense that Unit I opened with a note regarding the affirmative use of\nunauthorized access methods to promote \xe2\x80\x9cdefense.\xe2\x80\x9d\nBut the case for lawful-but-unauthorized access does not have to rest entirely on that defensiveminded ground. In some cases, in fact, lawful-but-unauthorized access frameworks are intended\nto serve goals that are simply distinct from cybersecurity. We see this with law enforcement\ninvestigations intended to solve (or prevent) crimes of all sorts; with collection of foreign\nintelligence (that is, espionage) on a vast array of topics; with promotion of U.S. foreign policy\ngoals via covert action; and with military operations both within and outside the context of armed\nconflict.\nOur aim in this unit is to survey each of those scenarios, with an emphasis on the key institutions,\npolicy conflicts, and legal frameworks.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n200\n\n21. Lawful-But-Unauthorized Access: Private Sector Self-Defense?\n\nLearning objectives\n\xe2\x80\xa2\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\nBe able to explain the uncertainty associated with words and phrases like \xe2\x80\x9chackback\xe2\x80\x9d and\n\xe2\x80\x9cactive defense\xe2\x80\x9d\nUnderstand that the policy problem undergirding the \xe2\x80\x9chackback\xe2\x80\x9d debate has to do with the\nrelative difficulty of securing rapid and effective government help in the context of a cyber\nattack (relative, that is, to the speed and efficacy of government help when a physical-space\nrobbery or other such harm occurs); be able to account for why this difference exists\nBe able to identify an array of responses a private-sector victim might wish to pursue, either in\nreal time or even ex ante, in response to an attack\nUnderstand which of these measures are permissible under the CFAA, which clearly are not,\nand which ones have an unclear status\nUnderstand what CISA 2015 did and did not make clear\nBe able to articulate the arguments for and against amending the law further to reduce the\ndisincentives for hacking back in various ways\nUnderstand that the AC/DC Act has not yet passed Congress, and may never pass Congress,\nyet still provides a useful case study as to the difficulty of pruning the legal constraints in this\narea\nBe able to distinguish \xe2\x80\x9cattributional measures\xe2\x80\x9d from more-aggressive forms of active defense\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\xe2\x80\xa2\n\xe2\x80\xa2\n\n201\n\nAppreciate why attackers might route their operations through compromised third-party\nservers, and why this greatly complicates the policy and the legal aspects of hackback\nAppreciate that pruning CFAA criminal liability without likewise pruning its civil liability\nprovisions might result in insufficient change to the incentives the private sector faces (though\nthat turns in large part on whether the fact pattern in question implicates impacts on third\nparties rather than just the attacker).\n\nAre there circumstances in which we want someone in the private sector to be able to access\nanother\xe2\x80\x99s system without their permission? We just completed a long unit focused on how the\nUnited States discourages that sort of thing\xe2\x80\x94including by imposing criminal and civil liability under\nthe CFAA\xe2\x80\x94so the idea of instead tolerating or even encouraging it at first blush seems jarring. The\nissue proves to be complicated, however, when we ask this question in the specific context of a\nhacking victim hoping to respond in self-defense (i.e., \xe2\x80\x9chackback\xe2\x80\x9d).\nIn recent years there has been considerable debate regarding both the extent to which certain\ndefensive measures are permissible in light of the CFAA (as well as CISA 2015\xe2\x80\x99s \xe2\x80\x9cdefensive\nmeasures\xe2\x80\x9d provision), and whether and how it might be desirable to prune back the CFAA in order\nto remove disincentives for potential or actual hacking victims to protect themselves in new (or at\nleast newly legal) ways.\nA. Defining Terms\nBefore we proceed, we should note that there is some disagreement regarding the proper\nmeaning of the term \xe2\x80\x9chackback.\xe2\x80\x9d Some use it to refer to any defensive measure adopted by a\npotential victim where the measure will have a downstream effect inside an adversary\xe2\x80\x99s system.\nOn that view, even a simple beacon would count. Others would reserve the term for more\naggressive forms of self-defense, limiting it to measures that have a disruptive effect on the\nadversary\xe2\x80\x99s system or that provide the victim (or whomever is assisting the victim, for the victim\nmay turn to an outside security vendor for help) with ongoing unauthorized access to some part\nof that system. Those who take this narrower view sometimes distinguish between \xe2\x80\x9chackback\xe2\x80\x9d\nand \xe2\x80\x9cactive defense,\xe2\x80\x9d with the latter referring to less-aggressive measures (like beacons) that are\nnot disruptive and that do not provide ongoing access. On the other hand, you sometimes will\nsee the phrase \xe2\x80\x9cactive defense\xe2\x80\x9d used more broadly to span across this entire category. The\nimportant point, at any rate, is that you should make sure to make clear how you are using these\nlabels, and likewise that you understand how others use them.\nFor the sake of convenience, I will use \xe2\x80\x9chackback\xe2\x80\x9d as a catch-all phrase meant to encompass\nthe entire category of self-defense measures that might have an effect within the attacker\xe2\x80\x99s own\nsystem.\nNow we can proceed. Let\xe2\x80\x99s first identify the competing policy considerations at work in the\nhackback debate, and then move on to consider the challenges that arise once one decides to\nprune the CFAA in hopes of encouraging at least some forms of hackback.\nB. Understanding the Competing Policy Considerations\nLet\xe2\x80\x99s use a hypothetical scenario in order to bring to light the competing policy considerations\nthat drive the debate over hackback.\nAssume an OPM-like scenario involving a private-sector business which we will call Cuckoo\xe2\x80\x99s\nEggnog Company (or simply \xe2\x80\x9cCuckoo\xe2\x80\x9d). You are Cliff, the CEO.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n202\n\nCuckoo\xe2\x80\x99s Chief Information Security Officer (\xe2\x80\x9cCISO\xe2\x80\x9d) has just notified you of an unfolding incident:\n\xe2\x80\x9cBad news, Cliff. Somebody\xe2\x80\x99s inside our network. Looks like they phished the creds of\nsomeone on my team, and they\xe2\x80\x99ve been logging in remotely at night with admin privileges.\nWe\xe2\x80\x99re still sorting out what they\xe2\x80\x99ve been up to, but so far know that they\xe2\x80\x99ve been scouting our\nfiles, and clearly took an interest in our secret formulas for next year\xe2\x80\x99s new products. Anyway,\nlooks like our uninvited guest copied some key files, including that database we created\nregarding customer preferences. He or she got it all stored in a particular spot under an\ninnocuous name, and compressed with an eye towards a quiet, gradual exfiltration. And,\nwell, looks like they went ahead and extracted it this morning. But it\xe2\x80\x99s not all bad news. We\xe2\x80\x99re\npretty sure we have the IP address of the server they sent those files to. And\xe2\x80\xa6well, you\nknow\xe2\x80\xa6we\xe2\x80\x99ve got some smart folks on our team. I think we could try some\xe2\x80\xa6creative things to\nget our stuff back. If you want to.\xe2\x80\x9d\nBy this time, your general counsel has joined the meeting. He has a nervous look on his face.\n\xe2\x80\x9cWhat exactly do you have in mind?\xe2\x80\x9d he asks the CISO.\n\xe2\x80\x9cWell, for starters I\xe2\x80\x99d like to do some scanning, see if maybe this server they\xe2\x80\x99re using has some\nknown vulns we might be able to use.\xe2\x80\x9d\n\xe2\x80\x9cUse for what, exactly?\xe2\x80\x9d\n\xe2\x80\x9cThat\xe2\x80\x99s up to y\xe2\x80\x99all. But, strictly hypothetically speaking, maybe I could delete their copy of our\ndata and files.\xe2\x80\x9d\nYou perk up. \xe2\x80\x9cYou can do that?\xe2\x80\x9d\nEncouraged by your interest, the CISO leans in. \xe2\x80\x9cOh yeah, for sure. Or I could leave it all there,\nbut stick in an extra file, something with a tempting title but a little surprise. They\xe2\x80\x99ll eventually open\nit, and when they do it\xe2\x80\x99ll phone home, giving me an IP address that would help us know if they\nmoved these files somewhere else.\xe2\x80\x9d\nYou are definitely tempted. Before you can answer, though, she continues: \xe2\x80\x9cBut you know what\nwould be even better? Let\xe2\x80\x99s hit these jerks with some ransomware. Or maybe just delete\neverything on their system!\xe2\x80\x9d\nYour CISO is smiling now, but your general counsel is not.\n\xe2\x80\x9cWhoa, slow down! I think we should call the cops, and leave this to the pros.\xe2\x80\x9d\nThe CISO rolls her eyes. \xe2\x80\x9cOh right, yes, that will be super helpful. Give me a break. You don\xe2\x80\x99t\nknow who to call, and even if you did it would be too late by the time they tried to do anything.\nLet me fix this while we still can, Cliff. I can do it right now.\xe2\x80\x9d\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\n203\n\nMake a list of the distinct actions the CISO has suggested.\nFor each one, what exact benefits might it provide? Think in terms of both the\ncompany and society.\nIs it likely that government action could produce that same benefit?\nIf you were to seek government help, whom would you call?\nNow identify potential negative consequences, apart from legal liability.\nDoes the balance of pros and cons (again setting aside legality) favor taking any of\nthese steps?\nNow assess the legality of each of these steps under the CFAA (bearing in mind, too,\nthe \xe2\x80\x9cdefensive measures\xe2\x80\x9d provision in CISA 2015).\n\nFor a real-life example of someone hacking back, consider the story of Tobias Fr\xc3\xb6mel, a German\ncitizen who suffered a ransomware attack but then managed to access the attacker\xe2\x80\x99s\ncommand-and-control server and extract from it the information he needed to generate\ndecryption keys needed by nearly 3,000 other victims. As Lawrence Abrams at Bleeping Computer\nreported, Fr\xc3\xb6mel reached out to potential victims with this message:\n\nhey guys,\ngood news for you all, bad news for me cause i paid already... maybe someone can give\nme a tip for my hard work ^^\nmy wallet: 1JrwK1hpNXHVebByLD2te4E2KzxyMnvhb\n\ni hacked back this criminal and get the whole database with keys, here it is:\nhttps://pastebin.com/N8ahWBni\n\ndecryption software:\nhttps://mega.nz/#!O9Jg3QYZ!5Gj8VrBXl4ebp_MaPDPE7JpzqdUaeUa5m9kL5fEmkVs\n\nmanual:\nupload to nas:\n"chmod +x decrypt"\n"sudo ./decrypt YOURDECRYPTIONKEY"\n\nand yeah, i know it was not legal from me too but he used already hacked servers with\nseveral webshells on it... and im not the bad guy here :D\n\nbut its really sad, i lost 670 \xe2\x82\xac to this criminal :\'(\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n204\n\ncheers\nbattleck aka tobias fr\xc3\xb6mel\n\nNote that the manual on computer crimes published by DOJ CCIPS (which is not legally binding,\nbut is a convenient expression of DOJ policy) includes an express admonition discouraging victims\nof a hack from responding in kind:\nDo Not Hack into or Damage the Source Computer\nAlthough it may be tempting to do so (especially if the attack is ongoing), the company should\nnot take any offensive measures on its own, such as \xe2\x80\x9chacking back\xe2\x80\x9d into the attacker\xe2\x80\x99s\ncomputer\xe2\x80\x94even if such measures could in theory be characterized as \xe2\x80\x9cdefensive.\xe2\x80\x9d Doing so\nmay be illegal, regardless of the motive. Further, as most attacks are launched from\ncompromised systems of unwitting third parties, \xe2\x80\x9chacking back\xe2\x80\x9d can damage the system of\nanother innocent party. If appropriate, however, the company\xe2\x80\x99s system administrator can\ncontact the system administrator from the attacking computer to request assistance in\nstopping the attack or in determining its true point of origin.\n\n\xe2\x80\xa2\n\nDoes this change your analysis above?\n\nC. Changing the Law to Encourage Hackback?\nSome members of Congress (led by Rep. Tom Graves of Georgia) have proposed legislation\ndesigned to encourage certain hackback measures, though no such bill has yet become law.\nThe best example is the proposal known as the \xe2\x80\x9cActive Cyber Defense Certainty Act\xe2\x80\x9d\xe2\x80\x94that is, the\n\xe2\x80\x9cAC/DC Act.\xe2\x80\x9d Let\xe2\x80\x99s have a close look at its key provisions, which appear in the text below, in order\nto appreciate the difficulties involved in amending federal law to create more space for such selfdefense measures. Just remember: this bill has not yet become a law; this is just an exercise to\nhelp us grapple with the practical challenges.\nThe AC/DC Act, if passed, would have created more legal space for hackback in two distinct\nways. First, it would have clarified the legality of using what the bill calls \xe2\x80\x9cattributional\ntechnologies.\xe2\x80\x9d Second, it would have provided legal protection for a separate category of\nactivity it calls \xe2\x80\x9cactive cyber defense measures.\xe2\x80\x9d Let\xe2\x80\x99s explore those in order.\n1. \xe2\x80\x9cAttributional Technology\xe2\x80\x9d\nSection 3 of the bill aimed to clarify the legality of using beacons, among other \xe2\x80\x9cattributional\ntechnologies.\xe2\x80\x9d To achieve that end, it would have amended the CFAA to include this language:\nException For The Use Of Attributional Technology.\xe2\x80\x94\n(1)\n\n[Section 1030(a)] shall not apply with respect to the use of attributional technology\nin regard to a defender who uses a program, code, or command for attributional\npurposes that beacons or returns locational or attributional data in response to a\ncyber intrusion in order to identify the source of an intrusion; if\xe2\x80\x94\n(A)\n\nthe program, code, or command originated on the computer of the\ndefender but is copied or removed by an unauthorized user; and\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n(B)\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\n205\n\nthe program, code, or command does not result in the destruction of data\nor result in an impairment of the essential operating functionality of the\nattacker\xe2\x80\x99s computer system, or intentionally create a backdoor enabling\nintrusive access into the attacker\xe2\x80\x99s computer system.\n\nReview: Did CISA 2015 already address this?\nWhat are the pros and cons of the proposed AC/DC Act approach?\n\nNote that Section 3 provided a definition of \xe2\x80\x9cattributional data\xe2\x80\x9d:\nThe term \xe2\x80\x98attributional data\xe2\x80\x99 means any digital information such as log files, text strings,\ntime stamps, malware samples, identifiers such as user names and Internet Protocol\naddresses and metadata or other digital artifacts gathered through forensic analysis.\xe2\x80\x9d\n\n\xe2\x80\xa2\n\nIs that definition too narrow, too broad, or just right?\n\nOf course, hacking back can involve more than just beacons and the like. What about more\naggressive measures?\n2. \xe2\x80\x9cActive Cyber Defense Measures\xe2\x80\x9d\nSection 4 of the bill addressed a category of activity labeled \xe2\x80\x9cactive cyber defense measures\xe2\x80\x9d\n(ACDMs). ACDMs were defined to include, as a default matter, any measure that is:\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\n(I)\n\nundertaken by, or at the direction of, a defender; and\n\n(II)\n\nconsist[s] of accessing without authorization the computer of the attacker \xe2\x80\xa6 to\ngather information in order to\xe2\x80\x94\n(aa)\n\nestablish attribution of criminal activity to share with law enforcement and\nother United States Government agencies responsible for cybersecurity;\n\n(bb)\n\ndisrupt continued unauthorized activity against the defender\xe2\x80\x99s own\nnetwork; or\n\n(cc)\n\nmonitor the behavior of an attacker to assist in developing future intrusion\nprevention or cyber defense techniques; but\n\nFocus first on subsection (aa): How (if at all) is this different than Section 3\xe2\x80\x99s\n\xe2\x80\x9cattributional technology\xe2\x80\x9d concept, which we just examined?\nNow focus on subsections (bb) and (cc): What are the pros and cons of providing\nlegal protection for activities of that kind?\n\nIf you found the scenarios described in (bb) or (cc) to be too broad, you might be comforted to\nknow that the bill actually went on to articulate a long list of limitations on which otherwise-\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n206\n\nqualifying activities would be eligible for ACDM status. I list each of those seven limitations below,\npausing after each one to pose questions. An otherwise-eligible measure could not qualify for\nACDM status after all if it:\n(I)\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\nintentionally destroys or renders inoperable information that does not belong to\nthe victim that is stored on another person or entity\xe2\x80\x99s computer;\n\nDoes this foreclose deletion of files copied from the victim\xe2\x80\x99s system?\nWhat about files copied from the system of some other victim?\nWhat if the victim/defender in good faith believes a file is a copy of its own data and\nhence deletes it, but this turns to be mistaken?\n\n(II)\n\nrecklessly causes physical injury or financial loss . . .;\n\nIs this a proper limitation? Why not limit the statute to intentional harms? Or expand it to\ninclude negligent harms?\n\n(III)\n\n\xe2\x80\xa2\n\nGo back to our hypothetical example involving Cuckoo\xe2\x80\x99s Eggnog Company, and\nimagine you are the general counsel. Consider whether you can clearly define the\nterms \xe2\x80\x9cthreat,\xe2\x80\x9d \xe2\x80\x9cpublic health,\xe2\x80\x9d and \xe2\x80\x9cpublic safety,\xe2\x80\x9d and then consider how the\nanswer to that question might impact your analysis of subsection (III) and the advice\nyou accordingly might give to Cliff.\n\n(IV)\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\nintentionally exceeds the level of activity required to perform reconnaissance on\nan intermediary computer to allow for attribution of the origin of the persistent\ncyber intrusion;\n\nWhat do you suppose is meant by \xe2\x80\x9cintermediary computer\xe2\x80\x9d?\nHow will the victim/defender know that the system in question is an \xe2\x80\x9cintermediary\xe2\x80\x9d?\n\n(V)\n\n\xe2\x80\xa2\n\ncreates a threat to the public health or safety;\n\nintentionally results in intrusive or remote access into an intermediary\xe2\x80\x99s computer;\n\nIs this exception consistent with the bill\xe2\x80\x99s effort to permit beacons or even more\naggressive forms of active defense?\n\n(VI)\n\nintentionally results in the persistent disruption to a person or entity\xe2\x80\x99s internet\nconnectivity resulting in damages . . .; or\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\nWhy have an exception for this scenario?\nHow do we know when disruption becomes \xe2\x80\x9cpersistent\xe2\x80\x9d?\nAt what point does slowing performance count as \xe2\x80\x9cdisruption\xe2\x80\x9d?\n(VII)\n\n\xe2\x80\xa2\n\n207\n\nimpacts any computer \xe2\x80\xa6 regarding access to national security information, \xe2\x80\xa6\nregarding government computers, or \xe2\x80\xa6 regarding a computer system used by or\nfor a Government entity for the furtherance of the administration of justice, national\ndefense, or national security;\n\nWhy have this exception?\n\nNow that we have a handle on what sorts of activities would count under Section 4 as ACDMs\n(if, indeed, it is possible to have a handle on that), the question becomes: What legal\nconsequences would have followed for ACDMs if the AC/DC Act had become law? The\nanswer is that Section 4 of the Act would have created an affirmative defense to criminal liability\nunder the CFAA\xe2\x80\x94though not also to civil liability\xe2\x80\x94for qualifying ACDMs:\n(1) GENERALLY.\xe2\x80\x94It is a defense to a criminal prosecution under this section that the\nconduct constituting the offense was an active cyber defense measure.\n(2) INAPPLICABILITY TO CIVIL ACTION.\xe2\x80\x94The defense against prosecution created by this\nsection does not prevent a United States person or entity who is targeted by an active\ndefense measure from seeking a civil remedy, including compensatory damages or\ninjunctive relief pursuant to subsection (g).\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\nWhy remove criminal, but not civil, liability?\nDoes this defeat the purpose of the bill?\nWhat is the effect of making ACDM status an \xe2\x80\x9caffirmative defense\xe2\x80\x9d to CFAA liability,\nas opposed to stating in the statute that the CFAA\xe2\x80\x99s scope does not extend to the\nACDM scenario?\n\nAnother wrinkle: Even if the hackback in question otherwise would qualify as an ACDM, the\nAC/DC Act would not have been available in all scenarios. For better or worse, in fact, the bill\nspecified that ACDMs could be used only where the entity doing the hacking back is \xe2\x80\x9ca victim of\na persistent unauthorized intrusion of the individual entity\xe2\x80\x99s computer.\xe2\x80\x9d\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\nWas it wise to limit Act in this way?\nHow many instances must there be, and of what duration, in order to count as\n\xe2\x80\x9cpersistent\xe2\x80\x9d?\n\nThere\xe2\x80\x99s one final caveat. In order to get the benefit of the ACDM defense, a qualifying \xe2\x80\x9cdefender\xe2\x80\x9d\nalso would have to follow a special notification regime. Section 5 specified that a\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n208\n\ndefender who uses an active cyber defense measure under the preceding section must\nnotify the FBI National Cyber Investigative Joint Task Force and receive a response from\nthe FBI acknowledging receipt of the notification prior to using the measure. . . .\nNotification must include the type of cyber breach that the person or entity was a victim\nof, the intended target of the active cyber defense measure, the steps the defender plans\nto take to preserve evidence of the attacker\xe2\x80\x99s criminal cyber intrusion, as well as the steps\nthey plan to prevent damage to intermediary computers not under the ownership of the\nattacker and other information requested by the FBI to assist with oversight.\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\nWhat is the point of requiring such notification?\nDoes the prospect of a resulting delay before action can occur defeat the purpose of\ncreating a pathway for private use of ACDMs?\nWhat sort of burdens does this place on FBI\xe2\x80\x99s NCIJTF?\nDoes this notification regime create any risk of unintended consequences, from the\npoint of view of a foreign government who is aware of the notification system and then\ndetects a U.S.-based, private-sector actor using ACDMs against it?\nAll things considered: Should Congress pass a statute along the lines of the AC/DC\nAct?\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n209\n\n21. Government Hacking: Law Enforcement\n\nLearning Objectives\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\nAppreciate that \xe2\x80\x9cgovernment hacking\xe2\x80\x9d is not some stand-alone activity that occurs\nindependent of a given agency\xe2\x80\x99s mission; agencies seek such capabilities for the same reason\nthey seek any other capability\xe2\x80\x94to execute their mission, whatever that mission may be\nBe able to describe the array of government interests where hacking plainly has become an\nimportant part of the toolkit (law enforcement, espionage, warfighting, covert action, etc.)\nUnderstand that criminal law investigation routinely entails privacy invasion even in the\nphysical realm, and that we have developed a complex body of constitutional, statutory, and\nother legal rules\xe2\x80\x94and corresponding institutions (especially courts)\xe2\x80\x94to simultaneously enable\nbut also constrain such actions\nUnderstand that the topic of law enforcement hacking is *not* concerned with rogue\ninvestigators using hacking in violation of those frameworks, but rather regular investigations\nthat are carried on under the authority of those frameworks and where there proves to be a\npractical need to try hacking in order to overcome a technical obstacle to accessing the\ninformation the government is lawfully-authorized to get (exactly as the government might use\nlock-picking, or a ram to force open a door, to overcome the practical obstacle of a locked\ndoor in the course of executing a warrant)\nKnow how the rise of encryption for communications gave FBI its original motivation to develop\nan ability to hack: unable to decipher encrypted communications in transit, FBI physically\ninstalled keylogging malware on a target\xe2\x80\x99s desktop so as to be able to get his key\nUnderstand that FBI switched later to phishing-style distribution in order more efficiently deliver\nsuch malware\nPonder whether you are comfortable relying on the generally-applicable legal regimes that\nprotect privacy from criminal investigation, or if instead you feel that online-investigative\nmethods such as these present special challenges warranting a further set of constraints\nUnderstand the difference between whether we should limit or otherwise regulate the ability\nof law enforcement entities to hack as a way to execute a warrant or other lawfully-authorized\nprocess for seeking evidence of a crime, and whether there should be a statute that in some\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\n210\n\nway limits how far the makers of communication systems and devices can go when it comes\nto engineering those systems or devices to be secure\nUnderstand that the \xe2\x80\x9cGoing Dark\xe2\x80\x9d issue concerns the latter\nBe able to state arguments in favor of, and against, legislation of that kind, and form your own\nview on the matter\nUnderstand that, in the Apple vs FBI dispute, FBI was seeking a court order to compel Apple to\nassist it in executing a search warrant; it was not a situation involving a request for legislation\nfrom Congress\nKnow that a growing number of US-based communications-related companies are moving\ntowards default end-to-end encryption\nBe able to explain how this trend relates to the policy dispute surrounding law enforcement\npurchases of services/capabilities from the insecurity industry\n\nUp to this point we have been considering the potential desirability and legality of allowing\nprivate-sector entities to hack in certain circumstances. But what about the government itself?\nA. What Policy Goals Might Government Hacking Serve?\nLet\xe2\x80\x99s begin by identifying some of the overarching policy goals that might be advanced by\nallowing certain government agencies latitude to hack. Here is a non-exhaustive list of possibilities:\n1.\n2.\n3.\n4.\n5.\n\nLaw Enforcement:\nEspionage:\nArmed Conflict:\n\xe2\x80\x9cGray zone\xe2\x80\x9d Competition:\nNonconsensual Defense:\n\nhack to gather evidence of crime\nhack to steal foreign-intelligence information\nhack in direct relation to an armed conflict\nhack to cause effects on foreign adversaries short of war\nhack to patch or defend others involuntarily\n\nIn each case listed above, the general idea is that in some circumstances it might be efficient for\nthe government to pursue certain policy goals via hacking (as opposed to having to rely on the\nvarious other methods otherwise available to the government).\n\nCan you imagine a hypothetical example, for each category, in which hacking might be\nthe most efficient way for the government to proceed?\nKnowing that hacking might sometimes be convenient for the pursuit of important policy goals\nonly starts the analysis, of course. Government hacking might entail offsetting costs, too.\n\nFor each of your hypothetical examples, can you identify at least one cost or risk that use of\na hacking approach (in contrast to some other approach) might entail?\nInsofar as the costs or risks seem to outweigh the benefits of government hacking in at least some\nof these circumstances, the question then becomes whether we can reduce those costs and risks\nto a tolerable level by adopting various rules and procedures intended to facilitate government\nhacking while safeguarding against anticipated harms. Bear that in mind through the remainder\nof the readings, as we survey the circumstances in which U.S. government institutions currently\nhave (or might one day have) authority to hack.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n211\n\nWe will proceed in the same order as the list above, beginning with government hacking to gather\nevidence of crime.\nB. Law-Enforcement Hacking\nIn the abstract, criminal investigation can be understood as a sometimes-complex process of\ngathering information and then applying some combination of expertise, reason, and analytic\ntechnique to gain insight from it. In today\xe2\x80\x99s world, that information-gathering function often entails\nseeking access to data that is \xe2\x80\x9cat rest\xe2\x80\x9d (running the gamut from a business\xe2\x80\x99s records to\ncommunications that are stored on some server or device) or that is \xe2\x80\x9cin motion\xe2\x80\x9d at the time of\nacquisition (think, for example, of wiretapping to gain access to the content of an email).\nThe government\xe2\x80\x99s legitimate criminal law investigative interests are in tension, of course, with the\nprivacy interests of the persons and entities whose data and communications might be at issue.\nNot surprisingly, the United States has developed a fairly elaborate legal framework to mediate\nthat tension.\n1. A Thumbnail Sketch of the Legal Framework for Criminal Investigations; or, Why Hack?\nThe Fourth Amendment to the Constitution of the United States is a foundational part of that\nframework. It has two key parts. First, it requires that all government actions constituting a\n\xe2\x80\x9csearch\xe2\x80\x9d be \xe2\x80\x9creasonable.\xe2\x80\x9d In practical terms, that means in most cases the government first must\nobtain a \xe2\x80\x9cwarrant\xe2\x80\x9d from a judge before conducting a \xe2\x80\x9csearch.\xe2\x80\x9d Second, the Fourth Amendment\nalso specifies that judges may not issue a warrant unless the government has provided a sworn\nstatement that is sufficient to establish \xe2\x80\x9cprobable cause\xe2\x80\x9d that the search will yield evidence of (or\nfruits from) a crime, and that \xe2\x80\x9cparticularly\xe2\x80\x9d describes the \xe2\x80\x9cplace to be searched\xe2\x80\x9d and the \xe2\x80\x9cthings\nto be seized.