Institutional structure

Status Quo

The government structures for responding to cyber-threats are complex, with a number of agencies sharing authority in occasionally overlapping areas.

CHART

This chart, while by no means an exhaustive survey of government action in the realm of cybercrime and cyberwar, attempts to plot several of the major actors in those areas as well as the main ways in which those actors are linked together.

Actors

Various government and private actors participate in preventing, detecting, and responding to various cyber-threats. Broadly speaking, these actors fall into four different categories:

• Cyber-specific federal agencies (e.g. Cyber Command)
• Defense and investigation agencies (e.g. Department of Defense, FBI, CIA, NSA)
• Independent agencies with relevant concerns and vulnerabilities (e.g. Department of State, Federal Communications Commission)
• Private corporations

In addition, the Federal Information Security Management Act, U.S.C § 3541 et seq., requires the head of each agency to ensure compliance with information security standards promulgated by the National Institute of Standards and Technology (NIST).

Links

• Structural
• Statutory
• Negotiated cooperation
• De facto cooperation

Current Problems

The scarcity of official coordination between different government agencies raises a number of issues. Agencies may claim overlapping jurisdiction, leading to inefficient staffing and funding decisions (as well as inter-agency tension). At the same time, gaps in coverage between the jurisdictions of various agencies may emerge elsewhere. The inability of agencies effectively to share intelligence about possible threats in new technological contexts contributes to slower and less successful government responses.

As one example, this New York Times article describes how one hacker, Albert Gonzalez, was able to evade capture by the police for a number of attacks on different commercial websites while he was simultaneously under protection as a Secret Service informant.