\xe2\x80\x9d\nBut not every search must be supported by a warrant to be count as reasonable. The Supreme\nCourt over time has recognized various exceptions and other limits to the reach of that rule. Most\nnotable for our purposes, the Supreme Court in the 1970s adopted the \xe2\x80\x9cthird-party doctrine.\xe2\x80\x9d\nUnder that rule, a person has no reasonable expectation of privacy in information that is in the\ncustody of a third party (such as your bank or your phone company), and thus the Fourth\nAmendment has no application should the government ask such a third party to turn over that\ninformation to it.\nThis rule has been controversial from the start for obvious reasons, and in 2018, the Supreme Court\ncaused a commotion in Carpenter v. United States by declining to apply the third-party doctrine\nto a circumstance in which the government obtained from a telecommunications company an\nentire month\xe2\x80\x99s worth of cell-site location data that showed a suspect\xe2\x80\x99s movements in a particularly\ncomprehensive way. For the time being, however, the third-party doctrine remains the rule for\nmost investigation scenarios (indeed, the Supreme Court in Carpenter itself went out of its way to\nsuggest that traditional investigative scenarios remain subject to this rule).\nAgainst the backdrop of this limitation on the relevance of the Fourth Amendment, Congress over\ntime has enacted a variety of statutes that both limit and facilitate government requests to third\nparties for production of information (including electronic information at rest and in motion). It is\nbeyond the scope of this course to explore those rules in detail, but for present purposes it is\nenough to know that criminal investigators routinely seek production of information from third\nparties via instruments that require less of an evidentiary showing than does a warrant and that\ndo not always require ex ante judicial involving, including \xe2\x80\x9cgrand jury subpoenas\xe2\x80\x9d and orders\nissued by courts under the 1986 Stored Communications Act. What\xe2\x80\x99s more, Congress even\nimposed requirements intended to help overcome potential technical obstacles that might arise\nin such cases. For example, the Communications Assistance to Law Enforcement Act (CALEA)\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n212\n\nrequires telecommunication companies to \xe2\x80\x9censure\xe2\x80\x9d that their systems are \xe2\x80\x9ccapable of\xe2\x80\x9d\ncompliance with court-ordered wiretaps and the like. And the Wiretap Act further provides that:\nAn order authorizing the interception of a . . . communication under this chapter shall,\nupon request of the applicant, direct that a provider of wire or electronic communication\nservice, landlord, custodian or other person shall furnish the applicant forthwith all\ninformation, facilities, and technical assistance necessary to accomplish the interception\nunobtrusively and with a minimum of interference with the services that such service\nprovider, landlord, custodian, or person is according the person whose communications\nare to be intercepted. (emphasis added).\nIn light of all this, it might seem that the government would have little occasion to engage in\nhacking. Why sneak in the back door, after all, if the front door is held open for you by the force\nof law? The first and foremost answer is that the front door is not always open as a practical\nmatter, even if it is open as a legal matter.\n\nHow might that be the case? Without looking ahead to the readings that follow, can you\nidentify any scenarios that might fit this description?\n2. Lawful Hacking\nTo understand how FBI eventually came to consider hacking as an option to overcome\npractical impediments to the execution of lawful investigative authorities, some historical\ncontext is in order.\nIn the 1990s, FBI developed a \xe2\x80\x9ctraffic sniffer\xe2\x80\x9d tool intended to be used in support of lawfully\nauthorized surveillance. The tool\xe2\x80\x94unwisely named \xe2\x80\x9cCarnivore\xe2\x80\x9d\xe2\x80\x94provided a capacity to filter\npackets transiting the network of an Internet Service Provider, flagging those that were to or from\na lawfully-approved target for surveillance. All of this would occur in cooperation with the ISP, so\nit was not an example of FBI hacking. Rather, it was an example of the FBI developing a capacity\nto accomplish something in circumstances in which the ISPs themselves either could not or would\nnot develop that same capacity (ISPs, notably, do not count as telecommunication companies\nfor purposes of CALEA).\nWhen the public became aware of Carnivore, it proved exceptionally controversial. Some\nobjected to the possibility that it might result in collection of much more than the target\xe2\x80\x99s\ncommunications, while others advanced more sweeping objections. Eventually, though, the issue\nwould become moot. As Kim Zetter explains in this article from Wired, the increasing ubiquity of\nencryption began making it impossible (or at least much harder) for FBI to derive readable plaintext from the packets that might be flagged via Carnivore or similar technologies.\nHow to overcome that obstacle? Some of the options entailed obvious downsides, not to mention\nposed massive political obstacles. One might try to ban encryption altogether, for example, or to\ncompel providers of encrypted communications services to maintain a capacity to decrypt upon\ncourt order. But another option was to shift focus away from intercepting communications in\ntransit (at which point encryption was an issue), and instead work to gain surreptitious access to\nthe sender or receiver\xe2\x80\x99s computer and thus see the pre-encryption or post-decryption messages\nin plain text after all. This was a much taller order and less scalable solution, to be sure, but it\nproved tempting enough to try.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n213\n\nZetter\xe2\x80\x99s article highlights a 1999 investigation of an organized crime figure as \xe2\x80\x9cthe first criminal\nsuspect known to be targeted by a government keystroke logger\xe2\x80\x9d\xe2\x80\x94i.e., malware that would\ncreate a record of all the typing that occurs on a computer. The stakes were high in that case,\nfor the agents involved had to break into the suspect\xe2\x80\x99s home (twice!) in order to install the logger.\nThey obtained a warrant, however, and managed the trick. And soon break-ins would no longer\nbe needed, as FBI developed malware that could be delivered remotely. The age of \xe2\x80\x9clawful\nhacking\xe2\x80\x9d was underway, eventually expanding to encompass a variety of investigative capacities\nbeyond keylogging.\n\nConsider the following questions:\n\xe2\x80\xa2 Is it correct to call this \xe2\x80\x9clawful\xe2\x80\x9d hacking? Why or why not?\n\xe2\x80\xa2 Can you articulate how the ubiquity of encryption drives law enforcement interest in\nhacking?\n\xe2\x80\xa2 Can you relate this law enforcement interest back to the topic of our last class: the\ninsecurity industry?\n\n3. Watering Holes and Network Investigative Techniques\nNotice that our examples, up to this point, involved known suspects. What happens when the\ncrime is apparent, but the suspect is not? Consider the issues that arose in United States v.\nHenderson, a decision by the United States Court of Appeals for the Ninth Circuit upholding the\nlegality of a law-enforcement hacking tactic used in connection with a child pornography\ninvestigation:\nIn 2014, the Federal Bureau of Investigation (\xe2\x80\x9cFBI\xe2\x80\x9d) began investigating the internet website\nupf45jv3bziuctml.onion, \xe2\x80\x9cPlaypen,\xe2\x80\x9d which was used to send and to receive child\npornography. Playpen operated on an anonymous network known as \xe2\x80\x9cThe Onion Router\xe2\x80\x9d\nor \xe2\x80\x9cTor\xe2\x80\x9d. To use Tor, the user must download and install the network software on his\ncomputer. Tor then allows the user to visit any website without revealing the IP address,\ngeographic location, or other identifying information of the user\xe2\x80\x99s computer by using a\nnetwork of relay computers. Tor also allows users to access \xe2\x80\x9chidden services,\xe2\x80\x9d which are\nwebsites that are accessible only through the Tor network and are not accessible publicly.\nA hidden-service website hosted on the Tor network does not reveal its location; a Tor user\ncan access the hidden-service website without knowing the location of its server and\nwithout its knowing the user\xe2\x80\x99s location. Playpen operated as a hidden-service website and\nrequired users to log in with a username and password to access its discussion forums,\nprivate messaging services, and images of child pornography.\nAfter determining that Playpen was hosted on servers located in Lenoir, North Carolina,\nthe FBI obtained and executed a valid search warrant in the Western District of North\nCarolina in January 2015, and seized the Playpen servers. The FBI removed the servers to\nits facility in Newington, Virginia. Because Tor conceals its users\xe2\x80\x99 locations and IP addresses,\nadditional investigation was required to identify Playpen users. The FBI then operated the\nPlaypen website from a government-controlled server in Newington in the Eastern District\nof Virginia, from which it obtained a valid court order authorizing it to intercept electronic\ncommunications sent and received by the site\xe2\x80\x99s administrators and users.\nThe FBI later obtained a warrant from a United States magistrate judge in the Eastern\nDistrict of Virginia \xe2\x80\xa6 authorizing searches for thirty days using what is known as a Network\nInvestigative Technique (\xe2\x80\x9cNIT\xe2\x80\x9d). Specifically, such \xe2\x80\x9cNIT warrant\xe2\x80\x9d authorized the search of\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n214\n\nall \xe2\x80\x9cactivating\xe2\x80\x9d computers\xe2\x80\x94that is, those of any website visitor, wherever located, who\nlogged into Playpen with a username and password. The NIT technology is computer code\nconsisting of a set of instructions. When a person logged into the Playpen site, the NIT\ncaused instructions to be sent to his computer, which in turn caused the computer to\nrespond to the government-controlled server with seven pieces of identifying information,\nincluding its IP address. The NIT mechanism allowed the FBI, while controlling the website\nfrom within the Eastern District of Virginia, to discover identifying information about\nactivating computers, even though Playpen operated on the Tor network.\nOn March 1, 2015, a person logged into Playpen under the username \xe2\x80\x9caskjeff.\xe2\x80\x9d The NIT\ninstructions were sent to askjeff\xe2\x80\x99s computer, which revealed its IP address through its\nresponse to the government-controlled server. The computer response also revealed that\naskjeff had been actively logged into Playpen for more than thirty-two hours since\nSeptember 2014 and had accessed child pornography.\nThe FBI traced the IP address to an internet service provider (\xe2\x80\x9cISP\xe2\x80\x9d), Comcast Corporation,\nwhich was served with an administrative subpoena requesting information about the user\nassigned to the IP address. The IP address turned out to be associated with a computer at\nthe San Mateo, California, home of Bryan Henderson\xe2\x80\x99s grandmother, with whom\nHenderson lived. A local federal magistrate judge in the Northern District of California\nissued a warrant to search the home, where the FBI then discovered thousands of images\nand hundreds of videos depicting child pornography on Henderson\xe2\x80\x99s computer and hard\ndrives. [Henderson was convicted, and later appealed the trial court\xe2\x80\x99s denial of his motion\nto suppress the NIT-derived evidence.]\n. . . Henderson challenges only the warrant issued by the Eastern District of Virginia on\nFebruary 20, 2015, authorizing the use of the NIT. . . . Henderson argues that . . . the NIT\nwarrant was issued in violation of Federal Rule of Criminal Procedure 41(b), which\nauthorizes magistrate judges to issue warrants subject to certain requirements. . . .\nHenderson urges that no provision within Rule 41(b) authorizes a magistrate judge to issue\nthe NIT warrant to search computers located outside of her district. In general, Rule 41(b)\npermits \xe2\x80\x9ca magistrate judge with authority in the district . . . to issue a warrant to search for\nand seize a person or property located within the district.\xe2\x80\x9d\n. . . The government concedes that a \xe2\x80\x9csearch\xe2\x80\x9d occurred when the NIT was deployed to\nusers\xe2\x80\x99 computers and returned their identifying information. As two of our sister circuits have\nbefore us, we agree. . . . However, the government counters that the NIT warrant was\nnonetheless authorized under Rule 41(b)(4)\xe2\x80\x99s specific provision for tracking devices, which\npermits \xe2\x80\x9ca magistrate judge with authority in the district . . . to issue a warrant to install\nwithin the district a tracking device . . . to track the movement of a person or property\nlocated within the district, outside the district, or both.\xe2\x80\x9d\nRule 41 defines a \xe2\x80\x9ctracking device\xe2\x80\x9d as \xe2\x80\x9can electronic or mechanical device which permits\nthe tracking of the movement of a person or object.\xe2\x80\x9d The government contends that\nHenderson\xe2\x80\x99s computer made a \xe2\x80\x9cvirtual trip\xe2\x80\x9d to the government server in the Eastern District\nof Virginia when he logged into the Playpen website. According to the government, his\ncomputer then \xe2\x80\x9cbrought\xe2\x80\x9d the NIT instructions, along with the usual Playpen website\ncontent, back with it from the government server to his computer\xe2\x80\x99s physical location in\nCalifornia. The NIT instructions then caused identifying location information to be\ntransmitted back to the government, just like a beeper or other tracking device would.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n215\n\nWe are not persuaded by the government\xe2\x80\x99s assertions. The NIT instructions did not actually\n\xe2\x80\x9ctrack the movement of a person or property,\xe2\x80\x9d as required by the tracking-device\nprovision. Rather, the NIT mechanism was simply a set of computer instructions that forced\nactivating computers, regardless of their location, to send certain information to the\ngovernment-controlled server in Virginia. Users\xe2\x80\x99 computers did not physically travel to\nVirginia, and the information they relayed did not reveal the physical location of any\nperson or property, unlike a beeper attached to a vehicle. The \xe2\x80\x9cseized information (mainly\nthe IP address) assisted the FBI in identifying a user, [but] it provided no information as to\nthe computer\xe2\x80\x99s or user\xe2\x80\x99s precise and contemporary physical location.\xe2\x80\x9d\n...\nInterestingly, Rule 41(b) was amended on December 1, 2016\xe2\x80\x94after the issuance of the NIT\nwarrant here\xe2\x80\x94to authorize magistrate judges to issue warrants to search computers\nlocated outside their district if \xe2\x80\x9cthe district where the media or information is located has\nbeen concealed through technological means.\xe2\x80\x9d As our sister circuits have recognized,\nsuch amendment plainly seems to \xe2\x80\x9cauthorize[] warrants such as the NIT warrant here.\xe2\x80\x9d . . .\nThe fact that Rule 41 was amended to authorize specifically these sorts of warrants further\nsupports the notion that Rule 41(b) did not previously do so.\n. . . But does a warrant issued in violation of Rule 41(b) compel suppression of evidence?\nNot necessarily. Only certain Rule 41 violations justify suppression. The suppression of\nevidence is \xe2\x80\x9ca judicially created remedy designed to safeguard Fourth Amendment rights\ngenerally through its deterrent effect, rather than a personal constitutional right of the\nparty aggrieved.\xe2\x80\x9d . . . [The Ninth Circuit went on to conclude that the suppression was not\nwarranted here because the officers relying on the warrant did so out of good-faith belief\nin its validity, and because there was no forward-looking deterrence justification for\nsuppression given the intervening amendment to Rule 41 noted above.]\n\nConsider the following questions:\n\xe2\x80\xa2 How would you explain, in plain terms, what the FBI did here under the label \xe2\x80\x9cNIT\xe2\x80\x9d?\n\xe2\x80\xa2 If a private person did the same thing, would it violate the CFAA?\n\xe2\x80\xa2 Can you identify any plausible alternative way for the FBI to identify the persons\naccessing Playpen other than the NIT approach they used?\n\xe2\x80\xa2 Can you identify any undesirable policy consequences to allowing the FBI to use this\nmethod? Don\xe2\x80\x99t forget: they did get a warrant.\n\xe2\x80\xa2 Change the facts: What legal consequence(s) if FBI had not obtained a warrant?\n\xe2\x80\xa2 Does it matter to your analysis that Playpen preexisted? What if FBI created it from\nscratch, as a \xe2\x80\x9cwatering hole\xe2\x80\x9d tactic?\n\xe2\x80\xa2 Revisit the topic of vulnerability disclosure, which arose with the last reading. Does our\nforay into NITs and lawful hacking change your views on that topic?\n\n4. Hacking to Get Data-at-Rest (and the Going-Dark Connection)\nNote: The NIT language is often used as a shorthand for lawful hacking scenarios, but not all law\nenforcement hacking is network-focused. Sometimes, for example, the idea is to overcome the\nsecurity of an encrypted device in order to access data-at-rest (or, as in the mafia case\nmentioned earlier, to install the equivalent of a keylogger in order to catch outbound and inbound\ntraffic pre- and post-encryption). The \xe2\x80\x9cApple v. FBI\xe2\x80\x9d controversy looms very large under that\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n216\n\nheading. As you probably are aware, that controversy is closely associated with a larger policy\ndebate sometimes called the \xe2\x80\x9cGoing Dark\xe2\x80\x9d debate.\nThe idea with that label is that law-enforcement agencies are losing the practical ability to end\nup with readable plain-text even when they have warrants or other lawful bases for accessing\ndata in motion or at rest, because of the combination of two trends: (1) the growing ubiquity of\nencryption as the default for the varied communications platforms people use these days, and\n(2) circumstances in which the company that created the relevant communication platform or\ndevice does not have\xe2\x80\x94and is not willing or perhaps even able to create\xe2\x80\x94a workaround. Thus, a\nseries of federal law-enforcement officials have argued that Congress should enact a new and\nbroader CALEA-style statute, this time focused on requiring companies to have and preserve the\nability to decrypt traffic or otherwise assist law enforcement in executing warrants in this situation.\nOpponents argue that there is naught that can or should be done about this, asserting that the\nnet gain for security overall outweighs lost investigative benefits, and that law enforcement in the\nmeantime may be enjoying a \xe2\x80\x9cgolden age\xe2\x80\x9d of investigative benefits in relation to non-content\nmetadata that remains available.\nA proper dive into the Going Dark debate is beyond the scope of our course, but if you want to\nspend more time on your own studying these issues, consider reading the \xe2\x80\x9cDon\xe2\x80\x99t Panic\xe2\x80\x9d report\nissued by the Berkman Center at Harvard and this essay from Susan Hennessey for Brookings, and\nlistening to this special episode of Pat Gray\xe2\x80\x99s Risky Business podcast (part of a special series\nsponsored by the Hewlett Foundation) in which Pat interviews former FBI General Counsel Jim\nBaker on the subject.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n217\n\n23. The Insecurity Industry\n\nLearning Objectives\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\nBe able to describe both the similarities and the differences among: (1) the security industry\n(security researchers, white-hat hackers, etc.), (2) the insecurity industry, and (3) black-hat\nhackers (hint: all use their skills to identify vulns, create exploits, etc.)\nUnderstand what a \xe2\x80\x9cbug-bounty\xe2\x80\x9d program is and why that model is desirable from the\ndefensive perspective\nAppreciate that there is a threshold question, for every society, regarding whether it will\nlegalize hacking for certain institutions (law enforcement, military, spies, etc.), and that this\nnecessarily gives rise to the question of how those institutions will acquire the capabilities\nneeded to perform that function\nUnderstand that there does not have to be a private industry to supply such capabilities; they\ncan be developed exclusively by government entities if that\xe2\x80\x99s how that society prefers to\nproceed\nBe able to describe the advantages of having an \xe2\x80\x9cinsecurity industry\xe2\x80\x9d to perform this role, as\nwell as the disadvantages\nUnderstand how the Apple/FBI dispute relates to this topic\nAppreciate the utility of having a formalized interagency process for determining when\ngovernment knowledge of a vuln/exploit should be disclosed to a vendor and when, instead,\nit should be kept for government use\nIn light of that, understand the basics of how the US government has done this via the \xe2\x80\x9cVEP\xe2\x80\x9d\nKnow that VEP determinations are not one-time decisions, but rather require recurring\nassessment; be able to describe how this might impact the decision at any given moment in\ntime\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\n218\n\nUnderstand that vendors themselves naturally may look at the question differently, and\nunderstand the complexities that arise if they attempt to sue an insecurity-industry entity (as\nillustrated by the FaceBook/WhatsApp suit against NSO Group)\nBe able to explain the difference among: (1) objecting to the idea that a government agency\nis authorized to hack under certain conditions; (2) objecting to the idea that such an agency\ncan turn to a private company to purchase the know-how to do this; and (3) fearing that in\nsome instances such private companies will sell their wares to a government buyer that might\nput them to abusive use\nUnderstand the notional array of regulatory options for minimizing the risk associated with that\nthird element; consider options that involve (a) outright prohibitions on certain sales, (b) presale requirements of licensing, transparency, or other processes, and (c) post-sale\nrequirements of auditing, reporting, or even liability\nAppreciate that one might have different rules for domestic and overseas sales\nUnderstand the role of the Wassenaar Arrangement, and the nature of the recent dispute\nrelating to rules that would limit exports (pay particular attention to the question of why this\nrules would interfere, potentially, with the penetration-testing industry)\nKnow that the United States does not formally regulate the \xe2\x80\x9cinsecurity industry\xe2\x80\x9d as such,\nmeaning that there are no special rules for just that industry (except for situations covered by\nexport-control law)\nUnderstand the problems illustrated by Project Raven, and how questions related to \xe2\x80\x9chuman\ncapital\xe2\x80\x9d differ from regulating the sale of software/code\n\nLet\xe2\x80\x99s turn now to a related topic involving \xe2\x80\x9clegitimate\xe2\x80\x9d private-sector hacking: the policy and legal\nquestions associated with what some describe pejoratively as the \xe2\x80\x9cinsecurity industry.\xe2\x80\x9d\nA. The Insecurity Industry, Government Clients, and the Vulnerabilities Equities Process Issue\nIn this course, we have spoken often of white-hat security researchers, corporate ventures like\nProject Zero, bug-bounty programs, and other elements of the security-enhancing ecosystem.\nThese players differ in whether and how they seek to be paid for their efforts, but they have in\ncommon a general commitment to increasing information security for all by using their knowledge\nof vulnerabilities, exploits, and tactics in a way that\xe2\x80\x99s intended to cause the owner or creator of\nrelevant systems to patch or take other remedial action. We also have spoken of actors who use\nthe same knowledge for nefarious purposes, either employing it directly on their own or cashing\nin on the black market by selling products and services without regard for how they might be put\nto use.\nBetween these poles, we find the insecurity industry. The key to understanding the insecurity\nindustry is to grasp that, for better or worse, most domestic legal systems permit certain entities\n(usually limited to government agencies, such as law enforcement organizations) to engage in\nunauthorized access under at least some conditions. That being the case, those entities either\nmust develop their own capacities to execute such operations or else purchase that capacity\nfrom others. And that\xe2\x80\x99s where the insecurity industry steps in: these entities supply products and\nservices to those legitimate users. Or that\xe2\x80\x99s how it is supposed to work, at any rate.\nUnquestionably, it does sometimes work that way. A famous example occurred several years ago,\nwhen the FBI had warrants to search the contents of iPhones belonging to Syed Farook and\nTashfeen Malik, the perpetrators of a horrific terrorist attack in San Bernadino in December 2015.\nThe FBI did not have their passwords, however, and could not run a brute-force password-guessing\nprogram without running afoul of iPhone security features that would progressively slow down the\ntime between guesses or even wipe the data from the phone after a certain number of incorrect\nguesses. The FBI turned to Apple for help, and Apple cooperated with the FBI up to a point. But,\ncritically, it refused a request to develop a bespoke iOS update that would have negated the\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n219\n\nsecurity features. The FBI then took Apple to a court of law, and Apple in turn took the FBI to the\ncourt of public opinion. Intense controversy followed, until the FBI announced that an unidentified\nthird-party somehow had managed to solve the access challenge. Here\xe2\x80\x99s how Ellen Nakashima\ndescribed this turn of events for the Washington Post:\nThe FBI cracked a San Bernardino terrorist\xe2\x80\x99s phone with the help of professional hackers\nwho discovered and brought to the bureau at least one previously unknown software flaw,\naccording to people familiar with the matter. The new information was then used to create\na piece of hardware that helped the FBI to crack the iPhone\xe2\x80\x99s four-digit personal\nidentification number without triggering a security feature that would have erased all the\ndata, the individuals said. The researchers, who typically keep a low profile, specialize in\nhunting for vulnerabilities in software and then in some cases selling them to the U.S.\ngovernment. They were paid a one-time flat fee for the solution.\nThe public later learned that the FBI paid approximately $900,000 for the capability it acquired in\nthat one instance. The Nakashima article goes on to explain:\nFBI Director James B. Comey has said that the solution works only on iPhone 5Cs running\nthe iOS 9 operating system \xe2\x80\x94 what he calls a \xe2\x80\x9cnarrow slice\xe2\x80\x9d of phones.\nApple said last week that it would not sue the government to gain access to the solution.\nStill, many security and privacy experts have been calling on the government to disclose\nthe vulnerability data to Apple so that the firm can patch it.\nIf the government shares data on the flaws with Apple, \xe2\x80\x9cthey\xe2\x80\x99re going to fix it and then\nwe\xe2\x80\x99re back where we started from,\xe2\x80\x9d Comey said last week in a discussion at Ohio\xe2\x80\x99s Kenyon\nCollege. Nonetheless, he said Monday in Miami, \xe2\x80\x9cwe\xe2\x80\x99re considering whether to make that\ndisclosure or not.\xe2\x80\x9d\nThe White House has established a process [the \xe2\x80\x9cVulnerabilities Equities Policy and\nProcess,\xe2\x80\x9d or \xe2\x80\x9cVEP\xe2\x80\x9d] in which federal officials weigh whether to disclose any security\nvulnerabilities they find. . . . The policy calls for a flaw to be submitted to the process for\nconsideration if it is \xe2\x80\x9cnewly discovered and not publicly known.\xe2\x80\x9d \xe2\x80\x9cWhen we discover these\nvulnerabilities, there\xe2\x80\x99s a very strong bias towards disclosure,\xe2\x80\x9d White House cybersecurity\ncoordinator Michael Daniel said in an October 2014 interview. . . . \xe2\x80\x9cThat\xe2\x80\x99s for a good\nreason. If you had to pick the economy and the government that is most dependent on\na digital infrastructure, that would be the United States.\xe2\x80\x9d But, he added, \xe2\x80\x9cwe do have an\nintelligence and national security mission that we have to carry out. That is a factor that\nwe weigh in making our decisions.\xe2\x80\x9d\nThe decision-makers, which include senior officials from the Justice Department, FBI,\nNational Security Agency, CIA, State Department and Department of Homeland Security,\nconsider how widely used the software in question is. They also look at the utility of the flaw\nthat has been discovered. Can it be used to track members of a terrorist group, to prevent\na cyberattack, to identify a nuclear weapons proliferator? Is there another way to obtain\nthe information?\nIn the case of the phone used by the San Bernardino terrorist, \xe2\x80\x9cyou could make the\njustification on both national security and on law enforcement grounds because of the\npotential use by terrorists and other national security concerns,\xe2\x80\x9d said a senior\nadministration official, speaking on the condition of anonymity because of the matter\xe2\x80\x99s\nsensitivity.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n220\n\nA decision also can be made to disclose the flaw \xe2\x80\x94 just not right away. An agency might\nsay it needs the vulnerability for only a few months. \xe2\x80\x9cA decision to withhold a vulnerability\nis not a forever decision,\xe2\x80\x9d Daniel said in the earlier interview. \xe2\x80\x9cWe require periodic reviews.\nSo if the conditions change, if what was originally a true [undiscovered flaw] suddenly\nbecomes identified, we can make the decision to disclose it at that point.\xe2\x80\x9d\nNote: If you wish, you can read more about the \xe2\x80\x9cVulnerabilities Equities Policy & Process\xe2\x80\x9d here,\nthough you do not need to so for purposes of this class.\n\nConsider the following:\n\xe2\x80\xa2 Can you explain the relationship between the growing ubiquity of encryption both on\ndevices themselves and on communications-in-transit, and the idea that the\ngovernment is motivated to devote more resources to acquiring hacking capabilities?\n\xe2\x80\xa2 Be prepared to attack or defend the idea of the \xe2\x80\x9cVulnerabilities Equities Policies and\nProcess,\xe2\x80\x9d in accordance with your own view of the matter.\n\xe2\x80\xa2 Be prepared to make policy arguments for and against allowing the government to\nbuy hacking capabilities from outsiders in the specific context in which a law\nenforcement agency has obtained a warrant authorizing the search.\n\xe2\x80\xa2 Does your answer apply the same way as to all countries and their varied legal systems,\nor is it a U.S.-specific answer?\n\xe2\x80\xa2 Does your answer change if the government does not have a warrant?\no What if the situation is a foreign-intelligence investigation rather than a criminal\ninvestigation?\no What if the government\xe2\x80\x99s intent is to use the capability only against foreign\ntargets outside the United States?\n\xe2\x80\xa2 If such sales are made unlawful, what impact would that have on the related debate\nover whether the law should empower courts under certain conditions to order\nhardware and software vendors like Apple to cooperate with the government in\ndeveloping solutions to circumvent user-privacy features?\n\nB. Policy Challenge: Insecurity Industry Sales that Facilitate Abuse\nIf every insecurity-industry vendor sold only to the FBI in contexts involving warrants, this topic would\nbe much less interesting. In reality, though, there are companies around the globe selling such\ngoods and services to a wide variety of government buyers, with some of their aims laudable and\nothers not so at all. To understand this better, we have an excerpt from an article that Joseph\nCox and Lorenzo Franceschi-Bicchierai wrote for Motherboard in 2018:\nAt first glance, Azimuth Security looks like any other bustling startup. Photos tweeted by the\nfirm\xe2\x80\x99s co-founder show a staffer zipping in front of glass-walled conference rooms on a\nhoverboard and employees in T-shirts playing with a stylish chess set over a beer. But this\nsmall Australian company plays a crucial role in the continuous battle for spies and cops\nto hack into phones around the world. . . .\nThe story of this little-known company provides a rare peek inside the secretive exploit\ntrade, which is populated with military contractors, individual researchers, and boutique\nhigh-end hacking shops like Azimuth. While the trade is commonly painted as a wild west\nfull of mercenaries who sell hacking tools to whoever can afford them, over a dozen wellplaced sources described an overlooked section of the industry that focuses on supplying\nto a select group of democratic governments, rather than authoritarian regimes. . . . Three\nsources familiar with the company said Azimuth\xe2\x80\x94through its partner firm\xe2\x80\x94provides exploits\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n221\n\nto members of the so-called Five Eyes, a global intelligence sharing group made up of the\nUnited States, United Kingdom, Canada, Australia, and New Zealand. . . . Azimuth\xe2\x80\x99s\nexploits are used in terrorism cases, and potentially other types of crime such as kidnapping\nor child pornography as well. . . .\nA plethora of companies now focus solely on offering exploits and other hacking tools to\nintelligence and law enforcement agencies around the world, typically with customer\nsupport and additional products to extract information from target devices. Think of it as\na hacking-tools-as-a-service. . . . Many of these firms have controversial client lists,\nincluding countries with abysmal human rights records such as Sudan, Ethiopia, and Russia.\n\nConsider the following:\n\xe2\x80\xa2 What distinction does this passage draw in terms of the potential purchasers of these\n\xe2\x80\x9chacking tools\xe2\x80\x9d?\n\xe2\x80\xa2 Should that distinction matter with reference to the legality of such sales?\n\xe2\x80\xa2 If you think purchaser identity should be used in determining the legality of such sales,\nwhat statutory language would suffice to implement the distinction?\n\xe2\x80\xa2 The passage also highlights various investigative purposes the purchaser might have in\nmind. Should that variable be used to determine legality?\n\xe2\x80\xa2 If so, what statutory language would suffice to implement the distinction?\n\xe2\x80\xa2 To what extent is it reasonable to expect a seller to determine, accurately, who will be\nthe ultimate user of the capabilities it sells and the purposes to which the capabilities\nwill be put?\nIt is clear that, on some occasions, vendors have sold hacking tools to an entity that has, in turn,\nused them to facilitate some undesirable end, such as surveilling political opponents (or worse).\nWhat liability, if any, should attach to the vendor in such cases?\nConsider the suit Facebook/WhatsApp recently filed against the Israeli firm NSO Group. Here are\nexcerpts from a handy summary by Andy Greenberg at Wired:\nWhatsApp published a statement accusing NSO of targeting 1,400 of its users, including at\nleast 100 members of "civil society" such as journalists and human-rights defenders, with\nmalicious voice calls designed to infect targeted phones with malware and steal\nmessages despite WhatsApp\'s end-to-end encryption. Those numbers would represent a\nnew scale for NSO, whose malware has already been linked to attacks against activists\nranging from the now-imprisoned United Arab Emirates dissident Ahmed Mansoor to\nMexican activists opposing a soda tax.\nWhatsApp paired its statement with a lawsuit in a Ninth Circuit court, accusing NSO of\nviolating the Computer Fraud and Abuse Act. . . . To make that charge stick, WhatsApp\nwill have to show that NSO obtained illegal access to WhatsApp\'s own systems. Given that\nNSO\'s targets were WhatsApp users rather than, say, WhatsApp\'s servers, they\'ll have to\nfind an argument that they, as the plaintiff, were the victim. . . .\nWhatsApp\'s most obvious unauthorized access argument relates to its terms of service,\nwhich prohibit reverse-engineering WhatsApp\'s code, harming its users, or sending\nmalware via WhatsApp. The company might argue that by agreeing to those terms of\nservice and then violating them, NSO\'s use of WhatsApp was unauthorized all along. The\ncomplaint appears to lay the groundwork for that case: It points out that NSO Group staff\n"created various WhatsApp accounts and agreed to the WhatsApp Terms."\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n222\n\nBut that terms-of-service argument will be an uphill battle . . . the Ninth Circuit in particular\nhas set a clear precedent that terms-of-service violations alone don\'t constitute\nunauthorized access. . . . WhatsApp\'s lawsuit doesn\'t make any mention of prior notice to\nNSO to stop abusing its services or hacking its users. . . .\nAnother, trickier strategy for WhatsApp may be to claim that the malicious data NSO sent\nvia WhatsApp servers was itself a kind of unauthorized access. The WhatsApp complaint\naccuses NSO of initiating malicious calls that hid their attack code in fake settings data,\nand in doing so bypassed "technical restrictions" on what sort of data WhatsApp\'s servers\nwere designed to pass on to phones. This may be the crux of WhatsApp\'s CFAA claim: that\nWhatsApp\'s own access restrictions were "hacked" with this technique, just as if someone\nhad bypassed a more obvious access restriction like one that demanded a username and\npassword. . . .\n"We dispute today\xe2\x80\x99s allegations and will vigorously fight them," said NSO in a statement.\n"The sole purpose of NSO is to provide technology to licensed government intelligence\nand law enforcement agencies to help them fight terrorism and serious crime. Our\ntechnology is not designed or licensed for use against human rights activists and\njournalists."\n\nConsider the following questions:\n\xe2\x80\xa2 Can you explain how the first theory of CFAA liability in this case relates to the\nFacebook v. Power Ventures case?\n\xe2\x80\xa2 If Facebook/WhatsApp prevail on this theory, does this have implications for the\ninsecurity industry more generally?\no For example, would this call into question the legality of the capability the FBI\napparently purchased in order to access the San Bernadino iPhones?\n\xe2\x80\xa2 Can you explain the second theory of CFAA liability in this case?\no If it prevails, would it cast a significant shadow over other insecurity-industry\npractices?\nC. Using Export-Control Laws and Institutions to Limit Risky International Sales\nIn addition to the question of what is and should be legal in any given country\xe2\x80\x99s domestic legal\nsystem, there is a distinct set of questions concerning whether and how the domestic and\ninternational legal systems that regulate international trade\xe2\x80\x94particularly trade in armaments and\nother security-sensitive capabilities\xe2\x80\x94apply to the insecurity industry. This has been a hot topic in\nrecent years in light of periodic stories of firms in one country providing capabilities to foreign\ngovernments which then put them to abusive ends.\nA prominent example involves the Italian firm \xe2\x80\x9cHacking Team,\xe2\x80\x9d which in 2015 was itself subject to\na massive doxing episode that revealed to the public that the company sold its surveillanceenabling malware kits to a variety of regimes including Azerbaijan, Bahrain, Egypt, Ethiopia,\nKazakhstan, Morocco, Nigeria, Oman, Saudi Arabia, and Sudan, but also the DEA, the FBI, and\nDoD in the United States. This added fuel to the fire of an ongoing effort to update international\narms-trade rules to encompass such transactions. Andy Greenberg at Wired summed up the\nsituation at the time:\nThat issue of whether hacking tools are defined as weapons in the terms of arms control\nagreements couldn\'t be more timely: An arms control pact called the Wassenaar\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n223\n\nArrangement has been hotly debated in recent weeks over its measures that would\ncontrol the international export of intrusion software. . . . The Wassenaar Arrangement has\nbeen criticized by the hacker community as limiting security research and preventing the\nsharing of penetration testing tools. But Privacy International\'s Eric King argues that the\npractices of Hacking Team demonstrate why the pact is necessary, along with what he\ndescribes as "carve-outs" to protect security research. "What\xe2\x80\x99s clear is that these\ncompanies can\xe2\x80\x99t be left to their own devices," says King. "Some form of regulation is\nneeded to prevent these companies from selling to human rights abusers. That\xe2\x80\x99s a hard\npolicy question, and one tool won\xe2\x80\x99t be a silver bullet. But regulation and export controls\nshould be part of the policy response."\n\nConsider the following questions:\n\xe2\x80\xa2 Should export-control rules encompass vulns, malware, or both?\n\xe2\x80\xa2 Why would \xe2\x80\x9cWhite Hat\xe2\x80\x9d security researchers object?\n\nWhat happened next? Garret Hink explained here for Lawfare in 2018:\nThe United States successfully negotiated research-use exceptions to export controls on\nsurveillance tools at the December 2017 meeting of the Wassenaar Arrangement, a club\nof advanced economies that coordinates export controls. These export controls\xe2\x80\x94\nrequirements that organizations selling or sending technologies with potential military\napplications abroad obtain a license from the Commerce Department\xe2\x80\x94affect key swaths\nof the cybersecurity industry. Although countries implement export controls at the national\nlevel, the United States and 40 other countries have agreed to coordinate their controlled\nitems at the Wassenaar Arrangement, an international framework for creating a voluntary\nexport control regime. At this year\xe2\x80\x99s meeting, the U.S. aimed to correct what the\ncybersecurity industry portrays as overly-broad controls on intrusive surveillance software\xe2\x80\x94\ncontrols that security experts say \xe2\x80\x9ccriminalized\xe2\x80\x9d essential tools for stopping malware. After\nyears of debate over the proper scope of export controls on surveillance products, the U.S.\nhas finally made a beachhead on getting long-sought-after exemptions for security\nresearch and information sharing. In this post, I describe the original Wassenaar export\ncontrols, summarize the 2017 revisions, and forecast what we should expect to see next.\nBackground\nThe Arab Spring revealed how repressive regimes use Western commercially developed\nsoftware surveillance tools to spy on dissidents and human rights activists. Human rights\norganizations sued a French company for giving to the Libyan government equipment\nthat activists say enabled torture of dissidents. Privacy International and other civil-society\ngroups pressured the British government to use existing legal mechanisms restrict repressive\nregimes\xe2\x80\x99 access to network intrusion software that employed enabled governments to\nintercept email, instant messaging and webcam data. (Citizen Lab\xe2\x80\x99s research explores this\ntopic extensively.) In 2013, the British and French governments negotiated the addition of\ntwo types of dual-use technology\xe2\x80\x94\xe2\x80\x9cintrusion software\xe2\x80\x9d and \xe2\x80\x9cIP network communications\nsurveillance systems\xe2\x80\x9d\xe2\x80\x94to the lists of dual-use technologies that the Wassenaar\nArrangement governs\nThe Wassenaar Arrangement is an export control framework\xe2\x80\x94not an international\nregulatory agency or treaty organization, but rather, a group of countries that meet\nregularly and agree to control certain technologies. An export control is a requirement\nthat a company wishing to sell a product abroad get a government license to export the\nitem; it is not a ban on that item\xe2\x80\x99s export. Wassenaar has no way to make its controls legally\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n224\n\nbinding on its members, who regulate controlled items through their domestic export\ncontrol regimes. The arrangement\xe2\x80\x99s 41 members include the U.S., near-all the European\nUnion (Cyprus is the lone outlier), Russia, Turkey, Argentina and South Africa. Its goal is to\nprevent \xe2\x80\x9cdestabilising accumulations\xe2\x80\x9d of conventional arms and dual-use goods and\ntechnologies\xe2\x80\x94items with both civilian and military applications.\nThe Intrusion Software Controls\nThe \xe2\x80\x9cintrusion software\xe2\x80\x9d control took on the difficult task of regulating surveillance software\nbased on computer code functionality. Wassenaar defined intrusion software as \xe2\x80\x9csoftware\nspecially designed or modified to avoid detection by monitoring tools, or to defeat\nprotective countermeasures\xe2\x80\x9d and that either extracted data from a computer or network\ndevice or modified the \xe2\x80\x9cstandard execution path\xe2\x80\x9d of a program to allow \xe2\x80\x9cthe execution\nof externally provided instructions.\xe2\x80\x9d\nBut rather than control intrusion software itself, the arrangement put export controls on\nsoftware, systems or equipment that interacted with intrusion software. The provision would\ncover the software toolkits that companies sell to law enforcement and intelligence\nagencies to carry out intrusive surveillance\xe2\x80\x94see for example Hacking Team\xe2\x80\x99s\nnotorious RCS package. It also controlled any type of technology involved in the\ndevelopment of intrusion software. \xe2\x80\x9cTechnology\xe2\x80\x9d in the control\xe2\x80\x99s context meant essentially\nany program, code or software tool that was connected to intrusion software. In\none interpretation of the WA\xe2\x80\x99s controls, \xe2\x80\x9cintrusion software\xe2\x80\x9d meant code that took\nadvantage of an exploit. By controlling software that used software vulnerabilities to carry\nout surveillance, the WA control targeted a limited subset of items that related to software\nexploits.\nWhen the United States tried to implement the intrusion software controls, Symantec,\nFireEye, independent security researchers and the EFF raised serious concerns about their\neffect\non\nsecurity\nsoftware\nand\nresearch.\nFirst,\nthe\nCommerce\nDepartment\xe2\x80\x99s implementation through the Commerce Department\xe2\x80\x99s Bureau of Industry\nand Security (BIS) expanded its scope to cover a broad range of cybersecurity items.\nMailyn Fidler detailed for Lawfare how the controls ratcheted up efforts to control trade in\nsoftware that used zero-day vulnerabilities. BIS said the controls would require export\nlicenses for commercially available penetration testing products and that potentially any\nexploit sent abroad or even to a national of a foreign country would require a license.\nBIS published an extensive FAQ that attempted to clarify how the controls affected\nsecurity research involving exploits. The EFF criticized the FAQ for creating more confusion\nthan clarity on the controls\xe2\x80\x99 scope. In addition, the Commerce Department revoked\nexemptions for commercially available software products that would have applied to\nmany of the newly controlled security products. It also failed to provide license exceptions\nfor security research. The security industry identified all of these actions as harmful to\nbusiness and research activities.\nBut the cybersecurity industry also had problems with the substance of the Wassenaar\nlanguage itself. Symantec, FireEye and other security software vendors said the intrusion\nsoftware definition was too broad and it encompassed legitimate products like endpoint\nsecurity systems and other tools that \xe2\x80\x9chook\xe2\x80\x9d into a system to modify its code. They said\nfurther that the controls would also make it much more difficult for security research and\nvulnerability information sharing. The control on \xe2\x80\x9ctechnology for the development\xe2\x80\x9d of\nintrusion software would have covered many essential tools for the security research\ncommunity such as exploit proofs-of-concept and automated vulnerability generators.\nIn response to a deluge of comments opposing the rule, the Commerce Department\nwithdrew the proposal. After escalating criticism and a dressing down from the House\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n225\n\noversight committee, the Commerce Department convened with its interagency partners\nto revise the U.S. approach. In March 2016, Commerce Secretary Penny Pritzker said in\na letter that the United States would attempt to remove the intrusion software controls at\nthat year\xe2\x80\x99s Wassenaar meetings. In December 2016, the U.S. negotiating team (with\nadded technical experts from the cybersecurity community) failed to convince the other\n40 Wassenaar members to agree on narrower language. Bipartisan groups of lawmakers\nin the House and Senate urged the Trump administration to continue the push to alter the\nWassenaar language at the 2017 meeting.\n2017 Revisions to the Wassenaar Controls\nAt the December 2017 Wassenaar meeting, the members agreed on a set of changes to\nthe intrusion software controls. It received limited media coverage. The revised control\nlist included several additions and alterations that Katie Moussouris, a security professional\nand technical adviser to the U.S. Wassenaar delegation, hailed as fixes for the problems\nthe cyber industry had complained about. The changes are:\n\xe2\x97\x8f Replacing language that controlled software \xe2\x80\x9cspecially designed\xe2\x80\x9d to operate or\ncommunicate with intrusion software with the terms \xe2\x80\x9csoftware specially designed for\ncommand and control\xe2\x80\x9d of intrusion software.\n\xe2\x97\x8f Adding an exception for software that carries out updates authorized by the\nowner or operator of the system.\n\xe2\x97\x8f Adding exemptions for controls on technology either involved in the\ndevelopment of intrusion software or the development of software that operates, controls\nor delivers intrusion software. These exemptions said the controls do not apply for\nvulnerability disclosure or cyber incident response activities. The list defines vulnerability\ndisclosure and cyber incident response as processes for sharing information about\nvulnerabilities and cyber incidents but does not explain how these exemptions apply to\nspecific categories of items.\n\xe2\x97\x8f Adding a clarifying note saying that the above-described exemptions \xe2\x80\x9cdo not\ndiminish national authorities\xe2\x80\x99 rights to ascertain compliance\xe2\x80\x9d with existing controls.\nThe alterations appear to address the some of the concerns associated with the\nWassenaar language, notably the concerns from the security research community about\nvulnerability information sharing. But it is not yet clear how the new language mitigates\nconcerns about the broad definition of intrusion software that may encompass legitimate\nsecurity tools not used for \xe2\x80\x9cvulnerability disclosure\xe2\x80\x9d or \xe2\x80\x9ccyber incident response.\xe2\x80\x9d Rob\nJoyce, White House cybersecurity coordinator, has praised the changes, as has Rep. Jim\nLangevin, a leading congressional voice on this issue.\nWhat Comes Next?\nThe path forward is not clear. The Commerce Department could use the new language\nto craft a new proposed rule, to be followed by yet another public comment period. It\nwould have to decide whether to add more exceptions and how to define how the new\nexemptions apply. Alternatively, Commerce could delay implementing the revised list and\nwait for the next meeting\xe2\x80\x99s negotiations. In that scenario, Commerce could push for the\nU.S. delegation to demand more substantial changes to Wassenaar\xe2\x80\x99s definition of intrusion\nsoftware. But the human rights and internet freedom communities united with industry to\noppose the 2015 proposed rule, and it is not clear whether the new changes will satisfy\ntheir concerns.\nThe Wassenaar changes could cause confusion for other countries as well. The EU has had\nintrusion software on its export control list since 2015. But as revelations that European\ncompanies sold surveillance toolkits to Middle Eastern dictators continued, the EU has\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n226\n\nsought to revamp its dual-use export control legislation in the interest of human rights.\nSeparately, Israel (which is not a Wassenaar member but has a domestic law that adopts\nall Wassenaar controls automatically) attempted to more rigorously define intrusion\nsoftware in early 2016. Doron Hindin detailed this effort for Lawfare. But a few months later,\nIsrael shifted its policy on export controls, substantially reducing the scope and strength of\nthe license requirements. It is unclear how the newest Wassenaar shift will play into both\nthe EU export control reform initiative and the liberalized Israeli approach.\n\nIs the problem solved? What further steps would you take?\nD. What about the International Trade in Personnel?\nRecent events in the United States have underscored that the question of exporting hacking\ncapability is not just a question of the trade in malware and vulns. It\xe2\x80\x99s also a trade in services\xe2\x80\x94\nespecially the services of trained personnel. Consider the following piece I wrote for Lawfare in\nFebruary 2019:\nIt\xe2\x80\x99s been known since 2012 that a Baltimore-based company called Cyber Point had a\ncontract with the United Arab Emirates (UAE) to assist its newly-established signals\nintelligence agency (then called the National Electronic Security Authority) with \xe2\x80\x9cadvice\non cyberdefense and policy,\xe2\x80\x9d as Ellen Nakashima reported at the time for the Washington\nPost. Later, there were suggestions that Cyber Point might be involved in helping the UAE\nservice acquire malware that the UAE used to support surveillance activities that included\nmonitoring of political opponents. And now, Reuters has a remarkable piece from Chris\nBing and Joel Schactman, published last week, that goes deeper and raises important\nquestions about the role of U.S. citizens in working for foreign intelligence agencies.\nThe Reuters report explains that Cyber Point hired a group of ex-NSA employees to work in\nthe UAE in support of the UAE signals intelligence service, under the name of \xe2\x80\x9cProject\nRaven.\xe2\x80\x9d Later, the Project Raven team was transferred in some fashion from the Cyber\nPoint contract to a contract with the UAE-based firm DarkMatter. Along the way, the\nAmericans came to appreciate that their efforts at times did indeed include surveillance\nof political opponents of UAE authorities, and further that the UAE service at times targeted\nAmericans despite assurances that this would not occur (or at least that the operations\nProject Raven in particular conducted or supported would not be directed at Americans).\nThey probably should not have been surprised by any of that. But be that as it may, the\nstory understandably has excited concern that the United States lacks a sufficient policyand-law framework to regulate situations of this kind.\nWhat policy concerns, precisely, does this story illustrate? It\xe2\x80\x99s important to be clear on that\nquestion before asking whether the U.S. has an adequate legal architecture for addressing\nscenarios like Project Raven.\nI see at least four distinct areas of concern implicated by the Project Raven story, each\nimplicating existing or potential legal architectures in different ways:\n1.\n2.\n3.\n4.\n\nWhether Americans in general should ever serve in a foreign intelligence agency;\nWhether former intelligence community employees in particular should not do this;\nWhether the United States adequately protects classified information;\nWhether the United States adequately protect the privacy of Americans from foreign\nsurveillance.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n227\n\nLet\xe2\x80\x99s take those in sequence.\n1. Whether Americans in general should ever serve in a foreign intelligence agency\nThe question here does not concern serving secretly as an asset for foreign governments,\nwhich U.S. law obviously should (and does) discourage. Instead, the question is whether it\nis inherently bad for U.S. persons (American citizens and lawful permanent residents) to\nhave overt work relationships with foreign intelligence agencies. Some might argue that\nall such service is inherently unfriendly to the U.S. government at least at some level, with\nsome contexts plainly much more so than others. Might some form of ban, with exceptions,\ntherefore be desirable? And if so, does the U.S. not already have something like this?\nThe case for having some form of ban begins with the idea that there is inherent tension\nbetween owing a duty of loyalty to the United States and providing services to a foreign\ngovernment in direct relation to that government\xe2\x80\x99s pursuit of its own security and foreign\npolicy goals, which in some cases may be inimical to the security and foreign policy goals\nof the United States. There is also the possibility that the actions of U.S. persons abroad,\neven when working under the direction and control of a foreign government, could be\nheld against the United States, fairly or not. On the flip side, there are of course\ncircumstances in which interests align enough to make such service with a foreign\nintelligence agency beneficial for the United States. The balance of equities, then, is highly\ncontext-dependent.\nThis suggests that the optimal legal framework would be one that allows such service only\nwhere there has been some degree of vetting on the front end, and some degree of\nongoing monitoring on the back end\xe2\x80\x94that is, a licensing model, as opposed to a flat ban.\nAs it turns out, the U.S. already has a version of this. But as the Project Raven story itself\nillustrates, the current system seems incomplete.\nThe existing licensing model was created primarily to address military-relevant materials\nand services. Under the Arms Export Control Act, the executive branch is authorized to\nprohibit the unlicensed export of \xe2\x80\x9cdefense articles\xe2\x80\x9d and \xe2\x80\x9cdefense services.\xe2\x80\x9d The meaning\nof those broad categories is explicated at great length and detail through the\nInternational Traffic in Arms Regulations (ITAR) and the U.S. Munitions List (USML). Things that\nfall within them cannot be exported without a license from the State Department\xe2\x80\x99s Director\nof Defense Trade Controls (DDTC). DDTC can\xe2\x80\x94and does\xe2\x80\x94impose conditions on the\nlicenses it grants, including, where appropriate, limitations designed to prevent U.S.provided articles and services from being used by foreign recipients in ways that violate\nhuman rights or that otherwise harm U.S. interests.\nDoes this apply to things or services provided to foreign intelligence services? The question\nis a tricky one, at least on paper, for the regulations are dense and their references to\nintelligence activities are sparse (and not tailored to clearly address grey zone activities in\nthe cyber domain). That said, the Project Raven/Cyber Point episode itself makes clear\nthat DDTC does view at least some such activity as coming within the licensing system;\nCyber Point applied for and received a license, after all.\nThe more important questions\xe2\x80\x94the ones the Project Raven story raises in relation to this\nparticular policy concern\xe2\x80\x94are whether the licensing system is sufficiently probing on the\nfront end when the license is being granted, and whether there is adequate back-end\nmonitoring for compliance with license conditions. The nuances in the Project Raven story,\nso far can be gleaned from the Reuters account, are tricky on both points.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n228\n\nReuters writes that Project Raven transitioned out from under Cyber Point (and its license)\nat some point, moving to UAE-based DarkMatter. Conduct subsequent to that shift\nprobably cannot be laid at Cyber Point\xe2\x80\x99s door, and thus would not violate the Cyber Point\nlicense. On that view, one cannot fault the front-end screening by DDTC, unless it turns out\nthat the Project Raven activities violated the license terms all along. On the other hand,\nthat same logic compels the conclusion that the U.S. persons who remained working for\nthe UAE at that point no longer had the benefit of a DDTC license, yet they continued\nproviding \xe2\x80\x9cdefense services\xe2\x80\x9d to the UAE. This suggest a possible enforcement gap in the\nlicensing scheme, though perhaps time will yield an enforcement gap now that the story\nhas become public.\nAt any rate, one potentially-attractive policy response to the whole episode would be to\nincrease the resources devoted to both front-end screening and in-progress monitoring for\nDDTC licenses. And perhaps the statute could be amended to support that in-progress\nmonitoring by imposing increased requirements for periodic compliance-reporting.\nBefore moving on, it\xe2\x80\x99s worth noting how things might look if the country decided licensing\nwas not the right way to go and, instead, wanted to move to a flat ban. That idea has a\nclose parallel in the context of foreign military service. In that setting, American criminal\nlaw has long made it a crime to enlist or otherwise enter into the service of a foreign military\n(unless that foreign military is at war with a state against which the U.S. too is at war), and\nseparately it has also long been a crime to take a foreign government\xe2\x80\x99s commission to\nserve in war against a party with which the United States is at peace. To be sure, there are\nample historical examples of the government looking the other way; enforcement has not\nbeen anything like uniform or rigid over time. But still, there it is.\nShould the U.S. treat foreign intelligence service the same way as foreign military service,\nwith a flat ban? This would certainly help minimize Project Raven scenarios in which U.S.\npersons end up contributing to undesirable foreign intelligence activities. But perhaps it\nwould overcorrect to too great an extent, for it also would preclude U.S. persons from\ncontributing to desirable activities, such as the sort of counterterrorism functions that the\nProject Raven personnel originally thought would be their focus. A well-tailored and wellresourced licensing system seems to me to be the better alternative.\n2. Whether former intelligence community employees in particular should not do this\nEven if Americans in general should have the option of foreign intelligence service, subject\nto proper licensing, one might argue that former intelligence community employees are a\nspecial case for whom no such license should be granted.\nThe case for a flat-ban for former intelligence community employees might go something\nlike this: First, as the Project Raven story suggests, the fact that an American working for a\nforeign service once was an intelligence community employee considerably enhances\nthe extent to which the actions of the foreign entity may come to reflect back on the\nUnited States, even if unfairly so. Second, much like the analogous scenario in which bans\nor at least delays are imposed before former public officials can engage in lobbying\nrelated to their former jobs, the U.S. should worry about both the appearance of\nimpropriety (which undermines public regard for the entity in question, and thus inhibits\nthat entity\xe2\x80\x99s ability to pursue its mission) and the possibility that people in public service\nmight be influenced in their decisions by future employment prospects. Third, officials might\nworry (as noted below) about the opportunities for compromise of U.S. personnel that are\ncreated by working with a foreign intelligence service. (Indeed, it is not hard to see how\nthe UAE service could have taken advantage of the growing murkiness of the Project\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n229\n\nRaven activities so as to create leverage over at least some of those former NSA\nemployees).\nThe case against such a flat ban, in contrast, builds from the premise developed above:\nthere are some circumstances in which it is in the U.S. national interest to improve the\nefficacy of foreign intelligence services by allowing Americans to work with them. If that\xe2\x80\x99s\nthe case, it stands to reason that the persons most able to provide that boost, in at least\nsome cases, will be former intelligence community employees. On that view, the licensing\nsystem to must function well enough to police against undue risk of the kinds just noted in\nthe preceding paragraph.\n3. Whether the U.S. adequately protects classified information\nThe preceding discussion draws attention to a related, but distinct, concern: Does the\nProject Raven scenario highlight an undue risk that classified information involving cyber\ncapabilities will leak to a foreign service as a result of former intelligence community\npersonnel serving with a foreign agency?\nYes and no. The good news is that the U.S. doesn\xe2\x80\x99t lack for relevant criminal laws in this\narea. Though there always is risk that a former employee will choose to violate those laws\nor be compromised into doing so, there\xe2\x80\x99s not much cause for trying to expand or\nstrengthen the legal guardrails when it comes to obvious concerns such as exposure of\nspecific tools like custom malware, access to staging servers, specialized physical\nequipment, etc. And the Project Raven story does not suggest otherwise.\nBut on the other hand, there also is great value in the sheer practical knowledge\xe2\x80\x94the\ntactics, techniques and procedures (TTPs)\xe2\x80\x94for which the foreign agency is hiring these\nformer intelligence community personnel in the first place. Whether and when that knowhow is itself classified information can be tricky, to say the least. Knowledge concerning a\nspecific software vulnerability\xe2\x80\x94of a zero day\xe2\x80\x94might readily count, but TTPs involving best\npractices for detection avoidance and lateral movement within a system might present a\nmurkier case. And the less clear things are, the more likely it is the former employee will\nsimply use the TTP in the new job, with the new employer and new colleagues gaining that\nknow-how along the way even if the U.S. person never intended to \xe2\x80\x9ctrain\xe2\x80\x9d them in any\nformal sense.\nIt seems to me the TTP-sharing issue is intractable to a certain extent. If one takes a\nsweeping approach to classifying know-how and then ensuring intelligence community\nemployees understand there will be a strict approach to enforcement, this runs the risk of\neffectively prohibiting those employees from going on to do related work\nfor anyone outside the government, not just foreign intelligence agencies. This in turn\nwould make the already-serious challenge of recruiting talented hackers and defenders\nmuch more so.\n4. Whether U.S. law adequately protects the privacy of Americans from surveillance by\nAmericans working for a foreign government\nPerhaps the most striking element of the Project Raven story is the reference to UAE\nsurveillance of Americans. My read of the story was that the Americans were not\nthemselves engaging in this activity. If that\xe2\x80\x99s right, then all that\xe2\x80\x99s at issue is the fact that\nforeign intelligence services spied on U.S. citizens\xe2\x80\x94an important thing to know, but not\nsomething that warrants some innovation in the U.S. legal architecture). But what if that\xe2\x80\x99s\nnot right? That is, what if some of the Americans associated with Project Raven were\nengaged in surveillance of their fellow citizens, on behalf of a foreign government?\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n230\n\nThe short and complete answer is that they would be in serious legal jeopardy, for neither\ntheir license (which surely excludes such activity anyway) nor the cloak of UAE domestic\nlaw would do anything to make such activity legal from the perspective of U.S. law. Various\nU.S. laws\xe2\x80\x94the Wiretap Act, for example, and the Computer Fraud and Abuse Act\xe2\x80\x94might\ncome into play.\nIndeed, the Reuters report notes that the FBI has taken a keen interest in Project Raven\nparticipants. Perhaps this is one of the reasons why? Time will tell. For now, it is enough to\nsay that this is not an area where the legal framework seems lacking.\n\nDoes the United States need new laws?\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n231\n\n24. Government Hacking: Espionage\n\nLearning objectives\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\nBe able to explain why the prospect hacking by U.S. law enforcement agencies might be\nmore controversial, within the United States, than hacking by U.S. intelligence agencies (hint:\nconsider the differences between typical crime investigation scenarios and typical foreignintelligence collection scenarios)\nUnderstand the roles of CIA and NSA in collecting foreign intelligence, and why hacking might\nbe a means through which they perform that function\nKnow that multiple statutes require reporting to Congress of \xe2\x80\x9csignificant intelligence activities\xe2\x80\x9d\nKnow that CIA is forbidden, by statute, from domestic security and police functions\nKnow that \xe2\x80\x9cPPD-28\xe2\x80\x9d articulated the US policy against using its espionage capacities to assist\nAmerican companies, and that it articulated an \xe2\x80\x9cexclusive\xe2\x80\x9d list of purposes for which NSA can\nengage in \xe2\x80\x9cbulk\xe2\x80\x9d collection\nUnderstand how the utility of a vuln for espionage purposes relates to the VEP\nUnderstand that there are not, currently, any international law rules specifically designed to\nimpose substantive limits on when hacking can be used\nUnderstand that the question of whether such international laws (or at least international\n\xe2\x80\x9cnorms\xe2\x80\x9d) is less a matter of concerns about espionage as it is a concern about other modes\nof government behavior that might involve actual disruption of the function of the penetrated\nsystem (such as armed conflict, covert action, or holding-at-risk)\n\nWe turn our attention now to espionage conducted by government agencies in order to collect\n\xe2\x80\x9cforeign intelligence\xe2\x80\x9d (i.e., intelligence concerning the capabilities, intentions, and actions of\nforeign states, organizations, or individuals). Espionage can, of course, be conducted using nontechnical means such as recruitment of human intelligence sources (\xe2\x80\x9cHUMINT\xe2\x80\x9d). But the use of\ntechnical means to capture \xe2\x80\x9csignals\xe2\x80\x9d (\xe2\x80\x9cSIGINT\xe2\x80\x9d) has long been a staple of espionage as well, and\nin today\xe2\x80\x99s world of computers, smartphones, and other digital communication systems those\nmeans increasingly require hacking.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n232\n\nOur task now is to become familiar with the most important U.S. government agencies that hack\nfor espionage purposes; to understand the legal and policy architectures associated with them;\nand to ponder whether any reforms to those architectures might be warranted.\nA. Which U.S. Government Institutions Perform this Function?\nIn the American system, the federal agencies associated with intelligence activities typically are\nreferred to collectively as the \xe2\x80\x9cIntelligence Community,\xe2\x80\x9d or simply the \xe2\x80\x9cIC\xe2\x80\x9d (pronounced eye-see).\nCurrently, the label encompasses eighteen such entities (the number increased in early 2021\nthanks to the creation of the U.S. Space Force as a distinct military service branch; USSF at the\nsame time announced that it will collect its collection and analysis capabilities under the heading\nof the \xe2\x80\x9cU.S. Space Force Intelligence, Surveillance and Reconnaissance Enterprise\xe2\x80\x9d (ISRE)). Half\nof these\xe2\x80\x94nine of them of them--are part of the Defense Department. Together they constitute\nthe \xe2\x80\x9cDefense Intelligence Enterprise,\xe2\x80\x9d with civilian oversight at the Defense Department routing\nthrough the Under Secretary of Defense for Intelligence and Security.\nAmong these DoD intelligence agencies, most notably for our purposes, is the National Security\nAgency (\xe2\x80\x9cNSA\xe2\x80\x9d). We introduced NSA previously, in our defensive-minded unit, when describing\nits critical role defending the federal government\xe2\x80\x99s \xe2\x80\x9cnational security systems\xe2\x80\x9d and its recent focus\non providing indirect support to private sector cybersecurity (especially that of the Defense\nIndustrial Base). NSA\xe2\x80\x99s role is not just defensive, however; it is the nation\xe2\x80\x99s lead agency for\ncollection and analysis of SIGINT (both for military intelligence purposes and in support of the\ngeneral foreign-intelligence collection goals of the federal government as a whole, or what we\nwill call \xe2\x80\x9cnational intelligence\xe2\x80\x9d). Hacking thus is central to NSA\xe2\x80\x99s mission. NSA and its eight military\nintelligence brethren fall within the budget, policy, and personnel domain of the Secretary of\nDefense (exercised, on a day-to-day basis, through the Under Secretary of Defense for\nIntelligence).\nAs for the other nine agencies that comprise the IC: seven of them also are part of a larger federal\ndepartment (specifically: the Departments of Justice, State, Treasury, Energy, and Homeland\nSecurity). The remaining two\xe2\x80\x94 the Office of the Director of National Intelligence (\xe2\x80\x9cODNI\xe2\x80\x9d) and the\nCentral Intelligence Agency (\xe2\x80\x9cCIA\xe2\x80\x9d)\xe2\x80\x94are free-standing agencies. ODNI was created in 2004 with\nthe goal of providing a degree of IC-wide coordination and services, based on the\nrecommendations of the 9/11 Commission. Thus the Director of National Intelligence (\xe2\x80\x9cDNI\xe2\x80\x9d) to a\nlimited extent functions as the head of the IC. The DNI\xe2\x80\x99s control over IC institutions apart from\nODNI itself is quite limited, however, both formally and functionally. Indeed, if one wants to\ndescribe the real, practical distribution of authority over the IC, it probably is most accurate to say\nthat the DNI, the Director of the CIA, and the Secretary of Defense (or the Under Secretary of\nDefense for Intelligence) form an informal triumvirate of most-powerful officials, no one of whom\nhas anything close to complete control over the others. As for the CIA, it is charged with the full\nspectrum of intelligence functions, including collection, analysis, and even the conduct of \xe2\x80\x9ccovert\naction.\xe2\x80\x9d It is most famous, of course, for its work with human assets, but both its collection and\ncovert-action missions may entail hacking.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\n233\n\nWhich scenario do you suppose is more likely to require resort to hacking: engaging in\nespionage or investigating crime?\nWhich do you suppose is more likely to occur within the United States (whether hacking\nis involved or not): the use of espionage by the U.S. government, or investigation of\ncrime?\nBearing in mind your answer to those questions, can you explain whether policy\nconcerns are more likely to arise for the United States with respect to law enforcement\nhacking or instead with respect to hacking by the government\xe2\x80\x99s spy agencies?\n\nB. What Legal Framework Regulates Espionage?\nOver the past five decades, the United States has developed a complex domestic legal\nframework relating to espionage activities. Though it does not include provisions that are specific\nto espionage conducted via hacking, its general provision applies in that context the same as\nwith any other espionage methods.\n1. Hacking to conduct surveillance against US persons or within the United States\nFrom a U.S. policy perspective, the most sensitive espionage-via-hacking scenarios naturally would\nbe those that target U.S. persons or that in some meaningful sense take place within the United\nStates (regardless of whether the activity would involve hacking or any other method). It therefore\nis no surprise that the legal architecture places significant constraints on such activity.\nIt was not always so. Prior to the mid-1970s, various federal agencies periodically engaged in\nelectronic surveillance within the United States in order to gather intelligence about both foreign\nand domestic security concerns, without statutory authorization and without court oversight or\nother involvement. When those activities came to public light in the early 1970s, it caused an\nuproar. Along with a contemporaneous Supreme Court decision holding that wiretapping for\ndomestic intelligence purposes still required a court-issued warrant under the Constitution\xe2\x80\x99s Fourth\nAmendment\xe2\x80\x94known as the \xe2\x80\x9cKeith Case\xe2\x80\x9d\xe2\x80\x94this set the stage for major reforms. First, the executive\nbranch effectively abandoned the idea of conducting electronic surveillance for purely-domestic\nintelligence purposes. Henceforth, electronic surveillance either would be a matter of criminal\nlaw enforcement investigation or for purposes of collecting information on foreign-intelligence\ntopics. And as to the latter, Congress in 1978 crafted the Foreign Intelligence Surveillance Court\n(\xe2\x80\x9cFISC\xe2\x80\x9d) system as a means to ensure case-specific approval by a federal judge over all such\nsurveillance activity.\nA full study of that topic is well-beyond the scope of this book (please see my other eCasebook,\nChesney on the Law of the Intelligence Community, if you are interested in that topic). For now, it\nsuffices to say that any effort on the part of any federal agency to engage in foreign-intelligence\ncollection via hacking directed at a U.S. person as the target, or otherwise taking place within the\nUnited States, almost certainly would be governed by this framework and thus would require\nworking through the Justice Department to file an application seeking permission from the FISC.\nAnd though there are many complex and important questions regarding the adequacy of the\nFISC review process, the critical point for our purposes is that those questions are much the same\nregardless of whether the government agency plans to using hacking or other methods to\neffectuate whatever surveillance the FISC might approve. In that sense, the domestic use of\nhacking to collect foreign-intelligence information is precisely analogous to the law enforcement\nuse of hacking we discussed in the previous reading.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n234\n\nThat last observation may remind you that, in our law enforcement reading, we quickly pivoted\nto the question of whether there should be laws to help ensure that when the government does\nengage in legally-authorized hacking it will be more likely to be able to do so effectively. That is,\nwe quickly pivoted to the \xe2\x80\x9cGoing Dark\xe2\x80\x9d debate. Notably, under that heading we have seen\nrepeated assertions by law enforcement officials (such as a succession of FBI Directors) pressing\nthe argument that some legislative steps eventually may be needed to limit the security measures\nthat the private sector has been deploying, particularly in relation to encryption. What we have\nnot seen, in contrast, is comparable statements by the heads of government agencies focused\nexclusively on foreign-intelligence collection, such as CIA and NSA.\n\xe2\x80\xa2\n\nCan you think of any reasons why this might be?\n2. Hacking to conduct surveillance against non-U.S. persons outside the United States\n\nBy design, the FISC system created in 1978 does not apply when the government uses electronic\nsurveillance to collect foreign intelligence from non-US persons outside the United States. The\nquestion therefore arises: does any other legal framework address that scenario, whether hacking\nwill be used or not?\nWe might call this scenario the \xe2\x80\x9ccore\xe2\x80\x9d foreign-intelligence scenario, since the overseas collection\nof foreign intelligence is the paradigm of espionage and the bulk of what we expect agencies\nlike NSA and CIA to do. And there is, in fact, some law that speaks to this situation. In particular,\nCongress has enacted transparency/oversight rules designed to ensure that Congress has at least\nsome understanding of what such agencies are doing in this core scenario.\nAccording to 50 U.S.C. 3092, both the DNI and the head of specific intelligence agencies (such\nas the Director of the NSA or the Director of the CIA) have a standing and constant obligation to\nkeep the congressional intelligence committees (the Senate Select Committee on Intelligence,\nand the House Permanent Select Committee on Intelligence) \xe2\x80\x9cfully and currently informed of all\nintelligence activities\xe2\x80\x9d carried out by or on behalf of the United States, including not just ongoing\nactivities but also \xe2\x80\x9csignificant anticipated\xe2\x80\x9d activities as well as \xe2\x80\x9csignificant intelligence failure[s].\xe2\x80\x9d\nThe same officials also must provide to those committees \xe2\x80\x9cany information or material\nconcerning\xe2\x80\x9d such activities, upon request. Separately, 50 USC 3091 imposes the same obligation\ndirectly on the President, with the additional caveat that \xe2\x80\x9cany illegal intelligence activity\xe2\x80\x9d must\nbe \xe2\x80\x9creported promptly\xe2\x80\x9d to those committees.\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\nCan you explain how the mere existence of a requirement to report to Congress on\ncollection activities might have a beneficial effect in terms of deterring bad ideas for\nspecific collection efforts?\nCan you think of any costs to having such reporting requirements (and do you need\nto know more about the granularity of that reporting before you can answer that\nquestion)?\nDo you think it is a problem that FISC approval is not required for collection efforts that\ntarget non-US persons outside the United States?\nCan you articulate the pros and cons of adopting such a rule?\nIs there any reason to adopt hacking-specific rules that differ from the generallyapplicable rules associated with the core foreign-intelligence collection scenario?\nDoes it matter to your analysis whether other countries (whether ally or adversary)\nsimilarly constrain their own espionage activities?\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n235\n\n3. PPD-28 and the Response to the Snowden Revelations\nWe should pause here to note that the executive branch can impose rules on itself, even when\nCongress has not seen fit to do so. Indeed, amidst the controversies unleashed by the Snowden\nrevelations that began in the summer of 2013, President Obama in Presidential Policy Directive\n28 (\xe2\x80\x9cPPD-28\xe2\x80\x9d) articulated several such constraints for SIGINT collection, and they remain on the\nbooks at this time. They include:\nSection 1(b) \xe2\x80\x93 The United States shall not collect signals intelligence for the purpose of\nsuppressing or burdening criticism or dissent, or for disadvantaging persons based on their\nethnicity, race, gender, sexual orientation, or religion. Signals intelligence shall be\ncollected exclusively where there is a foreign intelligence or counterintelligence purpose\nto support national and departmental missions and not for any other purposes.\nSection 1(c) - The collection of foreign private commercial information or trade secrets is\nauthorized only to protect the national security of the United States or its partners and\nallies. It is not an authorized foreign intelligence or counterintelligence purpose to collect\nsuch information to afford a competitive advantage [FN: \xe2\x80\x9cCertain economic purposes,\nsuch as identifying trade or sanctions violations or government influence or direction, shall\nnot constitute competitive advantage.\xe2\x80\x9d] to U.S. companies and U.S. business sectors\ncommercially.\n\nConsider the following questions:\n\xe2\x80\xa2 Is anything in Section 1(b) a serious constraint on what the United States otherwise\nmight genuinely be inclined to do?\n\xe2\x80\xa2 What about Section 1(c), bearing in mind the explanatory footnote?\n\xe2\x80\xa2 Should any of this be changed?\n\xe2\x80\xa2 Do you think any other country that engages in serious SIGINT collection against the\nUnited States actually follows comparable rules?\n\nPPD-28 goes on in Section 2 to discuss a new limit on the use of \xe2\x80\x9cbulk collection\xe2\x80\x9d of signals\nintelligence. Such collection need not involve hacking, but it might. For example, NSA in theory\nmight have the capability to surreptitiously access the network of a foreign Internet Service\nProvider, and from that perch collect all traffic crossing that network, relying on post-collection\nquerying of the bulk results in order to separate the wheat from the chaff. At any rate, Section 2\nof PPD-28 articulates limits on such approaches, whether made possible by hacking or not:\nLocating new or emerging threats and other vital national security information is difficult,\nas such information is often hidden within the large and complex system of modern global\ncommunications. The United States must consequently collect signals intelligence in\nbulk in certain circumstances in order to identify these threats. Routine communications\nand communications of national security interest increasingly transit the same networks,\nhowever, and the collection of signals intelligence in bulk may consequently result in the\ncollection of information about persons whose activities are not of foreign intelligence or\ncounterintelligence value. The United States will therefore impose new limits on its use of\nsignals intelligence collected in bulk. These limits are intended to protect the privacy and\ncivil liberties of all persons, whatever their nationality and regardless of where they might\nreside.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n236\n\nIn particular, when the United States collects nonpublicly available signals intelligence in\nbulk, it shall use that data only for the purposes of detecting and countering:\n(1) espionage and other threats and activities directed by foreign powers or their\nintelligence services against the United States and its interests;\n(2) threats to the United States and its interests from terrorism;\n(3) threats to the United States and its interests from the development, possession,\nproliferation, or use of weapons of mass destruction;\n(4) cybersecurity threats;\n(5) threats to U.S. or allied Armed Forces or other U.S or allied personnel; and\n(6) transnational criminal threats, including illicit finance and sanctions evasion\nrelated to the other purposes named in this section.\nIn no event may signals intelligence collected in bulk be used for the purpose of\nsuppressing or burdening criticism or dissent; disadvantaging persons based on their\nethnicity, race, gender, sexual orientation, or religion; affording a competitive advantage\nto U.S. companies and U.S. business sectors commercially; or achieving any purpose other\nthan those identified in this section.\n\nConsider the following questions:\n\xe2\x80\xa2 Given the six approved categories, is there anything significant left out?\n\xe2\x80\xa2 If so, is that a good thing or a bad thing?\n\xe2\x80\xa2 Do you suppose any other country that engages in SIGINT collection against the United\nStates similarly constrains its use of a bulk-collection methods?\n\nC. The Vulnerabilities Equities Process\nNot surprisingly, both NSA and CIA are in the business of developing their own hacking\ncapabilities. And though much hay can be made from already-public vulnerabilities (thanks to\nthe ubiquity of unpatched systems out there), zero-day vulns of course can be especially\nimportant given the sophistication of some of these agencies\xe2\x80\x99 targets. The agencies,\naccordingly, do attempt to discover such vulns, and at least some of the time they put them to\nwork rather than disclose them to the relevant companies for patching purposes. As we have\nnoted previously in this book, however, there are competing national interests, particularly in the\ncase of vulns that impact systems in widespread (or at least sensitive) use by Americans. For that\nreason, we will return now (and in considerably more detail) to the topic of the Vulnerabilities\nEquities Process.\nThis 2016 report from Ari Schwartz and Rob Knacke, for Harvard\xe2\x80\x99s Belfer Center, provides a useful\nhistory of the VEP:\nThe genesis and contours of the existing VEP are reflected in a series of documents\nobtained and made public in 2015 and 2016. A basic overview of the origins of the VEP is\nset forth in a document entitled \xe2\x80\x9cVulnerability Equities Process Highlights\xe2\x80\x9d (\xe2\x80\x9cHighlights\nPaper\xe2\x80\x9d). We can trace the origins of the VEP to a January 2008 directive, signed by\nPresident George W. Bush. This directive, known as National Security Policy Directive 54\n(NSPD 54), established a US-government-wide effort called the Comprehensive National\nCybersecurity Initiative (\xe2\x80\x9cCNCI\xe2\x80\x9d). One component of the CNCI required the Departments\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n237\n\nof State, Defense, Homeland Security, and Justice, as well as the Director of National\nIntelligence, to develop \xe2\x80\x9ca joint plan for the coordination and application of offensive\ncapabilities to defend US information systems.\xe2\x80\x9d\nThis joint plan noted, among other things, that the discovery of vulnerabilities \xe2\x80\x9cmay\npresent competing equities for [government] offensive and defensive mission interests\xe2\x80\x9d\nand recommended that \xe2\x80\x9cactions taken in response to knowledge of a specific\nvulnerability must be coordinated to ensure the needs of each of these \xe2\x80\x98equities\xe2\x80\x99 are\naddressed.\xe2\x80\x9d The plan recommended the development of a \xe2\x80\x9cVulnerabilities Equities\nProcess.\xe2\x80\x9d\nA working group, led by the Office of the Director of National Intelligence, developed\nthe VEP during 2008 and 2009 in response to the Joint Plan\xe2\x80\x99s recommendation. It\nconsisted of members from the National Security Council, Central Intelligence Agency,\nDefense Intelligence Agency, Justice Department, Federal Bureau of Investigation\n(\xe2\x80\x9cFBI\xe2\x80\x9d), Department of Defense, Department of State, Department of Energy, and\nDepartment of Homeland Security. This working group ultimately produced a document\nentitled \xe2\x80\x9cCommercial and Government Information Technology and Industrial Control\nProduct or System Vulnerability Equities Policy and Process\xe2\x80\x9d (\xe2\x80\x9cVEP Document\xe2\x80\x9d), which\nlays out the process that the government apparently continues to follow today. The VEP\nDocument is dated February 16, 2010.\nThe VEP Document demonstrates that the government established a process to\ndetermine whether vulnerabilities discovered or purchased by the government or its\ncontractors should be retained for government use or revealed to the appropriate\nvendor for patching.\nUnder the process as outlined by the VEP Document, the VEP is intended to \xe2\x80\x9cestablish[]\npolicy and responsibilities for disseminating information about vulnerabilities discovered\nby the United States Government (USG) or its contractors, or disclosed to the USG by the\nprivate sector or foreign allies in Government Off-The-Shelf (GOTS), Commercial Off-TheShelf (COTS) or other commercial information technology or industrial control products or\nsystems (to include both hardware and software).\xe2\x80\x9d More specifically, the paper \xe2\x80\x9cdefines\na process to ensure that dissemination decisions regarding the existence of a\nvulnerability are made quickly, in full consultation with all concerned government\norganizations, and in the best interest of government missions of cybersecurity,\ninformation assurance, intelligence, counterintelligence, law enforcement, military\noperations, and critical infrastructure protection.\xe2\x80\x9d The policy \xe2\x80\x9capplies to all components,\ncivilian and military personnel, and contractors of the United States Government . . . .\xe2\x80\x9d\nThe VEP Document goes on to give directions for appropriate classified treatment for\n\xe2\x80\x9cvulnerabilities discovered by the USG or by non-USG entities under contracts with the\nUSG, or disclosed to the USG by the private sector prior to entry into this process\xe2\x80\x9d and\nthen directs further that \xe2\x80\x9cUSG entities shall introduce any such vulnerability discovered\ninto the following Vulnerabilities Equities Process (VEP).\xe2\x80\x9d The VEP Document clarifies\nfurther that a vulnerability should be put through the VEP if it is \xe2\x80\x9cboth newly discovered\nand not publicly known.\xe2\x80\x9d The VEP Document exempts from the VEP any vulnerability\ndiscovered before its effective date (February 16, 2010). It also exempts from the process\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n238\n\nany vulnerability discovered during the course of open and unclassified federallysponsored research.\nThe VEP Document establishes the Information Assurance Directorate of the NSA as the\nExecutive Secretariat of the VEP. It also establishes an interagency Equities Review Board\n(\xe2\x80\x9cERB\xe2\x80\x9d) for making decisions on whether to retain or disclose a vulnerability. The\ncomposition of the ERB remains classified, however.\nUnder the process, the agency that comes into possession of a vulnerability that is newly\ndiscovered and not publicly known is required to notify the Executive Secretary, which\nthen disseminates the vulnerability to all relevant agency Points of Contact (\xe2\x80\x9cPOCs\xe2\x80\x9d),\nwho \xe2\x80\x9care responsible for ensuring that applicable cybersecurity, cyber defense,\ninformation assurance, intelligence, counterintelligence, law enforcement, or other\noffensive cyber operations equities of their organization are appropriately represented in\nthe process.\xe2\x80\x9d Each such agency then is responsible for designating one or more Subject\nMatter Experts (\xe2\x80\x9cSMEs\xe2\x80\x9d) to participate in a discussion convened by the Executive\nSecretary to arrive at a consensus on whether the vulnerability should be retained by the\ngovernment or disclosed for patching. Ultimately, the ERB is charged with making the\ndecision on whether to disclose or retain a discovered vulnerability, and the ERB acts by\nmajority vote. An affected agency is entitled to appeal the ERB\xe2\x80\x99s decision, although the\nappeals process itself remains redacted.\nThe VEP Document provides guidance for implementation of ERB decisions. The\nguidance on implementation of a decision not to disclose a vulnerability continues to be\nclassified. For implementation of decisions to disseminate information on vulnerabilities,\nthe guidance requires the ERB to establish \xe2\x80\x9cguidelines for disseminating that information,\nincluding mitigation strategies, to the cyber security centers that are primarily responsible\nfor defending or coordinating the defense of networks and systems, as well as offensive\nentities.\xe2\x80\x9d The VEP Document also provides for an annual oversight mechanism involving\nthe production of an annual report by the Executive Secretariat, although the identity of\nthe overseer of the process remains classified.\nAlthough the VEP was established in 2010, its existence was revealed publicly only after\nquestions were raised about the government\xe2\x80\x99s use of zero day vulnerabilities for\nintelligence and offensive purposes, including the government\xe2\x80\x99s practice of purchasing\nzero day vulnerabilities, following the leaks of classified information by Edward Snowden\nin 2013.\nThe report issued by the President\xe2\x80\x99s Review Group on Intelligence and Communication\nTechnologies (\xe2\x80\x9cPresident\xe2\x80\x99s Review Group\xe2\x80\x9d) in December 2013 did not mention an existing\nVEP, but did contain recommendations about how the government should manage\nvulnerability equities. Specifically, Recommendation 30 of the President\xe2\x80\x99s Review Group\nreport stated:\nWe recommend that the National Security Council staff should manage an interagency\nprocess to review on a regular basis the activities of the government regarding attacks\nthat exploit a previously unknown vulnerability in a computer application or system.\nThese are often called \xe2\x80\x98Zero Day\xe2\x80\x99 attacks because developers have had zero days to\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n239\n\naddress and patch the vulnerability. US policy should generally move to ensure that Zero\nDays are quickly blocked, so that the underlying vulnerabilities are patched on\ngovernment and other networks. In rare instances, US policy may briefly authorize using a\nZero Day for high priority intelligence collection, following senior, interagency review\ninvolving all appropriate departments.\nThe Obama Administration released information about the VEP only after Bloomberg\nNews alleged in April 2014 that the NSA had known about the then-recently revealed\nHeartbleed vulnerability, and exploited Heartbleed for its own purposes instead of\ndisclosing the vulnerability to be patched. In response to that allegation, which the NSA\nvigorously denied, the White House acknowledged that the government sometimes relies\non zero day vulnerabilities for intelligence and other, related purposes, rather than\ndisclosing such vulnerabilities and allowing them to be patched. However, the White\nHouse also asserted that it had reviewed the recommendations of the President\xe2\x80\x99s Review\nGroup and had determined, as of January 2014, that the government\xe2\x80\x99s policy should be\nthat there is a \xe2\x80\x9cbias\xe2\x80\x9d toward disclosure to vendors for patching rather than retention by\nthe government. The exception to this government \xe2\x80\x9cbias\xe2\x80\x9d toward disclosure is if there is a\n\xe2\x80\x9cclear national security or law enforcement need. . . .\xe2\x80\x9dThe Administration described\nthese decisions as the implementation of a \xe2\x80\x9creinvigorated\xe2\x80\x9d process for balancing the\nequities surrounding zero day vulnerabilities.\nResponding to the Heartbleed allegation against the NSA, White House Cybersecurity\nCoordinator Michael Daniel authored a White House blogpost in late April 2014 that\nfurther outlined the Obama Administration\xe2\x80\x99s policy regarding zero day vulnerabilities.\nEchoing the White House\xe2\x80\x99s statement in early April 2014, Daniel stated that \xe2\x80\x9c[t]his spring,\nwe re-invigorated our efforts to implement existing policy with respect to disclosing\nvulnerabilities\xe2\x80\x94so that everyone can have confidence in the integrity of the process that\nwe use to make these decisions.\xe2\x80\x9d Addressing allegations that the government hoards\nzero day vulnerabilities, Daniel asserted that \xe2\x80\x9c[b]uilding up a huge stockpile of\nundisclosed vulnerabilities while leaving the Internet vulnerable and the American\npeople unprotected would not be in our national security interest.\xe2\x80\x9d Nonetheless, while\nasserting that disclosure of zero day vulnerabilities is in the national interest \xe2\x80\x9cin the\nmajority of cases,\xe2\x80\x9d he categorically rejected the suggestion that the government should\n\xe2\x80\x9ccompletely forego this tool as a way to conduct intelligence collection, and better\nprotect our country in the long-run.\xe2\x80\x9d\nDaniel explained that the government has a \xe2\x80\x9cdisciplined, rigorous, and high-level\ndecision-making process for vulnerability disclosure\xe2\x80\x9d that is inter-agency in nature, and\nthat explores all the pros and cons of disclosure. He emphasized that \xe2\x80\x9cthere are no hard\nand fast rules\xe2\x80\x9d governing the process, but outlined the following factors, lightly edited for\nclarity, that the ERB considers before deciding whether to disclose a zero day\nvulnerability:\n\xe2\x80\xa2 The extent of the vulnerable system\xe2\x80\x99s use in the Internet infrastructure;\n\xe2\x80\xa2 The risks posed and the harm that could be done if the vulnerability is left unpatched;\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n240\n\n\xe2\x80\xa2 Whether the Administration would know if another government or organization was\nexploiting the vulnerability;\n\xe2\x80\xa2 Whether the vulnerability is needed to obtain intelligence (i.e., how badly does the US\ngovernment need the information, and are there alternative means of obtaining it);\n\xe2\x80\xa2 How likely it is that others will discover the vulnerability;\n\xe2\x80\xa2 Whether the government can use the vulnerability for a short period of time before\ndisclosing it; and\n\xe2\x80\xa2 Whether the vulnerability can be patched or otherwise mitigated.\nDaniel concluded by asserting that the government \xe2\x80\x9cweigh[s] these considerations\nthrough a deliberate process that is biased toward responsibly disclosing the vulnerability\n. . . .\xe2\x80\x9d He also emphasized the need for sufficient transparency in the process to \xe2\x80\x9cinstill\nsome confidence that your government is acting responsibly in the handling of this\nimportant issue.\xe2\x80\x9d\nThe disclosures by the White House in response to the Heartbleed allegations made clear\nthat the government has a VEP, but provided no additional information on the VEP itself,\nor when it was developed. In response to these disclosures, the Electronic Frontier\nFoundation (EFF) filed a Freedom of Information Act request for documents related to the\nVEP described in the Daniel Blog Post, and then a lawsuit to compel the disclosure of\nthose documents. The result of that suit was the release of a series of documents, the\nmost significant of which are the Highlights Paper and the VEP Document.\nIn the period between the filing of the EFF suit and the release of the Highlights Paper\nand the VEP Document, there were several additional statements by government\nofficials that shed further light on the VEP and its implementation. In a speech delivered\nin November 2014, Admiral Michael Rogers, the head of the NSA, discussed the\ngovernment\xe2\x80\x99s vulnerability disclosure policies, and stated that \xe2\x80\x9cby orders of magnitude,\nthe greatest number of vulnerabilities we find, we share.\xe2\x80\x9d\nWhile the Obama Administration deserves credit for re-invigorating the process and for\ndemonstrating a clear bias toward disclosure, the fact that the process fell into disuse\nfrom when it went into effect in 2010 until the Intelligence Review Group made its\nrecommendations in 2014 is troubling. In an interview given to WIRED Magazine, Daniel\nasserted that the \xe2\x80\x9cdefault-disclosure policy was established in 2010\xe2\x80\x9d but that \xe2\x80\x9cit \xe2\x80\x98had not\nbeen implemented to the full degree that it should have been,\xe2\x80\x99 hence the government\xe2\x80\x99s\nuse of the term \xe2\x80\x98reinvigorated\xe2\x80\x99 to describe this new phase.\xe2\x80\x9d In particular, the \xe2\x80\x9crelevant\nagencies . . . \xe2\x80\x98had not been doing sufficient interagency communications and ensuring\nthat everybody had the right level of visibility across the entire government\xe2\x80\x99 about\nvulnerabilities that were discovered.\xe2\x80\x9d Daniel asserted that \xe2\x80\x9calthough \xe2\x80\x98they probably were\ndisclosing the vulnerability\xe2\x80\x99 by default, they \xe2\x80\x98may not have been communicating that to\nall the relevant agencies as regular as they should have been.\xe2\x80\x99\xe2\x80\x9d Agencies \xe2\x80\x9cmight have\nbeen communicating \xe2\x80\x98at the subject-matter expert level,\xe2\x80\x99 but the communication may\nnot have been happening as consistently, in as coordinated a fashion or within the\ntimelines that the policy dictated.\xe2\x80\x9d\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n241\n\nThus, from the public statements made after the issuance of the Daniel Blog Post, it can\nbe concluded that the VEP has at least once in its short history fallen out of use. While the\nprocess appears now to be functioning well, should the issue once again fade from\nattention, the policy in its current form gives few guarantees that adherence to it will not\nlapse.\nIn November 2017, the Trump Administration published a 14-page overview of its revisions to the\nVEP (available here if you wish to peruse it). As described by Ellen Nakashima in the Washington\nPost:\nThe White House on Wednesday made public for the first time the rules by which the\ngovernment decides to disclose or keep secret software flaws that can be turned into\ncyberweapons \xe2\x80\x94 whether by U.S. agencies hacking for foreign intelligence, moneyhungry criminals or foreign spies seeking to penetrate American computers.\nThe move to publish an unclassified charter responds to years of criticism that the process\nwas unnecessarily opaque, fueling suspicion that it cloaked a stockpile of software flaws\nthat the National Security Agency was hoarding to go after foreign targets but that put\nAmericans\' cybersecurity at risk.\n"This is a really big improvement and an outstanding process," said White House\ncybersecurity coordinator Rob Joyce, who spoke at an Aspen Institute event and issued\na blog post on the charter.\nBy making it public, he said, "we hope to demonstrate to the American people that the\nfederal government is carefully weighing the risks and benefits" of disclosure vs. retention.\nThe rules are part of the "Vulnerabilities Equities Process," which the Obama\nadministration revamped in 2014 as a multiagency forum to debate whether and when\nto inform companies such as Microsoft and Juniper that the government has discovered\nor bought a software flaw that, if weaponized, could affect the security of their product.\nThe Trump administration has mostly not altered the rules under which the government\nreaches a decision but is disclosing its process. Under the VEP, an "equities review board"\nof at least a dozen national security and civilian agencies will meet monthly \xe2\x80\x94 or more\noften, if a need arises \xe2\x80\x94 to discuss newly discovered vulnerabilities. Besides the NSA, the\nCIA and the FBI, the list includes the Treasury, Commerce and State departments, and\nthe Office of Management and Budget.\nThe priority is on disclosure, the policy states, to protect core Internet systems, the U.S.\neconomy and critical infrastructure, unless there is "a demonstrable, overriding interest" in\nusing the flaw for intelligence or law enforcement purposes.\nThe government has long said that it discloses the vast majority \xe2\x80\x94 more than 90 percent\n\xe2\x80\x94 of the vulnerabilities it discovers or buys in products from defense contractors or other\nsellers. In recent years, that has amounted to more than 100 a year, according to people\nfamiliar with the process.\nBut because the process was classified, the National Security Council, which runs the\ndiscussion, was never able to reveal any numbers. Now, Joyce said, the number of flaws\ndisclosed and the number retained will be made public in an annual report. A classified\nversion will be sent to Congress, he said.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n242\n\n"This represents a good step forward in transparency and shows the government getting\nmore comfortable and more mature with this process," said Michael Daniel, who, as\nJoyce\'s predecessor, oversaw the revamped process. Daniel issued the first blog post on\nthe VEP in April 2014 in large part to push back against the misperception that the\nHeartbleed bug, which sparked fears of a massive security hole in the Internet, had been\nkept secret by the NSA.\nThe debate raged anew this year when it became public that the malicious code at the\nheart of the WannaCry virus that hit computer systems globally was developed by the\nNSA. The Washington Post reported in May that officials at the agency had years earlier\ndiscussed whether the flaw at the base of the tool, EternalBlue, was so dangerous that it\nshould be revealed to Microsoft.\n[NSA officials worried about the day its potent hacking tool would get loose. Then it did.]\nInstead, the agency retained it. In August 2016, a mysterious group calling itself the\nShadow Brokers put online a set of "exploits," or tools, that included EternalBlue. That\neventually led the NSA to alert Microsoft, which issued a patch in March. But not enough\npeople and companies used the patch \xe2\x80\x94 especially in Russia, India, Iran, Brazil and\nother countries in Eastern Europe and Asia where computers were infected by\nWannaCry or other viruses based on the flaw.\nAnother major breach occurred in March, when the anti-secrecy group WikiLeaks\ndumped online a trove of CIA hacking tools.\n"A lot of companies whose software was affected were confused," recalled Ari Schwartz,\ncoordinator of the Coalition for Cybersecurity Policy and Law, which includes such firms\nas Microsoft, Symantec, Intel and Palo Alto Networks. "They were taken aback that\nnobody from the CIA had come to them and told them. They found out about it from the\npress."\nJoyce noted that at times the government has alerted a company to a flaw only to be\ntold, "That\'s great, but we\'re telling customers that they need to buy this shiny nextgeneration [device], and so they have no intention of patching their own equipment,"\nhe said. There have also been companies who, when informed of a flaw, said: "That\'s not\na flaw. That\'s a feature."\nAll the government can do at that point, he said, is put out a Department of Homeland\nSecurity warning about the software flaws.\nTech companies generally reacted favorably to Wednesday\'s move. "Getting the VEP\nright is critical to fostering trust and cooperation between the tech sector and the\ngovernment," said Heather West, senior policy manager at Mozilla, which makes the\nwidely used browser Firefox. "This accomplishes a lot of things we were asking for in terms\nof reform."\nFormer critics of the process also applauded the transparency. "I\'m very happy to see\nthat they make clear that the presumption lies in favor of disclosure," said Michelle\nRichardson, a security expert at the Center for Democracy & Technology.\n\nSean Lyngaas, writing at FCW (Federal Computer Week) in November 2015, reported the\nfollowing:\nThe National Security Agency last year disclosed to the private sector about 91 percent\nof previously unknown software vulnerabilities the agency discovered, according to NSA\nDirector Adm. Michael Rogers.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n243\n\n"There shouldn\xe2\x80\x99t be any doubt in anyone\'s mind that the direction clearly to us within the\nU.S. government structure is a preference to disclose vulnerabilities because a secure\nInternet is in the best interests of our nation and the broader world around us," said\nRogers, who also heads U.S. Cyber Command. He spoke Nov. 7 at the Reagan National\nDefense Forum in Simi Valley, Calif.\nThe topic of "zero-day" vulnerabilities, or those unknown to the broader IT security\ncommunity, has been a hot one, with evidence suggesting the NSA has hoarded such\nsoftware flaws to exploit them in covert activities.\nWhen asked what makes some zero-days worth keeping, Rogers said the decision to\nwithhold a vulnerability is based on the intelligence insight it generates. Among the other\nconsiderations in an inter-agency process for disclosing the vulnerabilities, he said,\nare: "What\xe2\x80\x99s the price of not sharing this vulnerability? How broadly is it deployed?\nWhat\xe2\x80\x99s the economic impact?" The zero-day disclosure process was once internal to the\nNSA but is now overseen by the National Security Council, according to an NSA\nstatement.\nThe statement said that "historically," the NSA has released more than 91 percent of the\nvulnerabilities it has discovered. The other 9 percent were either already fixed by vendors\nor kept "for national security reasons," the statement added.\n"Disclosing a vulnerability can mean that we forego an opportunity to: collect crucial\nforeign intelligence that could thwart a terrorist attack; stop the theft of our nation\xe2\x80\x99s\nintellectual property; [or] discover even more dangerous vulnerabilities that are being\nused to exploit our networks," the NSA statement said.\nChaouki Bekrar, founder of Zerodium, a startup that rewards researchers for discovering\nzero-days, noted that some vulnerabilities are more critical than others. "The NSA didn\xe2\x80\x99t\nsay the criticality of [zero days] reported vs unreported," he tweeted. "Reporting nonexploitable [zero days] is a cheap way to improve your reports stats."\nRogers was joined at the Reagan National Defense Forum by, among others, Rep. Adam\nSchiff (D-Calif.), the House Permanent Select Committee on Intelligence\'s ranking\nminority member.\nSchiff used the aftermath of the hack of Sony Pictures Entertainment, which U.S. officials\nattributed to North Korea, to explain why he thought the United States lacked a credible\ndeterrent in cyberspace. In the wake of the hack, North Korea\xe2\x80\x99s frail Internet\ninfrastructure experienced an outage, leading some to speculate that the United States\nhad retaliated in kind. The lack of clarity on whether Washington was responsible for the\noutage was problematic for the congressman.\n"If it was a response, it wouldn\'t be a very effective one," he said, "because part of\nhaving a deterrent capability is they got to know when they\xe2\x80\x99re suffering the\nrepercussions."\n\nConsider this story, from Andy Greenberg at Wired (May 7, 2019), describing an instance in\nwhich NSA-developed malware did fall into the hands of adversaries:\nTHE NOTION OF a so-called zero-day vulnerability in software is supposed to mean, by\ndefinition, that it\'s secret. The term refers to a hackable flaw in code that the software\'s\nmaker doesn\'t know about but that a hacker does\xe2\x80\x94in some cases offering that hacker a\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n244\n\npowerful, stealthy skeleton key into the hearts of millions of computers. But according to\nnew findings from security firm Symantec, one extraordinarily powerful flaw in Microsoft\nsoftware at one point remained "secret" to Microsoft while at least three active hacker\ngroups knew about it. And both before and after that secret became public in early\n2017, it took a long, strange trip through the hands of intelligence agencies around the\nworld, enabling years of espionage and, eventually, mayhem.\nOn Monday, Symantec revealed that it had traced how a hacker group it calls\nBuckeye\xe2\x80\x94also known as APT3 or Gothic Panda and widely believed to be a contractor\nof the Chinese Ministry of Security Services\xe2\x80\x94used NSA hacking tools apparently\nintercepted from the networks of NSA targets and repurposed those tools to use against\nother victims, including US allies. Most notably, Symantec says, the Chinese group\'s\nhacking had planted an NSA backdoor on the network of its victims using a zero-day\nvulnerability in Microsoft\'s Server Message Block (SMB) software, also seemingly learned\nby studying the NSA\'s hacking tools.\nThat newly revealed hijacking of the NSA\'s intrusion techniques doesn\'t just dredge up\nlongstanding questions about how and when the NSA should secretly exploit software\nvulnerabilities to use for spying rather than help software companies to fix them. It also\nadds another chapter to the strange story of this particular zero-day\'s journey: Created\nby the NSA, intercepted by China, later stolen and leaked by another mysterious hacker\ngroup known as the Shadow Brokers, and ultimately used by North Korea and Russia in\ntwo of the most damaging and costly cyberattacks in history.\n"Based on what we know historically, it\xe2\x80\x99s extremely unusual to have a zero-day be utilized\nlike this by multiple groups, some of them unbeknownst to each other, for years," says Eric\nChien, a Symantec security analyst. "I can\xe2\x80\x99t think of another case where something like\nthis has ever happened."\nWith the addition of Symantec\'s findings, here\'s what we now know about the timeline of\nthat zero-day\'s path.\nBorn at the NSA\nThe SMB vulnerability\xe2\x80\x94labelled as CVE-2017-0143 and CVE-2017-0144 in two slightly\ndifferent forms\xe2\x80\x94appears to have first been discovered by the NSA sometime before\n2016, though the NSA has never publicly admitted to having used it; it wouldn\'t be tied to\nthe agency until it leaked in 2017, revealing its integration in NSA tools called EternalBlue,\nEternalRomance, and EternalSynergy.\nThe SMB zero-day no doubt represented a kind of precious specimen for the agency\'s\nspies: Microsoft\'s SMB feature allows the sharing of files between PCs. But the agency\'s\nresearchers found that it could be tricked into confusing harmless data with executable\ncommands that an attacker injected via SMB into a computer\'s memory. That made it a\nrare entry point that the NSA\'s hackers could use to run their own code on practically any\nWindows machine with no interaction from the target user, and one that offered access\nto the computer\'s kernel, the deepest part of its operating system. "It\xe2\x80\x99s exactly the kind of\nvulnerability someone would want," Chien says. "The target doesn\xe2\x80\x99t have to open a\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n245\n\ndocument or visit a website. You have a machine on the internet, and I can get you with\nit. I immediately have the highest privileges available to me."\nOr, as Matthew Hickey, founder of security firm Hacker House, at one point described it,\n"It\xe2\x80\x99s internet God mode."\nAdopted by China\nSymantec found that by March 2016, the SMB zero-day had been obtained by the\nChinese BuckEye group, which was using it in a broad spying campaign. The BuckEye\nhackers seemed to have built their own hacking tool from the SMB vulnerability, and just\nas unexpectedly were using it on victim computers to install the same backdoor tool,\ncalled DoublePulsar, that the NSA had installed on its targets\' machines. That suggests\nthat the hackers hadn\'t merely chanced upon the same vulnerability in their research\xe2\x80\x94\nwhat the security world calls a bug collision.; they seemed to have somehow obtained\nparts of the NSA\'s toolkit.\nSymantec\'s researchers say they still don\xe2\x80\x99t know how the BuckEye hackers got the NSA\xe2\x80\x99s\nhacking secrets. But Symantec\'s Chien says their theory is that the tools were found in\nvictim networks, reverse-engineered, and repurposed. "It doesn\'t look like they had the\nexploit executables,\xe2\x80\x9d says Jake Williams, a former NSA hacker and now founder of\nsecurity firm Rendition Infosec, who reviewed Symantec\'s findings. "But it\'s possible they\nwere able to steal them [when they were] being thrown at targets by monitoring network\ncommunications."\nSymantec says it detected BuckEye\xe2\x80\x99s hackers in five different intrusions, stretching from\nMarch 2016 to August 2017, all using the combination of the SMB exploit and the NSA\'s\nDoublePulsar backdoor. Those intrusions, all seemingly bent on espionage, hit\ntelecommunications companies as well as research and educational organizations in\nHong Kong, the Philippines, Vietnam, Belgium, and Luxembourg.\nLeaked and Weaponized\nStarting a year after those stealthy intrusions began, however, the NSA\'s zero-day was\nhijacked in a far more public fashion. In April 2017, a still-mysterious group calling itself the\nShadow Brokers dumped the NSA\'s EternalBlue, EternalRomance, EternalSynergy, and\nDoublePulsar tools into public view, part of a series of leaks from the group that had\nstarted the previous summer with a failed attempt to auction the stolen tools to the\nhighest bidder. It\'s still entirely unclear how the NSA\'s crown jewels ended up in the\nShadow Brokers\' hands, though theories include a rogue NSA insider selling the tools and\nhackers chancing upon an NSA "staging server," a machine used as a kind of remote\noutpost from which to launch operations.\nEternalBlue and EternalRomance were integrated into a pair of nation-state cyberattacks\nthat hit the vast numbers of still-unpatched computers across the globe, with\ncatastrophic consequences.\nAnticipating that leak, Microsoft had pushed out an emergency SMB patch after a\nwarning from the NSA. Nonetheless, over the next two months, the now-public\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n246\n\nEternalBlue and EternalRomance were integrated into a pair of nation-state\ncyberattacks that hit the vast numbers of still-unpatched computers across the globe,\nwith catastrophic consequences.\nFirst, the North Korean\xe2\x80\x93coded WannaCry worm tore through the internet, combining\nEternalBlue with a ransomware payload that encrypted hundreds of thousands of\ncomputers, from police departments in India and universities in China to the National\nHealth Service in the United Kingdom. The next month, Russian military intelligence\nhackers combined EternalBlue and EternalRomance with the open source hacking tool\nMimikatz to create an even larger digital debacle. That second worm was targeted at\nRussia\'s enemies in Ukraine and wiped an estimated 10 percent of the country\'s\ncomputers. But it quickly spread beyond Ukraine\'s borders, paralyzing companies such as\nMaersk, a European subsidiary of FedEx, the US pharmaceutical Merck, and many others,\ncosting a record-breaking $10 billion in damage.\nDespite the NSA\'s decision to help Microsoft patch its SMB flaw before those attacks, the\nagency has already faced plenty of criticism for having kept its zero-day secret for as\nlong as it did. But with Symantec\'s latest revelations, the knowledge of yet another\nhacker campaign that had somehow obtained that zero-day and was using it for global\nspying will no doubt spark those criticisms again. It may lead to a reexamination of the\nWhite House\'s so-called Vulnerabilities Equities Process, a system of determining which\nflaws that US agencies discover should be patched and which ones should be used for\noperations. "No matter how you play it, the fact that someone else besides the Shadow\nBrokers had these exploits is extremely concerning and raises serious questions about our\nvulnerability equities process," Williams says.\nBut others counter that the reuse of hacking tools by adversaries should be part of the\nexpected cost of using them in the first place. And as Symantec\'s BuckEye research\nshows, that cost may be entirely hidden: The reuse of a zero-day by an adversary can\nremain as secret as its initial use for years afterward\xe2\x80\x94more than three years, in this case.\n"When you utilize a vulnerability, it has a chance to be discovered," Chien says. \xe2\x80\x9cThat can\nhappen, and we saw it happen here. But we didn\xe2\x80\x99t know it had happened for quite\nsome time.\xe2\x80\x9d\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\nWhat lesson do you take from this?\nShould the United States alter its VEP policy?\n\nGiven the totality of what you have just read:\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\nShould the U.S. government adopt, via legislation or executive order, any additional\nrules intended to limit or regulate the use of hacking for espionage purposes?\nShould the U.S. government support efforts to craft international law constraints\nspecifically designed to limit the use of hacking for espionage purposes?\nHow about promoting a limiting \xe2\x80\x9cnorm\xe2\x80\x9d of some kind?\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n247\n\n25. Government Hacking: Armed Conflict\n\nLearning objectives\n\xe2\x80\xa2\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\nKnow what \xe2\x80\x9cUSCYBERCOM\xe2\x80\x9d is, and be able to describe the differences among Cyber\nProtection Teams, Combat Mission Teams, and National Mission Teams\nUnderstand the issues highlighted by the Task Force Ares experience, including in particular (1)\nthe balance between the interest in collecting intelligence and the interest in\ndisrupting/destroying adversary capabilities and (2) the diplomatic and other issues that arise\nwhen an adversary\xe2\x80\x99s capabilities are sustained via infrastructure located in the territory of a\nthird country\nUnderstand the international legal framework relating to military cyber operations\nBe able to explain what the \xe2\x80\x9cdual hat\xe2\x80\x9d is, why it came to exist in the first place, what was\nexpected to happen to it eventually, why some no longer want that to happen, and how\nCongress intervened to ensure it would not happen until certain conditions are met\nUnderstand how the Obama administration addressed the problem of unintended negative\nconsequences from operations impacting third countries, and what we know of the Trump\nadministration\xe2\x80\x99s change to that process\n\nIn addition to hacking for purposes of criminal investigations and espionage, the U.S. government\nalso might wish to engage in hacking for a variety of other reasons including:\n\xe2\x80\xa2\n\xe2\x80\xa2\n\nas part of an armed conflict; or\nas a means to engage in competition with foreign actors below the threshold of armed\nconflict (including both acknowledged and deniable actions).\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n248\n\nWe will conclude the course in this reading and the next by surveying the legal and policy issues\nassociated with U.S. government activity (and that of other governments) in these contexts,\nstarting with armed conflict.\nA. Cyberspace operations in the context of armed conflict\nBoth regular armed forces and non-state armed groups increasingly depend on computers and\ncommunication networks for a growing array of functions. It follows inevitably that military\norganizations will seek to establish the ability to penetrate adversary systems. This certainly is true\nfor the armed forces of the United States.\nTo some extent, military hacking is a topic that falls within the scope of the espionage discussion\nin the previous reading. Military organizations often perform intelligence collection, after all, both\nin connection with armed conflict (as a form of combat support) and otherwise (as part of the\nprocess of understanding the capabilities and intentions of potential adversaries). But not all\nhacking carried out by military entities fits that bill. Military hacking also might occur in order to\nachieve what we might call an \xe2\x80\x9coperational effect.\xe2\x80\x9d For example, a military organization might\nhack a system in order to manipulate information stored there, to disrupt or destroy its functionality,\nor to hold it \xe2\x80\x9cat risk\xe2\x80\x9d of such an effect.\nThis brings us to a critical point: military organizations conduct cyberspace operations in\nconnection with armed conflicts, yes, but not only in connection with armed conflicts. Knowing\nthat a particular cyberspace operation was conducted by a military organization thus is not\nenough, on its own, to tell us whether we are dealing with a circumstance involving armed conflict\n(or to put things in more colloquial terms, it is not enough to tell us whether we are dealing with a\ncircumstance involving war).\nFor the moment, we will focus on military hacking in circumstances that do constitute armed\nconflict. We will save until the next subsection the critical and recurring set of issues that arise when\nstates use hacking (using military organizations or otherwise) to cause operational effects in the\ncyber domain below that threshold.\nB. The role of CYBERCOM\nWe have discussed US Cyber Command previously in connection with our study of how the U.S.\ngovernment defends its own networks (recall that JFHQ-DoDIN, the entity with overall responsibility\nfor defending the DoDIN, is a component of CYBERCOM), and also our study of the larger\ndefensive ecosystem and the way it can interact with international relations (for CYBERCOM at\ntimes will take public-protecting actions such as providing IOCs to VirusTotal, especially (though\napparently not only) when accompanied by a name-and-shame attribution to a foreign\ngovernment). But CYBERCOM\xe2\x80\x99s mission is by no means limited to defense. Bear that in mind as\nyou read this thumbnail sketch of CYBERCOM\xe2\x80\x99s origins.\nAs Fred Kaplan explains in his book Dark Territory: The Secret History of Cyber War (available here\nif you are interested in going deeper), the military\xe2\x80\x99s effort to organize for cyber operations traces\nback to the late 1990s. As the Department began to appreciate how vulnerable its own networks\nwere, it established a new office (the \xe2\x80\x9cJoint Task Force\xe2\x80\x94Computer Network Defense,\xe2\x80\x9d or just \xe2\x80\x9cJTFCND\xe2\x80\x9d) to coordinate defensive efforts. Kaplan writes that the\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n249\n\n\xe2\x80\x9cinitial plan was to give [JTF-CND] an offensive role as well, a mandate to develop options\nfor attacking an adversary\xe2\x80\x99s network\xe2\x80\xa6. [But the organizer] knew that the services wouldn\xe2\x80\x99t\ngrant such powers to a small bureau with no command authority. \xe2\x80\xa6 [Eventually, in] 2000,\nJTF-CND became JTF-CNO, the O standing for \xe2\x80\x9cOperations,\xe2\x80\x9d and those operations\nincluded not just Computer Network Defense but also, explicitly, Computer Network\nAttack\xe2\x80\xa6. [JTF-CNO] was placed under the purview of U.S. Space Command\xe2\x80\xa6it was an\nodd place to be, but SpaceCom was the only unit that wanted the mission\xe2\x80\xa6[and] in any\ncase, it was a command, invested with war-planning and war-fighting powers. [But key\nleaders] felt that the cyber missions\xe2\x80\x94especially those dealing with cyber offense\xe2\x80\x94should\nultimately be brought to the Fort Meade headquarters of the NSA.\xe2\x80\x9d (pp. 121-22)\nIt took many years, but that is what happened in the end. In the summer of 2009, Secretary of\nDefense Gates directed the creation of a new command\xe2\x80\x94United States Cyber Command\n(CYBERCOM)\xe2\x80\x94focused on both defensive and offensive functions. In order to ensure its rapid\nmaturation, moreover, the new command would be collocated with NSA at Ft. Meade, and NSA\xe2\x80\x99s\nDirector would be \xe2\x80\x9cdual-hatted\xe2\x80\x9d as the CYBERCOM commander as well. This would enable NSA\nto incubate CYBERCOM in terms of personnel, knowledge, technical capabilities, and so forth.\nLess obviously, it also would ensure a process for deconfliction of priorities should the interests of\nCYBERCOM in causing an operational effect in cyberspace come into conflict with the interests\nof NSA in collecting intelligence.\nSo, what exactly is CYBERCOM\xe2\x80\x99s role? The Defense Department\xe2\x80\x99s 2015 Cyber Strategy document\nprovides a handy explanation:\nIn 2012, DoD began to build a [Cyber Mission Force (\xe2\x80\x9cCMF\xe2\x80\x9d)] to carry out DoD\xe2\x80\x99s cyber missions.\nOnce fully operational, the CMF will include nearly 6,200 military, civilian, and contractor\nsupport personnel from across the military departments and defense components\xe2\x80\xa6. The\nCyber Mission Force will be comprised of cyber operators organized into 133 teams, primarily\naligned as follows:\nCyber Protection Forces will augment traditional defensive measures and defend priority DoD\nnetworks and systems against priority threats;\nNational Mission Forces and their associated support teams will defend the United States and\nits interests against cyberattacks of significant consequence; and\nCombat Mission Forces and their associated support teams will support combatant\ncommands by generating integrated cyberspace effects in support of operational plans and\ncontingency operations.\nCombatant commands integrate Combat Mission Forces and Cyber Protection Teams into\nplans and operations and employ them in cyberspace, while the National Mission Force\noperates under the Commander of USCYBERCOM. Outside of this construct, teams can also\nbe used to support other missions as required by the Department.\nPut simply, CYBERCOM has three core missions: defend DODIN (that\xe2\x80\x99s the job of the Cyber\nProtection Forces, operating under the purview of JFHQ-DoDIN); provide operational capabilities\nto military forces engaged in combat (that\xe2\x80\x99s the job of the Combat Mission Forces, who will be\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n250\n\noperating in practice under the purview of regional combatant commanders); and in special\ncircumstances defend the nation more generally (that\xe2\x80\x99s the job of the National Mission Forces).\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\nCan you identify circumstances that you feel would justify deployment of the National\nMission Forces?\nIs that question harder or easier than asking the same thing about a physical-domain\nthreat to the United States, such as a ballistic missile or a military aircraft entering U.S.\nairspace?\n\nNow, a quick primer on what a \xe2\x80\x9ccombatant command\xe2\x80\x9d is and how CYBERCOM fits into that\npicture: The traditional organizational structure of the Armed Forces of the United States involved\na sharp division into a series of separate \xe2\x80\x9cservice branches\xe2\x80\x9d: the Army, Navy, Air Force, and\nMarines (and the Coast Guard as well, though its precise status is complicated). The several\nbranches not only recruited, trained, and equipped their own forces, but in the past they also\nplanned and commanded their own operations (often, though not always, in coordination with\none another). Today, they continue to recruit, train, and equip separately, but they no longer\nplan and command operations independently. We now have a \xe2\x80\x9cjoint forces\xe2\x80\x9d model for purposes\nof actual operations. Under this model, assets generated by each branch come under the\noperational control of a single, unified command structure. More specifically, we now have a\nglobe-spanning series of geographically-defined \xe2\x80\x9ccombatant commands,\xe2\x80\x9d such as Central\nCommand (CENTCOM, which encompasses the Middle East through to Afghanistan) and IndoPacific Command (INDOPACOM).\nSo far so good, but it gets more complicated. In addition to these geographically defined\ncommands, we also have several additional commands that have no geographic boundaries\nbut instead are defined by the particular functions they perform or support. CYBERCOM is such a\ncommand. Special Operations Command (SOCOM) is another. These functional commands are\nlike the geographic ones in that their subordinate units and personnel are mostly generated by\nthe various service branches, but then brought together under a \xe2\x80\x9cjoint\xe2\x80\x9d command structure for\noperational purposes. In CYBERCOM\xe2\x80\x99s case, that means that Army, Navy, Air Force, and Marine\nunits and personnel make up the various Cyber Mission Forces.\n\n\xe2\x80\xa2\n\nYou likely have heard of the creation of Space Force as a new service branch in the\nU.S. military. Should we create \xe2\x80\x9cCyber Force,\xe2\x80\x9d such that the task of recruiting, training,\nand equipping cyber mission teams falls to an independent branch rather than Army,\nNavy, Air Force, and Marines?\n\nC. CYBERCOM\xe2\x80\x99s role during armed conflict: Joint Task Force-Ares as a case study\nLet\xe2\x80\x99s start with a word of caution about terminology. People often use phrases like cyber war and\ncyber attack without meaning to claim that an actual circumstance of war exists or that a\nparticular action amounts to an attack in a war-related sense. Such terms are just convenient\nshorthands in such cases. Unfortunately, such language can sometimes lead to confusion. Always\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n251\n\nbe clear about your own use of these terms, and be alert to how others might be using (or\nmisusing) them.\n\n\xe2\x80\xa2\n\nDo a search to find recent news articles that use the words \xe2\x80\x9ccyberwar\xe2\x80\x9d or \xe2\x80\x9ccyber\nattack.\xe2\x80\x9d Do any of the examples seem misplaced?\n\nHaving said that, let us assume for the moment that we do have a circumstance of armed conflict,\nsuch as the conflict in Iraq and Syria involving the Islamic State. What are the critical policy and\nlegal issues that arise when CYBERCOM conducts operations for effect in that setting?\nTo answer that, let\xe2\x80\x99s use the experience of Joint Task Force-Ares as a case study. JTF-Ares is the\nname of the CYBERCOM mission to engage the Islamic State in the cyber domain, for purposes of\nboth intelligence-gathering and achieving operational effects (either stand-alone operational\neffects such as shutting down a website operated by IS, or effects intended to support kinetic\noperations in the field). In 2016, the public began to catch glimpses of internal U.S. government\ndebates associated with these activities, glimpses that highlighted a variety of recurring issues\nraised by this scenario. The following text is excerpted from a post I wrote for Lawfare in 2017,\nmarshaling the public reports that existed up to that point and using them to highlight the issues:\n1. July 2016 \xe2\x80\x93 Reports of DOD frustration over pace of anti-ISIS cyber operations\nIn July 2016, the Washington Post (Ellen Nakashima & Missy Ryan) reported on\nCYBERCOM\xe2\x80\x99s efforts to disrupt the Islamic State\xe2\x80\x99s online activities (internal\ncommunications, external propaganda, financing, etc.), emphasizing the view of DOD\nleadership that CYBERCOM was underperforming:\n\xe2\x80\x9cAn unprecedented Pentagon cyber-offensive against the Islamic State has gotten off to\na slow start, officials said, frustrating Pentagon leaders and threatening to undermine\nefforts to counter the militant group\xe2\x80\x99s sophisticated use of technology for recruiting,\noperations and propaganda. \xe2\x80\xa6 But defense officials said the command is still working to\nput the right staff in place and has not yet developed a full suite of malware and other\ntools tailored to attack an adversary dramatically different from the nation-states\nCybercom was created to fight. \xe2\x80\xa6 Although officials declined to detail current\noperations, they said that cyberattacks occurring under the new task force might, for\ninstance, disrupt a payment system, identify a communications platform used by Islamic\nState members and knock it out, or bring down Dabiq, the Islamic State\xe2\x80\x99s online magazine.\n\xe2\x80\xa6\xe2\x80\x9d\nThe report is an excellent snapshot of several distinct challenges the military use of\ncomputer network operations can pose.\nOne such challenge is operational capacity. The story suggests that CYBERCOM simply did\nnot have the right personnel and the right exploits on hand for this particular mission, at\nleast at the start. That\xe2\x80\x99s a problem that can be fixed, and the report details the steps DOD\nbegan taking in 2016 to do just that.\nAnother challenge is the need to have an effective process for deconfliction between\nintelligence-collection and operational-effect equities. As the article summarized the\nissue:\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n252\n\n\xe2\x80\x9cWhenever the military undertakes a cyber-operation to disrupt a network, the intelligence\ncommunity may risk losing an opportunity to monitor communications on that network. So\nmilitary cybersecurity officials have worked to better coordinate their target selection and\noperations with intelligence officials.\xe2\x80\x9d\nThis is not a novel tension, in the abstract. For as long as there has been signals intelligence,\nthere have been tensions of this kind. When one side has access to the other\xe2\x80\x99s\ncommunications, there will always be tension between the temptation to exploit that\naccess for operational effect (with the opportunity cost of risking loss of that access going\nforward as the enemy realizes it has been monitored) and the temptation to instead\nexploit it for indirect intelligence advantage (with the opportunity cost of forgoing direct\noperational advantage in at least some cases). World War II provides famous\nexamples. And so one might fairly ask: is there anything really different about computer\nnetwork operations, warranting special attention to the topic in this setting?\nPerhaps. In this domain there is much more overlap between the means of collection and\nthe means of carrying out a disruptive operations. Indeed, those means often will be the\nexact same: a particular exploit providing access to an enemy device, network, etc. It\nseems to me that this ensures that the tension between collection and operational equities\nwill arise with greater frequency, and less room for workarounds, than in more familiar\nsettings.\nHaving mentioned both the operational capacity concern and the competing-equities\nconcern, now is a good time to emphasize the significance of the status-quo for NSA and\nCYBERCOM: the dual-hatted commander. Whereas more familiar, traditional scenarios\ninvolving tension between collection and operational equities usually involve distinct\nunderlying institutions and commanders, the status quo with respect to computer network\noperations has always (well, the past seven years) involved the dual-hatting of NSA\xe2\x80\x99s\ndirector and CYBERCOM\xe2\x80\x99s commander.\nThis model in theory ensures that neither institution has a home-field advantage, and\nmaximizes the chance that the key decisionmaker (yes, there can be important decisions\nboth below and above the dual-hat, but the dual-hat is obviously in the key position) fully\nbuys into and fully grasps the importance of each institution\xe2\x80\x99s mission.\nOf course, it is possible that the dual-hat might tilt one direction to an unfair or undesirable\ndegree. And it is possible that some might perceive such a tilt even when there isn\xe2\x80\x99t one.\nAs 2016 wore on, questions of this kind began to appear in public, and by September the\nmedia was reporting that DNI Clapper and SecDef Carter both were in favor of splitting\nup the dual-hat. It was not the first time this topic had come up, to be sure; President\nObama had considered ordering a split in 2013 (during the aftermath of the Snowden\ncontroversy), but had not taken that step at least in part out of concern about\nCYBERCOM\xe2\x80\x99s independent operational capacity. Now the idea appeared to have\nmomentum.\nA report from Ellen Nakashima in the Washington Post that same month suggested that this\nmomentum was in part a product of CYBERCOM\xe2\x80\x99s operational maturation, but also in\nsignificant part driven by the perception that Admiral Rogers, the current dual-hat, favored\ncollection equities to an undue extent:\n\xe2\x80\x9cWhether or not it\xe2\x80\x99s true, the perception with Secretary Carter and [top aides] has become\nthat the intelligence agency has been winning out at the expense of [cyber] war efforts,\xe2\x80\x9d\nsaid one senior military official\xe2\x80\xa6.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n253\n\n(See also this report by the New York Times, stating that frustration along these same lines\ncontributed to the effort to get President Obama to remove Admiral Rogers in late 2016.)\nThe Washington Post report also highlighted concerns that splitting NSA and CYBERCOM\nat the leadership level might actually weaken rather than empower CYBERCOM, as NSA\ninevitably would become free to withhold from CYBERCOM at least some exploits or other\nforms of access so that sources would not be lost:\n\xe2\x80\x9cCyber Command\xe2\x80\x99s mission, their primary focus, is to degrade or destroy,\xe2\x80\x9d the former\nofficial said. \xe2\x80\x9cNSA\xe2\x80\x99s is exploit [to gather intelligence] only. So without having one person as\nthe leader for both, the bureaucratic walls will go up and you\xe2\x80\x99ll find NSA not cooperating\nwith Cyber Command to give them the information they\xe2\x80\x99ll need to be successful.\xe2\x80\x9d\n2. December 2016 \xe2\x80\x93 Congress puts on the brakes\nAgainst this backdrop, Congress intervened in late 2016 to slow down the Obama\nadministration\xe2\x80\x99s move to split the dual-hat. Section 1642 of the NDAA FY\xe2\x80\x9917, enacted in\nlate December, provides that NSA and CYBERCOM must continue to share a dual-hatted\ndirector/commander unless and until the Secretary of Defense and the Chairman of the\nJoint Chiefs of Staff jointly certify to certain Congressional committees (SASC & HASC; SSCI\n& HPSCI; and the Appropriations Committees) that separation will not pose\n\xe2\x80\x9cunacceptable\xe2\x80\x9d risks to CYBERCOM\xe2\x80\x99s effectiveness, and that the following six conditions\nare met:\n\xe2\x80\x9c(i) Robust operational infrastructure has been deployed that is sufficient to meet the\nunique cyber mission needs of the United States Cyber Command and the National\nSecurity Agency, respectively.\n(ii) Robust command and control systems and processes have been established for\nplanning, deconflicting, and executing military cyber operations.\n(iii) The tools and weapons used in cyber operations are sufficient for achieving required\neffects.\n(iv) Capabilities have been established to enable intelligence collection and operational\npreparation of the environment for cyber operations.\n(v) Capabilities have been established to train cyber operations personnel, test cyber\ncapabilities, and rehearse cyber missions.\n(vi) The cyber mission force has achieved full operational capability. Section 1642(b)(2)(C)\n(emphasis added).\nPresident Obama\xe2\x80\x99s signing statement criticized Congress for imposing this requirement, but\ndid not include a claim that it was unconstitutional. It remains the law at this time.\n3. Early 2017 \xe2\x80\x93 Complications in the War Against the Islamic State\nWhile lawmakers and policymakers wrestled with the pros and cons of splitting NSA and\nCYBERCOM, computer network operations against the Islamic State continued to\naccelerate.\nAlong the way, however, new problems emerged.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n254\n\nAs Ellen Nakashima of the Washington Post reported in May 2017, CYBERCOM by late 2016\nhad encountered a new set of challenges in its enhanced effort to shut down ISIS sites and\nplatforms: third-country effects.\n\xe2\x80\x9cA secret global operation by the Pentagon late last year to sabotage the Islamic State\xe2\x80\x99s\nonline videos and propaganda sparked fierce debate inside the government over\nwhether it was necessary to notify countries that are home to computer hosting services\nused by the extremist group, including U.S. allies in Europe. \xe2\x80\xa6 Cybercom developed the\ncampaign under pressure from then-Defense Secretary Ashton B. Carter, who wanted the\ncommand to raise its game against the Islamic State. But when the CIA, State Department\nand FBI got wind of the plan to conduct operations inside the borders of other countries\nwithout telling them, officials at the agencies immediately became concerned that the\ncampaign could undermine cooperation with those countries on law enforcement,\nintelligence and counterterrorism. The issue took the Obama National Security Council\nweeks to address\xe2\x80\xa6\xe2\x80\x9d\nThis article highlights a third significant challenge associated with computer network\noperations: attacking the enemy\xe2\x80\x99s online presence often requires, or at least risks, some\ndegree of impact on servers located in other countries. Third-country impact involves both\nlegal and policy challenges, and as the quote above illustrates it also brings into play\notherwise-unrelated equities of other agencies. Thus, the competing-equities tension is not\njust a clash between collection and operational equities, but in some cases many others\nas well. The dual-hat command structure is primarily an answer only to the former, not the\nlatter.\nMeanwhile, a sobering reality about the utility of cyberattacks on Islamic State\ncommunications began to become clear: the effects often did not last. This was the thrust\nof an important piece by David Sanger and Eric Schmitt in the New York Times in June\n2017:\n\xe2\x80\x9c[S]ince they began training their arsenal of cyberweapons on \xe2\x80\xa6internet use by the Islamic\nState, the results have been a consistent disappointment, American officials say. \xe2\x80\xa6 [It] has\nbecome clear that recruitment efforts and communications hubs reappear almost as\nquickly as they are torn down. \xe2\x80\xa6 \xe2\x80\x9cIn general, there was some sense of disappointment in\nthe overall ability for cyberoperations to land a major blow against ISIS," or the Islamic\nState, said Joshua Geltzer, who was the senior director for counterterrorism at the National\nSecurity Council until March. "This is just much harder in practice than people think..."\nThis suggested that the military equities that some felt had been undervalued by Admiral\nRogers in the past were less weighty than proponents had assumed. Nonetheless,\nmomentum towards separation\xe2\x80\x94and concern that the dual-hat unduly favors collection\nequities\xe2\x80\x94continues.\nIn mid-July, reports emerged that the Pentagon had submitted to the Trump administration\na plan for effectuating the split, with some of the accompanying commentary continuing\nto advance the argument that NSA holds CYBERCOM back to an improper extent:\n\xe2\x80\x9cThe goal, [unnamed U.S. officials] said, is to give U.S. Cyber Command more autonomy,\nfreeing it from any constraints that stem from working alongside the NSA, which is\nresponsible for monitoring and collecting telephone, internet and other intelligence data\nfrom around the world \xe2\x80\x94 a responsibility that can sometimes clash with military operations\nagainst enemy forces.\xe2\x80\x9d\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n255\n\nThis account raises a number of questions for you to consider:\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\nCan you list the variables that may have constrained CYBERCOM in conducting\noperations for effect against the Islamic State?\nWhat are the pros and cons of ending the dual-hat arrangement?\nMilitary operations that produce damage in the physical world often are followed by\nenemy efforts to repair that damage and restore functionality. Is there reason to think\nsuch remediation efforts are, on the whole, easier in cyberspace?\nCan you explain the diplomatic challenge associated with the risk of third-party\neffects?\nWhat steps, if any, would you recommend embracing in order to address that\nchallenge?\n\nThe account above refers to interagency battles over potential CYBERCOM operations, with CIA,\nState, and Justice objecting at certain points. This might cause you to wonder: What put those\norganizations in a position even to know about those plans, let alone to object effectively at the\nWhite House level? The answer has to do with an Obama administration policy directive that\nreportedly required interagency vetting of this sort for military cyber operations expected to have\neffects outside of areas of active hostilities. Notably, Trump administration officials have\nannounced that this requirement has been revoked (in the form of National Security Presidential\nMemorandum 13, the precise details of which are not yet public). Some have argued, since then,\nthat there remains a strong element of interagency vetting in these cases. But let\xe2\x80\x99s assume that\nthere is at least a reduction in the extent of that vetting:\n\n\xe2\x80\xa2\n\nWhat are the pros and cons of weakening the interagency vetting requirement?\n\nThe third-party effect issue also raises a profoundly-sensitive set of international law issues. How\nso? Here\xe2\x80\x99s a thumbnail sketch. First, Article 2(4) of the U.N. Charter prohibits the \xe2\x80\x9cuse of force\xe2\x80\x9d in\ninternational affairs, absent special conditions including (i) a specific type of approval by the U.N.\nSecurity Council or (ii) the existence of an armed attack to which this action is a necessary and\nproportionate response.\n\nIf the U.S. government were to shut down an Islamic State propaganda site run from a server\nin Germany, without seeking consent from the German government:\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\nWould that constitute a \xe2\x80\x9cuse of force\xe2\x80\x9d implicating Article 2(4)?\nWould the U.S. government likely be able to get a U.N. Security Council resolution\nauthorizing the action?\nIf this could be done, would timing nonetheless be an issue?\nThe United States might argue that it and its coalition partners are responding to an\narmed attack from the Islamic State. Assume that this is a plausible argument to\nexplain the use of force against the Islamic State in Iraq and Syria. Is it obvious that the\nsame would be true as to an activity taking effect in Germany?\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n256\n\nIf a cyber-domain activity does not constitute a \xe2\x80\x9cuse of force\xe2\x80\x9d regulated by the U.N. Charter, it\nmight nonetheless constitute an \xe2\x80\x9cinternationally-wrongful act\xe2\x80\x9d in the sense of being a prohibited\n\xe2\x80\x9cintervention\xe2\x80\x9d in the internal affairs of a sovereign state. This is a hot topic in international law,\ncurrently. To understand why, consider this excerpt from a much-noted articulation of the British\nview of these questions, from then Attorney General Jeremy Wright in May 2018:\n\xe2\x80\x9cIn certain circumstances, cyber operations which do not meet the threshold of the use of\nforce but are undertaken by one state against the territory of another state without that\nstate\xe2\x80\x99s consent will be considered a breach of international law.\nThe international law prohibition on intervention in the internal affairs of other states is of\nparticular importance in modern times when technology has an increasing role to play in\nevery facet of our lives, including political campaigns and the conduct of elections. As set\nout by the International Court of Justice in its judgment in the Nicaragua case, the purpose\nof this principle is to ensure that all states remain free from external, coercive intervention\nin the matters of government which are at the heart of a state\xe2\x80\x99s sovereignty, such as the\nfreedom to choose its own political, social, economic and cultural system.\nThe precise boundaries of this principle are the subject of ongoing debate between states,\nand not just in the context of cyber space. But the practical application of the principle in\nthis context would be the use by a hostile state of cyber operations to manipulate the\nelectoral system to alter the results of an election in another state, intervention in the\nfundamental operation of Parliament, or in the stability of our financial system. Such acts\nmust surely be a breach of the prohibition on intervention in the domestic affairs of states.\nFurthermore, a breach of this principle of non-intervention provides victim states with the\nability to take action in response that would otherwise be considered unlawful, but which\nis permissible if it is aimed at returning relations between the hostile state and the victim\nstate to one of lawfulness, and bringing an end to the prior unlawful act. Such action is\npermissible under the international law doctrine of countermeasures. Put simply, if a hostile\nstate breaches international law as a result of its coercive actions against the target state\xe2\x80\x99s\nsovereign freedoms, then the victim state can take action to compel that hostile state to\nstop.\nConsistent with the de-escalatory nature of international law, there are clear restrictions\non the actions that a victim state can take under the doctrine of countermeasures. A\ncountermeasure can only be taken in response to a prior internationally wrongful act\ncommitted by a state, and must only be directed towards that state. This means that the\nvictim state must be confident in its attribution of that act to a hostile state before it takes\naction in response. In cyberspace of course, attribution presents particular challenges, to\nwhich I will come in a few moments. Countermeasures cannot involve the use of force,\nand they must be both necessary and proportionate to the purpose of inducing the hostile\nstate to comply with its obligations under international law.\nThese restrictions under the doctrine of countermeasures are generally accepted across\nthe international law community. The one area where the UK departs from the excellent\nwork of the International Law Commission on this issue is where the UK is responding to\ncovert cyber intrusion with countermeasures.\nIn such circumstances, we would not agree that we are always legally obliged to give\nprior notification to the hostile state before taking countermeasures against it. The\ncovertness and secrecy of the countermeasures must of course be considered necessary\nand proportionate to the original illegality, but we say it could not be right for international\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n257\n\nlaw to require a countermeasure to expose highly sensitive capabilities in defending the\ncountry in the cyber arena, as in any other arena.\nIn addition, it is also worth stating that, as a matter of law, there is no requirement in the\ndoctrine of countermeasures for a response to be symmetrical to the underlying unlawful\nact. What matters is necessity and proportionality, which means that the UK could respond\nto a cyber intrusion through non-cyber means, and vice versa.\nThrough the principle of non-intervention, it is clear that the international community has\nset a boundary at which interference in another state\xe2\x80\x99s sovereign freedoms is considered\ninternationally wrongful and as such, in breach of international law, giving rise to the right\nto take action which may otherwise be unlawful in response. As I have already mentioned,\nthe precise parameters of this principle remain the subject of ongoing debate in the\ninternational law community, but a further contested area amongst those engaged in the\napplication of international law to cyber space is the regulation of activities that fall below\nthe threshold of a prohibited intervention, but nonetheless may be perceived as affecting\nthe territorial sovereignty of another state without that state\xe2\x80\x99s prior consent.\nSome have sought to argue for the existence of a cyber specific rule of a \xe2\x80\x9cviolation of\nterritorial sovereignty\xe2\x80\x9d in relation to interference in the computer networks of another state\nwithout its consent.\nSovereignty is of course fundamental to the international rules-based system. But I am not\npersuaded that we can currently extrapolate from that general principle a specific rule or\nadditional prohibition for cyber activity beyond that of a prohibited intervention. The UK\nGovernment\xe2\x80\x99s position is therefore that there is no such rule as a matter of current\ninternational law.\xe2\x80\x9d\nIt is widely thought that this understanding of the legal status of sovereignty reflects the U.S. position\nas well. Here is language from a speech by Brian Egan, then the Legal Adviser of the State\nDepartment, in 2016:\n\xe2\x80\x9cIn certain circumstances, one State\xe2\x80\x99s non-consensual cyber operation in another State\xe2\x80\x99s\nterritory could violate international law, even if it falls below the threshold of a use of force.\nThis is a challenging area of the law that raises difficult questions. The very design of the\nInternet may lead to some encroachment on other sovereign jurisdictions. Precisely when\na non-consensual cyber operation violates the sovereignty of another State is a question\nlawyers within the U.S. government continue to study carefully, and it is one that ultimately\nwill be resolved through the practice and opinio juris of States.\nRelatedly, consider the challenges we face in clarifying the international law prohibition\non unlawful intervention. As articulated by the International Court of Justice (ICJ) in its\njudgment on the merits in the Nicaragua Case, this rule of customary international law\nforbids States from engaging in coercive action that bears on a matter that each State is\nentitled, by the principle of State sovereignty, to decide freely, such as the choice of a\npolitical, economic, social, and cultural system. This is generally viewed as a relatively\nnarrow rule of customary international law, but States\xe2\x80\x99 cyber activities could run afoul of\nthis prohibition. For example, a cyber operation by a State that interferes with another\ncountry\xe2\x80\x99s ability to hold an election or that manipulates another country\xe2\x80\x99s election results\nwould be a clear violation of the rule of non-intervention. For increased transparency,\nStates need to do more work to clarify how the international law on non-intervention\napplies to States\xe2\x80\x99 activities in cyberspace.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n\xe2\x80\xa2\n\n258\n\nCan you explain how the varying national interests and circumstances of the United\nStates, Russia, and China might cause them to take different positions on these issues?\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n259\n\n26. Government Hacking: Grey-Zone Competition\n\nLearning objectives\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\nUnderstand the uncertainties associated with the idea of a \xe2\x80\x9cgrey zone\xe2\x80\x9d category\nUnderstand the arguments for and against conducting cyber operations that are meant to\nhave a disruptive impact outside the context of armed conflict\nForm a view on which types of government agency(ies) should have responsibility for such\nactivity, if it is to be conducted at all\nBe able to describe the way that the US government has allocated authority in this area\nBe familiar with the Stuxnet/Olympic Games episode and lessons learned from it\nUnderstand the scope of activities attributed to Sandworm, and lessons learned from them\nAppreciate the international law questions associated with grey zone cyber activity\n\nA. Defining the parameters of this category\nThe prior reading illustrated how cyber domain operations during armed conflict raise interesting\nlegal and policy questions. Yet they are not quite as interesting, perhaps, as the ones raised by\noperations carried out in the cyber domain that have disruptive or destructive effects but that are\nnot carried out in connection with armed conflict.\nLet\xe2\x80\x99s begin with an effort to be precise about the category of activity that is at issue here. We are\nnot talking about cyber activities primarily intended to support espionage. Rather, we are\nfocused on activities that are primarily intended to cause effects. Those effects might concern\ncomputer systems themselves, altering or disrupting their function as an end in itself, or they might\nconducted as a means to cause physical-world effects. In either case, the key point is that a\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n260\n\nvariety of policy and legal questions arise when such activities occur outside the context of armed\nconflict.\nLet\xe2\x80\x99s begin by noting that there is a question regarding whether and how to apply a single label\nto this category of activity. Recognizing that a growing number of states appear to find such\nactivity to be an appealing way to advance their national interests, some would apply the\nconcept of \xe2\x80\x9cgrey zone competition\xe2\x80\x9d here. That evocative label reflects the idea that states\nsometimes compete with one another in aggressively-adversarial ways that are difficult for\noutsiders to observe clearly, and thus are \xe2\x80\x9cgrey\xe2\x80\x9d both in terms of transparency and in terms of the\nspectrum of intensity that runs from peaceful relations to war. Not all such activity occurs within\nthe cyber domain, of course, but the cyber domain is well-suited to grey zone competition given\nthe difficulties of attribution and collapsing of geographic distance that it entails.\nBearing all that in mind, and noting that there are few if any alternative conceptual shorthands\navailable, it is understandable, perhaps even inevitable, that grey zone competition is used in this\ncontext. But do not lose sight of the fact that this is not a formal legal category along the lines of\n\xe2\x80\x9carmed conflict,\xe2\x80\x9d and that people may vary widely in what comes to mind when they hear or see\nthis label.\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\nDo you find the \xe2\x80\x9cgrey zone\xe2\x80\x9d label helpful? Why or why not?\nIs there a better alternative?\nCan you articulate how this category differs from the category \xe2\x80\x9cespionage\xe2\x80\x9d?\nCan you think of reasons why a government might want to conduct a \xe2\x80\x9cgrey zone\xe2\x80\x9d\ncyber operation impacting computer systems in another country?\nCan you think of reasons why a government nonetheless should not engage in this sort\nof activity?\nCan you think of real world examples possibly conducted by the United States?\nCan you think of real world examples possibly conducted against the United States?\n\nB. Whose job should this be?\nIn a moment we will look at some of the legal considerations raised by grey zone cyber activity.\nBefore we do that, however, let\xe2\x80\x99s consider whether such activity should be the particular province\nof any specific type of government entity.\nThe practical capability to perform such operations might be found within an array of government\norganizations. A country\xe2\x80\x99s military might have the means. So too one or more of its intelligence\nagencies. So too with its law enforcement agencies. In short, practical capacity does not in all\ncases dictate the allocation of responsibility for conducting such operations.\nIs there something inherent in the nature of such operations, however, that suggests that they\nshould usually be performed by a particular type of government entity?\nBecause this category by definition exists below the level of armed conflict, it is not obvious that\nthe role should fall to military entities. On the other hand, militaries do routinely have a key role in\nnon-armed-conflict situations (hostage rescue, peacekeeping, disaster response, etc.), so this\nconsideration also does not rule them out of the picture.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n261\n\nMeanwhile, the possibility that such activities will be conducted in a manner intended to obscure\nthe responsible government\xe2\x80\x99s role does point conceptually towards the familiar category of\n\xe2\x80\x9ccovert action\xe2\x80\x9d (that is, operations intended to cause practical effects where the sponsoring role\nof the government is not meant to be apparent or acknowledged), which ordinarily is the\nprovince of an intelligence agency. This common feature of grey zone cyber activity thus appears\nat first glance to favor allocation of responsibility to such an agency. That said, it is not the case\nthat covert action must be performed only by intelligence agencies. In the US system, for\nexample, the default rule is that covert action should be performed by the CIA. The president\ncan assign responsibility elsewhere in particular cases, however, and in any event the statutory\ndefinition of \xe2\x80\x9ccovert action\xe2\x80\x9d expressly excludes situations that qualify as traditional \xe2\x80\x9cmilitary\nactivities.\xe2\x80\x9d So, again, the picture is a muddy one.\n\nAssume your government wants to have a grey zone cyber capacity, and you have complete\nfreedom to assign that function to one or more existing government entities.\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\nWould you assign this exclusively to just one of them? Why or why not?\nWhat factors would matter most to you in making this decision?\nWhich type of entity would you most likely ask to play the leading role, and why?\nIf money was no object, would you consider creating a brand-new, stand-alone\nagency for this purpose? Why or why not?\n\nC. How the United States currently distributes responsibility for this function\nFor the U.S. government, the ability to perform cyber operations for disruptive or destructive effect\noutside the context of armed conflict is lodged both with USCYBERCOM and the CIA.\nThe CIA, as noted, is America\xe2\x80\x99s lead agency for covert action in general, and there is nothing that\nprecludes a given covert action program from including a cyber component. And as we shall\nsee in the case study on Stuxnet below, there is ample reason in the public record to believe that\nCIA at times has been directed to execute a covert action program that includes cyber domain\noperations of this kind.\nMeanwhile, Congress has taken a number of steps to ensure that USCYBERCOM has clear statutory\nauthority to engage in at least some forms of grey zone activity too\xe2\x80\x94including operational steps\ndistinct from the blue-space defensive missions we have discussed previously. Until recently, there\nhad been considerable uncertainty regarding whether CYBERCOM has affirmative authority\nunder U.S. law to take on this particular role. To some extent, this reflected tension with the CIA\xe2\x80\x99s\nlead responsibility for conducting covert action and the related consideration, noted above, that\ntraditional military activities are formally excluded from the covert action category. To resolve\nthat tension in a way that would empower USCYBERCOM, Congress has passed a series of statutes\nthat collectively establish that USCYBERCOM can conduct such operations and that they do not\ncount as covert action under US law even if there are deniable elements to the operation. Here\nare the key passages, now codified as 10 USC 394:\n(a) IN GENERAL.-The Secretary of Defense shall \xe2\x80\xa6 when appropriately authorized to do so,\nconduct, military cyber activities or operations in cyberspace, including clandestine\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n262\n\nmilitary activities or operations in cyberspace, to defend the United States and its allies,\nincluding in response to malicious cyber activity carried out against the United States or a\nUnited States person by a foreign power.\n(b) AFFIRMATION OF AUTHORITY.-Congress affirms that the activities or operations referred\nto in subsection (a), when appropriately authorized, include the conduct of military\nactivities or operations in cyberspace short of hostilities \xe2\x80\xa6 including for the purpose of\npreparation of the environment, information operations, force protection, and deterrence\nof hostilities, or counterterrorism operations involving the Armed Forces of the United States.\n(c) CLANDESTINE ACTIVITIES OR OPERATIONS.-A clandestine military activity or operation in\ncyberspace shall be considered a traditional military activity for the purposes of [the\nstatutory definition of \xe2\x80\x9ccovert action\xe2\x80\x9d]\n\n\xe2\x80\xa2\n\nIs this two-track arrangement (CIA and USCYBERCOM) optimal?\n\nIn Section 1642 of the NDAA Fiscal Year \xe2\x80\x9919, moreover, Congress added the following statement\nof authority:\n(a) AUTHORITY TO DISRUPT, DEFEAT, AND DETER CYBER ATTACKS.\xe2\x80\x94\n(1) IN GENERAL.\xe2\x80\x94In the event that the National Command Authority determines that the\nRussian Federation, People\xe2\x80\x99s Republic of China, Democratic People\xe2\x80\x99s Republic of Korea,\nor Islamic Republic of Iran is conducting an active, systematic, and ongoing campaign of\nattacks against the Government or people of the United States in cyberspace, including\nattempting to influence American elections and democratic political processes, the\nNational Command Authority may authorize the Secretary of Defense, acting through the\nCommander of the United States Cyber Command, to take appropriate and proportional\naction in foreign cyberspace to disrupt, defeat, and deter such attacks under the authority\nand policy of the Secretary of Defense to conduct cyber operations and information\noperations as traditional military activities.\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\nCan you break this statute down into \xe2\x80\x9celements\xe2\x80\x9d that must be satisfied?\nWhat is the consequence if one or more of these elements is not satisfied?\n\nD. Case study: Stuxnet and Olympic Games\nPerhaps the most famous example of a grey-zone cyber operation apparently conducted in part\nby the United States involved an ambitious covert action program intended to disrupt centrifuges\nat the Iranian nuclear enrichment facility in Natanz. David Sanger of the New York Times played\na key role in the early public reporting on these dramatic events. Here are excerpts from one of\nthe key articles he wrote, from the summer of 2012:\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n263\n\nFrom his first months in office, President Obama secretly ordered increasingly\nsophisticated attacks on the computer systems that run Iran\xe2\x80\x99s main nuclear enrichment\nfacilities, significantly expanding America\xe2\x80\x99s first sustained use of cyberweapons,\naccording to participants in the program.\nMr. Obama decided to accelerate the attacks \xe2\x80\x94 begun in the Bush administration and\ncode-named Olympic Games \xe2\x80\x94 even after an element of the program accidentally\nbecame public in the summer of 2010 because of a programming error that allowed it to\nescape Iran\xe2\x80\x99s Natanz plant and sent it around the world on the Internet. Computer\nsecurity experts who began studying the worm, which had been developed by the\nUnited States and Israel, gave it a name: Stuxnet.\nAt a tense meeting in the White House Situation Room within days of the worm\xe2\x80\x99s\n\xe2\x80\x9cescape,\xe2\x80\x9d Mr. Obama, Vice President Joseph R. Biden Jr. and the director of the Central\nIntelligence Agency at the time, Leon E. Panetta, considered whether America\xe2\x80\x99s most\nambitious attempt to slow the progress of Iran\xe2\x80\x99s nuclear efforts had been fatally\ncompromised.\n\xe2\x80\x9cShould we shut this thing down?\xe2\x80\x9d Mr. Obama asked, according to members of the\npresident\xe2\x80\x99s national security team who were in the room.\nTold it was unclear how much the Iranians knew about the code, and offered evidence\nthat it was still causing havoc, Mr. Obama decided that the cyberattacks should\nproceed. In the following weeks, the Natanz plant was hit by a newer version of the\ncomputer worm, and then another after that. The last of that series of attacks, a few\nweeks after Stuxnet was detected around the world, temporarily took out nearly 1,000 of\nthe 5,000 centrifuges Iran had spinning at the time to purify uranium.\nThis account of the American and Israeli effort to undermine the Iranian nuclear program\nis based on interviews over the past 18 months with current and former American,\nEuropean and Israeli officials involved in the program, as well as a range of outside\nexperts. None would allow their names to be used because the effort remains highly\nclassified, and parts of it continue to this day.\nThese officials gave differing assessments of how successful the sabotage program was in\nslowing Iran\xe2\x80\x99s progress toward developing the ability to build nuclear weapons. Internal\nObama administration estimates say the effort was set back by 18 months to two years,\nbut some experts inside and outside the government are more skeptical, noting that\nIran\xe2\x80\x99s enrichment levels have steadily recovered, giving the country enough fuel today\nfor five or more weapons, with additional enrichment.\n\xe2\x80\xa6 Iran initially denied that its enrichment facilities had been hit by Stuxnet, then said it\nhad found the worm and contained it. Last year, the nation announced that it had\nbegun its own military cyberunit, and Brig. Gen. Gholamreza Jalali, the head of Iran\xe2\x80\x99s\nPassive Defense Organization, said that the Iranian military was prepared \xe2\x80\x9cto fight our\nenemies\xe2\x80\x9d in \xe2\x80\x9ccyberspace and Internet warfare.\xe2\x80\x9d But there has been scant evidence that\nit has begun to strike back.\n\xe2\x80\xa6It appears to be the first time the United States has repeatedly used cyberweapons to\ncripple another country\xe2\x80\x99s infrastructure, achieving, with computer code, what until then\ncould be accomplished only by bombing a country or sending in agents to plant\nexplosives. The code itself is 50 times as big as the typical computer worm, Carey\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n264\n\nNachenberg, a vice president of Symantec, one of the many groups that have dissected\nthe code, said at a symposium at Stanford University in April. Those forensic investigations\ninto the inner workings of the code, while picking apart how it worked, came to no\nconclusions about who was responsible.\nA similar process is now under way to figure out the origins of another cyberweapon\ncalled Flame that was recently discovered to have attacked the computers of Iranian\nofficials, sweeping up information from those machines. But the computer code appears\nto be at least five years old, and American officials say that it was not part of Olympic\nGames. They have declined to say whether the United States was responsible for the\nFlame attack.\nMr. Obama, according to participants in the many Situation Room meetings on Olympic\nGames, was acutely aware that with every attack he was pushing the United States into\nnew territory, much as his predecessors had with the first use of atomic weapons in the\n1940s, of intercontinental missiles in the 1950s and of drones in the past decade. He\nrepeatedly expressed concerns that any American acknowledgment that it was using\ncyberweapons \xe2\x80\x94 even under the most careful and limited circumstances \xe2\x80\x94 could\nenable other countries, terrorists or hackers to justify their own attacks.\n\xe2\x80\x9cWe discussed the irony, more than once,\xe2\x80\x9d one of his aides said. Another said that the\nadministration was resistant to developing a \xe2\x80\x9cgrand theory for a weapon whose\npossibilities they were still discovering.\xe2\x80\x9d Yet Mr. Obama concluded that when it came to\nstopping Iran, the United States had no other choice.\nIf Olympic Games failed, he told aides, there would be no time for sanctions and\ndiplomacy with Iran to work. Israel could carry out a conventional military attack,\nprompting a conflict that could spread throughout the region.\nA Bush Initiative\nThe impetus for Olympic Games dates from 2006, when President George W. Bush saw\nfew good options in dealing with Iran. At the time, America\xe2\x80\x99s European allies were\ndivided about the cost that imposing sanctions on Iran would have on their own\neconomies. Having falsely accused Saddam Hussein of reconstituting his nuclear\nprogram in Iraq, Mr. Bush had little credibility in publicly discussing another nation\xe2\x80\x99s\nnuclear ambitions. The Iranians seemed to sense his vulnerability, and, frustrated by\nnegotiations, they resumed enriching uranium at an underground site at Natanz, one\nwhose existence had been exposed just three years before.\nIran\xe2\x80\x99s president, Mahmoud Ahmadinejad, took reporters on a tour of the plant and\ndescribed grand ambitions to install upward of 50,000 centrifuges. For a country with only\none nuclear power reactor \xe2\x80\x94 whose fuel comes from Russia \xe2\x80\x94 to say that it needed fuel\nfor its civilian nuclear program seemed dubious to Bush administration officials. They\nfeared that the fuel could be used in another way besides providing power: to create a\nstockpile that could later be enriched to bomb-grade material if the Iranians made a\npolitical decision to do so.\nHawks in the Bush administration like Vice President Dick Cheney urged Mr. Bush to\nconsider a military strike against the Iranian nuclear facilities before they could produce\nfuel suitable for a weapon. Several times, the administration reviewed military options\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n265\n\nand concluded that they would only further inflame a region already at war, and would\nhave uncertain results.\nFor years the C.I.A. had introduced faulty parts and designs into Iran\xe2\x80\x99s systems \xe2\x80\x94 even\ntinkering with imported power supplies so that they would blow up \xe2\x80\x94 but the sabotage\nhad had relatively little effect. General James E. Cartwright, who had established a small\ncyberoperation inside the United States Strategic Command, which is responsible for\nmany of America\xe2\x80\x99s nuclear forces, joined intelligence officials in presenting a radical\nnew idea to Mr. Bush and his national security team. It involved a far more sophisticated\ncyberweapon than the United States had designed before.\nThe goal was to gain access to the Natanz plant\xe2\x80\x99s industrial computer controls. That\nrequired leaping the electronic moat that cut the Natanz plant off from the Internet \xe2\x80\x94\ncalled the air gap, because it physically separates the facility from the outside world. The\ncomputer code would invade the specialized computers that command the centrifuges.\nThe first stage in the effort was to develop a bit of computer code called a beacon that\ncould be inserted into the computers, which were made by the German company\nSiemens and an Iranian manufacturer, to map their operations. The idea was to draw the\nequivalent of an electrical blueprint of the Natanz plant, to understand how the\ncomputers control the giant silvery centrifuges that spin at tremendous speeds. The\nconnections were complex, and unless every circuit was understood, efforts to seize\ncontrol of the centrifuges could fail.\nEventually the beacon would have to \xe2\x80\x9cphone home\xe2\x80\x9d \xe2\x80\x94 literally send a message back to\nthe headquarters of the National Security Agency that would describe the structure and\ndaily rhythms of the enrichment plant. Expectations for the plan were low; one\nparticipant said the goal was simply to \xe2\x80\x9cthrow a little sand in the gears\xe2\x80\x9d and buy some\ntime. Mr. Bush was skeptical, but lacking other options, he authorized the effort.\nBreakthrough, Aided by Israel\nIt took months for the beacons to do their work and report home, complete with maps of\nthe electronic directories of the controllers and what amounted to blueprints of how they\nwere connected to the centrifuges deep underground.\nThen the N.S.A. and a secret Israeli unit respected by American intelligence officials for its\ncyberskills set to work developing the enormously complex computer worm that would\nbecome the attacker from within.\nThe unusually tight collaboration with Israel was driven by two imperatives. Israel\xe2\x80\x99s Unit\n8200, a part of its military, had technical expertise that rivaled the N.S.A.\xe2\x80\x99s, and the Israelis\nhad deep intelligence about operations at Natanz that would be vital to making the\ncyberattack a success. But American officials had another interest, to dissuade the\nIsraelis from carrying out their own pre-emptive strike against the Iranian nuclear facilities.\nTo do that, the Israelis would have to be convinced that the new line of attack was\nworking. The only way to convince them, several officials said in interviews, was to have\nthem deeply involved in every aspect of the program.\nSoon the two countries had developed a complex worm that the Americans called \xe2\x80\x9cthe\nbug.\xe2\x80\x9d But the bug needed to be tested. So, under enormous secrecy, the United States\nbegan building replicas of Iran\xe2\x80\x99s P-1 centrifuges, an aging, unreliable design that Iran\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n266\n\npurchased from Abdul Qadeer Khan, the Pakistani nuclear chief who had begun selling\nfuel-making technology on the black market. Fortunately for the United States, it already\nowned some P-1s, thanks to the Libyan dictator, Col. Muammar el-Qaddafi.\nWhen Colonel Qaddafi gave up his nuclear weapons program in 2003, he turned over\nthe centrifuges he had bought from the Pakistani nuclear ring, and they were placed in\nstorage at a weapons laboratory in Tennessee. The military and intelligence officials\noverseeing Olympic Games borrowed some for what they termed \xe2\x80\x9cdestructive testing,\xe2\x80\x9d\nessentially building a virtual replica of Natanz, but spreading the test over several of the\nEnergy Department\xe2\x80\x99s national laboratories to keep even the most trusted nuclear\nworkers from figuring out what was afoot.\nThose first small-scale tests were surprisingly successful: the bug invaded the computers,\nlurking for days or weeks, before sending instructions to speed them up or slow them\ndown so suddenly that their delicate parts, spinning at supersonic speeds, selfdestructed. After several false starts, it worked. One day, toward the end of Mr. Bush\xe2\x80\x99s\nterm, the rubble of a centrifuge was spread out on the conference table in the Situation\nRoom, proof of the potential power of a cyberweapon. The worm was declared ready to\ntest against the real target: Iran\xe2\x80\x99s underground enrichment plant.\n\xe2\x80\x9cPrevious cyberattacks had effects limited to other computers,\xe2\x80\x9d Michael V. Hayden, the\nformer chief of the C.I.A., said, declining to describe what he knew of these attacks\nwhen he was in office. \xe2\x80\x9cThis is the first attack of a major nature in which a cyberattack\nwas used to effect physical destruction,\xe2\x80\x9d rather than just slow another computer, or hack\ninto it to steal data.\n\xe2\x80\x9cSomebody crossed the Rubicon,\xe2\x80\x9d he said.\nGetting the worm into Natanz, however, was no easy trick. The United States and Israel\nwould have to rely on engineers, maintenance workers and others \xe2\x80\x94 both spies and\nunwitting accomplices \xe2\x80\x94 with physical access to the plant. \xe2\x80\x9cThat was our holy grail,\xe2\x80\x9d one\nof the architects of the plan said. \xe2\x80\x9cIt turns out there is always an idiot around who doesn\xe2\x80\x99t\nthink much about the thumb drive in their hand.\xe2\x80\x9d\nIn fact, thumb drives turned out to be critical in spreading the first variants of the\ncomputer worm; later, more sophisticated methods were developed to deliver the\nmalicious code.\nThe first attacks were small, and when the centrifuges began spinning out of control in\n2008, the Iranians were mystified about the cause, according to intercepts that the\nUnited States later picked up. \xe2\x80\x9cThe thinking was that the Iranians would blame bad parts,\nor bad engineering, or just incompetence,\xe2\x80\x9d one of the architects of the early attack said.\nThe Iranians were confused partly because no two attacks were exactly alike. Moreover,\nthe code would lurk inside the plant for weeks, recording normal operations; when it\nattacked, it sent signals to the Natanz control room indicating that everything downstairs\nwas operating normally. \xe2\x80\x9cThis may have been the most brilliant part of the code,\xe2\x80\x9d one\nAmerican official said.\nLater, word circulated through the International Atomic Energy Agency, the Viennabased nuclear watchdog, that the Iranians had grown so distrustful of their own\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n267\n\ninstruments that they had assigned people to sit in the plant and radio back what they\nsaw.\n\xe2\x80\x9cThe intent was that the failures should make them feel they were stupid, which is what\nhappened,\xe2\x80\x9d the participant in the attacks said. When a few centrifuges failed, the\nIranians would close down whole \xe2\x80\x9cstands\xe2\x80\x9d that linked 164 machines, looking for signs of\nsabotage in all of them. \xe2\x80\x9cThey overreacted,\xe2\x80\x9d one official said. \xe2\x80\x9cWe soon discovered they\nfired people.\xe2\x80\x9d\nImagery recovered by nuclear inspectors from cameras at Natanz \xe2\x80\x94 which the nuclear\nagency uses to keep track of what happens between visits \xe2\x80\x94 showed the results. There\nwas some evidence of wreckage, but it was clear that the Iranians had also carted\naway centrifuges that had previously appeared to be working well.\nBut by the time Mr. Bush left office, no wholesale destruction had been accomplished.\nMeeting with Mr. Obama in the White House days before his inauguration, Mr. Bush urged\nhim to preserve two classified programs, Olympic Games and the drone program in\nPakistan. Mr. Obama took Mr. Bush\xe2\x80\x99s advice.\nThe Stuxnet Surprise\nMr. Obama came to office with an interest in cyberissues, but he had discussed them\nduring the campaign mostly in terms of threats to personal privacy and the risks to\ninfrastructure like the electrical grid and the air traffic control system. He commissioned a\nmajor study on how to improve America\xe2\x80\x99s defenses and announced it with great fanfare\nin the East Room.\nWhat he did not say then was that he was also learning the arts of cyberwar. The\narchitects of Olympic Games would meet him in the Situation Room, often with what\nthey called the \xe2\x80\x9chorse blanket,\xe2\x80\x9d a giant foldout schematic diagram of Iran\xe2\x80\x99s nuclear\nproduction facilities. Mr. Obama authorized the attacks to continue, and every few\nweeks \xe2\x80\x94 certainly after a major attack \xe2\x80\x94 he would get updates and authorize the next\nstep. Sometimes it was a strike riskier and bolder than what had been tried previously.\n\xe2\x80\x9cFrom his first days in office, he was deep into every step in slowing the Iranian program\n\xe2\x80\x94 the diplomacy, the sanctions, every major decision,\xe2\x80\x9d a senior administration official\nsaid. \xe2\x80\x9cAnd it\xe2\x80\x99s safe to say that whatever other activity might have been under way was\nno exception to that rule.\xe2\x80\x9d\nBut the good luck did not last. In the summer of 2010, shortly after a new variant of the\nworm had been sent into Natanz, it became clear that the worm, which was never\nsupposed to leave the Natanz machines, had broken free, like a zoo animal that found\nthe keys to the cage. It fell to Mr. Panetta and two other crucial players in Olympic\nGames \xe2\x80\x94 General Cartwright, the vice chairman of the Joint Chiefs of Staff, and Michael\nJ. Morell, the deputy director of the C.I.A. \xe2\x80\x94 to break the news to Mr. Obama and Mr.\nBiden.\nAn error in the code, they said, had led it to spread to an engineer\xe2\x80\x99s computer when it\nwas hooked up to the centrifuges. When the engineer left Natanz and connected the\ncomputer to the Internet, the American- and Israeli-made bug failed to recognize that its\nenvironment had changed. It began replicating itself all around the world. Suddenly, the\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n268\n\ncode was exposed, though its intent would not be clear, at least to ordinary computer\nusers.\n\xe2\x80\x9cWe think there was a modification done by the Israelis,\xe2\x80\x9d one of the briefers told the\npresident, \xe2\x80\x9cand we don\xe2\x80\x99t know if we were part of that activity.\xe2\x80\x9d\nMr. Obama, according to officials in the room, asked a series of questions, fearful that\nthe code could do damage outside the plant. The answers came back in hedged terms.\nMr. Biden fumed. \xe2\x80\x9cIt\xe2\x80\x99s got to be the Israelis,\xe2\x80\x9d he said. \xe2\x80\x9cThey went too far.\xe2\x80\x9d\nIn fact, both the Israelis and the Americans had been aiming for a particular part of the\ncentrifuge plant, a critical area whose loss, they had concluded, would set the Iranians\nback considerably. It is unclear who introduced the programming error.\nThe question facing Mr. Obama was whether the rest of Olympic Games was in\njeopardy, now that a variant of the bug was replicating itself \xe2\x80\x9cin the wild,\xe2\x80\x9d where\ncomputer security experts can dissect it and figure out its purpose.\n\xe2\x80\x9cI don\xe2\x80\x99t think we have enough information,\xe2\x80\x9d Mr. Obama told the group that day,\naccording to the officials. But in the meantime, he ordered that the cyberattacks\ncontinue. They were his best hope of disrupting the Iranian nuclear program unless\neconomic sanctions began to bite harder and reduced Iran\xe2\x80\x99s oil revenues.\nWithin a week, another version of the bug brought down just under 1,000 centrifuges.\nOlympic Games was still on.\nA Weapon\xe2\x80\x99s Uncertain Future\nAmerican cyberattacks are not limited to Iran, but the focus of attention, as one\nadministration official put it, \xe2\x80\x9chas been overwhelmingly on one country.\xe2\x80\x9d There is no\nreason to believe that will remain the case for long. Some officials question why the same\ntechniques have not been used more aggressively against North Korea. Others see\nchances to disrupt Chinese military plans, forces in Syria on the way to suppress the\nuprising there, and Qaeda operations around the world. \xe2\x80\x9cWe\xe2\x80\x99ve considered a lot more\nattacks than we have gone ahead with,\xe2\x80\x9d one former intelligence official said.\nMr. Obama has repeatedly told his aides that there are risks to using \xe2\x80\x94 and particularly\nto overusing \xe2\x80\x94 the weapon. In fact, no country\xe2\x80\x99s infrastructure is more dependent on\ncomputer systems, and thus more vulnerable to attack, than that of the United States. It is\nonly a matter of time, most experts believe, before it becomes the target of the same\nkind of weapon that the Americans have used, secretly, against Iran.\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\nBe able to state the pros and cons of conducting this operation.\nDoes this story impact your views regarding whether the US government ever should\nengage in such activities?\nDo you think awareness of this operation meaningfully changed what other nations\nare willing to do in the cyber domain?\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n269\n\nE. Case study: Sandworm\nThe past decade has seen no small amount of grey zone cyber activity of the destructive sort.\nMany of the most dramatic and damaging examples have been attributed to a group associated\nwith Russian military intelligence (aka G.R.U.) known dubbed \xe2\x80\x9cSandworm\xe2\x80\x9d by security researchers\nin light of the recurrence of Dune references in their code. Consider this October 2020 Wired\narticle from Andy Greenberg (whose terrific book Sandworm is an extraordinary tale of GRU\xe2\x80\x99s\nactivities):\nNEARLY HALF A decade ago, the Russian hackers known as Sandworm hit Western Ukraine\nwith the first-ever cyberattack to cause a blackout, an unprecedented act of cyberwar\nthat turned off the lights for a quarter million Ukrainians. They were just getting started. From\nthere Sandworm embarked on a years-long spree of wantonly destructive attacks:\nanother blackout attack on the Ukrainian capital of Kyiv in 2016, the release of the\nNotPetya worm in 2017 that spread globally from Ukraine to cause $10 billion in damage,\nand a cyberattack that temporarily destroyed the IT backend of the 2018 Winter\nOlympics in South Korea, among others.\nYet in spite of crossing every red line the cybersecurity world has tried to draw to protect\ncivilian critical infrastructure from catastrophic hacking, Sandworm\'s members had never\nbeen charged or even officially named in connection with those attacks. Until now.\nOn Monday, the Department of Justice unsealed charges including computer fraud and\nconspiracy against six of the hackers who allegedly make up Sandworm, a group also\nknown in the security industry by the names Telebots, Voodoo Bear, and Hades,\nand confirmed earlier this year to work in Unit 74455 of Russia\'s GRU military intelligence\nagency based in a building known as the Tower in the Moscow suburb of Khimki. The\nindictment names all six Russian men, who are in their late twenties to early thirties: Yuriy\nSergeyevich Andrienko, Sergey Vladimirovich Detistov, Pavel Valeryevich Frolov, Artem\nValeryevich Ochichenko, and Petr Nikolayevich Pliskin, as well as Anatoliy Sergeyevich\nKovalev, who was previously indicted two years ago for his allegedly role into hacking US\nStates\' Boards of Election in 2016.\n\xe2\x80\x9cNo country has weaponized its cyber capabilities as maliciously or irresponsibly as Russia,\nwantonly causing unprecedented damage to pursue small tactical advantages and to\nsatisfy fits of spite,\xe2\x80\x9d assistant attorney general John Demers said in a statement.\n"They continue to do disruptive and destructive attacks against anyone they perceive to\nbe an adversary to Russia or to have slighted Russia in some way," added a senior Justice\nDepartment official who asked not to be identified, in a call with WIRED. "This is probably\none of the most dangerous and aggressive groups of hackers that\xe2\x80\x99s out there."\nThe charges represent not only the first criminal charges against Sandworm for its most\ndestructive attacks, but the first time that most of the charged hackers have been publicly\nidentified as members of the hacker group. Two other GRU hackers believed to be part of\nSandworm\xe2\x80\x94Aleksey Aleksandrovich Potemkin and Aleksandr Vladimirovich Osadchuk\xe2\x80\x94\nwere previously named in the separate, 2018 indictment of 12 GRU hackers for hacking\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n270\n\nthat interfered in the 2016 US election. Kovalev, who in the new indictment is accused of\nhelping to hack the 2017 campaign of French president Emmanuel Macron, was also\nnamed in those 2018 charges.\nThe new indictment also represents the first official acknowledgement from the US\ngovernment that Sandworm was responsible for a cyberattack on the 2018 Winter\nOlympics, in which a piece of malware known as Olympic Destroyer took down much of\nthe IT infrastructure of the Games just as the opening ceremony was beginning in\nPyeongchang, South Korea. Olympic Destroyer contained layers of "false flags," spoofed\nclues in its code designed to trick investigators into blaming North Korea or China. And\naccording to the new indictment, Sandworm also tried to breach two Olympic partner\norganizations responsible for timekeeping in the Olympics, not just the Wifi, Olympics app,\nticketing, and displays that were ultimately disrupted\xe2\x80\x94perhaps an attempt to corrupt the\nOlympics sporting events\' actual results, too.\nIn the more than two years that followed, no government in the world officially seemed\nwilling to blame the cyberattack on Russia, even as private intelligence firms like FireEye\nfound strong evidence of Sandworm\'s involvement, and US intelligence leaked their\nfindings of Russia\'s culpability to The Washington Post. (The European Union did finally\nname "Olympic Destroyer" as one of the known names for Sandworm in sanctions against\nthe group in July, but without explicitly saying that the sanctions were in response to the\nOlympics attack.)\nThat long silence led to warnings from the cybersecurity community that Russia would no\ndoubt attempt to attack the 2020 Olympics in Tokyo, too. And separately from the\nSandworm indictment, those warnings were proven true today when the UK\'s National\nCybersecurity Center revealed that it had tracked, in a joint operation with US intelligence\nagencies, reconnaissance activities by Russian hackers seeking to disrupt the 2020\nOlympics as predicted\xe2\x80\x94though the games were ultimately delayed due to Covid-19\xe2\x80\x94\ntargeting the games\' organizers, logistics partners, and sponsors.\nThe Justice Department\'s new indictment against the hackers includes a long history of\nother GRU hacking around the world: The hackers allegedly targeted the Organization for\nthe Prohibition of Chemical Weapons in the Netherlands and the United Kingdom\xe2\x80\x99s\nDefense Science and Technology Laboratory while those two organizations were\ninvestigating the Novichok poisoning of GRU defector Sergei Skripal and his daughter, an\nattack not previously linked to Sandworm despite known GRU involvement. The indictment\nalso lays out new details of Sandworm\'s targeting of the nation of Georgia in 2019, which\nincluded an attempt to compromise the Georgian parliament in addition to a previously\nknown campaign of web defacements across the country\'s internet, affecting 15,000 sites.\nPerhaps most significantly, the criminal charges mark the first global law enforcement\nresponse targeting Sandworm\'s hackers for their release of the NotPetya malware that\nravaged networks across the world. To initially install its data-destroying, self-spreading\ncode on its victims\' machines, Sandworm hijacked the update mechanism of MEDoc, a\ncommon piece of Ukrainian accounting software. But beyond infecting hundreds of\nUkrainian companies and government agencies, NotPetya also spread far beyond\nUkraine\'s borders, inflicting $10 billion in damage to companies including Merck, FedEx,\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n271\n\nMaersk, Mondelez, as well as paralyzing updates to medical record systems in hospitals\nacross the US and causing serious collateral damage to Russian firms, too.\nThe indictment accuses Andrienko, Detistov, Frolov, and Pliskin specifically of developing\ndifferent components of the NotPetya malware. It goes so far as to state that Andrienko\nand Pliskin "celebrated" after the malware was deployed.\nDespite US and EU sanctions against Russia for NotPetya, no hackers were criminally\ncharged with the global cyberattack, or even named as individually responsible for it, until\nnow. That apparent inaction led many in the cybersecurity world to marvel for years at\nWestern governments\' failure to hold Sandworm accountable. \xe2\x80\x9cNotPetya tested the red\nlines of the West, and the result of the test was that there are no red lines yet,\xe2\x80\x9d Johns\nHopkins professor of strategic studies Thomas Rid told WIRED in 2018. \xe2\x80\x9cThe lack of any\nproper response is almost an invitation to escalate more.\xe2\x80\x9d\nNow, however belatedly, that accountability has arrived for Sandworm\'s hackers. But as\nwith so many indictments of foreign, state-sponsored hackers, the defendants will likely\nnever see the inside of a US courtroom, given their protection by the Russian government.\nNonetheless, indictments against foreign hackers limit their ability to use the Western\nfinancial system or to travel to any country that may have an extradition agreement with\nthe US. "We have an obligation to hold accountable those who commit crimes\xe2\x80\x94 no matter\nwhere they reside and no matter for whom they work\xe2\x80\x94in order to seek justice on behalf\nof these victims," US attorney Scott W. Brady said in a statement.\nThe Sandworm indictment also sends a message to the GRU and others hackers engaged\nin reckless attacks around the world that they, too, can be named and shamed, says John\nHultquist, director of intelligence at FireEye, who first named Sandworm in 2014 and has\ntracked the hackers across their long, chaotic career. "It\'s obviously great that they\'re\nfinally being accused," Hultquist says.\nA Justice Department official speaking to WIRED denied that the timing of the indictment\nwas related to the approach of Election Day in just two weeks. "We charge the cases when\nthey\'re ready to be charged," the official said.\nBut Hultquist notes that Sandworm was, in fact, involved in the 2016 election interference,\nand that Microsoft has already linked another GRU group known as Fancy Bear or APT28\nto attempts to breach campaigns and other political organizations involved in the 2020\nelection. "Plainly, I think they\'re attempting to discourage them from acting in this election\nby using legal tools and outing their involvement in other incidents," Hultquist says of the\nJustice Department\'s indictment.\nElection aside, the signaling to state-sponsored hackers is clear, belated as it may be, says\nHultquist: "We know who you are and what you\xe2\x80\x99ve done," he says. And the consequences\nof that knowledge will catch up with hackers who cross red lines\xe2\x80\x94even if it takes five years.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\xe2\x80\xa2\n\n272\n\nCan you distinguish Sandworm\xe2\x80\x99s activities from Stuxnet?\nRecall the prior reading\xe2\x80\x99s discussion of international law. Does it appear to you that\nany of the activities described in these case studies cross an international law line?\nThe indictment described in the article brings us back to the early part of this course.\nWhat if anything will this indictment accomplish?\n\nF. The ransomware crisis and state responsibility\nIn 2021, a spate of high-impact ransomware episodes (most notably involving Colonial Pipeline)\ngenerated a huge amount of public concern about Russia\xe2\x80\x99s tolerance for ransomware crews\n(that is, organized crime networks conducting or otherwise making possible ransomware attacks)\nconducting ransomware attacks overseas from safe haven within Russia. Consider this account\nfrom Ellen Nakashima and Eugene Scott of the Washington Post, from July 2021:\nPresident Biden told Russian President Vladimir Putin on Friday that the United States will\ntake \xe2\x80\x9cany necessary action\xe2\x80\x9d to defend U.S. infrastructure, the White House said, after\nRussia-based hackers carried out the largest known ransomware attack to date.\nBiden has been under increasing pressure to counter such costly, brazen assaults \xe2\x80\x94\npressure that spiked last weekend after the latest attack, which afflicted up to 1,500\ncompanies, schools and hospitals around the world. It was claimed by a criminal group\ncalled REvil operating largely out of Russia.\nIn a phone call, Biden warned Putin that Russia must take action to disrupt ransomware\ngroups operating there, or the United States would impose consequences, the president\nsaid.\n\xe2\x80\x9cI made it very clear to him that the United States expects when a ransomware operation\nis coming from his soil, even though it\xe2\x80\x99s not sponsored by the state, we expect them to act\nif we give them enough information to act on who that is,\xe2\x80\x9d Biden said\xe2\x80\xa6.\nAsked if there would be consequences, Biden said, \xe2\x80\x9cyes.\xe2\x80\x9d The president did not elaborate.\n\xe2\x80\xa6 Biden\xe2\x80\x99s call to Putin came after a meeting between the two leaders three weeks ago\nin Geneva, during which Biden delivered a similar warning. It was the first time the two\nspoke since and reflected the sense of urgency surrounding the surge in ransomware\nattacks \xe2\x80\x94 something the Biden administration has elevated to a national security threat.\n\xe2\x80\xa6 Some national security experts say Putin has had enough time to curb the attacks. \xe2\x80\x9cIt\xe2\x80\x99s\ntime to take the gloves off,\xe2\x80\x9d said David Laufman, a former senior Justice Department\nofficial who oversaw prosecution of state-sponsored cyber attacks. He said Biden should\nimpose consequences now, such as economic sanctions, export controls and lawenforcement actions, to disrupt criminals\xe2\x80\x99 use of computer infrastructure.\nAccording to the Kremlin\xe2\x80\x99s readout of their call, Putin told Biden that Russia had expressed\nwillingness to cooperate on the issue, but that U.S. law enforcement agencies had not\napproached Russian authorities about the recent cyberattacks.\nA senior administration official disputed that. \xe2\x80\x9cWe have relayed multiple specific requests\nfor action on cyber criminals\xe2\x80\x9d to Moscow, \xe2\x80\x9cand been clear about what Russia\xe2\x80\x99s\nresponsibility is with regard to taking action, including again today,\xe2\x80\x9d said the official,\nspeaking on the condition of anonymity under ground rules set by the White House.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n273\n\nRussian security services are able to identify criminal hackers without U.S. help, say current\nand former U.S. officials. Biden, on the call, expressed confidence in the Russian\ngovernment\xe2\x80\x99s ability to do so, the people familiar with their exchange said.\nBiden\xe2\x80\x99s remarks inevitably raise expectations that the United States will take decisive\naction to punish Moscow if the attacks do not abate quickly. Administration officials sought\nto temper those expectations.\n\xe2\x80\x9cThis is a broad campaign and won\xe2\x80\x99t have an immediate on-off effect like a light switch,\xe2\x80\x99\xe2\x80\x99\nthe senior administration official said, \xe2\x80\x9cbut we\xe2\x80\x99re going to have to stay on top of it over a\nlong period of time.\xe2\x80\x9d\nThe official alluded to Biden\xe2\x80\x99s statement in Geneva that \xe2\x80\x9cwe\xe2\x80\x99ll find out within six months to\na year\xe2\x80\x9d whether the engagement with Russia is working.\n\xe2\x80\x9cThe president really meant what he said . . . when he said that our assessment of this\nprocess, and our evaluation of Russia\xe2\x80\x99s actions, would take time,\xe2\x80\x9d the official said.\nThe White House strategy extends beyond the bilateral talks. \xe2\x80\x9cThis is really about our own\nresilience as a nation in the face of these attacks,\xe2\x80\x9d the official said. \xe2\x80\x9cIt\xe2\x80\x99s about addressing\nthe challenges posed by cryptocurrency, which provides fuel for these sorts of\ntransactions. It\xe2\x80\x99s about ensuring that our allies and our partners are working with us\ncollaboratively and upping their own game when it comes to resilience.\xe2\x80\x9d\nPainter, the former State Department cyber official, said he, too, would not expect attacks\nto cease overnight. But \xe2\x80\x9cwe can now expect Putin to take action\xe2\x80\x9d and Biden\xe2\x80\x99s remarks\nhave \xe2\x80\x9cset the stage for [imposing consequences on Russia] if they don\xe2\x80\x99t.\xe2\x80\x9d\nBut, he warned, setting red lines and failing to act when they\xe2\x80\x99re crossed is dangerous.\n\xe2\x80\x9cIf you don\xe2\x80\x99t get the change of behavior you\xe2\x80\x99re looking for and you don\xe2\x80\x99t then take an\naction, you look like a paper tiger,\xe2\x80\x9d he said. \xe2\x80\x9cIt puts you in a weaker position.\xe2\x80\x9d\n\n\xe2\x80\xa2\n\xe2\x80\xa2\n\n\xe2\x80\xa2\n\nGiven the Russian government\xe2\x80\x99s toleration of this activity, should this situation be\nviewed through the grey-zone competition lens?\nWould it change your analysis if it were true that some Russian ransomware operators\nwere providing Russian intelligence agencies with access to data they capture in the\ncourse of their crimes?\nWould you handle the situation differently from the approach taken by the Biden\nadministration?\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0cChesney on Cybersecurity\n\n274\n\nGoing deeper\xe2\x80\xa6\nCongratulations, you\xe2\x80\x99ve reached the end of the book! I\xe2\x80\x99m grateful to you for reading it, and I\nhope you feel your time and energy were well spent. Please do not hesitate to email me\n(rchesney@law.utexas.edu) with any thoughts or suggestions you care to share; I\xe2\x80\x99ll be happy to\nhear from you. Meanwhile, if you want to stay engaged with this topic, I have some\nrecommendations for you.\nFirst, two cybersecurity-focused podcasts:\nThe Cyberlaw Podcast - a weekly review of key legal developments relating to\ncybersecurity, followed by in-depth interviews with a wide variety of guests.\nRisky Business \xe2\x80\x93 a weekly review of important news from the technology side of\ncybersecurity, also followed by in-depth interviews with a variety of guests\nSecond, two projects of mine that sometimes touch on cybersecurity issues:\nThe National Security Law Podcast \xe2\x80\x93 Each week, my UT colleague Steve Vladeck and I\nreview, discuss, and debate the latest national security law developments (always with a\nhealthy dose of frivolity; the show is not for those who prefer their national security law\ndiscussions to be dry and serious at all times).\nLawfare \xe2\x80\x93 Lawfare is the nation\xe2\x80\x99s leading source of online analysis of current national\nsecurity legal issues. Co-founded by Ben Wittes, Jack Goldsmith, and me, Lawfare covers\nan array of topics including those associated with cyber domain activities.\n\nThe end.\n\nElectronic copy available at: https://ssrn.com/abstract=3547103\n\n\x0c'